Java
Monthly
Unauthenticated remote code execution in Apache Roller 6.1.5, where the XML-RPC endpoint deserializes attacker-controlled bytes during request parsing before any authentication check occurs. The servlet is mapped unconditionally, so the vulnerable parsing path is still reachable even when the global XML-RPC feature is turned off, and no non-default configuration is required. This rates CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis; practical RCE reliability depends on a usable deserialization gadget chain being present on the application classpath, which the advisory does not enumerate. Vendor-released patch: Apache Roller 6.1.6.
Unauthenticated configuration tampering in Apache Roller 6.1.5 lets any remote attacker persistently rewrite the site-global frontpage weblog selection on a default installation, because the installation-time setup action remains anonymously reachable after setup completes and persists the value without any authorization check. Impact is bounded rather than severe: only one site-global setting is altered, no data is disclosed (C:N), and a global administrator can restore the setting afterward, which is why our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L rather than the submitted 8.2 high with I:H/A:L. The attack is a single unauthenticated HTTP request with no user interaction, so exposure is broad wherever 6.1.5 is internet-facing; exploitation status is no public exploit identified at time of analysis, and the issue is not tied to any optional feature or non-default configuration.
Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows unauthenticated remote attackers to cause a logged-in author or administrator to perform state-changing actions under the victim's authority, because the CSRF validation filter accepts requests that omit the required salt token and instead validates against a value the server itself generated for the request. Exploitation requires social engineering the privileged user into visiting a crafted page while their session is active (UI:R); no optional feature or non-default configuration is needed, and both standard and multipart forms are affected. A vendor patch is available in Apache Roller 6.1.6 or later; no public exploit code or active exploitation has been identified at time of analysis. The impact is bounded by the victim's own permission level (owner, editor, drafter, or administrator).
Replay of a captured WSSE digest authentication header against Apache Roller 6.1.5 allows an attacker to assume the victim's AtomPub authority - publishing, editing, and deleting blog content under that identity - without ever knowing the underlying password. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L, 7.7) rates it as remotely reachable without valid credentials, but real-world exposure is tightly gated: the AtomPub API must be explicitly enabled (it ships off by default), WSSE must be the configured AtomPub authentication method, the install must use plaintext-compatible password storage, and the attacker must first be able to observe a legitimate user's header in transit, which is what drives the High attack complexity. Only version 6.1.5 is affected; 6.1.6 removes WSSE as an AtomPub authentication option, and no public exploit code has been identified at time of analysis (the issue is not in CISA KEV, so there is no confirmation of active exploitation).
Incorrect authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker to bind an outstanding request token to an arbitrary user account - including an administrator - by submitting an unsigned authorization request that supplies the target identity directly instead of relying on the logged-in session. Exploitation is constrained: it requires an installation that has configured a non-default OAuth 1.0a site-wide consumer, plus knowledge of one of that consumer's outstanding (issued but unconsumed) request tokens, which is the basis for the high attack-complexity rating despite the critical 9.0 CVSS 3.1 score. Successful abuse yields administrator-level API access to the blog server, so confidentiality and integrity impact are high (the independent assessment scores availability impact as none); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released a fix in Apache Roller 6.1.6.
Missing per-weblog authorization in Apache Roller 6.1.5 allows any authenticated user to read, modify, or delete weblog content owned by other weblogs via the legacy XML-RPC Blogger and MetaWeblog APIs, which authenticate the caller but do not check the caller's permission on the affected weblog or entry. Exploitation requires an authenticated account and the non-default global XML-RPC feature to be enabled, although the per-weblog API flag defaults to on for UI-created weblogs, and impact is confined to weblog content rather than the host. No public exploit identified at time of analysis, and while the NVD-style CVSS 3.1 score is 9.9 (critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, that figure conflicts with the vendor's Moderate rating and the stated constraints.
Unauthenticated account takeover in X-SpringBoot through 6.0 allows remote attackers to authenticate as any user by submitting the hardcoded default master login verification code 172839, shipped in the database seed, to the emailOrMobileLogin endpoint together with a known email address or mobile number. Exploitation requires the deployment to retain the default seed and the attacker to know a valid account identifier, but no credentials, OTP, or user interaction are needed; publicly available exploit code exists. The vulnerability has a CVSS 4.0 base score of 9.3, and the assessed CVSS 3.1 vector is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
X-SpringBoot through 6.0 allows remote unauthenticated attackers to hijack user accounts by abusing unauthenticated endpoints that return login verification codes in HTTP responses, enabling authentication as any victim whose mobile number or email is known. Publicly available exploit code exists, and the vulnerability is not confirmed actively exploited (not in CISA KEV). Affected users are those running X-SpringBoot versions 0 through 6.0 with network-exposed login endpoints.
Authenticated privilege escalation in X-SpringBoot through 6.0 lets any account with delegated user-management permissions reset passwords, rebind roles, or delete users - including the super administrator - through POST /sys/user/update and POST /sys/user/delete because those endpoints perform no object-level ownership verification. Publicly available exploit code exists, in the form of the referenced Python BOLA proof-of-concept, but no CISA KEV status is provided and the risk is tempered by the PR:H requirement that the attacker already be a sub-administrator rather than an unauthenticated remote user. The impact is full compromise of user accounts on affected instances that delegate user-management privileges.
Session fixation in the HTTP management interface of Apache Qpid Broker-J through 10.1.0 lets remote, unauthenticated attackers hijack an administrator's authenticated management session by reusing a session identifier that is retained across successful authentication, yielding full confidentiality, integrity, and availability impact (C:H/I:H/A:H) over the broker's management functions. Exploitation requires the HTTP management interface to be reachable by the attacker and, critically, requires a legitimate management user - typically an administrator - to authenticate using a session identifier the attacker has planted, fixed, or otherwise obtained before login, so the assessed vector is AV:N/AC:H/PR:N/UI:R rather than the NVD-published 9.8 CRITICAL (AC:L/UI:N), which is inconsistent with the session-fixation class. There is no public exploit identified at time of analysis, and brokers are only exposed where management access is not otherwise restricted; upgrading to 10.1.1 addresses the flaw.
CPU starvation and JVM heap exhaustion in Gerrit Code Review (versions 2.1.6 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2) let remote attackers stall or crash the server by submitting crafted regular expressions through search queries (RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate and sibling predicates) or through the REST regex filter endpoints /projects/?r= (RegexListSearcher) and /projects/{project}/branches/?r= (RefFilter). Patterns built from large counted repetitions or exponential DFA-determinization shapes are compiled into an unbounded dk.brics.automaton instance on the request thread before index evaluation and before access-control visibility filtering, so trivial requests can pin request threads or trigger OutOfMemoryError regardless of configured heap size. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (availability-only, high impact), and exploitation is fully unauthenticated only where anonymous read access is enabled - if anonymous read is disabled an authenticated account is required. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in 3.12.10, 3.13.9, and 3.14.3.
Uncontrolled resource consumption in Gerrit Code Review (versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2) allows unauthenticated remote attackers to cause a persistent denial of service by sending search queries containing deeply nested parentheses to query evaluation endpoints such as /changes/?q=, /accounts/?q=, or the SSH 'gerrit query' command. A small number of requests - roughly 25 to match the default httpd.maxThreads - can permanently pin all HTTP worker threads because the ANTLR 3 query parser recurses without memoization before capability or visibility checks and worker threads do not abort when clients disconnect, requiring a server restart. This is assessed as a genuine operational priority for Gerrit operators; no public exploit code or active exploitation has been identified at time of analysis.
Gerrit Code Review 2.16.0-3.12.9, 3.13.0-3.13.8, and 3.14.0-3.14.2 mishandle project-name normalization, allowing an authenticated user (or an unauthenticated user when the repository was previously public) to keep reading private repository content and to durably restore revoked project-owner administrative privileges. Requests that reference a project with repeated terminal .git suffixes (for example project.git.git) are cached under a different key than the canonical project, so revoking read access or removing owner rules on the canonical name never evicts the stale alias ProjectState during the ProjectCache validity window, permitting reads of newly created private commits and writes to refs/meta/config. No public exploit code has been identified at time of analysis; exploitation requires the attacker to have previously held access to the project and to act before the stale cache entry would naturally expire.
SQL injection in IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 allows remote unauthenticated attackers to view, add, modify, or delete back-end database information. The flaw (CWE-89) carries a CVSS 3.1 base score of 8.6, with an independent assessment vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, indicating high confidentiality and integrity impact and low availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a vendor patch is available via IBM support.
Denial of service in JLine's built-in less viewer affects all 3.x releases from 3.0.0 before 3.30.15 and 4.x releases before 4.3.1: a user-supplied search or display-filter pattern containing nested quantifiers is handed straight to Java's backtracking regex engine and applied repeatedly across file content, so a pattern run against non-matching lines can consume excessive CPU and block the session thread indefinitely. The practical risk profile is multi-user Telnet or SSH deployments that embed the less viewer, where repeated sessions can exhaust a bounded worker pool and deny service to other users; the independent assessment scores this as availability-only (CVSS 3.1 A:H, no confidentiality or integrity impact) and notes that an interactive session foothold and viewable file content are prerequisites, which the published vector's PR:N rating does not reflect. No public exploit code and no confirmed active exploitation were identified at time of analysis, so exploitation is opportunistic rather than observed. The fix is the SafeRegex wrapper plus regex timeouts shipped in 3.30.15 and 4.3.1.
Denial of service in JLine3's built-in grep command (org.jline:jline-builtins) lets anyone who can supply a search pattern hang a worker thread indefinitely via catastrophic regular-expression backtracking. The builtin - reachable in applications that embed JLine3 and expose the shell to remote or interactive users - rewrites non-line-regexp patterns as .*pattern.* before compiling them with Java's backtracking regex engine, so a short input such as (a+)+b tested against non-matching text causes exponential CPU consumption (CWE-1333; CVSS 3.1 base 7.5 upstream, while the assessed vector requires low privileges, PR:L). Impact is availability-only (C:N/I:N/A:H) with no confidentiality or integrity loss; publicly available exploit code exists in the form of the advisory's two-line PoC, but the issue is not listed in CISA KEV and no confirmed active exploitation has been reported. Vendor-fixed releases are available: 3.30.15 on the 3.x line and 4.3.1 on the 4.x line.
Moquette MQTT brokers prior to 0.18.1 can start up with authentication and authorization silently disabled whenever a configured authenticator_class or authorizator_class fails to load, so any remote client - including anonymous MQTT clients, since the broker is anonymous by default - can read and write every topic the broker handles while the operator believes access controls are active. The flaw is not directly attacker-triggered: it requires a deployment that both intends to enforce auth and has a broken class-load (misspelled class name, missing dependency, constructor failure, or classpath problem), which is why the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N even though the end-state is a full confidentiality and integrity break; the vendor's CVSS 4.0 vector is 9.3. No public exploit for this fail-open condition was identified at time of analysis, and no CISA KEV entry is present; version 0.18.1 fixes the issue by aborting startup instead of falling back to permissive defaults.
Durable MQTT sessions in Moquette 0.18.0 and earlier can corrupt each other's persisted queues when a client connects with an identifier ending in '_meta', allowing cross-session message loss, misdelivery, or exposure of queued content. The flaw only exists when the broker is configured with H2 MVStore-backed durable/persistent sessions, and the attacker must use a client ID shaped like '<victim_client_id>_meta', so some knowledge or predictability of a target client ID is required; Moquette accepts anonymous clients by default, so authentication is not necessarily a barrier (assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:L/I:H/A:L). The impact is integrity-dominant with limited confidentiality loss - this is a JVM memory-safe broker and no RCE is involved; the upstream advisory that covers this bug also ships source-only PoC code for a companion pattern-ACL bypass, but no public exploit identified at time of analysis and no CISA KEV listing. The issue is fixed in Moquette 0.18.1.
Unauthorized message injection in the Moquette lightweight Java MQTT broker affects all releases prior to 0.18.1: PostOffice.publishWill publishes a client's Last-Will Testament without running the canWrite authorization and reserved-topic checks that gate a normal PUBLISH, so remote unauthenticated attackers (CVSS vector PR:N) can register a Will on a topic they are not allowed to write and have the broker deliver that message to subscribers when the connection is abruptly dropped. This is an integrity-only flaw (C:N/I:H/A:N) whose real-world severity depends on how sensitive the restricted topic is - for example device command-and-control channels - and exploitation requires that an ACL or IAuthorizatorPolicy actually restricts writes to the targeted topic; vendors score it 8.7 (CVSS 4.0). Publicly available exploit code exists (the upstream advisory ships source-level PoCs, including a wildcard-ACL injection proof), but there is no indication in the supplied data of confirmed active exploitation (CISA KEV), and no patch is available other than upgrading to vendor-released version 0.18.1.
Unbounded per-session message queuing in Moquette MQTT Broker before 0.18.1 permits remote unauthenticated clients to exhaust broker memory or persistent storage by sustaining a fast publisher against a slow subscriber, causing denial of service. The CVSS 4.0 base score is 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N), consistent with a high-availability-only impact under CWE-770; the independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms no confidentiality or integrity impact. Default Moquette configurations permit anonymous clients, broadening exposure, and no public exploit identified at time of analysis; no CISA KEV entry, EPSS score, or public exploit specific to this queue-exhaustion issue is provided in the input.
Remote unauthenticated clients can crash a Moquette MQTT broker running 0.18.0 or earlier by publishing or subscribing with a topic name or filter that is nested to an extreme depth, triggering uncontrolled recursion in the broker's CTrie subscription structure and an uncaught StackOverflowError. Because Moquette accepts anonymous MQTT clients by default, network reachability is the only precondition, and the resulting crash lands on a SessionEventLoop that catches only InterruptedException and is never restarted, so the failure wedges every session co-located on that loop rather than just the attacker's connection - a broker-wide denial of service with high availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor-published CVSS 4.0 base 8.7). The issue is not in CISA KEV and no public exploit identified at time of analysis; it is fixed in Moquette 0.18.1, which introduces a MAX_TOPIC_DEPTH of 1024 enforced on both PUBLISH and SUBSCRIBE paths.
Remote, pre-authentication denial of service in the Moquette MQTT broker (moquette-io moquette-broker) through 0.18.0 allows any client able to reach the MQTT listener to wedge the broker's session event loop by sending a malformed shared-subscription filter such as '$share/grp' that omits the '/{topicFilter}' portion. Because the exception is thrown while building the subscription and the SessionEventLoop only catches InterruptedException and is never restarted, command handling on that loop stops and every other client session assigned to the same loop is denied service; the network vector is unauthenticated (CVSS 4.0 AV:N/AC:L/PR:N/UI:N with VA:H, score 8.7; vendor-assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Moquette accepts anonymous MQTT clients by default and the target does not need shared subscriptions pre-configured for the crash to occur, so exploitation requires only network reachability; publicly available exploit code exists in the form of source-level proof-of-concept tests published with the advisory, but there is no indication of active exploitation (not in CISA KEV).
Denial of service in the Moquette lightweight Java MQTT broker prior to 0.18.1: a single remote, unauthenticated MQTT client can terminate a shared SessionEventLoop with a command that raises an uncaught exception, and because SessionEventLoopGroup never restarts a dead loop, every other client session pinned to that loop stops processing PUBLISH, SUBSCRIBE, PUBACK and related commands. Because Moquette accepts anonymous MQTT clients by default and the CVSS vector (PR:N) confirms no authentication is required, an attacker who chooses client IDs that distribute across the broker's available loops can progressively disable session processing broker-wide; impact is availability-only (C:N/I:N/A:H, no code execution or data exposure), and the upstream advisory documents concrete trigger inputs such as a malformed $share/grp SUBSCRIBE, a deeply nested topic, and an ACL NPE. No public exploit tooling was identified at time of analysis, and the issue is fixed in 0.18.1.
Cross-tenant authorization bypass combined with pre-authentication denial of service in Moquette Broker 0.18.0 and earlier lets unauthenticated remote MQTT clients read and write other tenants' topics and repeatedly wedge or exhaust the broker. The critical flaw is wildcard injection through pattern-based ACLs that substitute %c/%u with an unvalidated clientId, so a client connecting with clientId '+' turns a rule such as sensor/%c/# into the filter sensor/+/#; from the same unauthenticated position an attacker can also trigger a $share/grp SUBSCRIBE StringIndexOutOfBoundsException, a StackOverflowError on deeply nested topics, an ACL NPE, unauthorized Will-message publishes, and unbounded subscription/retained/interceptor state that causes memory or disk exhaustion. Publicly available exploit code exists in the form of source-only PoCs (JDK 17) for the pattern-ACL bypass, the shared-subscription crash, and the H2 metadata collision; the vendor-released fix is 0.18.1, and no CISA KEV entry or confirmed in-the-wild exploitation was provided. Score of 9.6 reflects scope change with high confidentiality and integrity impact, gated on a multi-tenant pattern-ACL configuration for the worst outcome.
Unauthenticated remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker positioned on an adjacent network segment to send a crafted Java-serialized payload to the PayDir Business Rules Manager RMI SSL endpoint and execute arbitrary code on the target host. Because the vulnerable service is exposed with no authentication and no user interaction required (CVSS 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), successful exploitation exposes all PayDir credentials and enables manipulation of payment business rules, producing high confidentiality and integrity impact. The adjacency requirement is the primary limiting factor, and no public exploit identified at time of analysis; a vendor patch is available per the IBM advisory.
Privilege escalation in ZohoCorp ManageEngine Applications Manager 182000 and earlier allows a holder of an authenticated low-privileged account to read an administrator's API key and then replay that key to carry out administrator-level actions over the network. Exploitation requires a valid low-privilege login (CVSS vector PR:L) on a vulnerable instance, but needs no user interaction and no special configuration, and successful abuse grants full high-integrity, high-confidentiality control of the application. No public exploit code or confirmed active exploitation was identified at time of analysis; the primary limiting factor is the mandatory pre-existing low-privilege account, which is why this rates as a genuine high-priority flaw rather than a benign high-CVSS artifact.
SQL injection in ManageEngine Applications Manager (builds 182000 and below) allows an authenticated low-privileged user to run arbitrary SQL commands against the application's database, enabling escalation to administrator privileges and, from there, remote code execution on the underlying host. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is rated high priority because the only meaningful barrier is possession of any valid low-privileged account - no user interaction or special configuration is required, and once credentials exist the attack complexity is low. Exploitation status: no public exploit identified at time of analysis; the issue was reported by the vendor (Zohocorp), and no CISA KEV listing or public proof-of-concept code has been observed in the supplied intelligence.
Authenticated low-privileged users can delete service monitors outside their assigned scope in ZohoCorp ManageEngine Applications Manager versions 182000 and below due to improper permission validation (CWE-20). This network-reachable flaw (CVSS 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) requires valid credentials and no user interaction, causing high integrity impact and partial availability loss for monitoring coverage. No public exploit code or active exploitation has been identified at time of analysis.
Configuration tampering in ZohoCorp ManageEngine Applications Manager 182000 and below lets an authenticated low-privileged user modify the application's server-wide proxy settings, an operation that should be restricted to administrators. Because proxy settings govern outbound traffic from the monitoring server - including connections to monitored hosts and external services - a non-admin can redirect or intercept that traffic and expose sensitive configuration data; the independent assessment rates integrity impact lower (I:L) than the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1 HIGH) while agreeing on high confidentiality impact. Exploitation requires a valid low-privileged account and network reachability to the management interface; it is not pre-authentication. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Broken scope enforcement in ZohoCorp ManageEngine Applications Manager (versions 182200 and below) lets an authenticated, low-privileged user trigger administrator-configured MBean actions against monitors that lie outside that user's assigned scope, resulting in high integrity impact with limited confidentiality and availability effects (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, 7.6 HIGH). Exploitation requires a valid low-privileged Applications Manager account and the prior existence of administrator-configured MBean actions on the target instance; no user interaction is needed, and authentication requirements are confirmed as authenticated (PR:L) by the published vector. No public exploit code was identified and the flaw is not listed in CISA KEV, so there is no public exploit identified at time of analysis; the absence of a public exploit and the PR:L prerequisite are the main factors limiting immediate mass exploitation.
ManageEngine Applications Manager builds 182200 and below embed a static Google Cloud service-account private key inside the shipped installer, so anyone who downloads that installer artifact can extract the credential without authenticating to the product and then impersonate the service account directly against Google Cloud APIs. The vendor scores this CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) because the leaked key grants high confidentiality and integrity impact on associated cloud resources and the scope changes beyond the Applications Manager instance itself, with no authentication or user interaction required. Exploitation depends on the installer being obtainable and the referenced service account remaining active with meaningful IAM permissions; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the credential is static rather than runtime-dependent, which makes the exposure durable rather than conditional.
Authenticated OS command injection in Zoho ManageEngine OpManager MSP 12.8.709 and below allows an attacker holding any valid low-privilege console account to execute arbitrary operating system commands on the server through the Notification Profile module, with no user interaction required. Exploitation yields full compromise of confidentiality, integrity and availability of the OpManager host, which for an MSP deployment typically means access to monitored customer infrastructure. The vendor rates the issue 9.9 (scope-changed); our independent assessment places it at high severity with unchanged scope, and no public exploit code has been identified at time of analysis, so the practical risk is concentrated in environments where operator or tenant accounts are widely provisioned or reusable.
Authentication bypass in Zoho ManageEngine OpManager 12.8.710 and earlier allows an attacker reaching the web console to skip an authentication control when the optional Application Manager Plugin is enabled, with high impact to confidentiality, integrity, and availability (CVSS 8.8). Only instances with that specific non-default add-on are exposed; deployments without the plugin are not affected. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, but the CVSS vector (AV:N/AC:L/PR:L/UI:N) combined with the CWE-306 missing-authentication root cause means the precondition is worth treating as near-unauthenticated until the vendor advisory clarifies it.
Command injection in the Diagnose Settings feature of ZohoCorp ManageEngine OpManager and Firewall Analyzer 12.8.709 and earlier allows an authenticated low-privilege user to run arbitrary operating system commands on the host through the web management interface, resulting in complete loss of confidentiality, integrity, and availability (CVSS 8.8, PR:L, UI:N). Exploitation requires a valid low-privileged account and network reachability to the console, but no user interaction and no non-default configuration, so the management interface is the primary gating factor. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, meaning the practical risk is concentrated on internet- or partner-facing ManageEngine consoles where any account holder can reach the vulnerable feature.
An authenticated, low-privileged user of ManageEngine OpManager or ManageEngine Firewall Analyzer (versions 12.8.709 and below) can abuse the 'Rule Tracking Compare Policies' feature to inject crafted XML that is parsed server-side, disclosing data beyond that feature's authorization boundary. The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) reflects a network-reachable, low-complexity issue requiring only any valid console credential and no user interaction, with a scope change and high confidentiality impact but no integrity or availability impact, which confines the practical effect to information disclosure rather than code execution or service disruption. Because a session is required, the flaw is not pre-authentication exploitable; no public exploit code has been identified at time of analysis and no KEV listing was provided in the available intelligence, so exploitation appears to depend on an attacker first obtaining or holding a low-privilege console account with access to the affected feature.
Data exposure in ManageEngine Firewall Analyzer - and in the co-listed ManageEngine OpManager - version 12.8.709 and below allows an unauthenticated attacker positioned on the same network segment as the Firewall Analyzer syslog collector to read sensitive information, including data belonging to the monitored firewall and network devices, which is why the vendor score carries a scope change despite the confidentiality-only impact. No authentication or user interaction is required and complexity is low (CVSS 3.1 7.4, AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N); the adjacent-network requirement is the principal limiting factor, since the collector is not reachable directly from the internet unless its syslog service has been exposed beyond the local segment. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) in the supplied intelligence, which consists solely of a vendor advisory and CPE mappings, and no EPSS score was provided.
WebSocket message smuggling in Apache Tomcat allows a remote, unauthenticated attacker to inject or reorder messages within a compressed WebSocket stream, corrupting application-level message boundaries and undermining integrity of data exchanged over the connection. The flaw affects the 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121 release lines, plus the end-of-support 8.5.0-8.5.100 and 7.0.56-7.0.109 branches, but it only triggers when the per-message-deflate compression extension has been negotiated on the WebSocket connection; deployments that serve only standard HTTP or that run WebSocket endpoints without compression are not exposed. There is no confirmed active exploitation (CISA KEV does not list this issue), no public exploit code identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none', making this a genuine but conditionally-gated integrity flaw rather than a drop-everything emergency.
HTTP/2 request smuggling in Apache Tomcat can mix up request headers between concurrent streams, allowing unauthenticated remote attackers to potentially read or alter other users' request data when the connector has HTTP/2 explicitly enabled. The flaw is a regression from the fix for CVE-2026-41293 and affects only Tomcat 11.0.22 through 11.0.25, 10.1.55 through 10.1.59, and 9.0.118 through 9.0.121; exploitation is rated high complexity (AC:H) with limited confidentiality and integrity impact (C:L/I:L). No public exploit code has been identified at time of analysis, and the independent assessment rates this as a moderate-priority, genuine protocol-layer flaw rather than a critical emergency.
Authentication can succeed when it should have been rejected in Apache Tomcat deployments that use CLIENT_CERT (mutual-TLS) authentication with soft fail disabled, allowing network attackers to reach resources that the mutual-TLS configuration was meant to protect. The affected range is broad - 9.0.92 through 9.0.121, 10.1.22 through 10.1.59, and 11.0.0-M14 through 11.0.25 - but the flaw is gated on two non-default conditions (the CLIENT_CERT authenticator in use and soft fail turned off) and, per the vendor, only manifests in some scenarios, so it is not universally reproducible even on correctly configured vulnerable instances. No public exploit code has been identified at time of analysis, and no evidence of active exploitation is present; the attacker needs network reachability to the mTLS-protected listener.
Denial of service in Apache Tomcat's asynchronous WebSocket write path allows remote, unauthenticated attackers to exhaust server resources by triggering lost write timeouts, so non-blocking WebSocket sends are never released after their effective lifetime. All maintained branches are affected - 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121, plus the end-of-life 8.5.0-8.5.100 and 7.0.43-7.0.109 lines - although exposure is bounded to instances whose deployed applications actually perform asynchronous (non-blocking) WebSocket writes; servers with no WebSocket endpoints or only synchronous writes are not exposed. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only) and CISA's SSVC assessment records no observed exploitation, with no public exploit code identified at time of analysis; the primary risk is sustained resource pressure that degrades or halts the affected connector rather than data compromise.
Apache Tomcat 11.0.19 through 11.0.25, 10.1.53 through 10.1.59, and 9.0.116 through 9.0.121 can cause an unrelated user's request to fail when a malformed request triggers incomplete cleanup of request-processing state on a reachable HTTP connector. No authentication or user interaction is required, but the effect is fundamentally gated by a race window - the advisory itself states the failure occurs only 'depending on timing' - so it is non-deterministic and cannot be reliably triggered on demand, and the realistic worst case is intermittent failure of another user's individual request rather than sustained denial of service, data disclosure, or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis; the 7.3 base score reflects low impact across confidentiality, integrity, and availability, though our assessment rates attack complexity as High rather than Low.
Denial of service in Apache Tomcat allows an attacker to pin an AJP processing thread through a single AJP request, exhausting the connector's limited thread pool (CWE-770, allocation of resources without limits or throttling). The affected range is broad: 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, plus the end-of-life branches 8.5.0-8.5.100 and 7.0.0-7.0.109, which remain affected even though they are no longer supported. There is no public exploit identified at time of analysis, no KEV listing, and no EPSS score in the input; the independent assessment rates the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (availability-only impact), but exploitation requires the AJP connector to be enabled and network-reachable, which has not been the default configuration since Tomcat 9.0.31.
Uncontrolled resource consumption in Apache Tomcat's WebSocket close-message handling allows unauthenticated remote attackers to exhaust server resources and degrade availability on instances that expose WebSocket endpoints. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), the impact is limited to availability (Low) with no confidentiality or integrity effect, and no user interaction is required. Affected releases are 11.0.0-M5 through 11.0.25, 10.1.8 through 10.1.59, 9.0.74 through 9.0.121, plus the end-of-life 8.5.88 through 8.5.100 line; fixes are available in 11.0.26, 10.1.60, and 9.0.122. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, but the low attack complexity and unauthenticated network reachability make prompt patching advisable for any deployment using WebSockets.
Apache Tomcat's HTTP/2 connector harbors a race condition (CWE-362) that allows unauthenticated remote attackers to inject trailer fields into another user's concurrent HTTP/2 request, resulting in high confidentiality and integrity impact without affecting availability. Affected versions are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.39 through 9.0.121, and the end-of-life 8.5.59 through 8.5.100; exploitation is conditional on winning a concurrency race and only applies when the HTTP/2 upgrade protocol is enabled and actively serving traffic. No public exploit code or active exploitation has been identified at time of analysis, and the overall threat is considered credible but conditional.
Authentication bypass in Apache Tomcat allows unauthenticated remote attackers to reach WebSocket endpoints that are supposed to be protected by container-managed security constraints, simply by referencing the endpoint under an alternate name so the constraint is never matched. Exploitation requires only that the application expose one or more WebSocket endpoints and rely on container-level (web.xml security-constraint) authentication or authorization rules to guard them; no credentials, no user interaction, and no non-default configuration beyond that are needed, and per the CVSS vector (PR:N) the attack is unauthenticated and network-reachable. Affected lines are Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, plus end-of-support 8.5.0-8.5.100 and 7.0.43-7.0.109; no public exploit code has been identified at time of analysis and Apache has released fixed versions 11.0.26, 10.1.60 and 9.0.122.
Cross-application authentication realm leakage in Apache Tomcat's Jakarta Authentication integration causes requests to be validated against the realm established by whichever co-hosted web application authenticated first, breaking per-application authentication boundaries. The flaw (CWE-287, improper authentication) affects Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M4 through 9.0.121, plus end-of-life 8.5.0 through 8.5.100. Exploitation is gated by a non-default deployment - SimpleAuthConfigProvider as the default Jakarta Authentication provider with two or more applications sharing it - and the independent assessment rates the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (unauthenticated, high attack complexity, low impact); no public exploit identified at time of analysis, the issue is not in CISA KEV, and the vulnerable configuration is not Tomcat's default.
Origin-validation bypass in the Apache Sling Security Bundle before 1.3.2 allows a remote attacker to defeat the ReferrerFilter when that filter is relied upon as the cross-site request protection control, so cross-site requests that should have been blocked are accepted, yielding low-level confidentiality, integrity, and availability impact. Exploitation requires the victim to be lured into a crafted request carrying an authenticated session (CSRF-style user interaction), and only deployments that depend on ReferrerFilter for origin validation are exposed. Apache rates this 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), while our independent assessment adjusts the vector to UI:R given the required session-riding interaction; EPSS is only 0.13% (3rd percentile) and there is no public exploit identified at time of analysis.
Unauthenticated remote attackers can reach internal Apache Doris Frontend (FE) metadata service endpoints in affected 2.0.x through 4.1.x releases and read sensitive cluster information, because those endpoints authenticate callers using client-supplied node information rather than verifying the requesting party (CWE-287, header trust). Exploitation is gated by deployment: it only succeeds 'under certain network configurations' where the FE meta interfaces are reachable by the attacker, so clusters with the FE meta service kept off attacker-reachable networks are not exposed. The vulnerability is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with confidentiality-only impact - no integrity or availability effect - and no public exploit has been identified at time of analysis; there is no CISA KEV listing. Vendor-released patches exist in Apache Doris 4.0.8 and 4.1.4.
Denial of service in FasterXML jackson-databind allows unauthenticated remote attackers to exhaust CPU resources by submitting crafted JSON that triggers quadratic complexity in forward-reference resolution for @JsonIdentityInfo object IDs. The attack requires the application to deserialize attacker-influenced JSON into a collection or map configured with @JsonIdentityInfo; a shallow document with N forward references defined in reverse order causes O(N^2) identity comparisons during deserialization. This is a conditional availability risk-only applications using identity-enabled deserialization on untrusted input are exposed-and no public exploit code has been identified at time of analysis, though a vendor patch is available.
Memory exhaustion in FasterXML jackson-databind allows unauthenticated remote attackers to grow an internal deserializer cache without bound by submitting JSON payloads that carry ever-changing, unrecognized polymorphic type IDs. TypeDeserializerBase caches each fallback resolution keyed by the raw attacker-supplied ID string, the map has no configurable size limit, and it lives for the lifetime of the long-lived ObjectMapper, so distinct unknown IDs translate directly into permanently retained heap - the reporter measured 10,000 retained entries from 10,000 distinct unknown IDs versus a single entry for 10,000 repetitions of one unknown ID. Exploitation requires a non-default configuration (name-based polymorphism via @JsonTypeInfo(use = Id.NAME) with a defaultImpl/fallback deserializer, an endpoint that accepts attacker-influenced type IDs, and a shared application-scoped mapper), so the affected population is substantially narrower than the 7.5 base score suggests; no public exploit has been identified at time of analysis and a vendor patch is available.
Denial of service in FasterXML jackson-core 2.8.0 and later: an unauthenticated remote attacker who can supply a malformed JSON token to a parser created via JsonFactory.createParser(DataInput) causes UTF8DataInputJsonParser._reportInvalidToken() to accumulate the entire offending token into an exception message without ever applying ErrorReportConfiguration.getMaxErrorTokenLength(). The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token (versus 367 characters for identical input on the InputStream path), and because the StringBuilder also incurs byte-to-char expansion and internal array doubling, scaling the payload can exhaust heap and trigger a JVM-wide OutOfMemoryError. Only the DataInput parser path is reachable, impact is availability-only, and no public exploit identified at time of analysis; the 7.5 base score captures the theoretical worst case rather than the narrow real-world reachability.
Authenticated remote code execution in openEQUELLA releases before 2026.1.0 lets any logged-in non-guest user execute arbitrary code on the server by sending a crafted serialized Java object to the HTTP invoker endpoint at /invoker/*. The flaw is a denylist bypass: the class-name filter in PluginAwareObjectInputStream is evaded by wrapping a malicious payload inside a java.security.SignedObject, whose inner stream is handled by a separate ObjectInputStream that never applies the denylist, ultimately routing into a JNDI lookup sink. No public exploit identified at time of analysis and the vulnerability is not in CISA KEV; the practical barrier is only the low-privilege account requirement (PR:L per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, scored 8.7 under CVSS 4.0), which is trivial to satisfy on instances that permit self-registration or broad SSO/LDAP provisioning.
MPXJ's MerlinReader (versions 5.5.5 through 16.4.1) creates a default-configured DocumentBuilder when parsing XML taken from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype declarations and external entities enabled, so a crafted database can coerce the parser into reading arbitrary local files when an application imports an untrusted Merlin file. The practical impact is bounded: per the vendor, MPXJ's downstream handling of the parsed XML means the file contents are unlikely to be exfiltrated, so this is effectively blind XXE (local file access, possible SSRF or parser DoS) rather than reliable data disclosure, which is why the independent assessment rates Confidentiality as Low despite the 7.5 HIGH base score, and the CVSS vector shows network reachability with PR:N/UI:N (unauthenticated, no user interaction beyond the file being processed by the host application). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; a vendor-released patch is available in MPXJ 16.4.1.
Cross-site request forgery in Adobe Experience Manager Forms JEE (AEM 6.5 and 6.5 LTS) lets an attacker forge requests that bypass a security control and perform unauthorized writes on behalf of a logged-in user, producing a limited availability disruption. The attacker requires no authentication of their own (CVSS vector PR:N), but exploitation depends entirely on a victim who holds a valid AEM Forms JEE session being induced to visit a malicious URL or interact with a compromised page (UI:R); there is no confidentiality impact, and integrity (I:H) plus a minor availability effect (A:L) account for the 7.1 base score. No public exploit code has been identified at time of analysis, and real-world risk is best judged as moderate rather than critical given the victim-interaction prerequisite.
Stored cross-site scripting in Adobe Experience Manager 6.5 Forms JEE and 6.5 LTS Forms JEE lets a high-privileged, authenticated attacker plant malicious JavaScript inside form fields that executes in a victim's browser when the poisoned form page is rendered, with a scope change that can extend impact to the victim's session or account. The CVSS vector confirms the prerequisites: PR:H means the attacker must already hold an elevated AEM account able to write form content, and UI:R means a victim must actively browse to the affected page, so realistic exposure is limited to malicious insiders or attackers who have already compromised high-privilege AEM credentials. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the 8.1 score is driven by the high confidentiality and integrity impact on the victim's session rather than by an easy unauthenticated path, making this a genuine but constrained-priority issue rather than a drop-everything emergency.
Unsafe reflection in Apache Calcite Avatica before 1.29.0 allows an attacker who can influence plugin-instantiation parameters to force the loading and static initialization of arbitrary classes on the server classpath. Exploitation requires low privileges (PR:L per the assessed CVSS vector) and a dangerous static-initializer gadget already present on the classpath; the vendor states no well-known class currently satisfies this, so real-world risk is low despite the RCE tag. No public exploit code or active exploitation has been identified at time of analysis.
Remote, unauthenticated denial of service against applications running FasterXML jackson-core 2.17.0 through 2.18.10: a JSON string of attacker-supplied numeric-looking text coerced into a BigDecimal, BigInteger, Double, or Float target drives NumberInput.looksLikeValidNumber() into quadratic regular-expression backtracking, and a single 160,000-character value was measured at roughly 74 seconds, so a small number of concurrent requests of ordinary body size can exhaust a server's request-handling thread pool. Reachability is narrowed by the data-binding requirement: only endpoints where jackson-databind's StdDeserializer/NumberDeserializers perform String-to-number coercion are exposed, and 2.16.x and earlier do not contain the affected method at all. No public exploit code identified at time of analysis, and no CISA KEV confirmation of active exploitation.
Missing authentication in the ManageEngine ADSelfService Plus REST API (all builds before 7001) lets remote, unauthenticated attackers reach API functionality that should require a valid session or credential, as classified under CWE-306. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H (8.6), meaning no credentials and no user interaction are needed, with the highest rated component being availability impact and more limited confidentiality/integrity effects - the exact reachable endpoints are not disclosed in the vendor advisory. No public exploit code and no confirmed active exploitation were identified at time of analysis, so EPSS/KEV signals cannot be used to prioritize this; risk is driven by internet-exposed instances of a pre-7001 build, and patching to build 7001 removes the exposure entirely.
Stored cross-site scripting in MCMS 6.1.1 through 6.2.1 allows an authenticated user with article authoring or submission privileges to inject JavaScript into the contentDetails field, which is excluded from the global XSS filter; a victim, such as an administrator, editor, or site visitor, must view the stored article for the payload to execute (UI:R). Publicly available exploit code exists, and the EPSS score is low at 0.19% (9th percentile), with no confirmed active exploitation from the provided KEV data. The independent assessment rates this as moderate priority with low confidentiality and integrity impact, not the high impact suggested by the original 8.7 feed score.
Unauthenticated SQL injection in MCMS 6.1.1 through 6.2.1 lets network attackers inject arbitrary SQL through the PageAction.verify endpoint at GET /ms/mdiy/page/verify.do; the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N indicates high confidentiality and integrity impact without availability impact, while the CVE record lists an overall 9.8. No public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is 0.19% (9th percentile), meaning the realistic risk is governed by whether an MCMS instance is internet- or attacker-network-reachable rather than by any observed exploitation. In short, this is a classic high-severity signal profile with a low real-world-exploitation signal underneath it.
Authenticated users of lamp-cloud (dromara/lamp-cloud) through version 5.10.0 can permanently delete notifications belonging to other users by calling DELETE /anyone/extendNotice/deleteMyNotice with arbitrary notice IDs, because the endpoint deletes by the attacker-supplied key without verifying that the notice belongs to the requester. Any low-privilege account with network access to the application is sufficient - no administrative role and no user interaction are required (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) - and because notice IDs appear to be sequential/enumerable, a single authenticated user can systematically purge the notification records of other tenants/users. Publicly available exploit code exists (a PoC script targeting the notice-delete BOLA was published in the LinYuanyi1/cve-request-poc repository and reported by VulnCheck), though the impact is bounded to integrity and availability of the notice subsystem with no data disclosure.
Authenticated profile tampering in dromara lamp-cloud through 5.10.0 lets any logged-in user overwrite other users' profile records - nickname, ID card, sex, nation, education, work description and avatar attachment - by supplying a victim's user ID in the body of a PUT request to /anyone/baseInfo or /anyone/avatar. The root cause is a broken object-level authorization (BOLA/IDOR, CWE-639) in the lamp-oauth UserInfoController, which takes the target identity from attacker-controlled request data instead of the authenticated session; exploitation requires only a low-privilege account (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N, no user interaction) and is scored 7.1 with impact confined to integrity. Publicly available exploit code exists (two Python BOLA proof-of-concept scripts published alongside the VulnCheck advisory), while no confirmed active exploitation (CISA KEV) is reported for this issue at time of analysis.
Authenticated users of Dromara lamp-cloud through 5.10.0 can download other users' stored attachments by supplying a valid attachment identifier to the /anyone/file/down or /anyone/file/download endpoints in FileAnyoneController, which never validate the file's created_by owner column against the requesting principal (CWE-639, IDOR/BOLA). The flaw is network-reachable and low-complexity, requires only a low-privilege authenticated account and no user interaction, and yields high confidentiality impact with no integrity or availability effect; it is rated 7.1 under CVSS 4.0 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Publicly available exploit code exists (a Python proof-of-concept published on GitHub), but the issue is not listed in CISA KEV, so no confirmed active exploitation is established at time of analysis.
Authenticated users on any Dromara lamp-cloud deployment up to and including 5.10.0 can read the complete profile of every other user by calling the getUserInfoById endpoint with an arbitrary userId, exposing mobile numbers, email addresses, national identity card numbers, and WeChat/DingTalk OpenIDs. The flaw is a classic object-level authorization bypass (CWE-639) requiring only a valid low-privileged account - no elevated role, user interaction, or non-default configuration - and publicly available exploit code exists (a Python BOLA PoC in the LinYuanyi1/cve-request-poc repository), so userIds can be enumerated at scale to harvest PII. There is no confirmed CISA KEV entry and no evidence of active exploitation; the risk is best characterized as a moderate, not urgent, priority driven by the high confidentiality impact and the low-effort, automatable nature of the enumeration, tempered by the relatively small footprint of this open-source Spring Cloud framework. Vendor-released patch: none identified at time of analysis.
Authenticated users can exploit a missing authorization check in jshERP 3.6 and earlier to manipulate userBusiness authorization-relation rows, enabling privilege escalation, access revocation, or role-function modification for any tenant user. Publicly available exploit code exists (POC), and while no active exploitation has been confirmed, the flaw is network-reachable, low-complexity, and requires only a low-privileged account, posing significant risk. The vulnerability is rooted in CWE-862 (Missing Authorization).
Authenticated users of jshERP through 3.6 can read, modify, and delete other users' business objects - such as materials - by supplying direct object identifiers to by-id info, update, and delete endpoints that lack ownership checks (CWE-639). Exploitation requires a valid low-privileged account (PR:L per the CVSS vector) and network access to the affected API; publicly available exploit code exists, and object IDs are likely enumerable, though CISA KEV does not list active exploitation. With a CVSS 4.0 base score of 8.7, the flaw is a moderate-to-high priority for multi-user or multi-tenant deployments, while single-user instances have little data to expose.
Privilege escalation in jshERP through 3.6 lets any authenticated user - including one holding only a low-privileged tenant account (CVSS PR:L, no administrative rights, user interaction, or non-default configuration required) - modify or delete arbitrary role definitions through the /role/update and /role/delete endpoints in RoleController, which perform no caller-permission checks. Successful abuse allows an attacker to widen a role's data scope to 'all data', delete roles, and consequently read every business record in the tenant. Publicly available exploit code exists (a proof-of-concept script has been published); there is no indication of confirmed active exploitation (not in CISA KEV), and no vendor-released fixed version has been identified from the available data, making this a genuine, actionable priority within its limited install base.
Missing authorization in jshERP through version 3.6 lets authenticated low-privilege users rewrite or delete tenant-wide system configuration through the systemConfig endpoint, because SystemConfigService.updateSystemConfig performs no privilege check. Successful abuse corrupts the integrity of company identity, stock rules, approval behavior, and printing configuration, with a secondary risk of disrupting tenant operations; there is no confidentiality exposure reported. Exploitation requires only a valid low-privilege tenant account (no user interaction or non-default configuration), and publicly available exploit code exists, so the practical threat is mainly malicious insiders or holders of compromised or self-registered accounts. Rated 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) and tracked as CWE-862, this is a genuine but moderate-priority issue rather than a critical emergency.
jshERP through 3.6 exposes unsalted MD5 password hashes via the /user/info endpoint, allowing any authenticated user to retrieve password digests for arbitrary users by supplying their user IDs. This information disclosure (CWE-200) affects all versions up to 3.6, and publicly available exploit code exists. Attackers with a low-privilege account can enumerate user IDs to obtain hashes, which can be cracked offline to recover plaintext passwords, potentially leading to full account takeover for weak passwords. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting the need for authentication and the high confidentiality impact.
Authenticated account takeover in jshERP through 3.6 allows any logged-in user to reset the password of any other account, including administrators, by issuing POST /user/resetPwd with an arbitrary target user ID. Because the endpoint performs no ownership or authority check on the supplied user ID and resets the victim's password to a known default value, an attacker holding even the lowest-privilege credentials can seize administrative control of the application. Publicly available exploit code exists (a Python PoC), and while there is no confirmed active exploitation (CISA KEV) or exploitation telemetry, the flaw is trivial to trigger and needs no user interaction, making insider or low-privilege-credential exposure the primary risk.
Privilege escalation in jshERP 3.6 allows an authenticated low-privilege tenant user to grant themselves arbitrary roles, including tenant administrator, by sending a crafted POST request to the updateOneValueByKeyIdAndType endpoint with type=UserRole, their own user ID, and a role ID list. The endpoint applies no ownership or privilege validation (CWE-862), and publicly available exploit code exists. Exploitation requires only a valid low-privilege session; no victim interaction or special configuration is needed, and no CISA KEV listing is present in the provided data to confirm active exploitation.
A memory leak in SmallRye Fault Tolerance, the fault-tolerance library used by Quarkus for retries, circuit breakers, and related resilience patterns, allows unauthenticated remote attackers to steadily exhaust application heap and cause denial of service on services that expose endpoints using the @ApplyGuard or @ApplyFaultTolerance annotations. Each request routed through those fault-tolerance guards allocates internal tracking objects that are never released, so sustained traffic grows memory usage until the JVM slows and crashes with an out-of-memory condition. The vendor CVSS 3.1 base of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this as high-severity availability-only impact, consistent with the CWE-400 uncontrolled resource consumption classification and the 'Denial Of Service' tag; no public exploit identified at time of analysis, and applications that do not use these annotations are unaffected.
Server-side request forgery in self-hosted draw.io (jgraph/drawio) prior to 30.3.8 lets an unauthenticated remote attacker point the /embed2.js?fetch= endpoint at internal IPv6 Unique Local Address (ULA) resources and read the reflected response, including AWS instance metadata served on the fd00:ec2::/32 range, which can expose IAM credentials and other sensitive internal data. The flaw is a filter bypass rather than a missing check: the private-address guard compared the JDK's fully expanded IPv6 text form against the compressed prefixes 'fc00::' and 'fd00::', so the entire fc00::/7 ULA space slipped through. Exploitation requires a reachable self-hosted draw.io instance and an internal target genuinely addressable over IPv6 ULA - IPv4 private ranges remain blocked, and neither authentication nor the ENABLE_DRAWIO_PROXY=1 flag nor DNS rebinding is needed on the primary /embed2.js path. No public exploit code was identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV listing); the CVSS 4.0 base score is 7.7 (High), reflecting a network-vector, scope-changing confidentiality impact.
Stored cross-site scripting in GoCD (versions 13.3.0 through 26.1.0) allows an authenticated user who holds write access to a material tracked by the server to embed arbitrary HTML or JavaScript in a modification comment crafted to imitate the special package-material trackback JSON format. The payload executes in the browser of a privileged user who later views a page that renders that comment - Stage Detail, Job/Build Detail, Value Stream Map, or Pipeline History - potentially exposing the victim's session or permitting actions with the victim's privileges; not every material comment is rendered in every view, so victim interaction and payload placement are required. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but a public upstream fix commit and the release of GoCD 26.1.0 are available, and the EPSS-style risk is bounded: this is a genuine but contained stored-XSS risk rather than a drop-everything emergency. The CVSS 4.0 vector (PR:L, UI:P, VC:L/VI:H/VA:L) confirms the authenticated, victim-interaction-dependent nature of exploitation.
Unauthenticated remote code execution risk in Apache MINA 2.0.X through 2.0.30 and 2.1.X through 2.1.14 arises because those maintenance branches never received the resolveProxyClass() override that closed CVE-2026-47065. An attacker who can reach an application that uses MINA's ObjectSerializationDecoder and relies on acceptMatchers can wrap a malicious serialized object in java.lang.reflect.Proxy to bypass the allow-list, and, if a suitable gadget chain is present, execute code. No public exploit identified at time of analysis; upgrades within 2.0.X or 2.1.X do not remediate, so affected users must move to the 2.2.X line at 2.2.8 or later.
An authorization flaw in the pki-core v2 REST ACL filter lets an authenticated member of the default Certificate Manager Agents group invoke profile-management operations reserved for Administrator-level accounts, so a request to POST /v2/profiles/raw that should require profiles.create is instead authorized under the lower-privileged profiles.approve permission. The root cause is that when a literal ACL key (profiles.create) and a wildcard ACL key (profiles.approve) both match, the filter picks the winner by lexicographic string comparison rather than by specificity, allowing the wildcard mapping to override the more specific literal one; CVSS 3.1 rates this 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), with the highest threat to the confidentiality and integrity of the CA's issuance policy. Exploitation requires valid agent-level credentials and the default ACL configuration, and no public exploit code has been identified at time of analysis, so this is a privilege escalation inside an existing trusted role rather than unauthenticated access.
Cache poisoning in the Open VSX registry allows an unauthenticated remote client to inject attacker-chosen download, signature, and public-key URLs into per-extension metadata that is then served to every other client, so downstream VS Code-compatible editors fetch and install an attacker-supplied VSIX. Exploitation requires the deployment to be reachable directly by clients, or fronted by a reverse proxy that relays rather than overwrites the client's X-Forwarded-Host/X-Forwarded-Proto/X-Forwarded-Prefix headers, with ovsx.server.url left unset and the attacker's source address treated as a trusted proxy (by default only loopback and private ranges are). Because the VSIX download URL, its signature URL and the verifying public key URL are all derived from the same base URL, extension signing provides no protection; poisoned entries persist for the cache lifetime (one hour by default) and spread cluster-wide when ovsx.redis.enabled is set. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the prerequisite is a common default deployment shape, so the risk is real and high rather than theoretical.
Memory exhaustion in Apache MINA's CompressionFilter lets unauthenticated remote attackers crash the affected JVM by sending ZLib-compressed data that inflates to an unbounded size, since the pre-fix filter allocates an output buffer proportional to the decompressed result without enforcing any limit (CWE-409, CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N with availability-only impact). The flaw is reachable only in deployments that instantiate the filter for inbound decompression (compressInbound=true) and expose that endpoint to untrusted network peers; applications that never enable CompressionFilter, or that already configure a maxDecompressedSize bound, are not affected. Our assessment rates this a genuine but bounded availability risk rather than a critical priority, and no public exploit code was identified at time of analysis; there is no KEV listing or confirmed in-the-wild activity.
Remote code execution in openEQUELLA before 2026.1.0 allows an authenticated attacker to execute arbitrary operating-system commands on the server by injecting FreeMarker template expressions into content surfaces they can author, such as collection summary sections, advanced-script wizard controls, dashboard portlets, and MIME display templates. The root cause is that the product's FreeMarker configuration (BasicConfiguration) relied on FreeMarker's default unrestricted TemplateClassResolver and left the ?api built-in reachable, so a payload such as <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")} instantiates the Execute utility and calls Runtime.exec. Exploitation requires a valid low-privilege account (CVSS 4.0 vector PR:L) plus passive user interaction when the malicious template is rendered (UI:P), and it is not possible against patched instances (2026.1.0+) which enforce SAFER_RESOLVER; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and EPSS is modest (0.92%, ~58th percentile), consistent with a high-severity but authentication-gated issue.
Command injection within Acode on Android lets any locally installed application execute arbitrary shell commands inside Acode's own sandboxed UID, exposing private app data, stored remote credentials, Storage Access Framework grants and granted runtime permissions. The flaw affects builds from 1.11.6 up to but not including 1.12.7, where the terminal plugin exports com.foxdebug.acode.rk.exec.terminal.TerminalService without a binding permission and TerminalService.java performs no caller verification, so a zero-permission hostile app can bind the service and pass an attacker-controlled cmd value via MSG_EXEC. Exploitation is strictly local and requires the victim to already have run a malicious app alongside a vulnerable Acode release; no public exploit code has been identified at time of analysis and there is no CISA KEV listing or EPSS signal reported.
Moquette MQTT brokers running versions prior to 0.18.1 fail to enforce topic write ACLs on Last Will and Testament messages, letting a remote, unauthenticated client (CVSS vector contains PR:N) publish attacker-controlled payloads into ACL-protected topics it is not permitted to write to. The attacker sets a restricted topic as the Will Topic in the CONNECT packet and then drops the connection abnormally (for example with a TCP RST) so the broker fires the Will through PostOffice.publishWill() → publish2Subscribers() without ever calling authorizator.canWrite(), the check that guards normal QoS 0/1/2 PUBLISH paths. The published CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N); our independent assessment concurs on network reachability, no privileges and no user interaction, with integrity-only impact, though it rates the per-event integrity effect as low because each bypass delivers only a single message (repeatable by reconnecting). No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in 0.18.1.
Denial of service in Apache Neethi before 3.2.4 lets unauthenticated remote attackers pin CPU for extended periods by supplying a crafted pair of WS-Policy documents to an application that runs them through Neethi's policy-intersection logic. The flaw is an uncontrolled resource-consumption issue (CWE-770) in which a small, carefully constructed input drives exponential work, and CISA's SSVC framework rates it automatable; no public exploit code has been identified at time of analysis. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), confidentiality and integrity are untouched and scope is unchanged, so practical exposure is limited to SOAP/web-services deployments that actually intersect untrusted, client-supplied policy documents.
Denial of service in Apache Neethi before 3.2.4 allows unauthenticated remote attackers to exhaust server CPU and memory by submitting a small WS-Policy document that contains repeated policy references, which Neethi re-expands exponentially during normalization. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), with impact limited to availability - there is no confidentiality or integrity loss. Practical exposure is bounded: only applications that actually parse and normalize attacker-supplied WS-Policy (typically SOAP/web-service endpoints built on Apache Axis2 or CXF) are reachable, and no public exploit identified at time of analysis. This is a genuine but bounded availability risk, and upgrading to 3.2.4 removes the flaw.
Heap exhaustion in Apache Neethi versions before 3.2.4 lets unauthenticated remote attackers exhaust server memory by submitting a crafted WS-Policy document whose oversized policy assertion is copied into memory without being counted against Neethi's size limits, resulting in denial of service. The issue is availability-only (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and reachable only where an application actually parses attacker-supplied WS-Policy input, most commonly SOAP endpoints built on Apache Axis2 or CXF. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), so the practical risk is bounded by whether untrusted WS-Policy documents reach the parser.
Stack exhaustion in Apache Neethi before 3.2.4 lets an unauthenticated remote attacker crash the WS-Policy parser by supplying a policy document whose element nesting is deep enough to slip past Neethi's nesting-depth guard and drive unbounded recursion until the thread stack is exhausted. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) the impact is availability-only: no confidentiality or integrity loss, but a successful parse failure can take down the parser thread and potentially the hosting SOAP endpoint. The practical reachability condition is that the target application must actually hand attacker-controlled WS-Policy content to Neethi - typical of Apache Axis2 or CXF-based WS-* services that accept client- or peer-supplied policy - whereas deployments that only parse locally configured, trusted policy are not exposed; no public exploit code was identified at time of analysis and neither CISA KEV nor EPSS data accompanies this record.
Azkaban through 4.0.0 fails to enforce project-level permission checks in the ScheduleServlet fetchSchedule action, letting any authenticated user read the scheduling configuration of projects they do not own or have rights to. A logged-in attacker who supplies arbitrary project and flow identifiers can retrieve execution times, cron expressions, flow parameters, and notification email lists belonging to other teams. This is a read-only confidentiality exposure (CWE-862 missing authorization) with no code execution or data modification, exploitation requires a valid account (CVSS 3.1 PR:L), and no public exploit code or CISA KEV active-exploitation listing was identified at time of analysis.
Remote code execution in IBM MQ Java and JMS client libraries allows an authenticated attacker with access to a message queue or topic to bypass the deserialization allow-list filter in exception handling and execute arbitrary code on client applications. The flaw is network-reachable but requires low-privileged authentication (PR:L) and is limited to a specific exception-handling path (AC:H), with impact confined to the client process rather than the MQ server. No public exploit code was identified at time of analysis.
Authenticated code injection in XWiki Rendering (the xwiki-rendering-xml module, versions before 14.10.2) lets any user who can edit their own user profile - or any other document - close the surrounding HTML macro and inject Groovy or Python script macros that execute with programming rights, granting remote code execution and unrestricted read/write access to all wiki contents. Exploitation requires only a low-privilege, authenticated account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, severity 9.9) and needs no victim interaction beyond the affected page being rendered; the attacker reaches the flaw through rendered output that is embedded in an HTML macro without escaping, with exploitable sinks including the user profile (since XWiki syntax 2.0, demonstrably exploitable from XWiki 3.3 Milestone 1) and the extension point org.xwiki.platform.search.ui.docdoesnotexist (added in XWiki 8.3 Milestone 1). No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the vendor advisory documents a detailed reproduction payload and the scope change (S:C) combined with high confidentiality, integrity and availability impact makes this a genuine high-priority issue; vendors have released the fix in XWiki 14.10.2 and 15.0 RC1.
Improper handling of HTTP/2 and HTTP/3 Extended CONNECT requests in Netty-based services can downgrade them to ordinary CONNECT requests, enabling request-smuggling or desynchronization in deployments where a fronting proxy and backend interpret the downgraded request differently. The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning unauthenticated remote attackers can affect integrity, though the independent assessment raises attack complexity to High and scope to Changed and limits practical impact to proxy/gateway mismatches on endpoints that accept HTTP/2 or HTTP/3 Extended CONNECT. No CISA KEV entry or public exploit code was identified at time of analysis, so priority is moderate and conditional rather than urgent.
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat middleware lets a remote, unauthenticated attacker smuggle requests across the HTTP/1-to-HTTP/2 protocol boundary, overriding the :authority pseudo-header that downstream services use for routing and authorization. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N = 8.2 High) rates integrity as the dominant impact (I:H) with limited confidentiality exposure (C:L) and no availability effect, consistent with a CWE-444 request-smuggling class defect. Exploitation is not confirmed actively exploited (no CISA KEV listing) and no public exploit identified at time of analysis, although real-world exploitation requires a deployment that actually translates HTTP/1 requests into HTTP/2 and a downstream component that trusts :authority for routing or authorization decisions.
Unauthenticated remote code execution in Apache Roller 6.1.5, where the XML-RPC endpoint deserializes attacker-controlled bytes during request parsing before any authentication check occurs. The servlet is mapped unconditionally, so the vulnerable parsing path is still reachable even when the global XML-RPC feature is turned off, and no non-default configuration is required. This rates CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis; practical RCE reliability depends on a usable deserialization gadget chain being present on the application classpath, which the advisory does not enumerate. Vendor-released patch: Apache Roller 6.1.6.
Unauthenticated configuration tampering in Apache Roller 6.1.5 lets any remote attacker persistently rewrite the site-global frontpage weblog selection on a default installation, because the installation-time setup action remains anonymously reachable after setup completes and persists the value without any authorization check. Impact is bounded rather than severe: only one site-global setting is altered, no data is disclosed (C:N), and a global administrator can restore the setting afterward, which is why our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L rather than the submitted 8.2 high with I:H/A:L. The attack is a single unauthenticated HTTP request with no user interaction, so exposure is broad wherever 6.1.5 is internet-facing; exploitation status is no public exploit identified at time of analysis, and the issue is not tied to any optional feature or non-default configuration.
Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows unauthenticated remote attackers to cause a logged-in author or administrator to perform state-changing actions under the victim's authority, because the CSRF validation filter accepts requests that omit the required salt token and instead validates against a value the server itself generated for the request. Exploitation requires social engineering the privileged user into visiting a crafted page while their session is active (UI:R); no optional feature or non-default configuration is needed, and both standard and multipart forms are affected. A vendor patch is available in Apache Roller 6.1.6 or later; no public exploit code or active exploitation has been identified at time of analysis. The impact is bounded by the victim's own permission level (owner, editor, drafter, or administrator).
Replay of a captured WSSE digest authentication header against Apache Roller 6.1.5 allows an attacker to assume the victim's AtomPub authority - publishing, editing, and deleting blog content under that identity - without ever knowing the underlying password. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L, 7.7) rates it as remotely reachable without valid credentials, but real-world exposure is tightly gated: the AtomPub API must be explicitly enabled (it ships off by default), WSSE must be the configured AtomPub authentication method, the install must use plaintext-compatible password storage, and the attacker must first be able to observe a legitimate user's header in transit, which is what drives the High attack complexity. Only version 6.1.5 is affected; 6.1.6 removes WSSE as an AtomPub authentication option, and no public exploit code has been identified at time of analysis (the issue is not in CISA KEV, so there is no confirmation of active exploitation).
Incorrect authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker to bind an outstanding request token to an arbitrary user account - including an administrator - by submitting an unsigned authorization request that supplies the target identity directly instead of relying on the logged-in session. Exploitation is constrained: it requires an installation that has configured a non-default OAuth 1.0a site-wide consumer, plus knowledge of one of that consumer's outstanding (issued but unconsumed) request tokens, which is the basis for the high attack-complexity rating despite the critical 9.0 CVSS 3.1 score. Successful abuse yields administrator-level API access to the blog server, so confidentiality and integrity impact are high (the independent assessment scores availability impact as none); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released a fix in Apache Roller 6.1.6.
Missing per-weblog authorization in Apache Roller 6.1.5 allows any authenticated user to read, modify, or delete weblog content owned by other weblogs via the legacy XML-RPC Blogger and MetaWeblog APIs, which authenticate the caller but do not check the caller's permission on the affected weblog or entry. Exploitation requires an authenticated account and the non-default global XML-RPC feature to be enabled, although the per-weblog API flag defaults to on for UI-created weblogs, and impact is confined to weblog content rather than the host. No public exploit identified at time of analysis, and while the NVD-style CVSS 3.1 score is 9.9 (critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, that figure conflicts with the vendor's Moderate rating and the stated constraints.
Unauthenticated account takeover in X-SpringBoot through 6.0 allows remote attackers to authenticate as any user by submitting the hardcoded default master login verification code 172839, shipped in the database seed, to the emailOrMobileLogin endpoint together with a known email address or mobile number. Exploitation requires the deployment to retain the default seed and the attacker to know a valid account identifier, but no credentials, OTP, or user interaction are needed; publicly available exploit code exists. The vulnerability has a CVSS 4.0 base score of 9.3, and the assessed CVSS 3.1 vector is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
X-SpringBoot through 6.0 allows remote unauthenticated attackers to hijack user accounts by abusing unauthenticated endpoints that return login verification codes in HTTP responses, enabling authentication as any victim whose mobile number or email is known. Publicly available exploit code exists, and the vulnerability is not confirmed actively exploited (not in CISA KEV). Affected users are those running X-SpringBoot versions 0 through 6.0 with network-exposed login endpoints.
Authenticated privilege escalation in X-SpringBoot through 6.0 lets any account with delegated user-management permissions reset passwords, rebind roles, or delete users - including the super administrator - through POST /sys/user/update and POST /sys/user/delete because those endpoints perform no object-level ownership verification. Publicly available exploit code exists, in the form of the referenced Python BOLA proof-of-concept, but no CISA KEV status is provided and the risk is tempered by the PR:H requirement that the attacker already be a sub-administrator rather than an unauthenticated remote user. The impact is full compromise of user accounts on affected instances that delegate user-management privileges.
Session fixation in the HTTP management interface of Apache Qpid Broker-J through 10.1.0 lets remote, unauthenticated attackers hijack an administrator's authenticated management session by reusing a session identifier that is retained across successful authentication, yielding full confidentiality, integrity, and availability impact (C:H/I:H/A:H) over the broker's management functions. Exploitation requires the HTTP management interface to be reachable by the attacker and, critically, requires a legitimate management user - typically an administrator - to authenticate using a session identifier the attacker has planted, fixed, or otherwise obtained before login, so the assessed vector is AV:N/AC:H/PR:N/UI:R rather than the NVD-published 9.8 CRITICAL (AC:L/UI:N), which is inconsistent with the session-fixation class. There is no public exploit identified at time of analysis, and brokers are only exposed where management access is not otherwise restricted; upgrading to 10.1.1 addresses the flaw.
CPU starvation and JVM heap exhaustion in Gerrit Code Review (versions 2.1.6 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2) let remote attackers stall or crash the server by submitting crafted regular expressions through search queries (RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate and sibling predicates) or through the REST regex filter endpoints /projects/?r= (RegexListSearcher) and /projects/{project}/branches/?r= (RefFilter). Patterns built from large counted repetitions or exponential DFA-determinization shapes are compiled into an unbounded dk.brics.automaton instance on the request thread before index evaluation and before access-control visibility filtering, so trivial requests can pin request threads or trigger OutOfMemoryError regardless of configured heap size. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (availability-only, high impact), and exploitation is fully unauthenticated only where anonymous read access is enabled - if anonymous read is disabled an authenticated account is required. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in 3.12.10, 3.13.9, and 3.14.3.
Uncontrolled resource consumption in Gerrit Code Review (versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2) allows unauthenticated remote attackers to cause a persistent denial of service by sending search queries containing deeply nested parentheses to query evaluation endpoints such as /changes/?q=, /accounts/?q=, or the SSH 'gerrit query' command. A small number of requests - roughly 25 to match the default httpd.maxThreads - can permanently pin all HTTP worker threads because the ANTLR 3 query parser recurses without memoization before capability or visibility checks and worker threads do not abort when clients disconnect, requiring a server restart. This is assessed as a genuine operational priority for Gerrit operators; no public exploit code or active exploitation has been identified at time of analysis.
Gerrit Code Review 2.16.0-3.12.9, 3.13.0-3.13.8, and 3.14.0-3.14.2 mishandle project-name normalization, allowing an authenticated user (or an unauthenticated user when the repository was previously public) to keep reading private repository content and to durably restore revoked project-owner administrative privileges. Requests that reference a project with repeated terminal .git suffixes (for example project.git.git) are cached under a different key than the canonical project, so revoking read access or removing owner rules on the canonical name never evicts the stale alias ProjectState during the ProjectCache validity window, permitting reads of newly created private commits and writes to refs/meta/config. No public exploit code has been identified at time of analysis; exploitation requires the attacker to have previously held access to the project and to act before the stale cache entry would naturally expire.
SQL injection in IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 allows remote unauthenticated attackers to view, add, modify, or delete back-end database information. The flaw (CWE-89) carries a CVSS 3.1 base score of 8.6, with an independent assessment vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, indicating high confidentiality and integrity impact and low availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a vendor patch is available via IBM support.
Denial of service in JLine's built-in less viewer affects all 3.x releases from 3.0.0 before 3.30.15 and 4.x releases before 4.3.1: a user-supplied search or display-filter pattern containing nested quantifiers is handed straight to Java's backtracking regex engine and applied repeatedly across file content, so a pattern run against non-matching lines can consume excessive CPU and block the session thread indefinitely. The practical risk profile is multi-user Telnet or SSH deployments that embed the less viewer, where repeated sessions can exhaust a bounded worker pool and deny service to other users; the independent assessment scores this as availability-only (CVSS 3.1 A:H, no confidentiality or integrity impact) and notes that an interactive session foothold and viewable file content are prerequisites, which the published vector's PR:N rating does not reflect. No public exploit code and no confirmed active exploitation were identified at time of analysis, so exploitation is opportunistic rather than observed. The fix is the SafeRegex wrapper plus regex timeouts shipped in 3.30.15 and 4.3.1.
Denial of service in JLine3's built-in grep command (org.jline:jline-builtins) lets anyone who can supply a search pattern hang a worker thread indefinitely via catastrophic regular-expression backtracking. The builtin - reachable in applications that embed JLine3 and expose the shell to remote or interactive users - rewrites non-line-regexp patterns as .*pattern.* before compiling them with Java's backtracking regex engine, so a short input such as (a+)+b tested against non-matching text causes exponential CPU consumption (CWE-1333; CVSS 3.1 base 7.5 upstream, while the assessed vector requires low privileges, PR:L). Impact is availability-only (C:N/I:N/A:H) with no confidentiality or integrity loss; publicly available exploit code exists in the form of the advisory's two-line PoC, but the issue is not listed in CISA KEV and no confirmed active exploitation has been reported. Vendor-fixed releases are available: 3.30.15 on the 3.x line and 4.3.1 on the 4.x line.
Moquette MQTT brokers prior to 0.18.1 can start up with authentication and authorization silently disabled whenever a configured authenticator_class or authorizator_class fails to load, so any remote client - including anonymous MQTT clients, since the broker is anonymous by default - can read and write every topic the broker handles while the operator believes access controls are active. The flaw is not directly attacker-triggered: it requires a deployment that both intends to enforce auth and has a broken class-load (misspelled class name, missing dependency, constructor failure, or classpath problem), which is why the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N even though the end-state is a full confidentiality and integrity break; the vendor's CVSS 4.0 vector is 9.3. No public exploit for this fail-open condition was identified at time of analysis, and no CISA KEV entry is present; version 0.18.1 fixes the issue by aborting startup instead of falling back to permissive defaults.
Durable MQTT sessions in Moquette 0.18.0 and earlier can corrupt each other's persisted queues when a client connects with an identifier ending in '_meta', allowing cross-session message loss, misdelivery, or exposure of queued content. The flaw only exists when the broker is configured with H2 MVStore-backed durable/persistent sessions, and the attacker must use a client ID shaped like '<victim_client_id>_meta', so some knowledge or predictability of a target client ID is required; Moquette accepts anonymous clients by default, so authentication is not necessarily a barrier (assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:L/I:H/A:L). The impact is integrity-dominant with limited confidentiality loss - this is a JVM memory-safe broker and no RCE is involved; the upstream advisory that covers this bug also ships source-only PoC code for a companion pattern-ACL bypass, but no public exploit identified at time of analysis and no CISA KEV listing. The issue is fixed in Moquette 0.18.1.
Unauthorized message injection in the Moquette lightweight Java MQTT broker affects all releases prior to 0.18.1: PostOffice.publishWill publishes a client's Last-Will Testament without running the canWrite authorization and reserved-topic checks that gate a normal PUBLISH, so remote unauthenticated attackers (CVSS vector PR:N) can register a Will on a topic they are not allowed to write and have the broker deliver that message to subscribers when the connection is abruptly dropped. This is an integrity-only flaw (C:N/I:H/A:N) whose real-world severity depends on how sensitive the restricted topic is - for example device command-and-control channels - and exploitation requires that an ACL or IAuthorizatorPolicy actually restricts writes to the targeted topic; vendors score it 8.7 (CVSS 4.0). Publicly available exploit code exists (the upstream advisory ships source-level PoCs, including a wildcard-ACL injection proof), but there is no indication in the supplied data of confirmed active exploitation (CISA KEV), and no patch is available other than upgrading to vendor-released version 0.18.1.
Unbounded per-session message queuing in Moquette MQTT Broker before 0.18.1 permits remote unauthenticated clients to exhaust broker memory or persistent storage by sustaining a fast publisher against a slow subscriber, causing denial of service. The CVSS 4.0 base score is 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N), consistent with a high-availability-only impact under CWE-770; the independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms no confidentiality or integrity impact. Default Moquette configurations permit anonymous clients, broadening exposure, and no public exploit identified at time of analysis; no CISA KEV entry, EPSS score, or public exploit specific to this queue-exhaustion issue is provided in the input.
Remote unauthenticated clients can crash a Moquette MQTT broker running 0.18.0 or earlier by publishing or subscribing with a topic name or filter that is nested to an extreme depth, triggering uncontrolled recursion in the broker's CTrie subscription structure and an uncaught StackOverflowError. Because Moquette accepts anonymous MQTT clients by default, network reachability is the only precondition, and the resulting crash lands on a SessionEventLoop that catches only InterruptedException and is never restarted, so the failure wedges every session co-located on that loop rather than just the attacker's connection - a broker-wide denial of service with high availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor-published CVSS 4.0 base 8.7). The issue is not in CISA KEV and no public exploit identified at time of analysis; it is fixed in Moquette 0.18.1, which introduces a MAX_TOPIC_DEPTH of 1024 enforced on both PUBLISH and SUBSCRIBE paths.
Remote, pre-authentication denial of service in the Moquette MQTT broker (moquette-io moquette-broker) through 0.18.0 allows any client able to reach the MQTT listener to wedge the broker's session event loop by sending a malformed shared-subscription filter such as '$share/grp' that omits the '/{topicFilter}' portion. Because the exception is thrown while building the subscription and the SessionEventLoop only catches InterruptedException and is never restarted, command handling on that loop stops and every other client session assigned to the same loop is denied service; the network vector is unauthenticated (CVSS 4.0 AV:N/AC:L/PR:N/UI:N with VA:H, score 8.7; vendor-assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Moquette accepts anonymous MQTT clients by default and the target does not need shared subscriptions pre-configured for the crash to occur, so exploitation requires only network reachability; publicly available exploit code exists in the form of source-level proof-of-concept tests published with the advisory, but there is no indication of active exploitation (not in CISA KEV).
Denial of service in the Moquette lightweight Java MQTT broker prior to 0.18.1: a single remote, unauthenticated MQTT client can terminate a shared SessionEventLoop with a command that raises an uncaught exception, and because SessionEventLoopGroup never restarts a dead loop, every other client session pinned to that loop stops processing PUBLISH, SUBSCRIBE, PUBACK and related commands. Because Moquette accepts anonymous MQTT clients by default and the CVSS vector (PR:N) confirms no authentication is required, an attacker who chooses client IDs that distribute across the broker's available loops can progressively disable session processing broker-wide; impact is availability-only (C:N/I:N/A:H, no code execution or data exposure), and the upstream advisory documents concrete trigger inputs such as a malformed $share/grp SUBSCRIBE, a deeply nested topic, and an ACL NPE. No public exploit tooling was identified at time of analysis, and the issue is fixed in 0.18.1.
Cross-tenant authorization bypass combined with pre-authentication denial of service in Moquette Broker 0.18.0 and earlier lets unauthenticated remote MQTT clients read and write other tenants' topics and repeatedly wedge or exhaust the broker. The critical flaw is wildcard injection through pattern-based ACLs that substitute %c/%u with an unvalidated clientId, so a client connecting with clientId '+' turns a rule such as sensor/%c/# into the filter sensor/+/#; from the same unauthenticated position an attacker can also trigger a $share/grp SUBSCRIBE StringIndexOutOfBoundsException, a StackOverflowError on deeply nested topics, an ACL NPE, unauthorized Will-message publishes, and unbounded subscription/retained/interceptor state that causes memory or disk exhaustion. Publicly available exploit code exists in the form of source-only PoCs (JDK 17) for the pattern-ACL bypass, the shared-subscription crash, and the H2 metadata collision; the vendor-released fix is 0.18.1, and no CISA KEV entry or confirmed in-the-wild exploitation was provided. Score of 9.6 reflects scope change with high confidentiality and integrity impact, gated on a multi-tenant pattern-ACL configuration for the worst outcome.
Unauthenticated remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker positioned on an adjacent network segment to send a crafted Java-serialized payload to the PayDir Business Rules Manager RMI SSL endpoint and execute arbitrary code on the target host. Because the vulnerable service is exposed with no authentication and no user interaction required (CVSS 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), successful exploitation exposes all PayDir credentials and enables manipulation of payment business rules, producing high confidentiality and integrity impact. The adjacency requirement is the primary limiting factor, and no public exploit identified at time of analysis; a vendor patch is available per the IBM advisory.
Privilege escalation in ZohoCorp ManageEngine Applications Manager 182000 and earlier allows a holder of an authenticated low-privileged account to read an administrator's API key and then replay that key to carry out administrator-level actions over the network. Exploitation requires a valid low-privilege login (CVSS vector PR:L) on a vulnerable instance, but needs no user interaction and no special configuration, and successful abuse grants full high-integrity, high-confidentiality control of the application. No public exploit code or confirmed active exploitation was identified at time of analysis; the primary limiting factor is the mandatory pre-existing low-privilege account, which is why this rates as a genuine high-priority flaw rather than a benign high-CVSS artifact.
SQL injection in ManageEngine Applications Manager (builds 182000 and below) allows an authenticated low-privileged user to run arbitrary SQL commands against the application's database, enabling escalation to administrator privileges and, from there, remote code execution on the underlying host. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is rated high priority because the only meaningful barrier is possession of any valid low-privileged account - no user interaction or special configuration is required, and once credentials exist the attack complexity is low. Exploitation status: no public exploit identified at time of analysis; the issue was reported by the vendor (Zohocorp), and no CISA KEV listing or public proof-of-concept code has been observed in the supplied intelligence.
Authenticated low-privileged users can delete service monitors outside their assigned scope in ZohoCorp ManageEngine Applications Manager versions 182000 and below due to improper permission validation (CWE-20). This network-reachable flaw (CVSS 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) requires valid credentials and no user interaction, causing high integrity impact and partial availability loss for monitoring coverage. No public exploit code or active exploitation has been identified at time of analysis.
Configuration tampering in ZohoCorp ManageEngine Applications Manager 182000 and below lets an authenticated low-privileged user modify the application's server-wide proxy settings, an operation that should be restricted to administrators. Because proxy settings govern outbound traffic from the monitoring server - including connections to monitored hosts and external services - a non-admin can redirect or intercept that traffic and expose sensitive configuration data; the independent assessment rates integrity impact lower (I:L) than the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1 HIGH) while agreeing on high confidentiality impact. Exploitation requires a valid low-privileged account and network reachability to the management interface; it is not pre-authentication. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Broken scope enforcement in ZohoCorp ManageEngine Applications Manager (versions 182200 and below) lets an authenticated, low-privileged user trigger administrator-configured MBean actions against monitors that lie outside that user's assigned scope, resulting in high integrity impact with limited confidentiality and availability effects (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, 7.6 HIGH). Exploitation requires a valid low-privileged Applications Manager account and the prior existence of administrator-configured MBean actions on the target instance; no user interaction is needed, and authentication requirements are confirmed as authenticated (PR:L) by the published vector. No public exploit code was identified and the flaw is not listed in CISA KEV, so there is no public exploit identified at time of analysis; the absence of a public exploit and the PR:L prerequisite are the main factors limiting immediate mass exploitation.
ManageEngine Applications Manager builds 182200 and below embed a static Google Cloud service-account private key inside the shipped installer, so anyone who downloads that installer artifact can extract the credential without authenticating to the product and then impersonate the service account directly against Google Cloud APIs. The vendor scores this CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) because the leaked key grants high confidentiality and integrity impact on associated cloud resources and the scope changes beyond the Applications Manager instance itself, with no authentication or user interaction required. Exploitation depends on the installer being obtainable and the referenced service account remaining active with meaningful IAM permissions; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the credential is static rather than runtime-dependent, which makes the exposure durable rather than conditional.
Authenticated OS command injection in Zoho ManageEngine OpManager MSP 12.8.709 and below allows an attacker holding any valid low-privilege console account to execute arbitrary operating system commands on the server through the Notification Profile module, with no user interaction required. Exploitation yields full compromise of confidentiality, integrity and availability of the OpManager host, which for an MSP deployment typically means access to monitored customer infrastructure. The vendor rates the issue 9.9 (scope-changed); our independent assessment places it at high severity with unchanged scope, and no public exploit code has been identified at time of analysis, so the practical risk is concentrated in environments where operator or tenant accounts are widely provisioned or reusable.
Authentication bypass in Zoho ManageEngine OpManager 12.8.710 and earlier allows an attacker reaching the web console to skip an authentication control when the optional Application Manager Plugin is enabled, with high impact to confidentiality, integrity, and availability (CVSS 8.8). Only instances with that specific non-default add-on are exposed; deployments without the plugin are not affected. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, but the CVSS vector (AV:N/AC:L/PR:L/UI:N) combined with the CWE-306 missing-authentication root cause means the precondition is worth treating as near-unauthenticated until the vendor advisory clarifies it.
Command injection in the Diagnose Settings feature of ZohoCorp ManageEngine OpManager and Firewall Analyzer 12.8.709 and earlier allows an authenticated low-privilege user to run arbitrary operating system commands on the host through the web management interface, resulting in complete loss of confidentiality, integrity, and availability (CVSS 8.8, PR:L, UI:N). Exploitation requires a valid low-privileged account and network reachability to the console, but no user interaction and no non-default configuration, so the management interface is the primary gating factor. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, meaning the practical risk is concentrated on internet- or partner-facing ManageEngine consoles where any account holder can reach the vulnerable feature.
An authenticated, low-privileged user of ManageEngine OpManager or ManageEngine Firewall Analyzer (versions 12.8.709 and below) can abuse the 'Rule Tracking Compare Policies' feature to inject crafted XML that is parsed server-side, disclosing data beyond that feature's authorization boundary. The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) reflects a network-reachable, low-complexity issue requiring only any valid console credential and no user interaction, with a scope change and high confidentiality impact but no integrity or availability impact, which confines the practical effect to information disclosure rather than code execution or service disruption. Because a session is required, the flaw is not pre-authentication exploitable; no public exploit code has been identified at time of analysis and no KEV listing was provided in the available intelligence, so exploitation appears to depend on an attacker first obtaining or holding a low-privilege console account with access to the affected feature.
Data exposure in ManageEngine Firewall Analyzer - and in the co-listed ManageEngine OpManager - version 12.8.709 and below allows an unauthenticated attacker positioned on the same network segment as the Firewall Analyzer syslog collector to read sensitive information, including data belonging to the monitored firewall and network devices, which is why the vendor score carries a scope change despite the confidentiality-only impact. No authentication or user interaction is required and complexity is low (CVSS 3.1 7.4, AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N); the adjacent-network requirement is the principal limiting factor, since the collector is not reachable directly from the internet unless its syslog service has been exposed beyond the local segment. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) in the supplied intelligence, which consists solely of a vendor advisory and CPE mappings, and no EPSS score was provided.
WebSocket message smuggling in Apache Tomcat allows a remote, unauthenticated attacker to inject or reorder messages within a compressed WebSocket stream, corrupting application-level message boundaries and undermining integrity of data exchanged over the connection. The flaw affects the 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121 release lines, plus the end-of-support 8.5.0-8.5.100 and 7.0.56-7.0.109 branches, but it only triggers when the per-message-deflate compression extension has been negotiated on the WebSocket connection; deployments that serve only standard HTTP or that run WebSocket endpoints without compression are not exposed. There is no confirmed active exploitation (CISA KEV does not list this issue), no public exploit code identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none', making this a genuine but conditionally-gated integrity flaw rather than a drop-everything emergency.
HTTP/2 request smuggling in Apache Tomcat can mix up request headers between concurrent streams, allowing unauthenticated remote attackers to potentially read or alter other users' request data when the connector has HTTP/2 explicitly enabled. The flaw is a regression from the fix for CVE-2026-41293 and affects only Tomcat 11.0.22 through 11.0.25, 10.1.55 through 10.1.59, and 9.0.118 through 9.0.121; exploitation is rated high complexity (AC:H) with limited confidentiality and integrity impact (C:L/I:L). No public exploit code has been identified at time of analysis, and the independent assessment rates this as a moderate-priority, genuine protocol-layer flaw rather than a critical emergency.
Authentication can succeed when it should have been rejected in Apache Tomcat deployments that use CLIENT_CERT (mutual-TLS) authentication with soft fail disabled, allowing network attackers to reach resources that the mutual-TLS configuration was meant to protect. The affected range is broad - 9.0.92 through 9.0.121, 10.1.22 through 10.1.59, and 11.0.0-M14 through 11.0.25 - but the flaw is gated on two non-default conditions (the CLIENT_CERT authenticator in use and soft fail turned off) and, per the vendor, only manifests in some scenarios, so it is not universally reproducible even on correctly configured vulnerable instances. No public exploit code has been identified at time of analysis, and no evidence of active exploitation is present; the attacker needs network reachability to the mTLS-protected listener.
Denial of service in Apache Tomcat's asynchronous WebSocket write path allows remote, unauthenticated attackers to exhaust server resources by triggering lost write timeouts, so non-blocking WebSocket sends are never released after their effective lifetime. All maintained branches are affected - 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121, plus the end-of-life 8.5.0-8.5.100 and 7.0.43-7.0.109 lines - although exposure is bounded to instances whose deployed applications actually perform asynchronous (non-blocking) WebSocket writes; servers with no WebSocket endpoints or only synchronous writes are not exposed. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only) and CISA's SSVC assessment records no observed exploitation, with no public exploit code identified at time of analysis; the primary risk is sustained resource pressure that degrades or halts the affected connector rather than data compromise.
Apache Tomcat 11.0.19 through 11.0.25, 10.1.53 through 10.1.59, and 9.0.116 through 9.0.121 can cause an unrelated user's request to fail when a malformed request triggers incomplete cleanup of request-processing state on a reachable HTTP connector. No authentication or user interaction is required, but the effect is fundamentally gated by a race window - the advisory itself states the failure occurs only 'depending on timing' - so it is non-deterministic and cannot be reliably triggered on demand, and the realistic worst case is intermittent failure of another user's individual request rather than sustained denial of service, data disclosure, or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis; the 7.3 base score reflects low impact across confidentiality, integrity, and availability, though our assessment rates attack complexity as High rather than Low.
Denial of service in Apache Tomcat allows an attacker to pin an AJP processing thread through a single AJP request, exhausting the connector's limited thread pool (CWE-770, allocation of resources without limits or throttling). The affected range is broad: 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, plus the end-of-life branches 8.5.0-8.5.100 and 7.0.0-7.0.109, which remain affected even though they are no longer supported. There is no public exploit identified at time of analysis, no KEV listing, and no EPSS score in the input; the independent assessment rates the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (availability-only impact), but exploitation requires the AJP connector to be enabled and network-reachable, which has not been the default configuration since Tomcat 9.0.31.
Uncontrolled resource consumption in Apache Tomcat's WebSocket close-message handling allows unauthenticated remote attackers to exhaust server resources and degrade availability on instances that expose WebSocket endpoints. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), the impact is limited to availability (Low) with no confidentiality or integrity effect, and no user interaction is required. Affected releases are 11.0.0-M5 through 11.0.25, 10.1.8 through 10.1.59, 9.0.74 through 9.0.121, plus the end-of-life 8.5.88 through 8.5.100 line; fixes are available in 11.0.26, 10.1.60, and 9.0.122. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, but the low attack complexity and unauthenticated network reachability make prompt patching advisable for any deployment using WebSockets.
Apache Tomcat's HTTP/2 connector harbors a race condition (CWE-362) that allows unauthenticated remote attackers to inject trailer fields into another user's concurrent HTTP/2 request, resulting in high confidentiality and integrity impact without affecting availability. Affected versions are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.39 through 9.0.121, and the end-of-life 8.5.59 through 8.5.100; exploitation is conditional on winning a concurrency race and only applies when the HTTP/2 upgrade protocol is enabled and actively serving traffic. No public exploit code or active exploitation has been identified at time of analysis, and the overall threat is considered credible but conditional.
Authentication bypass in Apache Tomcat allows unauthenticated remote attackers to reach WebSocket endpoints that are supposed to be protected by container-managed security constraints, simply by referencing the endpoint under an alternate name so the constraint is never matched. Exploitation requires only that the application expose one or more WebSocket endpoints and rely on container-level (web.xml security-constraint) authentication or authorization rules to guard them; no credentials, no user interaction, and no non-default configuration beyond that are needed, and per the CVSS vector (PR:N) the attack is unauthenticated and network-reachable. Affected lines are Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, plus end-of-support 8.5.0-8.5.100 and 7.0.43-7.0.109; no public exploit code has been identified at time of analysis and Apache has released fixed versions 11.0.26, 10.1.60 and 9.0.122.
Cross-application authentication realm leakage in Apache Tomcat's Jakarta Authentication integration causes requests to be validated against the realm established by whichever co-hosted web application authenticated first, breaking per-application authentication boundaries. The flaw (CWE-287, improper authentication) affects Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M4 through 9.0.121, plus end-of-life 8.5.0 through 8.5.100. Exploitation is gated by a non-default deployment - SimpleAuthConfigProvider as the default Jakarta Authentication provider with two or more applications sharing it - and the independent assessment rates the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (unauthenticated, high attack complexity, low impact); no public exploit identified at time of analysis, the issue is not in CISA KEV, and the vulnerable configuration is not Tomcat's default.
Origin-validation bypass in the Apache Sling Security Bundle before 1.3.2 allows a remote attacker to defeat the ReferrerFilter when that filter is relied upon as the cross-site request protection control, so cross-site requests that should have been blocked are accepted, yielding low-level confidentiality, integrity, and availability impact. Exploitation requires the victim to be lured into a crafted request carrying an authenticated session (CSRF-style user interaction), and only deployments that depend on ReferrerFilter for origin validation are exposed. Apache rates this 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), while our independent assessment adjusts the vector to UI:R given the required session-riding interaction; EPSS is only 0.13% (3rd percentile) and there is no public exploit identified at time of analysis.
Unauthenticated remote attackers can reach internal Apache Doris Frontend (FE) metadata service endpoints in affected 2.0.x through 4.1.x releases and read sensitive cluster information, because those endpoints authenticate callers using client-supplied node information rather than verifying the requesting party (CWE-287, header trust). Exploitation is gated by deployment: it only succeeds 'under certain network configurations' where the FE meta interfaces are reachable by the attacker, so clusters with the FE meta service kept off attacker-reachable networks are not exposed. The vulnerability is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with confidentiality-only impact - no integrity or availability effect - and no public exploit has been identified at time of analysis; there is no CISA KEV listing. Vendor-released patches exist in Apache Doris 4.0.8 and 4.1.4.
Denial of service in FasterXML jackson-databind allows unauthenticated remote attackers to exhaust CPU resources by submitting crafted JSON that triggers quadratic complexity in forward-reference resolution for @JsonIdentityInfo object IDs. The attack requires the application to deserialize attacker-influenced JSON into a collection or map configured with @JsonIdentityInfo; a shallow document with N forward references defined in reverse order causes O(N^2) identity comparisons during deserialization. This is a conditional availability risk-only applications using identity-enabled deserialization on untrusted input are exposed-and no public exploit code has been identified at time of analysis, though a vendor patch is available.
Memory exhaustion in FasterXML jackson-databind allows unauthenticated remote attackers to grow an internal deserializer cache without bound by submitting JSON payloads that carry ever-changing, unrecognized polymorphic type IDs. TypeDeserializerBase caches each fallback resolution keyed by the raw attacker-supplied ID string, the map has no configurable size limit, and it lives for the lifetime of the long-lived ObjectMapper, so distinct unknown IDs translate directly into permanently retained heap - the reporter measured 10,000 retained entries from 10,000 distinct unknown IDs versus a single entry for 10,000 repetitions of one unknown ID. Exploitation requires a non-default configuration (name-based polymorphism via @JsonTypeInfo(use = Id.NAME) with a defaultImpl/fallback deserializer, an endpoint that accepts attacker-influenced type IDs, and a shared application-scoped mapper), so the affected population is substantially narrower than the 7.5 base score suggests; no public exploit has been identified at time of analysis and a vendor patch is available.
Denial of service in FasterXML jackson-core 2.8.0 and later: an unauthenticated remote attacker who can supply a malformed JSON token to a parser created via JsonFactory.createParser(DataInput) causes UTF8DataInputJsonParser._reportInvalidToken() to accumulate the entire offending token into an exception message without ever applying ErrorReportConfiguration.getMaxErrorTokenLength(). The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token (versus 367 characters for identical input on the InputStream path), and because the StringBuilder also incurs byte-to-char expansion and internal array doubling, scaling the payload can exhaust heap and trigger a JVM-wide OutOfMemoryError. Only the DataInput parser path is reachable, impact is availability-only, and no public exploit identified at time of analysis; the 7.5 base score captures the theoretical worst case rather than the narrow real-world reachability.
Authenticated remote code execution in openEQUELLA releases before 2026.1.0 lets any logged-in non-guest user execute arbitrary code on the server by sending a crafted serialized Java object to the HTTP invoker endpoint at /invoker/*. The flaw is a denylist bypass: the class-name filter in PluginAwareObjectInputStream is evaded by wrapping a malicious payload inside a java.security.SignedObject, whose inner stream is handled by a separate ObjectInputStream that never applies the denylist, ultimately routing into a JNDI lookup sink. No public exploit identified at time of analysis and the vulnerability is not in CISA KEV; the practical barrier is only the low-privilege account requirement (PR:L per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, scored 8.7 under CVSS 4.0), which is trivial to satisfy on instances that permit self-registration or broad SSO/LDAP provisioning.
MPXJ's MerlinReader (versions 5.5.5 through 16.4.1) creates a default-configured DocumentBuilder when parsing XML taken from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype declarations and external entities enabled, so a crafted database can coerce the parser into reading arbitrary local files when an application imports an untrusted Merlin file. The practical impact is bounded: per the vendor, MPXJ's downstream handling of the parsed XML means the file contents are unlikely to be exfiltrated, so this is effectively blind XXE (local file access, possible SSRF or parser DoS) rather than reliable data disclosure, which is why the independent assessment rates Confidentiality as Low despite the 7.5 HIGH base score, and the CVSS vector shows network reachability with PR:N/UI:N (unauthenticated, no user interaction beyond the file being processed by the host application). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; a vendor-released patch is available in MPXJ 16.4.1.
Cross-site request forgery in Adobe Experience Manager Forms JEE (AEM 6.5 and 6.5 LTS) lets an attacker forge requests that bypass a security control and perform unauthorized writes on behalf of a logged-in user, producing a limited availability disruption. The attacker requires no authentication of their own (CVSS vector PR:N), but exploitation depends entirely on a victim who holds a valid AEM Forms JEE session being induced to visit a malicious URL or interact with a compromised page (UI:R); there is no confidentiality impact, and integrity (I:H) plus a minor availability effect (A:L) account for the 7.1 base score. No public exploit code has been identified at time of analysis, and real-world risk is best judged as moderate rather than critical given the victim-interaction prerequisite.
Stored cross-site scripting in Adobe Experience Manager 6.5 Forms JEE and 6.5 LTS Forms JEE lets a high-privileged, authenticated attacker plant malicious JavaScript inside form fields that executes in a victim's browser when the poisoned form page is rendered, with a scope change that can extend impact to the victim's session or account. The CVSS vector confirms the prerequisites: PR:H means the attacker must already hold an elevated AEM account able to write form content, and UI:R means a victim must actively browse to the affected page, so realistic exposure is limited to malicious insiders or attackers who have already compromised high-privilege AEM credentials. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the 8.1 score is driven by the high confidentiality and integrity impact on the victim's session rather than by an easy unauthenticated path, making this a genuine but constrained-priority issue rather than a drop-everything emergency.
Unsafe reflection in Apache Calcite Avatica before 1.29.0 allows an attacker who can influence plugin-instantiation parameters to force the loading and static initialization of arbitrary classes on the server classpath. Exploitation requires low privileges (PR:L per the assessed CVSS vector) and a dangerous static-initializer gadget already present on the classpath; the vendor states no well-known class currently satisfies this, so real-world risk is low despite the RCE tag. No public exploit code or active exploitation has been identified at time of analysis.
Remote, unauthenticated denial of service against applications running FasterXML jackson-core 2.17.0 through 2.18.10: a JSON string of attacker-supplied numeric-looking text coerced into a BigDecimal, BigInteger, Double, or Float target drives NumberInput.looksLikeValidNumber() into quadratic regular-expression backtracking, and a single 160,000-character value was measured at roughly 74 seconds, so a small number of concurrent requests of ordinary body size can exhaust a server's request-handling thread pool. Reachability is narrowed by the data-binding requirement: only endpoints where jackson-databind's StdDeserializer/NumberDeserializers perform String-to-number coercion are exposed, and 2.16.x and earlier do not contain the affected method at all. No public exploit code identified at time of analysis, and no CISA KEV confirmation of active exploitation.
Missing authentication in the ManageEngine ADSelfService Plus REST API (all builds before 7001) lets remote, unauthenticated attackers reach API functionality that should require a valid session or credential, as classified under CWE-306. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H (8.6), meaning no credentials and no user interaction are needed, with the highest rated component being availability impact and more limited confidentiality/integrity effects - the exact reachable endpoints are not disclosed in the vendor advisory. No public exploit code and no confirmed active exploitation were identified at time of analysis, so EPSS/KEV signals cannot be used to prioritize this; risk is driven by internet-exposed instances of a pre-7001 build, and patching to build 7001 removes the exposure entirely.
Stored cross-site scripting in MCMS 6.1.1 through 6.2.1 allows an authenticated user with article authoring or submission privileges to inject JavaScript into the contentDetails field, which is excluded from the global XSS filter; a victim, such as an administrator, editor, or site visitor, must view the stored article for the payload to execute (UI:R). Publicly available exploit code exists, and the EPSS score is low at 0.19% (9th percentile), with no confirmed active exploitation from the provided KEV data. The independent assessment rates this as moderate priority with low confidentiality and integrity impact, not the high impact suggested by the original 8.7 feed score.
Unauthenticated SQL injection in MCMS 6.1.1 through 6.2.1 lets network attackers inject arbitrary SQL through the PageAction.verify endpoint at GET /ms/mdiy/page/verify.do; the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N indicates high confidentiality and integrity impact without availability impact, while the CVE record lists an overall 9.8. No public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is 0.19% (9th percentile), meaning the realistic risk is governed by whether an MCMS instance is internet- or attacker-network-reachable rather than by any observed exploitation. In short, this is a classic high-severity signal profile with a low real-world-exploitation signal underneath it.
Authenticated users of lamp-cloud (dromara/lamp-cloud) through version 5.10.0 can permanently delete notifications belonging to other users by calling DELETE /anyone/extendNotice/deleteMyNotice with arbitrary notice IDs, because the endpoint deletes by the attacker-supplied key without verifying that the notice belongs to the requester. Any low-privilege account with network access to the application is sufficient - no administrative role and no user interaction are required (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) - and because notice IDs appear to be sequential/enumerable, a single authenticated user can systematically purge the notification records of other tenants/users. Publicly available exploit code exists (a PoC script targeting the notice-delete BOLA was published in the LinYuanyi1/cve-request-poc repository and reported by VulnCheck), though the impact is bounded to integrity and availability of the notice subsystem with no data disclosure.
Authenticated profile tampering in dromara lamp-cloud through 5.10.0 lets any logged-in user overwrite other users' profile records - nickname, ID card, sex, nation, education, work description and avatar attachment - by supplying a victim's user ID in the body of a PUT request to /anyone/baseInfo or /anyone/avatar. The root cause is a broken object-level authorization (BOLA/IDOR, CWE-639) in the lamp-oauth UserInfoController, which takes the target identity from attacker-controlled request data instead of the authenticated session; exploitation requires only a low-privilege account (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N, no user interaction) and is scored 7.1 with impact confined to integrity. Publicly available exploit code exists (two Python BOLA proof-of-concept scripts published alongside the VulnCheck advisory), while no confirmed active exploitation (CISA KEV) is reported for this issue at time of analysis.
Authenticated users of Dromara lamp-cloud through 5.10.0 can download other users' stored attachments by supplying a valid attachment identifier to the /anyone/file/down or /anyone/file/download endpoints in FileAnyoneController, which never validate the file's created_by owner column against the requesting principal (CWE-639, IDOR/BOLA). The flaw is network-reachable and low-complexity, requires only a low-privilege authenticated account and no user interaction, and yields high confidentiality impact with no integrity or availability effect; it is rated 7.1 under CVSS 4.0 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Publicly available exploit code exists (a Python proof-of-concept published on GitHub), but the issue is not listed in CISA KEV, so no confirmed active exploitation is established at time of analysis.
Authenticated users on any Dromara lamp-cloud deployment up to and including 5.10.0 can read the complete profile of every other user by calling the getUserInfoById endpoint with an arbitrary userId, exposing mobile numbers, email addresses, national identity card numbers, and WeChat/DingTalk OpenIDs. The flaw is a classic object-level authorization bypass (CWE-639) requiring only a valid low-privileged account - no elevated role, user interaction, or non-default configuration - and publicly available exploit code exists (a Python BOLA PoC in the LinYuanyi1/cve-request-poc repository), so userIds can be enumerated at scale to harvest PII. There is no confirmed CISA KEV entry and no evidence of active exploitation; the risk is best characterized as a moderate, not urgent, priority driven by the high confidentiality impact and the low-effort, automatable nature of the enumeration, tempered by the relatively small footprint of this open-source Spring Cloud framework. Vendor-released patch: none identified at time of analysis.
Authenticated users can exploit a missing authorization check in jshERP 3.6 and earlier to manipulate userBusiness authorization-relation rows, enabling privilege escalation, access revocation, or role-function modification for any tenant user. Publicly available exploit code exists (POC), and while no active exploitation has been confirmed, the flaw is network-reachable, low-complexity, and requires only a low-privileged account, posing significant risk. The vulnerability is rooted in CWE-862 (Missing Authorization).
Authenticated users of jshERP through 3.6 can read, modify, and delete other users' business objects - such as materials - by supplying direct object identifiers to by-id info, update, and delete endpoints that lack ownership checks (CWE-639). Exploitation requires a valid low-privileged account (PR:L per the CVSS vector) and network access to the affected API; publicly available exploit code exists, and object IDs are likely enumerable, though CISA KEV does not list active exploitation. With a CVSS 4.0 base score of 8.7, the flaw is a moderate-to-high priority for multi-user or multi-tenant deployments, while single-user instances have little data to expose.
Privilege escalation in jshERP through 3.6 lets any authenticated user - including one holding only a low-privileged tenant account (CVSS PR:L, no administrative rights, user interaction, or non-default configuration required) - modify or delete arbitrary role definitions through the /role/update and /role/delete endpoints in RoleController, which perform no caller-permission checks. Successful abuse allows an attacker to widen a role's data scope to 'all data', delete roles, and consequently read every business record in the tenant. Publicly available exploit code exists (a proof-of-concept script has been published); there is no indication of confirmed active exploitation (not in CISA KEV), and no vendor-released fixed version has been identified from the available data, making this a genuine, actionable priority within its limited install base.
Missing authorization in jshERP through version 3.6 lets authenticated low-privilege users rewrite or delete tenant-wide system configuration through the systemConfig endpoint, because SystemConfigService.updateSystemConfig performs no privilege check. Successful abuse corrupts the integrity of company identity, stock rules, approval behavior, and printing configuration, with a secondary risk of disrupting tenant operations; there is no confidentiality exposure reported. Exploitation requires only a valid low-privilege tenant account (no user interaction or non-default configuration), and publicly available exploit code exists, so the practical threat is mainly malicious insiders or holders of compromised or self-registered accounts. Rated 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) and tracked as CWE-862, this is a genuine but moderate-priority issue rather than a critical emergency.
jshERP through 3.6 exposes unsalted MD5 password hashes via the /user/info endpoint, allowing any authenticated user to retrieve password digests for arbitrary users by supplying their user IDs. This information disclosure (CWE-200) affects all versions up to 3.6, and publicly available exploit code exists. Attackers with a low-privilege account can enumerate user IDs to obtain hashes, which can be cracked offline to recover plaintext passwords, potentially leading to full account takeover for weak passwords. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting the need for authentication and the high confidentiality impact.
Authenticated account takeover in jshERP through 3.6 allows any logged-in user to reset the password of any other account, including administrators, by issuing POST /user/resetPwd with an arbitrary target user ID. Because the endpoint performs no ownership or authority check on the supplied user ID and resets the victim's password to a known default value, an attacker holding even the lowest-privilege credentials can seize administrative control of the application. Publicly available exploit code exists (a Python PoC), and while there is no confirmed active exploitation (CISA KEV) or exploitation telemetry, the flaw is trivial to trigger and needs no user interaction, making insider or low-privilege-credential exposure the primary risk.
Privilege escalation in jshERP 3.6 allows an authenticated low-privilege tenant user to grant themselves arbitrary roles, including tenant administrator, by sending a crafted POST request to the updateOneValueByKeyIdAndType endpoint with type=UserRole, their own user ID, and a role ID list. The endpoint applies no ownership or privilege validation (CWE-862), and publicly available exploit code exists. Exploitation requires only a valid low-privilege session; no victim interaction or special configuration is needed, and no CISA KEV listing is present in the provided data to confirm active exploitation.
A memory leak in SmallRye Fault Tolerance, the fault-tolerance library used by Quarkus for retries, circuit breakers, and related resilience patterns, allows unauthenticated remote attackers to steadily exhaust application heap and cause denial of service on services that expose endpoints using the @ApplyGuard or @ApplyFaultTolerance annotations. Each request routed through those fault-tolerance guards allocates internal tracking objects that are never released, so sustained traffic grows memory usage until the JVM slows and crashes with an out-of-memory condition. The vendor CVSS 3.1 base of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this as high-severity availability-only impact, consistent with the CWE-400 uncontrolled resource consumption classification and the 'Denial Of Service' tag; no public exploit identified at time of analysis, and applications that do not use these annotations are unaffected.
Server-side request forgery in self-hosted draw.io (jgraph/drawio) prior to 30.3.8 lets an unauthenticated remote attacker point the /embed2.js?fetch= endpoint at internal IPv6 Unique Local Address (ULA) resources and read the reflected response, including AWS instance metadata served on the fd00:ec2::/32 range, which can expose IAM credentials and other sensitive internal data. The flaw is a filter bypass rather than a missing check: the private-address guard compared the JDK's fully expanded IPv6 text form against the compressed prefixes 'fc00::' and 'fd00::', so the entire fc00::/7 ULA space slipped through. Exploitation requires a reachable self-hosted draw.io instance and an internal target genuinely addressable over IPv6 ULA - IPv4 private ranges remain blocked, and neither authentication nor the ENABLE_DRAWIO_PROXY=1 flag nor DNS rebinding is needed on the primary /embed2.js path. No public exploit code was identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV listing); the CVSS 4.0 base score is 7.7 (High), reflecting a network-vector, scope-changing confidentiality impact.
Stored cross-site scripting in GoCD (versions 13.3.0 through 26.1.0) allows an authenticated user who holds write access to a material tracked by the server to embed arbitrary HTML or JavaScript in a modification comment crafted to imitate the special package-material trackback JSON format. The payload executes in the browser of a privileged user who later views a page that renders that comment - Stage Detail, Job/Build Detail, Value Stream Map, or Pipeline History - potentially exposing the victim's session or permitting actions with the victim's privileges; not every material comment is rendered in every view, so victim interaction and payload placement are required. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but a public upstream fix commit and the release of GoCD 26.1.0 are available, and the EPSS-style risk is bounded: this is a genuine but contained stored-XSS risk rather than a drop-everything emergency. The CVSS 4.0 vector (PR:L, UI:P, VC:L/VI:H/VA:L) confirms the authenticated, victim-interaction-dependent nature of exploitation.
Unauthenticated remote code execution risk in Apache MINA 2.0.X through 2.0.30 and 2.1.X through 2.1.14 arises because those maintenance branches never received the resolveProxyClass() override that closed CVE-2026-47065. An attacker who can reach an application that uses MINA's ObjectSerializationDecoder and relies on acceptMatchers can wrap a malicious serialized object in java.lang.reflect.Proxy to bypass the allow-list, and, if a suitable gadget chain is present, execute code. No public exploit identified at time of analysis; upgrades within 2.0.X or 2.1.X do not remediate, so affected users must move to the 2.2.X line at 2.2.8 or later.
An authorization flaw in the pki-core v2 REST ACL filter lets an authenticated member of the default Certificate Manager Agents group invoke profile-management operations reserved for Administrator-level accounts, so a request to POST /v2/profiles/raw that should require profiles.create is instead authorized under the lower-privileged profiles.approve permission. The root cause is that when a literal ACL key (profiles.create) and a wildcard ACL key (profiles.approve) both match, the filter picks the winner by lexicographic string comparison rather than by specificity, allowing the wildcard mapping to override the more specific literal one; CVSS 3.1 rates this 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), with the highest threat to the confidentiality and integrity of the CA's issuance policy. Exploitation requires valid agent-level credentials and the default ACL configuration, and no public exploit code has been identified at time of analysis, so this is a privilege escalation inside an existing trusted role rather than unauthenticated access.
Cache poisoning in the Open VSX registry allows an unauthenticated remote client to inject attacker-chosen download, signature, and public-key URLs into per-extension metadata that is then served to every other client, so downstream VS Code-compatible editors fetch and install an attacker-supplied VSIX. Exploitation requires the deployment to be reachable directly by clients, or fronted by a reverse proxy that relays rather than overwrites the client's X-Forwarded-Host/X-Forwarded-Proto/X-Forwarded-Prefix headers, with ovsx.server.url left unset and the attacker's source address treated as a trusted proxy (by default only loopback and private ranges are). Because the VSIX download URL, its signature URL and the verifying public key URL are all derived from the same base URL, extension signing provides no protection; poisoned entries persist for the cache lifetime (one hour by default) and spread cluster-wide when ovsx.redis.enabled is set. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the prerequisite is a common default deployment shape, so the risk is real and high rather than theoretical.
Memory exhaustion in Apache MINA's CompressionFilter lets unauthenticated remote attackers crash the affected JVM by sending ZLib-compressed data that inflates to an unbounded size, since the pre-fix filter allocates an output buffer proportional to the decompressed result without enforcing any limit (CWE-409, CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N with availability-only impact). The flaw is reachable only in deployments that instantiate the filter for inbound decompression (compressInbound=true) and expose that endpoint to untrusted network peers; applications that never enable CompressionFilter, or that already configure a maxDecompressedSize bound, are not affected. Our assessment rates this a genuine but bounded availability risk rather than a critical priority, and no public exploit code was identified at time of analysis; there is no KEV listing or confirmed in-the-wild activity.
Remote code execution in openEQUELLA before 2026.1.0 allows an authenticated attacker to execute arbitrary operating-system commands on the server by injecting FreeMarker template expressions into content surfaces they can author, such as collection summary sections, advanced-script wizard controls, dashboard portlets, and MIME display templates. The root cause is that the product's FreeMarker configuration (BasicConfiguration) relied on FreeMarker's default unrestricted TemplateClassResolver and left the ?api built-in reachable, so a payload such as <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")} instantiates the Execute utility and calls Runtime.exec. Exploitation requires a valid low-privilege account (CVSS 4.0 vector PR:L) plus passive user interaction when the malicious template is rendered (UI:P), and it is not possible against patched instances (2026.1.0+) which enforce SAFER_RESOLVER; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and EPSS is modest (0.92%, ~58th percentile), consistent with a high-severity but authentication-gated issue.
Command injection within Acode on Android lets any locally installed application execute arbitrary shell commands inside Acode's own sandboxed UID, exposing private app data, stored remote credentials, Storage Access Framework grants and granted runtime permissions. The flaw affects builds from 1.11.6 up to but not including 1.12.7, where the terminal plugin exports com.foxdebug.acode.rk.exec.terminal.TerminalService without a binding permission and TerminalService.java performs no caller verification, so a zero-permission hostile app can bind the service and pass an attacker-controlled cmd value via MSG_EXEC. Exploitation is strictly local and requires the victim to already have run a malicious app alongside a vulnerable Acode release; no public exploit code has been identified at time of analysis and there is no CISA KEV listing or EPSS signal reported.
Moquette MQTT brokers running versions prior to 0.18.1 fail to enforce topic write ACLs on Last Will and Testament messages, letting a remote, unauthenticated client (CVSS vector contains PR:N) publish attacker-controlled payloads into ACL-protected topics it is not permitted to write to. The attacker sets a restricted topic as the Will Topic in the CONNECT packet and then drops the connection abnormally (for example with a TCP RST) so the broker fires the Will through PostOffice.publishWill() → publish2Subscribers() without ever calling authorizator.canWrite(), the check that guards normal QoS 0/1/2 PUBLISH paths. The published CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N); our independent assessment concurs on network reachability, no privileges and no user interaction, with integrity-only impact, though it rates the per-event integrity effect as low because each bypass delivers only a single message (repeatable by reconnecting). No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in 0.18.1.
Denial of service in Apache Neethi before 3.2.4 lets unauthenticated remote attackers pin CPU for extended periods by supplying a crafted pair of WS-Policy documents to an application that runs them through Neethi's policy-intersection logic. The flaw is an uncontrolled resource-consumption issue (CWE-770) in which a small, carefully constructed input drives exponential work, and CISA's SSVC framework rates it automatable; no public exploit code has been identified at time of analysis. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), confidentiality and integrity are untouched and scope is unchanged, so practical exposure is limited to SOAP/web-services deployments that actually intersect untrusted, client-supplied policy documents.
Denial of service in Apache Neethi before 3.2.4 allows unauthenticated remote attackers to exhaust server CPU and memory by submitting a small WS-Policy document that contains repeated policy references, which Neethi re-expands exponentially during normalization. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), with impact limited to availability - there is no confidentiality or integrity loss. Practical exposure is bounded: only applications that actually parse and normalize attacker-supplied WS-Policy (typically SOAP/web-service endpoints built on Apache Axis2 or CXF) are reachable, and no public exploit identified at time of analysis. This is a genuine but bounded availability risk, and upgrading to 3.2.4 removes the flaw.
Heap exhaustion in Apache Neethi versions before 3.2.4 lets unauthenticated remote attackers exhaust server memory by submitting a crafted WS-Policy document whose oversized policy assertion is copied into memory without being counted against Neethi's size limits, resulting in denial of service. The issue is availability-only (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and reachable only where an application actually parses attacker-supplied WS-Policy input, most commonly SOAP endpoints built on Apache Axis2 or CXF. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), so the practical risk is bounded by whether untrusted WS-Policy documents reach the parser.
Stack exhaustion in Apache Neethi before 3.2.4 lets an unauthenticated remote attacker crash the WS-Policy parser by supplying a policy document whose element nesting is deep enough to slip past Neethi's nesting-depth guard and drive unbounded recursion until the thread stack is exhausted. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) the impact is availability-only: no confidentiality or integrity loss, but a successful parse failure can take down the parser thread and potentially the hosting SOAP endpoint. The practical reachability condition is that the target application must actually hand attacker-controlled WS-Policy content to Neethi - typical of Apache Axis2 or CXF-based WS-* services that accept client- or peer-supplied policy - whereas deployments that only parse locally configured, trusted policy are not exposed; no public exploit code was identified at time of analysis and neither CISA KEV nor EPSS data accompanies this record.
Azkaban through 4.0.0 fails to enforce project-level permission checks in the ScheduleServlet fetchSchedule action, letting any authenticated user read the scheduling configuration of projects they do not own or have rights to. A logged-in attacker who supplies arbitrary project and flow identifiers can retrieve execution times, cron expressions, flow parameters, and notification email lists belonging to other teams. This is a read-only confidentiality exposure (CWE-862 missing authorization) with no code execution or data modification, exploitation requires a valid account (CVSS 3.1 PR:L), and no public exploit code or CISA KEV active-exploitation listing was identified at time of analysis.
Remote code execution in IBM MQ Java and JMS client libraries allows an authenticated attacker with access to a message queue or topic to bypass the deserialization allow-list filter in exception handling and execute arbitrary code on client applications. The flaw is network-reachable but requires low-privileged authentication (PR:L) and is limited to a specific exception-handling path (AC:H), with impact confined to the client process rather than the MQ server. No public exploit code was identified at time of analysis.
Authenticated code injection in XWiki Rendering (the xwiki-rendering-xml module, versions before 14.10.2) lets any user who can edit their own user profile - or any other document - close the surrounding HTML macro and inject Groovy or Python script macros that execute with programming rights, granting remote code execution and unrestricted read/write access to all wiki contents. Exploitation requires only a low-privilege, authenticated account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, severity 9.9) and needs no victim interaction beyond the affected page being rendered; the attacker reaches the flaw through rendered output that is embedded in an HTML macro without escaping, with exploitable sinks including the user profile (since XWiki syntax 2.0, demonstrably exploitable from XWiki 3.3 Milestone 1) and the extension point org.xwiki.platform.search.ui.docdoesnotexist (added in XWiki 8.3 Milestone 1). No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the vendor advisory documents a detailed reproduction payload and the scope change (S:C) combined with high confidentiality, integrity and availability impact makes this a genuine high-priority issue; vendors have released the fix in XWiki 14.10.2 and 15.0 RC1.
Improper handling of HTTP/2 and HTTP/3 Extended CONNECT requests in Netty-based services can downgrade them to ordinary CONNECT requests, enabling request-smuggling or desynchronization in deployments where a fronting proxy and backend interpret the downgraded request differently. The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning unauthenticated remote attackers can affect integrity, though the independent assessment raises attack complexity to High and scope to Changed and limits practical impact to proxy/gateway mismatches on endpoints that accept HTTP/2 or HTTP/3 Extended CONNECT. No CISA KEV entry or public exploit code was identified at time of analysis, so priority is moderate and conditional rather than urgent.
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat middleware lets a remote, unauthenticated attacker smuggle requests across the HTTP/1-to-HTTP/2 protocol boundary, overriding the :authority pseudo-header that downstream services use for routing and authorization. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N = 8.2 High) rates integrity as the dominant impact (I:H) with limited confidentiality exposure (C:L) and no availability effect, consistent with a CWE-444 request-smuggling class defect. Exploitation is not confirmed actively exploited (no CISA KEV listing) and no public exploit identified at time of analysis, although real-world exploitation requires a deployment that actually translates HTTP/1 requests into HTTP/2 and a downstream component that trusts :authority for routing or authorization decisions.