Monthly
Remote code execution in AgenticSeek's bundled llm_server component, which ships with Flask debug mode hardcoded on (app.run(host='0.0.0.0', ..., debug=True)) so the interactive Werkzeug debugger is exposed on every interface by default rather than through an opt-in misconfiguration. Any network-reachable instance running a build prior to commit 409840c033851d861c5c83a91c05fd4a2a75a096 is in scope; an unauthenticated remote attacker (CVSS PR:N, no user interaction) who can reach the llm_server port and obtain the derivable Werkzeug debugger PIN can execute arbitrary Python code and operating system commands with the llm_server process's privileges, giving high confidentiality, integrity and availability impact. The assessed vector (CVSS:3.1 AV:N/AC:H/PR:N/UI:N) reflects that PIN derivation, not application authentication, is the rate-limiting step, while CVSS 4.0 scores it 9.2 Critical with AT:P; no public exploit code and no confirmed active exploitation were identified at time of analysis, though a vuln.today decision label of act_now and a vendor-released fix make prompt patching the priority.
Unauthenticated Go pprof debug endpoints exposed on the postgres-exporter metrics listener let any attacker who can reach that port from inside the cluster network read process arguments, full goroutine stacks, and heap memory - potentially leaking database connection strings and credentials - and repeatedly trigger CPU profiling to exhaust resources in a denial-of-service condition. The flaw is tracked as CVE-2026-83550 (CVSS 7.1, AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H per the vendor, C:H for confidentiality in our assessment) and affects postgres-exporter as shipped in Red Hat Multicluster Global Hub, where the CPE covers all tracked versions; exploitation requires adjacent/cluster network reachability rather than internet exposure. No public exploit code has been identified at time of analysis, and no CISA KEV listing indicates active exploitation; risk is best characterized as a real design flaw of moderate priority, with exposure materially reducible through NetworkPolicies that restrict access to the metrics port.
Unauthenticated remote code execution is possible in Perforce P4 Search container images prior to 2026.4.2 due to an exposed Java Debug Wire Protocol (JDWP) interface. An attacker with network access to the JDWP port can execute arbitrary code as the P4 Search service account, potentially compromising the connected P4 Server. No public exploit code has been identified at time of analysis, but the issue is rated critical (CVSS 9.5 in CVSS 4.0, assessed as CVSS 3.1 with scope change) and requires the debug interface to be reachable (attack prerequisite AT:P), making it a genuine high-priority issue rather than a high-CVSS-but-low-risk artifact.
Authenticated administrators of certain ASUS router models can abuse leftover debug code in the device's web management interface to enable the normally-disabled Telnet service via a crafted HTTP request, then execute arbitrary commands with root privileges on the router and potentially pivot to other devices on the same network. The flaw requires valid administrative credentials and a non-trivial request (vendor CVSS 4.0 8.9, AV:N/AC:H/PR:H), but once triggered it yields full root-level control with a scope change because the compromised router can be used to attack connected devices. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); ASUS has published a firmware remediation section in its security advisory.
Unauthenticated remote attackers who can reach a yii2-starter-kit deployment (through version 4.2.0) running with its default development configuration can read sensitive runtime data and write arbitrary PHP files. The dev profile sets the Yii debug and Gii modules' allowedIPs to ['*'] in common/config/web.php, so the debug endpoint leaks session cookies and executed database queries (C:H) while the Gii code generator can be abused to create attacker-controlled PHP in the application directory (I:H), a practical path to remote code execution. Exploitation requires the application to be network-exposed while still running the development/staging configuration; a properly hardened production deployment restricts allowedIPs (typically to localhost). No public exploit identified at time of analysis, and the issue is not in CISA KEV; EPSS data was not supplied.
Unauthenticated remote attackers can stall job dispatch for every tenant on Red Hat Ansible Automation Platform 2 by repeatedly calling four debug scheduler views that are routed in production builds because their URL include is not gated on the debug setting. Each call lets any network-reachable client acquire the cluster-wide scheduler advisory lock, and since the legitimate scheduler takes that same lock without waiting, genuine scheduler runs are skipped, job dispatch is delayed or halted, and controller web workers are consumed. The debug root view also discloses the list of debug endpoints to unauthenticated callers, and no public exploit code has been identified at time of analysis.
Privileged users of PLANET IGS-5225-8P2T4S industrial managed switches running V1 firmware before 1.2412b260707 or V2 firmware before 2.2412b260519 can activate undocumented debug functionality that ships enabled in the embedded software, reaching an OS command execution path that grants root-level access to the device. Exploitation requires high-privilege administrative/management access and local access to the device management plane (CVSS:4.0 AV:L/PR:H), so the realistic threat is a malicious insider or an attacker who has already obtained management credentials rather than an unauthenticated remote compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor-released patched firmware is available.
Secure Boot bypass in InsydeH2O UEFI firmware allows a locally-privileged attacker to leverage the embedded UEFI Shell to execute shell commands or startup scripts that circumvent Secure Boot integrity enforcement, enabling pre-OS code execution outside the chain of trust. The vulnerability affects InsydeH2O across all tracked versions per the CPE wildcard, with remediation details deferred to OEM-specific advisories referenced in Insyde SA-2026004. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope change to C:H/I:H/A:H reflects the catastrophic trust boundary violation once exploited.
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances running the UniFi OS platform, where leftover Active Debug Code (CWE-489) lets an authenticated low-privilege actor with network access elevate their privileges on the device. The flaw is vendor-reported via Ubiquiti Security Advisory Bulletin 067 and carries a 9.0 CVSS driven by a security-scope change and full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the wide device footprint makes it a notable patch priority.
Enabled telnet services on the Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums expose a network-accessible shell interface that authenticated low-privilege users can leverage to log into the device. Rooted in CWE-489 (Active Debug Code), the telnet daemon was never disabled before shipping production firmware, leaving a legacy unencrypted remote access protocol open on the device. Reported by JPCERT/CC with a CVSS 4.0 score of 8.7, no public exploit code or CISA KEV listing has been identified, though the network-accessible nature and low attack complexity represent meaningful risk in home and SMB environments.
Remote code execution in AgenticSeek's bundled llm_server component, which ships with Flask debug mode hardcoded on (app.run(host='0.0.0.0', ..., debug=True)) so the interactive Werkzeug debugger is exposed on every interface by default rather than through an opt-in misconfiguration. Any network-reachable instance running a build prior to commit 409840c033851d861c5c83a91c05fd4a2a75a096 is in scope; an unauthenticated remote attacker (CVSS PR:N, no user interaction) who can reach the llm_server port and obtain the derivable Werkzeug debugger PIN can execute arbitrary Python code and operating system commands with the llm_server process's privileges, giving high confidentiality, integrity and availability impact. The assessed vector (CVSS:3.1 AV:N/AC:H/PR:N/UI:N) reflects that PIN derivation, not application authentication, is the rate-limiting step, while CVSS 4.0 scores it 9.2 Critical with AT:P; no public exploit code and no confirmed active exploitation were identified at time of analysis, though a vuln.today decision label of act_now and a vendor-released fix make prompt patching the priority.
Unauthenticated Go pprof debug endpoints exposed on the postgres-exporter metrics listener let any attacker who can reach that port from inside the cluster network read process arguments, full goroutine stacks, and heap memory - potentially leaking database connection strings and credentials - and repeatedly trigger CPU profiling to exhaust resources in a denial-of-service condition. The flaw is tracked as CVE-2026-83550 (CVSS 7.1, AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H per the vendor, C:H for confidentiality in our assessment) and affects postgres-exporter as shipped in Red Hat Multicluster Global Hub, where the CPE covers all tracked versions; exploitation requires adjacent/cluster network reachability rather than internet exposure. No public exploit code has been identified at time of analysis, and no CISA KEV listing indicates active exploitation; risk is best characterized as a real design flaw of moderate priority, with exposure materially reducible through NetworkPolicies that restrict access to the metrics port.
Unauthenticated remote code execution is possible in Perforce P4 Search container images prior to 2026.4.2 due to an exposed Java Debug Wire Protocol (JDWP) interface. An attacker with network access to the JDWP port can execute arbitrary code as the P4 Search service account, potentially compromising the connected P4 Server. No public exploit code has been identified at time of analysis, but the issue is rated critical (CVSS 9.5 in CVSS 4.0, assessed as CVSS 3.1 with scope change) and requires the debug interface to be reachable (attack prerequisite AT:P), making it a genuine high-priority issue rather than a high-CVSS-but-low-risk artifact.
Authenticated administrators of certain ASUS router models can abuse leftover debug code in the device's web management interface to enable the normally-disabled Telnet service via a crafted HTTP request, then execute arbitrary commands with root privileges on the router and potentially pivot to other devices on the same network. The flaw requires valid administrative credentials and a non-trivial request (vendor CVSS 4.0 8.9, AV:N/AC:H/PR:H), but once triggered it yields full root-level control with a scope change because the compromised router can be used to attack connected devices. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); ASUS has published a firmware remediation section in its security advisory.
Unauthenticated remote attackers who can reach a yii2-starter-kit deployment (through version 4.2.0) running with its default development configuration can read sensitive runtime data and write arbitrary PHP files. The dev profile sets the Yii debug and Gii modules' allowedIPs to ['*'] in common/config/web.php, so the debug endpoint leaks session cookies and executed database queries (C:H) while the Gii code generator can be abused to create attacker-controlled PHP in the application directory (I:H), a practical path to remote code execution. Exploitation requires the application to be network-exposed while still running the development/staging configuration; a properly hardened production deployment restricts allowedIPs (typically to localhost). No public exploit identified at time of analysis, and the issue is not in CISA KEV; EPSS data was not supplied.
Unauthenticated remote attackers can stall job dispatch for every tenant on Red Hat Ansible Automation Platform 2 by repeatedly calling four debug scheduler views that are routed in production builds because their URL include is not gated on the debug setting. Each call lets any network-reachable client acquire the cluster-wide scheduler advisory lock, and since the legitimate scheduler takes that same lock without waiting, genuine scheduler runs are skipped, job dispatch is delayed or halted, and controller web workers are consumed. The debug root view also discloses the list of debug endpoints to unauthenticated callers, and no public exploit code has been identified at time of analysis.
Privileged users of PLANET IGS-5225-8P2T4S industrial managed switches running V1 firmware before 1.2412b260707 or V2 firmware before 2.2412b260519 can activate undocumented debug functionality that ships enabled in the embedded software, reaching an OS command execution path that grants root-level access to the device. Exploitation requires high-privilege administrative/management access and local access to the device management plane (CVSS:4.0 AV:L/PR:H), so the realistic threat is a malicious insider or an attacker who has already obtained management credentials rather than an unauthenticated remote compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor-released patched firmware is available.
Secure Boot bypass in InsydeH2O UEFI firmware allows a locally-privileged attacker to leverage the embedded UEFI Shell to execute shell commands or startup scripts that circumvent Secure Boot integrity enforcement, enabling pre-OS code execution outside the chain of trust. The vulnerability affects InsydeH2O across all tracked versions per the CPE wildcard, with remediation details deferred to OEM-specific advisories referenced in Insyde SA-2026004. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope change to C:H/I:H/A:H reflects the catastrophic trust boundary violation once exploited.
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances running the UniFi OS platform, where leftover Active Debug Code (CWE-489) lets an authenticated low-privilege actor with network access elevate their privileges on the device. The flaw is vendor-reported via Ubiquiti Security Advisory Bulletin 067 and carries a 9.0 CVSS driven by a security-scope change and full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the wide device footprint makes it a notable patch priority.
Enabled telnet services on the Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums expose a network-accessible shell interface that authenticated low-privilege users can leverage to log into the device. Rooted in CWE-489 (Active Debug Code), the telnet daemon was never disabled before shipping production firmware, leaving a legacy unencrypted remote access protocol open on the device. Reported by JPCERT/CC with a CVSS 4.0 score of 8.7, no public exploit code or CISA KEV listing has been identified, though the network-accessible nature and low attack complexity represent meaningful risk in home and SMB environments.