Monthly
Remote code execution as root in Sophos UTM (SG UTM) affects all versions when the email proxy is used with scanning enabled; unauthenticated network attackers can exploit a path traversal flaw, but must win a race condition by sustaining repeated attacks for several minutes. The product is end-of-life and requires a manual patch, so exposure persists until an operator actively installs the vendor fix. No public exploit has been identified at time of analysis, and the priority decision is act_now based on the vendor report and assessed impact.
Authenticated, privileged remote attackers on affected Siemens Industrial Edge Device Kit installations (arm64 and x86-64, versions 1.5 through 1.28) and the listed SIMATIC/SIPLUS HMI Unified Comfort panels can reach internal APIs and file paths that the software fails to restrict, exposing sensitive internal information and - per the vendor's description - potentially enabling further unauthorized system access or deletion of data. Siemens rates this CVSS 4.0 8.9 High (AV:N/AC:L/AT:P/PR:H/UI:N with full VC/VI/VA:H on the vulnerable system plus SC/SI/SA:H on subsequent systems); our independent assessment concurs with the high impact rating but emphasizes that the score is driven by impact breadth rather than ease of access, because exploitation requires a valid privileged session and an additional attack precondition is signalled by the AT:P metric. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Authenticated path traversal in the web portal of Satel Iberia's SenNet Datalogger Serie 200 allows a low-privileged portal user to read arbitrary files and list directories accessible to the web server's system account, exposing configuration or confidential data. The issue is scored CVSS 7.1 with a CVSS 4.0 vector of AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, and the independent assessment rates it a moderate-severity confidentiality issue rather than a top-priority emergency. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical risk is highest where the device web interface is reachable from untrusted networks or where default, shared, or weak portal credentials are in use.
Unauthenticated path traversal in Hitachi Coding Software Suite through 3.3.0 lets remote attackers read, create, modify, or delete arbitrary files on the affected host, a near worst-case profile with high confidentiality, integrity, and availability impact (CVSS 4.0 base 9.3; assessed CVSS 3.1 9.8-class vector AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H). The flaw requires only network reachability to the suite's file-handling interface - no authentication, user interaction, or special configuration is needed - so an attacker who can reach the service can fully control file content on the coding/marking system. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the real-world risk hinges on exposure: this industrial coding/marking software is typically deployed on isolated OT or plant networks, so hosts reachable from an attacker-controlled segment carry the greatest risk.
Authenticated path traversal in the WordPress Creator LMS plugin (WPFunnels) affects all versions up to and including 1.2.19 and allows a user holding only Contributor-level privileges to manipulate file paths and reach files outside the intended directory, primarily exposing sensitive data with limited integrity and availability effects. Exploitation requires a valid low-privilege account - self-registration must be enabled or an account otherwise obtained - and is rated high complexity (AC:H), meaning success depends on specific, not-guaranteed conditions; the issue is remote, needs no user interaction, and no public exploit has been identified at time of analysis. It is not confirmed actively exploited (no CISA KEV listing), and while the vendor-supplied CVSS of 7.5 and the scorer's high confidentiality/integrity/availability ratings read alarming, the practical risk is moderate because the attack is gated behind an authenticated Contributor role and elevated complexity.
Path traversal in the PHP web management interface of Pepperl+Fuchs ICE2/ICE3 series and Phoenix Contact IOL MA8 IO-Link master devices allows unauthenticated remote attackers to read arbitrary files via the /index.php/view_uploaded_iodd_file endpoint. The most critical disclosed impact is exfiltration of the SSH server's private key, which could enable decryption of captured SSH sessions or device impersonation. Three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the vulnerability affects a shared firmware/software base across multiple vendor OEM implementations. No public exploit or KEV listing identified at time of analysis.
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthenticated attackers to create image files at arbitrary filesystem paths under system server privilege. Reported by Samsung Mobile and patched in SMR Sep-2026 Release 1, the flaw is reachable over LTE and Wi-Fi networks with no user interaction required, as reflected in the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scoring 8.8. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Path traversal in Dell ObjectScale (versions prior to 4.3.0.1) enables a local low-privileged attacker to write to or corrupt files outside intended directory boundaries, achieving high integrity and availability impact without requiring user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) confirms exploitation requires only a local account with minimal privilege - no elevated rights or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is primarily from insider threats or attacker-controlled service accounts in post-compromise scenarios.
Path traversal in the Do Lasso WordPress plugin (versions <= 358) allows authenticated subscribers to traverse the server file system beyond the intended directory scope, achieving high confidentiality, integrity, and availability impact. The vulnerability is exploitable by any authenticated WordPress user holding the subscriber role - the lowest privilege tier - over the network, making it accessible to any registered site user. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the Patchstack advisory signals a patched version is available.
Unauthenticated arbitrary file read in Siemens License Server (SLS) versions prior to V5.3 allows remote attackers to traverse the filesystem and access sensitive files without any credentials. The root cause is missing sanitization of user-supplied path input (CWE-35), and the CVSS 4.0 score of 8.7 reflects network-exploitable access with no authentication or user interaction required and high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack complexity is low and the attack surface is any network-reachable SLS instance.
Remote code execution as root in Sophos UTM (SG UTM) affects all versions when the email proxy is used with scanning enabled; unauthenticated network attackers can exploit a path traversal flaw, but must win a race condition by sustaining repeated attacks for several minutes. The product is end-of-life and requires a manual patch, so exposure persists until an operator actively installs the vendor fix. No public exploit has been identified at time of analysis, and the priority decision is act_now based on the vendor report and assessed impact.
Authenticated, privileged remote attackers on affected Siemens Industrial Edge Device Kit installations (arm64 and x86-64, versions 1.5 through 1.28) and the listed SIMATIC/SIPLUS HMI Unified Comfort panels can reach internal APIs and file paths that the software fails to restrict, exposing sensitive internal information and - per the vendor's description - potentially enabling further unauthorized system access or deletion of data. Siemens rates this CVSS 4.0 8.9 High (AV:N/AC:L/AT:P/PR:H/UI:N with full VC/VI/VA:H on the vulnerable system plus SC/SI/SA:H on subsequent systems); our independent assessment concurs with the high impact rating but emphasizes that the score is driven by impact breadth rather than ease of access, because exploitation requires a valid privileged session and an additional attack precondition is signalled by the AT:P metric. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Authenticated path traversal in the web portal of Satel Iberia's SenNet Datalogger Serie 200 allows a low-privileged portal user to read arbitrary files and list directories accessible to the web server's system account, exposing configuration or confidential data. The issue is scored CVSS 7.1 with a CVSS 4.0 vector of AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, and the independent assessment rates it a moderate-severity confidentiality issue rather than a top-priority emergency. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical risk is highest where the device web interface is reachable from untrusted networks or where default, shared, or weak portal credentials are in use.
Unauthenticated path traversal in Hitachi Coding Software Suite through 3.3.0 lets remote attackers read, create, modify, or delete arbitrary files on the affected host, a near worst-case profile with high confidentiality, integrity, and availability impact (CVSS 4.0 base 9.3; assessed CVSS 3.1 9.8-class vector AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H). The flaw requires only network reachability to the suite's file-handling interface - no authentication, user interaction, or special configuration is needed - so an attacker who can reach the service can fully control file content on the coding/marking system. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the real-world risk hinges on exposure: this industrial coding/marking software is typically deployed on isolated OT or plant networks, so hosts reachable from an attacker-controlled segment carry the greatest risk.
Authenticated path traversal in the WordPress Creator LMS plugin (WPFunnels) affects all versions up to and including 1.2.19 and allows a user holding only Contributor-level privileges to manipulate file paths and reach files outside the intended directory, primarily exposing sensitive data with limited integrity and availability effects. Exploitation requires a valid low-privilege account - self-registration must be enabled or an account otherwise obtained - and is rated high complexity (AC:H), meaning success depends on specific, not-guaranteed conditions; the issue is remote, needs no user interaction, and no public exploit has been identified at time of analysis. It is not confirmed actively exploited (no CISA KEV listing), and while the vendor-supplied CVSS of 7.5 and the scorer's high confidentiality/integrity/availability ratings read alarming, the practical risk is moderate because the attack is gated behind an authenticated Contributor role and elevated complexity.
Path traversal in the PHP web management interface of Pepperl+Fuchs ICE2/ICE3 series and Phoenix Contact IOL MA8 IO-Link master devices allows unauthenticated remote attackers to read arbitrary files via the /index.php/view_uploaded_iodd_file endpoint. The most critical disclosed impact is exfiltration of the SSH server's private key, which could enable decryption of captured SSH sessions or device impersonation. Three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the vulnerability affects a shared firmware/software base across multiple vendor OEM implementations. No public exploit or KEV listing identified at time of analysis.
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthenticated attackers to create image files at arbitrary filesystem paths under system server privilege. Reported by Samsung Mobile and patched in SMR Sep-2026 Release 1, the flaw is reachable over LTE and Wi-Fi networks with no user interaction required, as reflected in the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scoring 8.8. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Path traversal in Dell ObjectScale (versions prior to 4.3.0.1) enables a local low-privileged attacker to write to or corrupt files outside intended directory boundaries, achieving high integrity and availability impact without requiring user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) confirms exploitation requires only a local account with minimal privilege - no elevated rights or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is primarily from insider threats or attacker-controlled service accounts in post-compromise scenarios.
Path traversal in the Do Lasso WordPress plugin (versions <= 358) allows authenticated subscribers to traverse the server file system beyond the intended directory scope, achieving high confidentiality, integrity, and availability impact. The vulnerability is exploitable by any authenticated WordPress user holding the subscriber role - the lowest privilege tier - over the network, making it accessible to any registered site user. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the Patchstack advisory signals a patched version is available.
Unauthenticated arbitrary file read in Siemens License Server (SLS) versions prior to V5.3 allows remote attackers to traverse the filesystem and access sensitive files without any credentials. The root cause is missing sanitization of user-supplied path input (CWE-35), and the CVSS 4.0 score of 8.7 reflects network-exploitable access with no authentication or user interaction required and high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack complexity is low and the attack surface is any network-reachable SLS instance.