Monthly
Missing authorization in the Execute Monitor API of the Amazon OpenSearch Alerting plugin allows any authenticated remote user to read, modify, or delete arbitrary index data by supplying crafted inline monitor requests with attacker-controlled data source and input index parameters. The flaw bypasses index-level permission enforcement, making it a meaningful privilege escalation risk in multi-tenant or shared OpenSearch deployments. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Denial of service in GnuTLS affects the Datagram Transport Layer Security (DTLS) packet reordering logic, where the comparator function fails to correctly handle packets with duplicate sequence numbers. Remote unauthenticated attackers can send specially crafted DTLS packet sequences to trigger unstable ordering or undefined behavior, causing service disruption. No public exploit identified at time of analysis, and the issue is rated CVSS 7.5 (High) for availability impact only.
Address space corruption in HPE NonStop TSQLFIL is reachable by a low-privileged local user on the NonStop host who invokes a specific affected API, which mishandles input and drives undefined behavior in the process memory space. The assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, score 5.3) shows no confidentiality loss but high availability impact, so the realistic outcome is integrity damage and/or abnormal termination of the affected TSQLFIL process rather than data theft. Exploitation is constrained by local authenticated access and by high attack complexity requiring preconditions outside the attacker's control, and no public exploit has been identified at time of analysis; there is no confirmed active exploitation (CISA KEV).
An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affected installations.
Local File Inclusion (LFI) vulnerability in Trend Micro Apex Central widgets that enables remote code execution (RCE) on affected systems. This vulnerability affects Trend Micro Apex Central installations below version 8.0.6955 and requires an authenticated attacker with low privileges to exploit. The vulnerability combines LFI with RCE capabilities, representing a significant threat to organizations using vulnerable Apex Central deployments.
A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity.
Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing authorization in the Execute Monitor API of the Amazon OpenSearch Alerting plugin allows any authenticated remote user to read, modify, or delete arbitrary index data by supplying crafted inline monitor requests with attacker-controlled data source and input index parameters. The flaw bypasses index-level permission enforcement, making it a meaningful privilege escalation risk in multi-tenant or shared OpenSearch deployments. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Denial of service in GnuTLS affects the Datagram Transport Layer Security (DTLS) packet reordering logic, where the comparator function fails to correctly handle packets with duplicate sequence numbers. Remote unauthenticated attackers can send specially crafted DTLS packet sequences to trigger unstable ordering or undefined behavior, causing service disruption. No public exploit identified at time of analysis, and the issue is rated CVSS 7.5 (High) for availability impact only.
Address space corruption in HPE NonStop TSQLFIL is reachable by a low-privileged local user on the NonStop host who invokes a specific affected API, which mishandles input and drives undefined behavior in the process memory space. The assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, score 5.3) shows no confidentiality loss but high availability impact, so the realistic outcome is integrity damage and/or abnormal termination of the affected TSQLFIL process rather than data theft. Exploitation is constrained by local authenticated access and by high attack complexity requiring preconditions outside the attacker's control, and no public exploit has been identified at time of analysis; there is no confirmed active exploitation (CISA KEV).
An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affected installations.
Local File Inclusion (LFI) vulnerability in Trend Micro Apex Central widgets that enables remote code execution (RCE) on affected systems. This vulnerability affects Trend Micro Apex Central installations below version 8.0.6955 and requires an authenticated attacker with low privileges to exploit. The vulnerability combines LFI with RCE capabilities, representing a significant threat to organizations using vulnerable Apex Central deployments.
A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity.
Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.