Monthly
Improper validation of the JWT seeding token used by Akamai's Guardicore Platform Agent (GPA) client before version 7.4 allows an attacker who persuades a user to interact with a crafted link to slip a spoofed token into the enrollment flow and inject arbitrary configuration parameters, reconfiguring the agent and compromising its functionality end to end. The same spoofed-token technique can be aimed at an already-seeded client, but only when the attacker also knows the specific identity-provider (IDP) URL that client used for enrollment, a concrete prerequisite that constrains opportunistic targeting. There is no public exploit code identified at time of analysis and the issue is not in CISA's KEV catalog; Akamai has released 7.4 as the corrected version, and the independent assessment rates the flaw CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - serious, but not an immediate drop-everything emergency on current signals.
Command injection in the OpenSSH ssh client before version 10.6 occurs when a username supplied on the command line contains a '$' or '\' character, which is not correctly escaped or quoted and can be interpreted as shell syntax. The flaw is assessed as CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and requires the victim to invoke ssh with an attacker-controlled username - for example from a crafted ssh:// URI, a shared connection string, or a script or alias - so it is not remotely triggerable against a default server. No public exploit was identified at time of analysis, EPSS is 0.13% (2nd percentile), and the issue does not appear on CISA KEV; this is a genuine but not emergency-grade issue, and patched clients (10.6 and later) are unaffected.
Durable MQTT sessions in Moquette 0.18.0 and earlier can corrupt each other's persisted queues when a client connects with an identifier ending in '_meta', allowing cross-session message loss, misdelivery, or exposure of queued content. The flaw only exists when the broker is configured with H2 MVStore-backed durable/persistent sessions, and the attacker must use a client ID shaped like '<victim_client_id>_meta', so some knowledge or predictability of a target client ID is required; Moquette accepts anonymous clients by default, so authentication is not necessarily a barrier (assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:L/I:H/A:L). The impact is integrity-dominant with limited confidentiality loss - this is a JVM memory-safe broker and no RCE is involved; the upstream advisory that covers this bug also ships source-only PoC code for a companion pattern-ACL bypass, but no public exploit identified at time of analysis and no CISA KEV listing. The issue is fixed in Moquette 0.18.1.
Namespace injection in MongoDB Go Driver's Client.BulkWrite API allows an attacker who controls the database name argument to redirect bulk write operations to an unintended database and collection. When an application passes untrusted, user-supplied input directly as a database name, the driver fails to escape reserved MongoDB namespace separator characters before constructing the target namespace string. The impact is a high-integrity write misdirection - data is silently written to attacker-influenced storage targets. No public exploit and no CISA KEV listing exist at time of analysis.
Privilege escalation in Microsoft Exchange Server 2016, 2019, and Subscription Edition allows authenticated network attackers to gain elevated privileges through resource injection (CWE-99), earning a CVSS 8.8 High rating with total technical impact across confidentiality, integrity, and availability. Affected deployment tracks span Exchange 2016 CU23 (below 15.01.2507.072), Exchange 2019 CU14 and CU15, and Exchange SE RTM, with vendor patches confirmed available for all tracks. No public exploit code has been identified at time of analysis, and SSVC assessment reports no observed exploitation, though the authenticated-only barrier is easily bypassed via credential theft and the total SSVC technical impact classification warrants prompt action.
The Magic: The Gathering Arena Windows/Steam client (builds 2026.59.30.12801.127931.6 and certain later 2026.60.x builds) hands a server-supplied home-screen carousel GoToExternalUrl value straight to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or domain, so any URI-scheme handler registered on the host - including ones a client would never expect, such as ms-calculator: - can be invoked with no user interaction. Exploitation requires the attacker to already control the carousel content delivered to clients, either by compromising the game's content backend or by intercepting the content channel on an adjacent network; that precondition is the primary limiter and is why this is assessed as a low-priority issue despite the unusual primitive (CVSS 3.1 base 3.4; NVD AV:A versus an assessed AV:N with AC:H, PR:N, UI:N, S:C, and only low integrity impact). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though a public technical writeup of the flaw exists; the practical impact is further bounded by which dangerous scheme handlers happen to be registered on a victim machine and whether one of them can be chained into a separately exploitable action.
An authenticated low-privilege user of a dotnet eShop (.NET 8) deployment can read order records belonging to other customers by manipulating the OrderNumber argument accepted by the GetOrderAsync function in the Ordering API (src/Ordering.API/Apis/OrdersApi.cs). The flaw is an improper control of resource identifiers issue (CWE-99) tagged as Information Disclosure and scored only 2.1 by the CNA (CVSS 4.0 vector), with our independent assessment at CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - confidentiality-only impact with no code execution or data modification. Exploitation requires a valid account (PR:L), no CISA KEV evidence of active exploitation is present, and no vendor-released patch has been identified because the maintainers have not yet responded to the report (GitHub issue #996); note that the CNA's CVSS 4.0 vector marks exploit maturity as E:P, indicating publicly available exploit code exists, but that eShop is a Microsoft reference sample application rarely run in production, which keeps realistic risk low.
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to download email attachments belonging to other mailboxes simply by supplying a different attachment ID to the admin attachment-download endpoint. Exploitation requires only a valid low-privileged account on the admin panel, causes confidentiality loss only (no modification or denial of service), and publicly available exploit code exists, which the CVSS 4.0 vector reflects via its E:P (proof-of-concept) exploit maturity rating. Vendor-released patch: 2.2.6, which enforces the mail.view permission on the download action.
Improper control of resource identifiers in Omega Solution HRM OS (versions up to 20260717) allows an authenticated low-privilege user to enumerate the permission mappings of arbitrary roles by manipulating the roleId parameter of the /role-permission/permission endpoint. The outcome is confidentiality-only: role and permission metadata can be read, but no data can be modified and no code can be executed, and the CVSS v4.0 base is only 2.1 (assessed CVSS v3.1 4.3, AV:N/AC:L/PR:L/UI:N/C:L/I:N/A:N). Publicly available exploit code exists (PoC referenced via VulDB and the linked GitHub issue), but there is no confirmed active exploitation (not in CISA KEV); the vendor was contacted early and did not respond, and no vendor-released patch has been identified at time of analysis.
Improper validation of parameters in GitLab CE/EE's Terraform state upload functionality allows an authenticated user holding project-level permissions to read restricted file contents on the server or cause denial of service. Affected releases are all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, with fixes published in the 19.3.2 patch release. Public exploit details exist via a HackerOne report, but the CVSS base score is only 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N); there is no CISA KEV listing and no EPSS data was provided.
Improper validation of the JWT seeding token used by Akamai's Guardicore Platform Agent (GPA) client before version 7.4 allows an attacker who persuades a user to interact with a crafted link to slip a spoofed token into the enrollment flow and inject arbitrary configuration parameters, reconfiguring the agent and compromising its functionality end to end. The same spoofed-token technique can be aimed at an already-seeded client, but only when the attacker also knows the specific identity-provider (IDP) URL that client used for enrollment, a concrete prerequisite that constrains opportunistic targeting. There is no public exploit code identified at time of analysis and the issue is not in CISA's KEV catalog; Akamai has released 7.4 as the corrected version, and the independent assessment rates the flaw CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - serious, but not an immediate drop-everything emergency on current signals.
Command injection in the OpenSSH ssh client before version 10.6 occurs when a username supplied on the command line contains a '$' or '\' character, which is not correctly escaped or quoted and can be interpreted as shell syntax. The flaw is assessed as CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and requires the victim to invoke ssh with an attacker-controlled username - for example from a crafted ssh:// URI, a shared connection string, or a script or alias - so it is not remotely triggerable against a default server. No public exploit was identified at time of analysis, EPSS is 0.13% (2nd percentile), and the issue does not appear on CISA KEV; this is a genuine but not emergency-grade issue, and patched clients (10.6 and later) are unaffected.
Durable MQTT sessions in Moquette 0.18.0 and earlier can corrupt each other's persisted queues when a client connects with an identifier ending in '_meta', allowing cross-session message loss, misdelivery, or exposure of queued content. The flaw only exists when the broker is configured with H2 MVStore-backed durable/persistent sessions, and the attacker must use a client ID shaped like '<victim_client_id>_meta', so some knowledge or predictability of a target client ID is required; Moquette accepts anonymous clients by default, so authentication is not necessarily a barrier (assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:L/I:H/A:L). The impact is integrity-dominant with limited confidentiality loss - this is a JVM memory-safe broker and no RCE is involved; the upstream advisory that covers this bug also ships source-only PoC code for a companion pattern-ACL bypass, but no public exploit identified at time of analysis and no CISA KEV listing. The issue is fixed in Moquette 0.18.1.
Namespace injection in MongoDB Go Driver's Client.BulkWrite API allows an attacker who controls the database name argument to redirect bulk write operations to an unintended database and collection. When an application passes untrusted, user-supplied input directly as a database name, the driver fails to escape reserved MongoDB namespace separator characters before constructing the target namespace string. The impact is a high-integrity write misdirection - data is silently written to attacker-influenced storage targets. No public exploit and no CISA KEV listing exist at time of analysis.
Privilege escalation in Microsoft Exchange Server 2016, 2019, and Subscription Edition allows authenticated network attackers to gain elevated privileges through resource injection (CWE-99), earning a CVSS 8.8 High rating with total technical impact across confidentiality, integrity, and availability. Affected deployment tracks span Exchange 2016 CU23 (below 15.01.2507.072), Exchange 2019 CU14 and CU15, and Exchange SE RTM, with vendor patches confirmed available for all tracks. No public exploit code has been identified at time of analysis, and SSVC assessment reports no observed exploitation, though the authenticated-only barrier is easily bypassed via credential theft and the total SSVC technical impact classification warrants prompt action.
The Magic: The Gathering Arena Windows/Steam client (builds 2026.59.30.12801.127931.6 and certain later 2026.60.x builds) hands a server-supplied home-screen carousel GoToExternalUrl value straight to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or domain, so any URI-scheme handler registered on the host - including ones a client would never expect, such as ms-calculator: - can be invoked with no user interaction. Exploitation requires the attacker to already control the carousel content delivered to clients, either by compromising the game's content backend or by intercepting the content channel on an adjacent network; that precondition is the primary limiter and is why this is assessed as a low-priority issue despite the unusual primitive (CVSS 3.1 base 3.4; NVD AV:A versus an assessed AV:N with AC:H, PR:N, UI:N, S:C, and only low integrity impact). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though a public technical writeup of the flaw exists; the practical impact is further bounded by which dangerous scheme handlers happen to be registered on a victim machine and whether one of them can be chained into a separately exploitable action.
An authenticated low-privilege user of a dotnet eShop (.NET 8) deployment can read order records belonging to other customers by manipulating the OrderNumber argument accepted by the GetOrderAsync function in the Ordering API (src/Ordering.API/Apis/OrdersApi.cs). The flaw is an improper control of resource identifiers issue (CWE-99) tagged as Information Disclosure and scored only 2.1 by the CNA (CVSS 4.0 vector), with our independent assessment at CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - confidentiality-only impact with no code execution or data modification. Exploitation requires a valid account (PR:L), no CISA KEV evidence of active exploitation is present, and no vendor-released patch has been identified because the maintainers have not yet responded to the report (GitHub issue #996); note that the CNA's CVSS 4.0 vector marks exploit maturity as E:P, indicating publicly available exploit code exists, but that eShop is a Microsoft reference sample application rarely run in production, which keeps realistic risk low.
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to download email attachments belonging to other mailboxes simply by supplying a different attachment ID to the admin attachment-download endpoint. Exploitation requires only a valid low-privileged account on the admin panel, causes confidentiality loss only (no modification or denial of service), and publicly available exploit code exists, which the CVSS 4.0 vector reflects via its E:P (proof-of-concept) exploit maturity rating. Vendor-released patch: 2.2.6, which enforces the mail.view permission on the download action.
Improper control of resource identifiers in Omega Solution HRM OS (versions up to 20260717) allows an authenticated low-privilege user to enumerate the permission mappings of arbitrary roles by manipulating the roleId parameter of the /role-permission/permission endpoint. The outcome is confidentiality-only: role and permission metadata can be read, but no data can be modified and no code can be executed, and the CVSS v4.0 base is only 2.1 (assessed CVSS v3.1 4.3, AV:N/AC:L/PR:L/UI:N/C:L/I:N/A:N). Publicly available exploit code exists (PoC referenced via VulDB and the linked GitHub issue), but there is no confirmed active exploitation (not in CISA KEV); the vendor was contacted early and did not respond, and no vendor-released patch has been identified at time of analysis.
Improper validation of parameters in GitLab CE/EE's Terraform state upload functionality allows an authenticated user holding project-level permissions to read restricted file contents on the server or cause denial of service. Affected releases are all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, with fixes published in the 19.3.2 patch release. Public exploit details exist via a HackerOne report, but the CVSS base score is only 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N); there is no CISA KEV listing and no EPSS data was provided.