Monthly
Local privilege escalation in Parallels RAS Client 21.0.26296 allows an attacker holding low-privileged code execution to reach SYSTEM-level authority by invoking an exposed dangerous function in the RAS RDP Backend Service (CWE-749). The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once exploited, with low attack complexity and no user interaction required beyond an initial foothold. No public exploit code and no CISA KEV confirmation have been identified at time of analysis, though ZDI's coordinated disclosure (ZDI-26-556) may accelerate POC development.
Local privilege escalation in Parallels RAS Client 21.0.26296 allows low-privileged local attackers to gain SYSTEM-level code execution by invoking an exposed dangerous function within the RAS RDP Backend Service. The root cause is CWE-749, where a privileged service function is accessible without proper access control to lower-privileged callers. Discovered and reported by Zero Day Initiative (ZDI-26-555 / ZDI-CAN-28885), no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Parallels RAS Client 21.0.26296 allows a low-privileged local attacker to escalate to SYSTEM-level execution by invoking an exposed dangerous function within the RAS RDP Backend Service. The flaw (CWE-749) stems from the service exposing an unsafe method that can be abused without administrative rights, enabling full system compromise. No public exploit or CISA KEV listing has been identified at time of analysis, though the vulnerability was coordinated through Zero Day Initiative (ZDI-CAN-29220).
Remote code execution in Azure Confidential Ledger allows an authorized attacker with elevated privileges to invoke an exposed dangerous method over the network and run arbitrary code, with a scope change (S:C) that lets the impact reach beyond the initially compromised component. Microsoft rates it CVSS 9.1 (Critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because Azure Confidential Ledger is a managed cloud service, remediation is delivered server-side by Microsoft rather than by customer patching.
Remote code execution as root is achievable against H3C NX15 firmware V100R017 via the `/api/esps` Web API endpoint, which exposes the `service.add` function without adequate access controls (CWE-749). Exploitation requires high-privilege authentication, but a post-authentication proof-of-concept script (`postauth_service_add_rce.py`) is publicly available on GitHub, demonstrating a complete root RCE chain. No vendor patch has been identified at time of analysis; no active exploitation is confirmed in CISA KEV.
Privilege escalation in MediaTek's AI Processing Unit Subsystem (apusys) driver allows a local attacker already holding System-level privileges on devices equipped with MT8366, MT8196, or MT8195 chipsets to escalate further, achieving high-impact access to confidential data and system integrity. The root cause is a missing bounds check (CWE-749) in an exposed driver function, patched under MediaTek ID AUTO00837766 in the August 2026 security bulletin. No public exploit code has been identified, and the EPSS score of 0.14% (4th percentile) confirms very low current exploitation probability.
Denial-of-service in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000/3050/3100/3150, firmware 1.0.0 up to but not including 1.9.1) allows an unauthenticated network attacker to reboot the charging controller by sending a crafted Modbus TCP command to the CharxModbusServer. The attack requires no credentials or user interaction and, per the CVSS 4.0 vector, produces high availability impact with no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity makes reliable disruption of charging service straightforward once the Modbus port is reachable.
Arbitrary code execution in ownCloud Core (ownCloud 10 Classic server, all versions before 10.15.3) allows an administrator to abuse an exposed dangerous method in the Updater component to run code on the server host. Any actor holding administrative credentials - legitimately, or via session hijack/credential theft/CSRF against an admin - can convert web-app admin rights into full server compromise. No public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor-issued GHSA-hvcx-ph66-mmvw advisory and the fix in 10.15.3 are the primary confirmation.
Cross-origin information disclosure in the Nx monorepo graph server (versions 17.0.4 through 22.7.1) exposes the full project dependency graph and workspace metadata to any website a developer visits while `nx graph` is running locally. The server unconditionally broadcasts `Access-Control-Allow-Origin: *`, bypassing the browser Same-Origin Policy and allowing attacker-controlled JavaScript to silently read internal project structure. In rare cases, the `/help` endpoint - which executes a workspace-configured target command - creates a path to arbitrary command injection on the developer's machine. No public exploit or CISA KEV listing identified at time of analysis.
Reverse-proxy takeover in Appsmith versions prior to 2.1 lets an authenticated low-privileged user abuse server-side request forgery to reach the bundled Caddy admin API, which ships with no authentication and listens on 0.0.0.0:2019 inside the container. By forcing the Appsmith server to issue a POST /load to that internal endpoint, the attacker rewrites the live Caddy configuration and seizes control of the reverse proxy that fronts the application. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the vendor-confirmed CWE-749 exposure carries a 9.9 CVSS rating.
Local privilege escalation in Parallels RAS Client 21.0.26296 allows an attacker holding low-privileged code execution to reach SYSTEM-level authority by invoking an exposed dangerous function in the RAS RDP Backend Service (CWE-749). The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once exploited, with low attack complexity and no user interaction required beyond an initial foothold. No public exploit code and no CISA KEV confirmation have been identified at time of analysis, though ZDI's coordinated disclosure (ZDI-26-556) may accelerate POC development.
Local privilege escalation in Parallels RAS Client 21.0.26296 allows low-privileged local attackers to gain SYSTEM-level code execution by invoking an exposed dangerous function within the RAS RDP Backend Service. The root cause is CWE-749, where a privileged service function is accessible without proper access control to lower-privileged callers. Discovered and reported by Zero Day Initiative (ZDI-26-555 / ZDI-CAN-28885), no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Parallels RAS Client 21.0.26296 allows a low-privileged local attacker to escalate to SYSTEM-level execution by invoking an exposed dangerous function within the RAS RDP Backend Service. The flaw (CWE-749) stems from the service exposing an unsafe method that can be abused without administrative rights, enabling full system compromise. No public exploit or CISA KEV listing has been identified at time of analysis, though the vulnerability was coordinated through Zero Day Initiative (ZDI-CAN-29220).
Remote code execution in Azure Confidential Ledger allows an authorized attacker with elevated privileges to invoke an exposed dangerous method over the network and run arbitrary code, with a scope change (S:C) that lets the impact reach beyond the initially compromised component. Microsoft rates it CVSS 9.1 (Critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because Azure Confidential Ledger is a managed cloud service, remediation is delivered server-side by Microsoft rather than by customer patching.
Remote code execution as root is achievable against H3C NX15 firmware V100R017 via the `/api/esps` Web API endpoint, which exposes the `service.add` function without adequate access controls (CWE-749). Exploitation requires high-privilege authentication, but a post-authentication proof-of-concept script (`postauth_service_add_rce.py`) is publicly available on GitHub, demonstrating a complete root RCE chain. No vendor patch has been identified at time of analysis; no active exploitation is confirmed in CISA KEV.
Privilege escalation in MediaTek's AI Processing Unit Subsystem (apusys) driver allows a local attacker already holding System-level privileges on devices equipped with MT8366, MT8196, or MT8195 chipsets to escalate further, achieving high-impact access to confidential data and system integrity. The root cause is a missing bounds check (CWE-749) in an exposed driver function, patched under MediaTek ID AUTO00837766 in the August 2026 security bulletin. No public exploit code has been identified, and the EPSS score of 0.14% (4th percentile) confirms very low current exploitation probability.
Denial-of-service in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000/3050/3100/3150, firmware 1.0.0 up to but not including 1.9.1) allows an unauthenticated network attacker to reboot the charging controller by sending a crafted Modbus TCP command to the CharxModbusServer. The attack requires no credentials or user interaction and, per the CVSS 4.0 vector, produces high availability impact with no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity makes reliable disruption of charging service straightforward once the Modbus port is reachable.
Arbitrary code execution in ownCloud Core (ownCloud 10 Classic server, all versions before 10.15.3) allows an administrator to abuse an exposed dangerous method in the Updater component to run code on the server host. Any actor holding administrative credentials - legitimately, or via session hijack/credential theft/CSRF against an admin - can convert web-app admin rights into full server compromise. No public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor-issued GHSA-hvcx-ph66-mmvw advisory and the fix in 10.15.3 are the primary confirmation.
Cross-origin information disclosure in the Nx monorepo graph server (versions 17.0.4 through 22.7.1) exposes the full project dependency graph and workspace metadata to any website a developer visits while `nx graph` is running locally. The server unconditionally broadcasts `Access-Control-Allow-Origin: *`, bypassing the browser Same-Origin Policy and allowing attacker-controlled JavaScript to silently read internal project structure. In rare cases, the `/help` endpoint - which executes a workspace-configured target command - creates a path to arbitrary command injection on the developer's machine. No public exploit or CISA KEV listing identified at time of analysis.
Reverse-proxy takeover in Appsmith versions prior to 2.1 lets an authenticated low-privileged user abuse server-side request forgery to reach the bundled Caddy admin API, which ships with no authentication and listens on 0.0.0.0:2019 inside the container. By forcing the Appsmith server to issue a POST /load to that internal endpoint, the attacker rewrites the live Caddy configuration and seizes control of the reverse proxy that fronts the application. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the vendor-confirmed CWE-749 exposure carries a 9.9 CVSS rating.