Monthly
Splunk SOAR deployments running any version below 8.7.0 expose files and directories to external parties (CWE-552), and the vendor rates the issue at CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning a network-reachable attacker holding only a low-privileged authenticated account can reach the exposed resources with no user interaction, with high confidentiality, integrity and availability impact and a scope change beyond the vulnerable component. The flaw was found during Cisco's internal security review and shipped in a bundled software hardening release rather than as a single documented bug, so the precise endpoint or feature that exposes the files is not described in the available sources. SSVC records no known exploitation and marks the issue not automatable, and no public exploit code or proof-of-concept was identified at time of analysis; the vendor-prioritised decision is act now, with upgrading to 8.7.0 as the remediation.
Unauthenticated attackers can download private ticket attachments from Trudesk through 1.2.11 because express.static serves the public/ directory ahead of the hasAuth-guarded /uploads mount, so a direct request bypasses the authentication middleware entirely. Successful retrieval requires knowing or guessing a valid ticket MongoDB ObjectId plus the matching attachment filename, which is the main bound on the risk: no credentials or user interaction are needed and default configurations are affected, but the 12-byte ObjectId is not trivially guessable, so blind mass exploitation is impractical and realistic compromise depends on IDs and filenames leaking via URLs, email notifications, or referrers, or on an instance where IDs can be enumerated. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated remote attackers can bypass access controls in the TSplus Remote Access web server via manipulated paths on the /socket.io/JWN/ endpoint, leading to disclosure of protected internal resources. This high-severity vulnerability (CVSS 4.0 base 8.7) affects internet-exposed portals with no authentication or user interaction required. No public exploit identified at time of analysis, but the flaw is trivially exploitable given network reachability.
Local file disclosure in Docling allows crafted HTML to embed readable files from the host filesystem into the rendered page image. When an application explicitly sets HTMLBackendOptions(render_page=True), has the optional Playwright dependency installed, and passes untrusted HTML as a filesystem Path, the HTML backend's browser request filter fails to enforce the enable_local_fetch setting or confine file:// access to the source document's directory, so an <iframe src="file:///..."> can pull in .env files, credentials, or other users' documents that Chromium then renders visibly into the output image. Publicly available exploit code exists and the issue is fixed in 2.118.1; EPSS is low (0.30%, 21st percentile) and there is no indication of active exploitation, so real-world priority is comparatively low despite the 7.5 CVSS, because exploitation demands a specific non-default configuration and disclosure is passive, read-only, and limited to text content Chromium renders in the viewport.
Toptech Systems TMS7 and TopHat expose a file export endpoint that lets any network-reachable, unauthenticated attacker submit a single crafted POST request and pull arbitrary database tables out of the system - an information disclosure of the highest severity as scored by CISA ICS (CVSS 10.0), and assessed by our analysis as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, i.e. confidentiality-only impact with no integrity or availability effect. Affected are deployments of Toptech TMS7 (all versions captured in CPE with a wildcard version) and TopHat, which are OT/ICS fuel-terminal and terminal-automation products typically expected to sit on segmented operational networks; the decisive factor for real-world exploitability is whether the export endpoint is reachable from outside that trusted OT segment, since no authentication, user interaction, or non-default toggle is required. There is no public exploit code identified at time of analysis and the flaw is not listed on CISA KEV, so exposure should be treated as a configuration-and-segmentation problem rather than a confirmed ongoing campaign. Authentication requirements are not in question here: the CVSS vector contains PR:N, so exploitation is unauthenticated.
Unauthenticated arbitrary file read and server-side request forgery in NUUO Network Video Recorder 2.0.0 allow a remote attacker to submit a crafted url parameter via POST to up.php, causing fopen() to retrieve a local file (or remote/internal URL) whose contents are then staged under /tmp/ using a basename()-derived filename. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) is consistent with the description's no-authentication requirement, indicating a low-complexity, confidentiality-only flaw reachable by anyone with network access to the NVR web service. Publicly available exploit code exists (SSVC Exploitation: poc, Automatable: yes, Technical Impact: partial), but the CVE is not listed in CISA KEV, so active exploitation is not confirmed; EPSS is low at 0.20% (10th percentile), and practical exposure is further reduced because the fetched content is written to /tmp/ rather than returned inline and NVRs are typically deployed on segmented internal networks.
Gallery - Private Photo Vault 1.0.41 (Android, by Brain Trust) exposes an unauthenticated HTTP server on TCP port 8080 that is reachable by any device on the same local network, serving full directory listings and file contents from Android external storage - the very media the app is marketed to protect. Any network-adjacent attacker can trivially enumerate and exfiltrate photos, videos, and other files without credentials or user interaction. No public exploit code is required beyond a standard web browser or curl; Fluid Attacks' advisory confirms a proof-of-concept exists, but no CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary file read in the Yogeta WP Cloud WordPress plugin (through version 1.0) allows any remote attacker to download arbitrary files from the server, including sensitive credential files such as wp-config.php, database configuration, and OS-level files like /etc/passwd. The plugin exposes a public endpoint that passes a user-supplied file path directly to a file-read function with no path validation and no authorization check, enabling full server-side file disclosure. Reported by WPScan with no patch available at time of analysis; no public exploit is identified at time of analysis, and EPSS stands at a low 0.16%, though the unauthenticated network-accessible nature makes this easily exploitable when the plugin is active.
Remote unauthenticated command execution in ConfigServer Security & Firewall (CSF) arises from an insecure Apache configuration that maps /usr/bin as a CGI directory on the Messenger v3 HTTPS virtual host. An attacker whose IP has been blocked by CSF can request any executable under /usr/bin and have it run as the Apache user, turning a blocklist-facing service into an arbitrary command-execution vector. WebPros fixed the flaw in CSF 16.31; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
TLS private key disclosure in SiYuan <=3.8.1 allows any authenticated user - or any network client on default no-auth-code deployments - to exfiltrate the server's TLS private key (conf/key.pem) and CA private key (conf/ca.key) via a simple POST to /api/file/getFile. The root cause is a dual flaw: the IsForbiddenAbsPath() blocklist covers only conf/conf.json by exact match while leaving sibling key material unprotected, and the getFile handler unconditionally skips the blocklist for RoleAdministrator - a role granted to every authenticated user in v3.8.1. On TLS-enabled, network-exposed instances this enables retrospective decryption of captured HTTPS sessions and forgery of certificates already trusted by clients that imported SiYuan's CA. No public exploit identified at time of analysis; vendor-confirmed fix is available in v3.8.2.
Splunk SOAR deployments running any version below 8.7.0 expose files and directories to external parties (CWE-552), and the vendor rates the issue at CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning a network-reachable attacker holding only a low-privileged authenticated account can reach the exposed resources with no user interaction, with high confidentiality, integrity and availability impact and a scope change beyond the vulnerable component. The flaw was found during Cisco's internal security review and shipped in a bundled software hardening release rather than as a single documented bug, so the precise endpoint or feature that exposes the files is not described in the available sources. SSVC records no known exploitation and marks the issue not automatable, and no public exploit code or proof-of-concept was identified at time of analysis; the vendor-prioritised decision is act now, with upgrading to 8.7.0 as the remediation.
Unauthenticated attackers can download private ticket attachments from Trudesk through 1.2.11 because express.static serves the public/ directory ahead of the hasAuth-guarded /uploads mount, so a direct request bypasses the authentication middleware entirely. Successful retrieval requires knowing or guessing a valid ticket MongoDB ObjectId plus the matching attachment filename, which is the main bound on the risk: no credentials or user interaction are needed and default configurations are affected, but the 12-byte ObjectId is not trivially guessable, so blind mass exploitation is impractical and realistic compromise depends on IDs and filenames leaking via URLs, email notifications, or referrers, or on an instance where IDs can be enumerated. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated remote attackers can bypass access controls in the TSplus Remote Access web server via manipulated paths on the /socket.io/JWN/ endpoint, leading to disclosure of protected internal resources. This high-severity vulnerability (CVSS 4.0 base 8.7) affects internet-exposed portals with no authentication or user interaction required. No public exploit identified at time of analysis, but the flaw is trivially exploitable given network reachability.
Local file disclosure in Docling allows crafted HTML to embed readable files from the host filesystem into the rendered page image. When an application explicitly sets HTMLBackendOptions(render_page=True), has the optional Playwright dependency installed, and passes untrusted HTML as a filesystem Path, the HTML backend's browser request filter fails to enforce the enable_local_fetch setting or confine file:// access to the source document's directory, so an <iframe src="file:///..."> can pull in .env files, credentials, or other users' documents that Chromium then renders visibly into the output image. Publicly available exploit code exists and the issue is fixed in 2.118.1; EPSS is low (0.30%, 21st percentile) and there is no indication of active exploitation, so real-world priority is comparatively low despite the 7.5 CVSS, because exploitation demands a specific non-default configuration and disclosure is passive, read-only, and limited to text content Chromium renders in the viewport.
Toptech Systems TMS7 and TopHat expose a file export endpoint that lets any network-reachable, unauthenticated attacker submit a single crafted POST request and pull arbitrary database tables out of the system - an information disclosure of the highest severity as scored by CISA ICS (CVSS 10.0), and assessed by our analysis as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, i.e. confidentiality-only impact with no integrity or availability effect. Affected are deployments of Toptech TMS7 (all versions captured in CPE with a wildcard version) and TopHat, which are OT/ICS fuel-terminal and terminal-automation products typically expected to sit on segmented operational networks; the decisive factor for real-world exploitability is whether the export endpoint is reachable from outside that trusted OT segment, since no authentication, user interaction, or non-default toggle is required. There is no public exploit code identified at time of analysis and the flaw is not listed on CISA KEV, so exposure should be treated as a configuration-and-segmentation problem rather than a confirmed ongoing campaign. Authentication requirements are not in question here: the CVSS vector contains PR:N, so exploitation is unauthenticated.
Unauthenticated arbitrary file read and server-side request forgery in NUUO Network Video Recorder 2.0.0 allow a remote attacker to submit a crafted url parameter via POST to up.php, causing fopen() to retrieve a local file (or remote/internal URL) whose contents are then staged under /tmp/ using a basename()-derived filename. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) is consistent with the description's no-authentication requirement, indicating a low-complexity, confidentiality-only flaw reachable by anyone with network access to the NVR web service. Publicly available exploit code exists (SSVC Exploitation: poc, Automatable: yes, Technical Impact: partial), but the CVE is not listed in CISA KEV, so active exploitation is not confirmed; EPSS is low at 0.20% (10th percentile), and practical exposure is further reduced because the fetched content is written to /tmp/ rather than returned inline and NVRs are typically deployed on segmented internal networks.
Gallery - Private Photo Vault 1.0.41 (Android, by Brain Trust) exposes an unauthenticated HTTP server on TCP port 8080 that is reachable by any device on the same local network, serving full directory listings and file contents from Android external storage - the very media the app is marketed to protect. Any network-adjacent attacker can trivially enumerate and exfiltrate photos, videos, and other files without credentials or user interaction. No public exploit code is required beyond a standard web browser or curl; Fluid Attacks' advisory confirms a proof-of-concept exists, but no CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary file read in the Yogeta WP Cloud WordPress plugin (through version 1.0) allows any remote attacker to download arbitrary files from the server, including sensitive credential files such as wp-config.php, database configuration, and OS-level files like /etc/passwd. The plugin exposes a public endpoint that passes a user-supplied file path directly to a file-read function with no path validation and no authorization check, enabling full server-side file disclosure. Reported by WPScan with no patch available at time of analysis; no public exploit is identified at time of analysis, and EPSS stands at a low 0.16%, though the unauthenticated network-accessible nature makes this easily exploitable when the plugin is active.
Remote unauthenticated command execution in ConfigServer Security & Firewall (CSF) arises from an insecure Apache configuration that maps /usr/bin as a CGI directory on the Messenger v3 HTTPS virtual host. An attacker whose IP has been blocked by CSF can request any executable under /usr/bin and have it run as the Apache user, turning a blocklist-facing service into an arbitrary command-execution vector. WebPros fixed the flaw in CSF 16.31; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
TLS private key disclosure in SiYuan <=3.8.1 allows any authenticated user - or any network client on default no-auth-code deployments - to exfiltrate the server's TLS private key (conf/key.pem) and CA private key (conf/ca.key) via a simple POST to /api/file/getFile. The root cause is a dual flaw: the IsForbiddenAbsPath() blocklist covers only conf/conf.json by exact match while leaving sibling key material unprotected, and the getFile handler unconditionally skips the blocklist for RoleAdministrator - a role granted to every authenticated user in v3.8.1. On TLS-enabled, network-exposed instances this enables retrospective decryption of captured HTTPS sessions and forgery of certificates already trusted by clients that imported SiYuan's CA. No public exploit identified at time of analysis; vendor-confirmed fix is available in v3.8.2.