Monthly
OS command injection in the web-based management API of Cisco Application Policy Infrastructure Controller (APIC) allows an attacker who already holds valid administrative credentials to run arbitrary commands as root on the underlying controller operating system. Exploitation is remote and requires no user interaction, but the PR:H rating in the CVSS vector confirms the high privilege bar: only authenticated admins can reach the vulnerable code path, so realistic exposure is limited to insider abuse, stolen or shared admin accounts, or APIC management interfaces reachable from untrusted networks. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; Cisco's base score of 6.5 understates the assessed impact, since the independent re-scoring (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) also credits full loss of availability on the controller.
User account enumeration in Dify 1.6.0 allows unauthenticated remote attackers to determine whether a given username or email is registered by analyzing distinct error messages returned during login or registration attempts. This information disclosure (CWE-544) has a CVSS base score of 5.3 and low-priority informational severity, with a publicly available proof-of-concept (EPSS 0.70%, 52nd percentile) but no confirmed active exploitation in CISA KEV. While the flaw itself only reveals account existence, it can facilitate follow-on brute force, credential stuffing, or social engineering campaigns, particularly against internet-facing Dify instances lacking rate-limiting or WAF protections.
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause an unhandled SSL exception which could leave the connection in an unexpected or insecure. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper error handling in firmware of some SSD DC Products may allow an attacker to enable denial of service. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC712 (All versions < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >=. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to an Unchecked Return Value Vulnerability. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
OS command injection in the web-based management API of Cisco Application Policy Infrastructure Controller (APIC) allows an attacker who already holds valid administrative credentials to run arbitrary commands as root on the underlying controller operating system. Exploitation is remote and requires no user interaction, but the PR:H rating in the CVSS vector confirms the high privilege bar: only authenticated admins can reach the vulnerable code path, so realistic exposure is limited to insider abuse, stolen or shared admin accounts, or APIC management interfaces reachable from untrusted networks. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; Cisco's base score of 6.5 understates the assessed impact, since the independent re-scoring (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) also credits full loss of availability on the controller.
User account enumeration in Dify 1.6.0 allows unauthenticated remote attackers to determine whether a given username or email is registered by analyzing distinct error messages returned during login or registration attempts. This information disclosure (CWE-544) has a CVSS base score of 5.3 and low-priority informational severity, with a publicly available proof-of-concept (EPSS 0.70%, 52nd percentile) but no confirmed active exploitation in CISA KEV. While the flaw itself only reveals account existence, it can facilitate follow-on brute force, credential stuffing, or social engineering campaigns, particularly against internet-facing Dify instances lacking rate-limiting or WAF protections.
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause an unhandled SSL exception which could leave the connection in an unexpected or insecure. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper error handling in firmware of some SSD DC Products may allow an attacker to enable denial of service. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC712 (All versions < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >=. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to an Unchecked Return Value Vulnerability. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.