Monthly
Improper neutralization (injection-class weakness, CWE-707) in Splunk Enterprise lets an attacker submit crafted input through a network-reachable Splunk interface and achieve high impact across confidentiality, integrity, and availability - per our independent assessment, exploitation requires low-privilege authentication (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), even though the upstream NVD-style vector claims PR:N/unauthenticated. Affected are Splunk Enterprise 10.4 before 10.4.3, 10.2 before 10.2.7, 10.0 before 10.0.10, and 9.4 before 9.4.15; the vendor grouped multiple internally identified findings by CWE and assigned this CVE to the neutralization group, so the advisory names no single endpoint or feature. No public exploit code has been identified at time of analysis, EPSS is only 0.15% (4th percentile), and the vulnerability is not listed as confirmed actively exploited (CISA KEV), so urgency should be driven by the critical severity and the accessibility of the affected interface rather than by observed exploitation.
Improper neutralization flaws in Cisco Application Policy Infrastructure Controller (APIC), the software controller for Cisco ACI data-center fabrics, allow unauthenticated network-reachable attackers to achieve full confidentiality, integrity, and availability impact - the input assigns CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issues were found during Cisco's own internal hardening review and are bundled as a single CVE covering multiple CWE-707 (Improper Neutralization) weaknesses rather than one disclosed trigger path; no specific protocol, endpoint, or non-default configuration prerequisite is documented. No public exploit code and confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Practically, exploitability hinges on reachability of APIC management/controller interfaces, which are normally confined to isolated out-of-band management networks, so real-world exposure is largely limited to insiders or attackers who have already pivoted into the management segment. Patches are available per the Cisco advisory cisco-sa-hardening-apic-UOXWtfh; because the reference is a hardening release rather than a single tagged fix, an exact fixed version string was not provided in the input data.
Improper neutralization of input in Cisco NX-OS software, NX-OS System Software running in ACI mode, and Cisco Unified Computing System (Managed) allows an authenticated attacker holding low-privilege credentials to reach high confidentiality, integrity, and availability impact against the affected device (CVSS 3.1: 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw surfaced during Cisco's internal security review and is remediated through a software hardening release rather than through an out-of-band emergency fix, which indicates internally discovered rather than customer-reported or externally exploited issues. There is no public exploit code and no confirmed active exploitation at time of analysis, though the network-reachable attack path and the breadth of affected platforms (standalone Nexus switches, ACI-mode fabrics, and UCS Managed systems) make it a credible operational priority despite the absence of exploitation signals.
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) software can let a low-privilege, authenticated remote attacker cause high-impact confidentiality, integrity, and availability effects on affected appliances, with information disclosure flagged among the affected weaknesses. Cisco scores the bundled issues 9.9 under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, where the scope change (S:C) and complete C/I/A impact push the rating into critical territory despite requiring a valid low-privilege credential and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the fixes were produced through an internal hardening review rather than in response to observed attacks, so real-world urgency cannot be confirmed from the available signals.
Improper-neutralization flaws (CWE-707) in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager - disclosed by Cisco as an internally discovered hardening release covering affected 12.8.x through 16.x builds - could allow an attacker to compromise confidentiality or integrity of the appliances, but the published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is unsupported by any of the technical detail Cisco actually provides. The advisory cisco-sa-hardening-esa-dfCrfXkm names no vulnerable feature, endpoint, protocol, or configuration setting and does not state whether authentication is required, so the unauthenticated PR:N claim is unverified; our assessment lowers the vector to CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N and treats exposed management interfaces as the most plausible attack surface. There is no public exploit code and no evidence of exploitation (CISA SSVC Exploitation: none), and EPSS is low at 0.37% (30th percentile), so this should be handled as a routine patch-cadence item rather than an emergency pre-auth remote compromise.
Improper neutralization flaws (CWE-707) in Cisco IOS XR Software allow an authenticated remote attacker with low privileges to achieve full confidentiality, integrity, and availability impact against affected devices. The vulnerabilities were identified internally by Cisco's security engineering team and addressed in a batch hardening release, reference advisory cisco-sa-hardening-iosxr-qg64NcM. No public exploit code has been identified at time of analysis, though the CVSS 8.8 score and complete C/I/A triad reflect significant potential impact in carrier and enterprise routing infrastructure.
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffic Manager, and WSO2 API Control Plane - allows an unauthenticated remote attacker to send malicious JSON payloads to the throttling event handling mechanism, crashing or corrupting API Gateway state so that legitimate API traffic can no longer be processed. Because the outage is persistent and requires manual intervention to restore service, and the CVSS scope is changed (S:C), a single request can take down the entire API Gateway tier. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute malicious code locally. KEV-listed and tracked as CVE-2025-26633, this vulnerability has been actively exploited by the Water Gamayun threat group (also tracked as EncryptHub) using crafted .msc files to deploy info-stealing malware. Public PoC is available and EPSS is 7.1%.
Microsoft Management Console Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Improper neutralization of Spring Expression Language (SpEL) input in halo-dev Halo versions up to 2.25.4/2.26.1 lets unauthenticated remote attackers influence expression handling through the comment reply-notification subscription component, producing low-level confidentiality, integrity, and availability impact. Publicly available exploit code exists and the vendor did not respond to disclosure, but there is no CISA KEV listing, so active exploitation is not confirmed. The independent assessment rates this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, a genuine but modest-severity issue.
Improper neutralization (injection-class weakness, CWE-707) in Splunk Enterprise lets an attacker submit crafted input through a network-reachable Splunk interface and achieve high impact across confidentiality, integrity, and availability - per our independent assessment, exploitation requires low-privilege authentication (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), even though the upstream NVD-style vector claims PR:N/unauthenticated. Affected are Splunk Enterprise 10.4 before 10.4.3, 10.2 before 10.2.7, 10.0 before 10.0.10, and 9.4 before 9.4.15; the vendor grouped multiple internally identified findings by CWE and assigned this CVE to the neutralization group, so the advisory names no single endpoint or feature. No public exploit code has been identified at time of analysis, EPSS is only 0.15% (4th percentile), and the vulnerability is not listed as confirmed actively exploited (CISA KEV), so urgency should be driven by the critical severity and the accessibility of the affected interface rather than by observed exploitation.
Improper neutralization flaws in Cisco Application Policy Infrastructure Controller (APIC), the software controller for Cisco ACI data-center fabrics, allow unauthenticated network-reachable attackers to achieve full confidentiality, integrity, and availability impact - the input assigns CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issues were found during Cisco's own internal hardening review and are bundled as a single CVE covering multiple CWE-707 (Improper Neutralization) weaknesses rather than one disclosed trigger path; no specific protocol, endpoint, or non-default configuration prerequisite is documented. No public exploit code and confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Practically, exploitability hinges on reachability of APIC management/controller interfaces, which are normally confined to isolated out-of-band management networks, so real-world exposure is largely limited to insiders or attackers who have already pivoted into the management segment. Patches are available per the Cisco advisory cisco-sa-hardening-apic-UOXWtfh; because the reference is a hardening release rather than a single tagged fix, an exact fixed version string was not provided in the input data.
Improper neutralization of input in Cisco NX-OS software, NX-OS System Software running in ACI mode, and Cisco Unified Computing System (Managed) allows an authenticated attacker holding low-privilege credentials to reach high confidentiality, integrity, and availability impact against the affected device (CVSS 3.1: 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw surfaced during Cisco's internal security review and is remediated through a software hardening release rather than through an out-of-band emergency fix, which indicates internally discovered rather than customer-reported or externally exploited issues. There is no public exploit code and no confirmed active exploitation at time of analysis, though the network-reachable attack path and the breadth of affected platforms (standalone Nexus switches, ACI-mode fabrics, and UCS Managed systems) make it a credible operational priority despite the absence of exploitation signals.
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) software can let a low-privilege, authenticated remote attacker cause high-impact confidentiality, integrity, and availability effects on affected appliances, with information disclosure flagged among the affected weaknesses. Cisco scores the bundled issues 9.9 under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, where the scope change (S:C) and complete C/I/A impact push the rating into critical territory despite requiring a valid low-privilege credential and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the fixes were produced through an internal hardening review rather than in response to observed attacks, so real-world urgency cannot be confirmed from the available signals.
Improper-neutralization flaws (CWE-707) in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager - disclosed by Cisco as an internally discovered hardening release covering affected 12.8.x through 16.x builds - could allow an attacker to compromise confidentiality or integrity of the appliances, but the published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is unsupported by any of the technical detail Cisco actually provides. The advisory cisco-sa-hardening-esa-dfCrfXkm names no vulnerable feature, endpoint, protocol, or configuration setting and does not state whether authentication is required, so the unauthenticated PR:N claim is unverified; our assessment lowers the vector to CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N and treats exposed management interfaces as the most plausible attack surface. There is no public exploit code and no evidence of exploitation (CISA SSVC Exploitation: none), and EPSS is low at 0.37% (30th percentile), so this should be handled as a routine patch-cadence item rather than an emergency pre-auth remote compromise.
Improper neutralization flaws (CWE-707) in Cisco IOS XR Software allow an authenticated remote attacker with low privileges to achieve full confidentiality, integrity, and availability impact against affected devices. The vulnerabilities were identified internally by Cisco's security engineering team and addressed in a batch hardening release, reference advisory cisco-sa-hardening-iosxr-qg64NcM. No public exploit code has been identified at time of analysis, though the CVSS 8.8 score and complete C/I/A triad reflect significant potential impact in carrier and enterprise routing infrastructure.
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffic Manager, and WSO2 API Control Plane - allows an unauthenticated remote attacker to send malicious JSON payloads to the throttling event handling mechanism, crashing or corrupting API Gateway state so that legitimate API traffic can no longer be processed. Because the outage is persistent and requires manual intervention to restore service, and the CVSS scope is changed (S:C), a single request can take down the entire API Gateway tier. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute malicious code locally. KEV-listed and tracked as CVE-2025-26633, this vulnerability has been actively exploited by the Water Gamayun threat group (also tracked as EncryptHub) using crafted .msc files to deploy info-stealing malware. Public PoC is available and EPSS is 7.1%.
Microsoft Management Console Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Improper neutralization of Spring Expression Language (SpEL) input in halo-dev Halo versions up to 2.25.4/2.26.1 lets unauthenticated remote attackers influence expression handling through the comment reply-notification subscription component, producing low-level confidentiality, integrity, and availability impact. Publicly available exploit code exists and the vendor did not respond to disclosure, but there is no CISA KEV listing, so active exploitation is not confirmed. The independent assessment rates this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, a genuine but modest-severity issue.