Monthly
Arbitrary file read in the Pods WordPress plugin before 3.3.9.2 allows users holding the Author role or higher to exfiltrate any file accessible to the web server process, including sensitive files outside the web root such as wp-config.php or system credentials. The flaw stems from the plugin's display callback resolver accepting unrestricted PHP callable targets without allowlisting. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available. The attack surface is limited to installations operating in restricted display-callback mode, which is the automatic default for WordPress sites whose initial Pods installation predated version 3.1.
Remote unauthenticated command execution in ConfigServer Security & Firewall (CSF) arises from an insecure Apache configuration that maps /usr/bin as a CGI directory on the Messenger v3 HTTPS virtual host. An attacker whose IP has been blocked by CSF can request any executable under /usr/bin and have it run as the Apache user, turning a blocklist-facing service into an arbitrary command-execution vector. WebPros fixed the flaw in CSF 16.31; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file read in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows any authenticated user holding only the low-privileged Standard role to retrieve arbitrary files from the device filesystem by manipulating the `file` query string parameter of `/cgi-bin/ugwdownload.cgi`. A public proof-of-concept exploit is available in SilviaMun's vulnerability-research repository on GitHub, significantly lowering the skill threshold for exploitation. No integrity or availability impact is established - this is a confidentiality-only vulnerability with high impact on device-resident sensitive data such as configuration files and credentials.
TLS private key disclosure in SiYuan <=3.8.1 allows any authenticated user - or any network client on default no-auth-code deployments - to exfiltrate the server's TLS private key (conf/key.pem) and CA private key (conf/ca.key) via a simple POST to /api/file/getFile. The root cause is a dual flaw: the IsForbiddenAbsPath() blocklist covers only conf/conf.json by exact match while leaving sibling key material unprotected, and the getFile handler unconditionally skips the blocklist for RoleAdministrator - a role granted to every authenticated user in v3.8.1. On TLS-enabled, network-exposed instances this enables retrospective decryption of captured HTTPS sessions and forgery of certificates already trusted by clients that imported SiYuan's CA. No public exploit identified at time of analysis; vendor-confirmed fix is available in v3.8.2.
Unauthenticated file read in HPE Networking Fabric Composer's web-based management interface exposes a subset of system files to remote attackers without requiring any credentials. The vulnerability is confined to files within a specific affected directory rather than offering arbitrary filesystem access, yielding a limited confidentiality impact consistent with the CVSS 5.3 (C:L) score. No active exploitation (KEV) or public proof-of-concept has been identified at time of analysis, and no EPSS signal is provided in available intelligence.
Authenticated privilege escalation in HPE Networking Fabric Composer's API allows low-privilege operator users to read limited information and make limited configuration changes beyond their authorized scope. The flaw affects all tracked versions per CPE data and requires only a valid low-privilege account to exploit - no special configuration or user interaction is needed. No public exploit code and no CISA KEV listing are present at time of analysis, keeping real-world risk moderate despite network accessibility.
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escalate privileges and execute arbitrary commands on the underlying operating system, resulting in complete system compromise. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects network-exploitable, low-complexity exploitation requiring only a valid operator account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the clear privilege escalation path from a low-privilege role to OS-level access makes this a high-priority remediation target in any Fabric Composer deployment.
Credential store overwrite in NousResearch Hermes Agent versions 0.16.0 through pre-0.17.0 is achievable by any attacker who can inject content into messages ingested by the agent, exploiting a gap in the sensitive-path guard (CWE-552) that failed to properly exclude auth.json from the file-write tool's reachable paths. By crafting malicious message payloads, an attacker bypasses the path restriction and overwrites the credential store without triggering any protection, resulting in credential tampering and potential unauthorized access to all identities stored therein. No public exploit has been identified at time of analysis, and a vendor-released patch (v0.17.0) is available.
Grafana Alloy's prometheus.operator.servicemonitors component exposes an arbitrary local file read path that leads to credential theft and potential Kubernetes privilege escalation. Any Kubernetes user with ServiceMonitor create or modify rights in a namespace watched by Alloy can point the bearerTokenFile field at any file accessible to the Alloy process - most critically Alloy's own projected Kubernetes service account token - and receive that file's contents exfiltrated via HTTP Bearer token to an attacker-controlled scrape endpoint. The CVSS 7.7 Scope:Changed rating correctly reflects that successful exploitation transcends the compromised namespace, potentially granting the attacker cluster-level API access commensurate with Alloy's own RBAC permissions. No public exploit has been identified at time of analysis.
Arbitrary file deletion in Veno File Manager (VFM) 4.4.9 lets attackers destroy files outside the intended scope by supplying a crafted path in the `remove=` parameter of the translations-update handler (/vfm-admin/index.php?section=translations&action=update). Because path traversal is not neutralized, an attacker can delete configuration, application, or user files anywhere the web server has write access, enabling denial of service, defacement, or removal of security-relevant files. Publicly available exploit code exists (GitHub PoC), though EPSS remains low (0.16%) and the flaw is not in CISA KEV.
Arbitrary file read in the Pods WordPress plugin before 3.3.9.2 allows users holding the Author role or higher to exfiltrate any file accessible to the web server process, including sensitive files outside the web root such as wp-config.php or system credentials. The flaw stems from the plugin's display callback resolver accepting unrestricted PHP callable targets without allowlisting. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available. The attack surface is limited to installations operating in restricted display-callback mode, which is the automatic default for WordPress sites whose initial Pods installation predated version 3.1.
Remote unauthenticated command execution in ConfigServer Security & Firewall (CSF) arises from an insecure Apache configuration that maps /usr/bin as a CGI directory on the Messenger v3 HTTPS virtual host. An attacker whose IP has been blocked by CSF can request any executable under /usr/bin and have it run as the Apache user, turning a blocklist-facing service into an arbitrary command-execution vector. WebPros fixed the flaw in CSF 16.31; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file read in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows any authenticated user holding only the low-privileged Standard role to retrieve arbitrary files from the device filesystem by manipulating the `file` query string parameter of `/cgi-bin/ugwdownload.cgi`. A public proof-of-concept exploit is available in SilviaMun's vulnerability-research repository on GitHub, significantly lowering the skill threshold for exploitation. No integrity or availability impact is established - this is a confidentiality-only vulnerability with high impact on device-resident sensitive data such as configuration files and credentials.
TLS private key disclosure in SiYuan <=3.8.1 allows any authenticated user - or any network client on default no-auth-code deployments - to exfiltrate the server's TLS private key (conf/key.pem) and CA private key (conf/ca.key) via a simple POST to /api/file/getFile. The root cause is a dual flaw: the IsForbiddenAbsPath() blocklist covers only conf/conf.json by exact match while leaving sibling key material unprotected, and the getFile handler unconditionally skips the blocklist for RoleAdministrator - a role granted to every authenticated user in v3.8.1. On TLS-enabled, network-exposed instances this enables retrospective decryption of captured HTTPS sessions and forgery of certificates already trusted by clients that imported SiYuan's CA. No public exploit identified at time of analysis; vendor-confirmed fix is available in v3.8.2.
Unauthenticated file read in HPE Networking Fabric Composer's web-based management interface exposes a subset of system files to remote attackers without requiring any credentials. The vulnerability is confined to files within a specific affected directory rather than offering arbitrary filesystem access, yielding a limited confidentiality impact consistent with the CVSS 5.3 (C:L) score. No active exploitation (KEV) or public proof-of-concept has been identified at time of analysis, and no EPSS signal is provided in available intelligence.
Authenticated privilege escalation in HPE Networking Fabric Composer's API allows low-privilege operator users to read limited information and make limited configuration changes beyond their authorized scope. The flaw affects all tracked versions per CPE data and requires only a valid low-privilege account to exploit - no special configuration or user interaction is needed. No public exploit code and no CISA KEV listing are present at time of analysis, keeping real-world risk moderate despite network accessibility.
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escalate privileges and execute arbitrary commands on the underlying operating system, resulting in complete system compromise. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects network-exploitable, low-complexity exploitation requiring only a valid operator account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the clear privilege escalation path from a low-privilege role to OS-level access makes this a high-priority remediation target in any Fabric Composer deployment.
Credential store overwrite in NousResearch Hermes Agent versions 0.16.0 through pre-0.17.0 is achievable by any attacker who can inject content into messages ingested by the agent, exploiting a gap in the sensitive-path guard (CWE-552) that failed to properly exclude auth.json from the file-write tool's reachable paths. By crafting malicious message payloads, an attacker bypasses the path restriction and overwrites the credential store without triggering any protection, resulting in credential tampering and potential unauthorized access to all identities stored therein. No public exploit has been identified at time of analysis, and a vendor-released patch (v0.17.0) is available.
Grafana Alloy's prometheus.operator.servicemonitors component exposes an arbitrary local file read path that leads to credential theft and potential Kubernetes privilege escalation. Any Kubernetes user with ServiceMonitor create or modify rights in a namespace watched by Alloy can point the bearerTokenFile field at any file accessible to the Alloy process - most critically Alloy's own projected Kubernetes service account token - and receive that file's contents exfiltrated via HTTP Bearer token to an attacker-controlled scrape endpoint. The CVSS 7.7 Scope:Changed rating correctly reflects that successful exploitation transcends the compromised namespace, potentially granting the attacker cluster-level API access commensurate with Alloy's own RBAC permissions. No public exploit has been identified at time of analysis.
Arbitrary file deletion in Veno File Manager (VFM) 4.4.9 lets attackers destroy files outside the intended scope by supplying a crafted path in the `remove=` parameter of the translations-update handler (/vfm-admin/index.php?section=translations&action=update). Because path traversal is not neutralized, an attacker can delete configuration, application, or user files anywhere the web server has write access, enabling denial of service, defacement, or removal of security-relevant files. Publicly available exploit code exists (GitHub PoC), though EPSS remains low (0.16%) and the flaw is not in CISA KEV.