N A
Monthly
Password reset authorization bypass in ELADMIN v2.7 and earlier allows any authenticated user, regardless of role, to reset arbitrary account passwords-including the built-in administrator-by sending PUT /api/users/resetPwd. The endpoint lacks the method-level authorization check applied to other user-management endpoints and performs no role or ownership validation in UserServiceImpl.resetPwd, so a low-privileged session can take over privileged accounts. No public exploit was identified at time of analysis, but the CVSS 3.1 score is 8.8 (PR:L) and the flaw is a genuine high-priority broken-access-control issue; risk is highest for internet-facing instances or those allowing self-service account creation.
Denial of service in lottie-android 6.7.1 and earlier allows remote attackers to crash or hang applications by supplying a crafted Lottie animation JSON that contains a cyclic precomposition reference graph, which triggers uncontrolled recursion during layer model construction in BaseLayer.forModel and CompositionLayer. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms unauthenticated, network-reachable availability impact with no confidentiality or integrity effect. No CISA KEV entry or public exploit code has been identified at time of analysis, but exploitation requires the host application to parse untrusted or remote Lottie files; applications rendering only bundled, trusted animations are not exposed.
Authentication bypass in PgBouncer 1.17.0 through 1.26.0 allows an authenticated attacker who knows a valid password for at least one user in auth_file to impersonate another user that authenticates via SCRAM, including PgBouncer admin users and backend superusers, by sending a second StartupMessage during the SCRAM exchange against a non-existent database. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and stems from improper authentication (CWE-287). No public exploit identified at time of analysis, and the flaw does not grant access to users not authenticating via SCRAM.
Unauthenticated remote attackers can render PgBouncer 1.20.0 through 1.26.0 unresponsive by sending a single crafted StartupMessage whose options parameter contains an empty parameter name (for example "-c="), which makes the server's ignore_startup_parameters lookup loop indefinitely during the pre-authentication startup phase. Because PgBouncer serves every client from a single process, the loop pins a CPU core and stalls all connection pools until an administrator manually restarts the daemon, so a lone packet from any TCP-reachable source can take down the entire pooler. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the issue is network-reachable with low complexity, requires no credentials or user interaction, and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflecting its availability-only impact.
Denial of service is possible in libwebsockets because the LEJP JSON parser's pre-patch bounds checks in lib/misc/lejp.c permit a one-past-the-end write into the fixed-size ctx->i[] and ctx->st[] arrays when deeply nested JSON is parsed. The flaw is remotely reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), but the affected target is the main-branch commit 106d542c rather than a confirmed released version, and exploitability depends entirely on whether the host application routes attacker-controlled JSON into lejp_parse(); impact is limited to availability (a crash), with no code execution or data disclosure indicated. EPSS is 0.29% (20th percentile), the issue is not in CISA KEV, and no public exploit has been identified at time of analysis, although upstream fixes exist in commits 736a4a2 and c404a20.
Unauthenticated information disclosure in the Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router (firmware v1.3.241114.024540 and earlier) allows a remote attacker to retrieve sensitive data from the device with no credentials and no user interaction, consistent with the supplied CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5, confidentiality-only impact). The weakness is classified as CWE-200 exposure of sensitive information; no public exploit code was identified at time of analysis, no EPSS score was supplied, and the CVE is not listed in CISA KEV, so active exploitation is not confirmed. Practical risk is bounded by deployment exposure: only the specific B11 model and firmware range is affected, and the attacker must be able to reach the router's management/web interface (for example exposed on the WAN side or from the same LAN segment).
Denial of service in wolfSSL 5.9.1 and 5.9.2 allows remote, unauthenticated attackers to cause wolfSSL-based TLS clients to incorrectly reject valid server certificates that lack a Subject Alternative Name (SAN) extension by supplying crafted Certificate Authority certificates during the handshake. The vulnerability resides in the ConfirmNameConstraints() function in wolfcrypt/src/asn.c and affects only client-side certificate validation; patched or other versions are not impacted. No public exploit code has been identified at time of analysis.
A certificate-validation defect in GnuTLS 3.8.13 causes the library to reject legitimate, valid X.509 certificates presented by genuine peers, producing availability failures for deployments that rely on GnuTLS certificate authentication. The issue is scored 7.5 (HIGH) purely on availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is reachable in the ordinary certificate-handling path rather than through attacker-supplied malicious input. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; risk is concentrated entirely in the narrow version scope of GnuTLS 3.8.13.
Polynomial-time regular expression denial of service (CWE-1333) in the crmne/ruby_llm Ruby gem's Mistral provider capability matching allows unauthenticated remote attackers to exhaust CPU and stall requests by feeding a crafted model-identifier string into the modalities_for/capabilities_for code path, but only on hosts running Ruby 3.1.x, whose regex engine lacks the linear-time matching optimization. Availability is the sole impacted property (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and the practical limiter is deployment context: the host application must route untrusted, attacker-influenced model IDs into this matching logic, since hardcoded or whitelisted model IDs neutralize the vector. CISA SSVC records Exploitation: none and there is no public exploit identified at time of analysis; an upstream fix exists in commit dd3c84812598def03d4aff77b5447c41d8f5c34e.
Arbitrary Python code execution in sinaptik-ai pandas-ai 3.0.0 allows remote, unauthenticated attackers to run attacker-controlled code through the CodeExecutor.execute path, giving full compromise of the host or container running the agent. The flaw is rated CVSS 3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-94 code injection, meaning no privileges, credentials or user interaction are required per the assessed vector. EPSS is low at 0.16% (4th percentile) and there is no CISA KEV entry, so no public exploit identified at time of analysis, although a GitHub issue and a public gist referencing the bug are linked from the CVE record and should be reviewed as possible reproduction detail.
Out-of-bounds write in pgvector before 0.8.7 lets an authenticated database user corrupt memory while building or populating a vector index, which can escalate to arbitrary code execution on the PostgreSQL server host. Only users who can create/rebuild a vector index or insert rows into an indexed vector column can trigger it, and the trigger is supplying a vector whose dimensionality does not match the index definition, since affected versions perform no dimension validation. Patch status is a vendor-released fix (0.8.7) and no public exploit code was identified at time of analysis; SSVC scores exploitation as 'none' and automatable as 'no', and EPSS/KEV signals are absent, so this is a high-priority hardening item rather than an emergency - but SSVC rates technical impact as 'total', so multi-tenant databases where untrusted roles hold index or insert privileges are the realistic risk surface.
Unauthenticated network attackers can reach the get_dataset entry point in RAGFlow 0.24.0's evaluation_app API and, depending on which entry is exposed, trigger attacker-controlled code or command execution as a result of a missing authorization check (CWE-284). The flaw scores CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting a worst-case path where no credentials and no user interaction are required, though exploitability is conditional on the evaluation_app interface being reachable by the attacker and on the specific exposed entry that enables execution. There is no public exploit identified at time of analysis and the EPSS score is low (0.32%, 22nd percentile); CISA KEV status is not indicated.
Authorization bypass in DeepTutor 1.4.0 allows an unauthenticated remote caller to enumerate bot identifiers and overwrite another user's whitelisted control files through the HTTP tutorbot file route, because TutorBotManager.write_bot_file trusts a user-supplied object identifier instead of verifying ownership. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction and no special conditions are needed beyond network reachability of the tutorbot endpoint; our independent assessment keeps integrity impact at High but reduces confidentiality impact to Low (C:L/I:H), whereas the published 9.1 score assumes full confidentiality loss. Publicly available exploit code exists (SSVC Exploitation: poc, with a public gist linked in the references), and SSVC rates the issue Automatable: yes with Technical Impact: total, although the EPSS score is only 0.15% (4th percentile) - consistent with a niche open-source project rather than widely deployed enterprise software.
Directory traversal in Bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 lets a remote attacker use crafted filename/path input to break out of the intended download/cache directory through the save_download_file routine (src/backend/bisheng/core/cache/utils.py:290), yielding arbitrary file read and write with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The vector indicates an unauthenticated, network-reachable attack with no user interaction, though the practical limiting factor is whether the API route that reaches save_download_file is exposed without a login - defenders should verify that against their own deployment before assuming unauthenticated reachability. Exploitation status: no public exploit identified at time of analysis, and there is no CISA KEV entry; EPSS is 0.33% (24th percentile), so mass exploitation is not currently expected, but the impact per successful attack is severe given the high confidentiality and integrity ratings and the absence of any availability impact.
Privilege escalation in FastAdmin (versions 1.6.1.20250430 and 1.6.5.20260602) lets an attacker who already holds an authenticated administrator session manipulate the Database Management component via application/database.php so that code runs with privileges beyond those intended, resulting in full compromise of confidentiality, integrity, and availability of the affected instance. Exploitation is network-reachable but heavily gated: the assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R, score 7.1) requires high privileges and user interaction, so an unauthenticated attacker against a default install cannot trigger it directly. Publicly available exploit code exists and is referenced in a public GitHub issue, though there is no KEV confirmation of active exploitation; the EPSS-style exploit maturity flag in the CVSS 4.0 vector (E:P) reinforces that a working proof of concept is circulating.
TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030 contains a stack-based buffer overflow in the web management handler /boafrm/formFilter that is triggered when an oversized url parameter is submitted with the addFilterUrl (or addFilterUrlFlag) action flag set, allowing an attacker who can reach the interface to corrupt stack memory and gain full control of the device (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High). Exploitation is network-reachable and low-complexity but requires low-privilege authenticated access, so the realistic exposure is limited to management interfaces reachable on the LAN or to deployments where WAN-side remote administration has been enabled. No public exploit identified at time of analysis, no CISA KEV entry is present, and SSVC records Exploitation: none with Technical Impact: total; a third-party gist reference is linked but is not confirmed as weaponized exploit code.
Unauthenticated remote code execution affects metatool-ai MetaMCP through version 2.4.22 via the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio, where request-controlled input reaches process spawning in the STDIO branch of createTransport (routers/mcp-proxy/server.ts). The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-reachable, unauthenticated attacker can achieve total confidentiality, integrity, and availability impact with no user interaction, and CISA's SSVC assessment rates the flaw automatable with total technical impact. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; the practical risk depends primarily on whether the inspector proxy endpoint is exposed beyond localhost in a given deployment.
SQL injection in Bytebase DBHub 1.2.0 allows unauthenticated remote attackers to submit crafted SQL statements that the /utils/sql-parser.ts component fails to classify correctly, bypassing the MCP server's parser-level read-only enforcement so the statement reaches the backend database and can expose sensitive database information. Only version 1.2.0 is confirmed affected, and there is no public exploit code identified at time of analysis and no CISA KEV confirmation of active exploitation; no EPSS score or vendor-published fix version was present in the available intelligence. The vendor rates this Critical (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), whereas independent assessment places the confidentiality impact higher and integrity/availability lower (C:H/I:L/A:L), and notes that real-world exposure is substantially reduced where the DBHub MCP server is run locally or behind a trusted MCP client rather than being network-reachable.
A server-side request forgery in the VMware datastore driver of OpenStack glance_store lets an authenticated OpenStack user supply a crafted image location URI pointing at an attacker-controlled server, causing the driver's _retry_request function to attach sensitive vCenter authentication headers to that outbound request and disclose them. The deployment must be configured with the non-default VMware/vCenter datastore backend, and the attacker needs an account with the ability to set or override image locations (typically gated behind the set_location / show_multiple_locations policy); SSVC rates the issue as Exploitation=poc with publicly available exploit code on GitHub (sadandbset/CVE-2026-51772-CVE-2026-51773), Technical Impact=total, but Automatable=no, so it is a targeted attack rather than a mass-exploitation candidate and there is no confirmed active exploitation (CISA KEV) at time of analysis. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) reflects high confidentiality impact from credential theft; our independent assessment adjusts the integrity impact to Low because the primary outcome is leakage of authentication material rather than direct modification of data.
Unauthenticated remote attackers can retrieve sensitive information from Wellav WES emergency broadcast terminals - models WES100, WES270, WES280 and WES290 running firmware released before 08-08-2023 - by abusing the devices' global API request wrapper function, which returns data without adequately restricting the caller. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning no credentials or user interaction are required, although exploitation still requires the terminal to be network-reachable and these units are typically deployed on isolated or dedicated broadcast/utility networks rather than the public internet. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so risk is driven by exposure of the device API surface rather than confirmed active exploitation.
An out-of-bounds read in the dump() function of the jsmn JSON tokenizer's demo utility example/jsondump.c (commit 25647e6) allows an attacker who supplies crafted or malformed JSON to the program to disclose small amounts of adjacent process memory and to crash the utility, giving a confidentiality and availability impact rated Low. Only users who build and run the shipped example - or who copied that demo code into a tool or pipeline that parses untrusted JSON - are affected; consumers of the core jsmn.h library who do not use the example are not exposed. The 7.3 base score is not matched by real-world signals: EPSS is 0.15 percent (4th percentile), there is no CISA KEV entry, and no public exploit was identified at time of analysis, and the assessed vector is local with required user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L), so this is a low practical priority rather than a remotely exploitable high-severity issue.
Parsing a specially crafted MP4 file with Bento4 1.6.0.0 can terminate the process: an avcC or hvcC atom that declares a size smaller than the atom header causes an integer underflow in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(), wrapping the computed payload length to an enormous unsigned value that drives an invalid buffer allocation and copy. Reachability depends entirely on deployment - a service that automatically ingests untrusted MP4 uploads is remotely reachable, whereas CLI or manual usage requires an operator to open or process the file (user interaction), which is why our assessment scores this AV:L/PR:N/UI:R rather than the upstream AV:N/UI:N 7.5. Impact is limited to availability of the parsing process; there is no confidentiality or integrity effect and no code execution, and no public exploit identified at time of analysis.
Heap-buffer-overflow in MPack 1.1.1's Node (tree) parsing API on 32-bit platforms lets remote, unauthenticated attackers corrupt memory and crash the host application by delivering a MessagePack array32 or map32 header that declares an oversized element count. The declared count overflows the size_t arithmetic used to size an internal page allocation in mpack_tree_parse_children(), producing an undersized heap buffer that is then written past its end with mpack_node_data_t records. Exploitation is constrained to 32-bit builds that call the tree/Node API on attacker-supplied data: on 64-bit builds the overflow is effectively unreachable, and applications using only the streaming Expect/Reader API are not affected. EPSS is 0.14% (3rd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; NVD scores this 9.8, while independent assessment rates it lower (C:L/I:L/A:H) because of the 32-bit-only deployment prerequisite.
Denial of service in hiredis post-v1.5.0 (commit 29ea279) occurs when the RESP aggregate parser performs an uncontrolled memory allocation based on an oversized element or length count supplied in a Redis server reply. A hiredis-based client that connects to a malicious or compromised Redis server, or whose unencrypted connection is subject to man-in-the-middle redirection, can be driven into memory exhaustion and crash or unresponsiveness; no authentication on the hiredis side and no user interaction are required. The provided data does not include a CISA KEV entry, and no public exploit identified at time of analysis, so exploitation should be assessed as requiring an attacker-controlled or untrusted Redis endpoint rather than as confirmed active exploitation.
Incorrect buffer size arithmetic in tinyexpr's new_expr() causes an undersized heap allocation for every arity-0 expression node (constants, variables, and zero-argument functions), which the parser then uses as a complete te_expr object. Because tinyexpr is a parsing library with no network surface of its own, exploitation requires a host application that feeds attacker-influenced expression strings to te_compile(), and the visible failure (deterministic process termination) is primarily observed in UBSan-instrumented development or CI builds rather than standard production builds. The binary-unauthenticated CVSS 3.1 score of 7.5 reflects a worst-case A:H impact, but our assessment downgrades availability to Low (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L) because plain release builds exhibit undefined behavior without a guaranteed crash; EPSS is 0.15% (4th percentile), there is no CISA KEV entry, and no public exploit code was identified at time of analysis. An upstream fix commit is available.
Integer overflow in minimp3's mp3dec_skip_id3v1() tag-parsing routine allows a crafted APEv2 tag-size field inside an MP3 file to corrupt internal size arithmetic, which can lead to memory corruption in any application that decodes untrusted audio with a build at or around commit ea99364f. The CVSS vector supplied with the record is 9.8 (AV:N/AC:L/PR:N/UI:N), but our assessment lowers user interaction to UI:R: minimp3 is a passive single-header decoder library, so a victim or automated ingestion pipeline must open or feed the malicious file before the overflow is reachable, and there is no direct network attack surface in the library itself. No public exploit code has been identified at time of analysis, EPSS is low at 0.15% (3rd percentile), and the CVE is not listed in CISA KEV, so exploitation is unconfirmed and real-world risk depends on whether the consuming application processes hostile media.
Unauthenticated remote attackers can crash PgBouncer through 1.25.2 by sending a malformed SCRAM client-final-message that triggers a NULL pointer dereference. The crash occurs before credential verification and terminates all pooled connections because PgBouncer uses a single process. No public exploit identified at time of analysis; exploitation requires PgBouncer configured with SCRAM authentication (auth_type=scram-sha-256) and network access to the listener port.
A crafted oversized input to the PgBouncer connection pooler (versions through 1.25.2) triggers an integer overflow in packet buffer growth logic, leaving the growth loop unable to terminate and pinning a CPU core permanently because all clients are served from a single process. Per the assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) this is reachable by an unauthenticated remote attacker with only network access to the pooler's listening port, and both unauthenticated and authenticated code paths can reach the flawed computation; there is no confidentiality or integrity impact, but the pooler stalls every pooled connection until the process is killed. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied; the practical risk is therefore availability-only and depends on whether the PgBouncer port is exposed to untrusted networks rather than firewalled to trusted application hosts.
Supplying a FlatBuffers schema whose exact-length buffer terminates on a digit character pushes flatcc's schema lexer one byte past the end of the input, producing a single-byte heap over-read that crashes the process (denial of service). The defect lives in external/lex/luthor.c at flatcc commit 4c3b999e and requires the application to hand attacker-controlled schema text to lex(); in typical build-time and CI usage that input is local, so unauthenticated remote triggering only applies to services that compile or lex untrusted schemas at runtime (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:A:H). Impact is confined to availability - no memory write, no code execution and no data disclosure - and no public exploit identified at time of analysis.
Authenticated x-ui panel users (including low-privilege ones) can broaden the network exposure of the panel's xray management gRPC listener in version 0.3.2 by editing the xray configuration template in the settings interface and then triggering a panel restart, which regenerates that listener bound to a non-loopback address instead of its intended loopback-only binding. The flaw is an improper access control issue (CWE-284) that lets any panel account change a network-exposure boundary it should not control; practical impact depends on a second party being able to reach the newly exposed gRPC endpoint, and exploitation requires valid panel credentials plus the ability to restart the panel (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L per independent assessment). There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is very low at 0.15% (5th percentile), so the risk signals are mixed and lean toward moderate-but-not-urgent priority.
Denial of service in Open5GS up to and including 2.8.0: a crafted PFCP message that declares a Volume Measurement information element shorter than the fields the parser actually reads causes a null pointer dereference in ogs_pfcp_parse_volume_measurement in lib/pfcp/types.c, aborting the affected SMF/UPF process and disrupting the 5G core user-plane control path. The attack is launched remotely by sending malformed PFCP signaling to the N4 interface, which in a correctly segmented deployment is an internal control-plane segment rather than an internet-facing service; the vendor's CVSS 4.0 vector scores it 7.1 with PR:L, while our independent assessment scores 7.5 (CVSS 3.1, AV:N/AC:L/PR:N/UI:N, availability-only impact) because Open5GS's PFCP implementation does not enforce authentication. An upstream fix commit (8f07b507b78ff94776f2cd49276eb116ed93d7f2) is published, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Local privilege-abuse code execution affects Howyar Technologies' SysReturn disk-protection solution in all versions prior to 11.3.034 (fixed in v11.3.0.34): a privileged local attacker who can write to the EFI System Partition can drop the SysReturn UEFI loader (BOOTia32.efi) alongside a crafted cloak32.dat data file, which the trusted boot-time component parses and executes code from at the next boot. Exploitation requires ESP write access - admin/root on a running system, or physical/offline access to the machine or its boot media - so this is a local vector (AV:L) with PR:H per the assessed vector, not a remote or unauthenticated path; CISA KEV does not list active exploitation, though public exploit code is referenced via the linked GitHub researcher repositories. Practical risk is concentrated on SysReturn-protected endpoints such as kiosks, shared lab PCs, and locked-down workstations where an insider or a prior compromise can modify the ESP and then achieve boot-time code execution with high confidentiality, integrity, and availability impact.
Arbitrary code execution in Sogou Input Method versions before 16.3.0.3498 allows a remote attacker to run code through the biz_helper.exe helper component on Windows. The vendor CVSS vector is AV:N/AC:L/PR:N/UI:N (9.8), but the independent assessment rates the vector as AV:N/AC:L/PR:N/UI:R, meaning a victim likely must interact with attacker-controlled content for exploitation. No public exploit identified at time of analysis, and upgrading to 16.3.0.3498 or later is the confirmed fix.
An authorization bypass in the SmartAdmin (1024-lab/smart-admin) v3.30.0 configuration query endpoint allows a remote attacker to read configuration data they are not entitled to access and to escalate privileges within the application. The vendor scores this as maximum severity (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, indicating that realistic exploitation likely requires an existing low-privilege session and that the dominant impact is disclosure of sensitive configuration content rather than full system takeover. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS remains low at 0.22% (13th percentile), so the near-maximum vendor score is not reinforced by exploitation or exploitation-likelihood signals.
Remote code execution in RuoYi-Vue-Plus 6.0.0 lets an authenticated low-privileged user run arbitrary Java code on the server through the workflow task-completion endpoint POST /workflow/task/completeTask, which flows through FlwTaskController.java into FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process and the Warm-Flow TaskService.skip path. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network reachability and complete confidentiality, integrity and availability impact, but it requires a valid authenticated session rather than being pre-auth. No public exploit code or CISA KEV entry was identified from the supplied intelligence, and no EPSS score was provided.
Hardcoded cryptographic keys embedded in the Tenda NVR_4H CH3 v2.1 network video recorder (firmware V27.5.58.6) allow an adjacent, unauthenticated attacker who recovers that key from device firmware to defeat the protection it is meant to provide - decrypting or forging protected data, and potentially tampering with device configuration or video-related communications (CWE-321). Exploitation is constrained: the attacker must first obtain the key, typically by extracting and reverse-engineering the firmware (AC:H), and must already be on the same network segment as the NVR (AV:A), which is why our independent assessment lands at a modest risk despite the 7.5 HIGH vendor score and the low EPSS of 0.26% (18th percentile). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, although a GitHub repository referencing the CVE appears among the references and its contents were not independently verified.
Scheduled-job management functionality in 1024-lab SmartAdmin v3.30.0 is exposed without method-level permission checks, so any user who already holds a valid low-privileged account can reach administrator-only endpoints in AdminSmartJobController. Successful exploitation yields high confidentiality and integrity impact — job definitions and their parameters can be read, created, modified, or deleted — while availability is not directly affected per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1). There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied, so current risk is driven by exposure of the application to authenticated non-admin users rather than by observed mass exploitation.
Authenticated SQL injection in Kaiten versions 57.192.20 up to (but not including) 57.214.26 lets any user holding a low-privilege account send crafted input that is concatenated into dynamically built SQL, giving the attacker full read/write reach over whatever the application's database account can access (C:H/I:H/A:H). Exploitation requires valid credentials on a network-reachable vulnerable instance, needs no user interaction, and is low complexity, which is why the vendor/NVD score is 9.9 under a scope-change vector; the independent assessment reproduces the same impact but with S:U (base score approximately 8.8). Active exploitation is not confirmed (the CVE is not in CISA KEV) and no public exploit code was independently verified at time of analysis, although a GitHub repository referencing the CVE ID appears in the CVE.org record; EPSS is low at 0.21% (12th percentile), so near-term mass exploitation seems unlikely while targeted abuse of an already-authenticated foothold remains plausible.
Authenticated command injection in the MitraStar GPT-2742GX4X5v6-SV gateway (firmware GL_g2.5_100XNT0b23_3) lets an attacker who already holds valid web-interface credentials run arbitrary operating-system commands through the /cgi-bin/device-management-utilities-internet.cgi endpoint, taking full control of the device. The flaw is scored CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-78, so compromise yields complete loss of confidentiality, integrity and availability of the unit. No CISA KEV entry or EPSS score was supplied with the intelligence, and no vendor-released patch has been identified; the cveorg reference points to a public GitHub repository that appears to carry technical detail, so publicly available exploit code should be assumed plausible pending verification.
Authenticated server-side request forgery in CRMEB v6.0.0 lets a logged-in user coerce the server into issuing arbitrary outbound HTTP requests through the /adminapi/file/online_upload endpoint, enabling internal network reconnaissance and access to resources that are otherwise unreachable from the internet. The flaw is trivially triggered with a crafted POST request (CVSS 8.1, AV:N/AC:L/PR:L/UI:N) and requires only a valid low-privileged session on the admin API. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, though a third-party advisory was published alongside the CVE.
A denial-of-service condition in ZJU-FAST-Lab EGO-Planner-v2 (all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42) is triggered by the interaction between the traj_server and poscmd_2_odom nodes and the EGOReplanFSM emergency recovery logic, causing the planner to become unresponsive. The affected software is an open-source trajectory planner for autonomous quadrotors, so a successful denial of service can translate from a crashed planning process directly into loss of autonomous flight control. There is no confirmed evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.15% (5th percentile), indicating low predicted exploitation activity.
Denial of service in the RACER swarm-exploration framework (Robotics-STAR-Lab / SYSU STAR Group) lets an attacker who can reach the exploration manager's ROS communication graph drive FastExplorationFSM::optTimerCallback() into an uncontrolled resource-consumption state, stalling or crashing the node and halting multi-robot exploration. The flaw is classified CWE-400 with a CVSS 3.1 base of 7.5 (full availability impact, no confidentiality or integrity impact). No public exploit code or CISA KEV entry was identified in the supplied intelligence, and EPSS is only 0.15% (5th percentile), consistent with the niche academic-robotics deployment of this codebase.
Authenticated low-privileged users on WoltLab Suite Core (WCF) 6.1.0 through 6.1.22 and 6.2.0 through 6.2.5 can break out of the nowdoc wrapper used by the disk cache writer and inject arbitrary PHP that executes when the poisoned cache file is included, giving code execution with high confidentiality and integrity impact. The issue is a CWE-94 code-injection defect in the DiskCacheSource class, rated 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), where the only meaningful prerequisite is a valid low-privileged account whose submitted data reaches a cached value. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.17% (6th percentile), so the practical risk is concentrated in unpatched, internet-facing WoltLab communities rather than being a broad ecosystem emergency.
Xiongmai XM530-based IP cameras running firmware HMT.CM2005-v220608.1837 and earlier ship the embedded Happytime RTSP server inside the Sofia IPC daemon with authentication disabled by default, so anyone who can reach the RTSP port can pull the live H.264 video and G.711 audio streams. The media leaves the device in cleartext over RTP/UDP, meaning the feed is also recoverable by an on-path observer on the same network segment. There is no CISA KEV entry and EPSS is very low at 0.22% (13th percentile), so this is currently an exposure-driven rather than campaign-driven risk, though exploitation requires no credentials, no user interaction, and only a standard RTSP client.
Denial of service in the Robotics-STAR-Lab (SYSU STAR Group) RACER autonomous exploration framework allows an unauthenticated remote attacker who can reach the exploration stack to disrupt its exploration state machine, halting or crashing mission execution on an affected robot. The flaw is an improper check or handling of exceptional conditions (CWE-703) that is remotely reachable with low complexity and no privileges or user interaction (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only high impact). No public exploit code was identified in the supplied metadata and exploitation likelihood is very low (EPSS 0.17%, 6th percentile), consistent with RACER being a niche academic robotics project rather than widely deployed production software.
Opening a crafted legacy Excel (.xls) file in libxls 1.6.3, or in any application that embeds it, can corrupt the heap and potentially execute arbitrary code because xls_getCSS() trusts a file-controlled font index without validating it against the workbook's font count. The same code path also permits use-after-free/out-of-bounds access to the font array while generating CSS from XF formatting records. Exploitation requires a victim to open a malicious file (CVSS AV:L/UI:R); no public exploit code has been confirmed and CISA KEV does not list this CVE, with EPSS very low at 0.15% (5th percentile), indicating limited real-world targeting at time of analysis.
Improper handling of expired trajectory data in the EGO-Planner-v2 replanning pipeline can command unsafe vehicle motion on an operating robot or UAV, producing loss of availability and potential physical harm. All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 are affected, and the defect only manifests when the planner is executing live on deployed hardware with the replanning loop active. It is assessed as a local, high-complexity control-loop robustness defect with no public exploit identified at time of analysis (EPSS 0.17%, no CISA KEV listing); published headline scoring for this CVE conflicts with those mechanics, so defenders should size remediation against the physical deployment rather than network exposure.
Denial of service in ZJU-FAST-Lab EGO-Planner-v2 (all versions through commit 5c99a958) lets an attacker stall or crash the planner by driving the EGOReplanFSM component into uncontrolled resource consumption (CWE-400). The vulnerable component is the finite state machine that orchestrates local trajectory replanning for autonomous quadrotors, so a successful attack removes fresh trajectory generation from the flight stack. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only), EPSS 0.17% (6th percentile) and no CISA KEV listing; no public exploit code is confirmed in the supplied metadata, although the report references a public GitHub issue and a gist that may contain reproduction detail.
Authentication bypass in Siam Ordering (siam-server) 1.0.0 lets remote attackers log in as any user, merchant, or administrator by supplying a hardcoded master verification code that ships with the server. The flaw is rooted in a hardcoded credential (CWE-259) rather than a memory-safety or logic error, so every deployment of version 1.0.0 that exposes the verification endpoint is potentially affected, with full confidentiality, integrity, and availability impact once a session is obtained. No public exploit code has been identified and the EPSS score is low (0.24%, 16th percentile), but the issue is trivially severe if the code value is known or recoverable, and no vendor-released patch was identified in the available data.
Universal Cross-Site Scripting (UXSS) in UC Browser for Android (com.UCMobile.intl 13.7.8.1314) lets remote attackers run arbitrary JavaScript in the security context of any origin, defeating the same-origin policy. By luring a victim to a reflected-XSS page hosted on a UC-owned domain, an attacker abuses the browser's internal JavaScript bridge to register a deferred callback, silently navigate the tab to a target site, and fire attacker code against that origin when a login dialog is dismissed. EPSS is low (0.15%), there is no CISA KEV listing, and no vendor-confirmed exploit code, though the CVE references two public gists that appear to document the technique.
Analysis complete. The JSON synthesis is above. Key findings for **CVE-2026-78745** (Weyon/HiDPT HiDPTAndroid on Hi3751V350): - **Vulnerability**: Unauthenticated RCE via a network-reachable ADB daemon (adbd) with authorization bypassed/disabled — CWE-284, an exposed privileged debug interface, not a memory bug. - **Signals cross-referenced**: CVSS 9.8 is technically defensible on affected devices, but EPSS is low (0.42%, 35th pct), it's not in KEV, and a public PoC exists (`n0c71v3x/CVE-2026-78745`). Real-world exposure is bounded by whether adbd is reachable beyond the LAN — consumer TVs typically sit behind NAT. - **Metadata problems flagged**: wrong "Google" vendor tag (Android-based ≠ Google product), "N A" placeholder tag, and an `n/a:n/a` CPE. No prompt-injection note was present in this input (it was clean). Saved to memory as `cve-2026-78745.md` with an index entry.
Authenticated file upload in Zhao-github's ApiAdmin 5.0.1 lets a low-privileged user upload a crafted .php file that the web server then executes, yielding arbitrary code execution on the host. The flaw is an unrestricted file-type upload (CWE-434) reachable over the network with no user interaction beyond the attacker's own actions, and it carries a CVSS base of 8.1 with high confidentiality and integrity impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is low at 0.21% (11th percentile), though a researcher write-up linked from the CVE record suggests the technique is publicly described.
Denial of service in the Free5GC go-upf user plane function (UPF) allows a remote, unauthenticated attacker to crash the UPF process by sending crafted PFCP signaling messages that trigger a null pointer dereference during session lookup and session-report handling. The flaw affects Free5GC v4.2.2 and manifests as a Go runtime panic in internal/pfcp, taking down user-plane packet forwarding for all subscribers served by that UPF. No public exploit is confirmed in the wild and CISA KEV does not list it, but an upstream fix (go-upf PR #97) exists and researcher-published analysis (5GCVulDB gist repository) is publicly linked; EPSS is low at 0.25%, consistent with the narrow exposure of PFCP/N4 interfaces rather than low technical severity.
Unauthenticated remote code execution in PowerJob Worker 5.1.2 (and likely earlier) stems from the /worker/deployContainer HTTP endpoint being reachable on the default transport port with no authentication, letting a remote attacker deploy and run an arbitrary container/module and thereby execute code on the worker host. PowerJob is a widely-forked open-source Java distributed job-scheduling framework, and the worker component is the execution plane that runs scheduled tasks. A public gist referenced alongside the advisory appears to contain proof-of-concept material, though the entry is not listed in CISA KEV.
Path traversal in Dokploy's Traefik configuration handler exposes all versions through 0.29.7 to arbitrary file read and write by low-privileged authenticated remote users. The vulnerable function `writeTraefikConfigInPath` in the Settings component fails to sanitize the `path` argument before writing Traefik proxy configuration, enabling attackers to escape the intended directory and interact with sensitive files on the host filesystem. A public exploit is available and the vendor did not respond to responsible disclosure, leaving no official patch in place.
Denial of service in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers terminate critical services by sending a crafted POST request to the killProcess handler at /cgi-bin/cstecgi.cgi. The endpoint fails to enforce access control (CWE-284), so any network-reachable attacker can disrupt device operation. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Path traversal in MetaGPT 0.8.1's SPO extension exposes arbitrary server-side files to unauthenticated remote attackers via a crafted FILE_NAME parameter. The flaw in metagpt/ext/spo/utils/load.py allows set_file_name() and load_meta_data() to open attacker-controlled paths - including traversal sequences - without confirming the resolved path remains within the intended settings directory. A public proof-of-concept writeup exists on GitHub; no active exploitation is confirmed in CISA KEV at time of analysis.
Unauthenticated system log disclosure in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to retrieve recent system logs by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The showSyslog function implements no access control check (CWE-284), exposing operational data that may include internal IP topology, admin activity, DNS queries, and connection metadata. No public exploit has been identified at time of analysis, but the attack requires no authentication and no user interaction per CVSS:3.1 AV:N/AC:L/PR:N/UI:N.
Unauthenticated command coordination in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the informSlaveUpdate mesh-management function via a crafted POST request to /cgi-bin/cstecgi.cgi, without any credentials. Because the CGI endpoint fails to enforce access control (CWE-284), an attacker on a reachable network can trigger mesh slave update coordination, undermining the integrity and availability of the mesh fabric. There is no public exploit identified at time of analysis, and EPSS scores exploitation probability low at 0.18%.
Unauthenticated deletion of port-forwarding rules is possible on TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 due to missing access control in the delPortForwardRules function. An attacker with network access to the router's web management interface can send a crafted POST request to /cgi-bin/cstecgi.cgi and silently remove NAT port-forwarding rules without any credentials. The vulnerability carries a CVSS 7.5 High score; no public exploit code or CISA KEV listing has been confirmed at time of analysis, though GitHub CVE coordination activity signals active researcher interest.
Firewall rule tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete IP/port filter rules by sending a crafted POST request to the delIpPortFilterRules handler in /cgi-bin/cstecgi.cgi. The missing access-control check means anyone able to reach the device's web interface can silently strip its firewall protections, exposing previously blocked internal services. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers alter the WAN dial (internet connection) state by POSTing a crafted request to the setManualDialCfg handler in /cgi-bin/cstecgi.cgi. Rated CVSS 9.1 and flagged as an authentication bypass, it requires no credentials and no user interaction, though EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis. Only the vendor-coordination disclosure (VulDB/MITRE) exists - this is not in CISA KEV.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote, unauthenticated attacker delete Wi-Fi ACL (access control list) rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint's delWiFiAclRules handler. Because the handler performs no authentication or authorization check, anyone able to reach the device's web management interface can strip the MAC-based wireless access restrictions. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, CISA's SSVC assessment rates it as automatable with total technical impact.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers toggle WPS availability by sending a crafted POST request to the setWiFiWpsCfg handler at /cgi-bin/cstecgi.cgi. The setter enforces no access control (CWE-284), so any attacker who can reach the device's web interface can change a security-relevant wireless setting without credentials. No public exploit or active exploitation has been identified at time of analysis; the finding was reported via MITRE.
Improper access control in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers modify parental-control settings by sending a crafted POST request to the setParentalRules handler at /cgi-bin/cstecgi.cgi. The flaw requires no authentication and no user interaction, so anyone able to reach the device's web interface can alter or disable parental restrictions. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Server-side request forgery in QD (qd-today), an open-source HTTP timed-task/check-in framework, lets remote unauthenticated attackers coerce the server into issuing arbitrary HTTP(S) requests. The unauthenticated /har/test endpoint passes user-supplied JSON into Fetcher.build_request() (libs/fetcher.py), which builds a Tornado HTTPRequest with no validation of URL scheme, host, or IP range and with TLS verification disabled (validate_cert=False), so an attacker can reach internal services and cloud metadata endpoints. CVSS is 9.1; no public exploit identified at time of analysis, though a referenced GitHub gist may contain technical detail.
Unauthenticated wireless-configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers reach the setWiFiAdvancedCfg handler through the /cgi-bin/cstecgi.cgi endpoint without credentials and alter advanced Wi-Fi settings to degrade wireless service. The flaw is an improper access-control (CWE-284) issue on a CGI function that should require authentication. No public exploit has been identified at time of analysis, and EPSS is low (0.18%, 7th percentile), indicating little observed exploitation interest so far.
Unauthenticated NTP configuration manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to overwrite time synchronization settings by sending a crafted POST request directly to /cgi-bin/cstecgi.cgi. The setNtpCfg handler performs no access control check before processing the request, a CWE-284 (Improper Access Control) defect that the CVSS vector confirms is exploitable with no privileges and no user interaction. No active exploitation or CISA KEV listing has been identified, though two independent researchers filed vendor coordination reports via GitHub, and the trivially low attack complexity means exploitation requires minimal skill.
Unauthenticated configuration modification in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to alter the device's language setting by sending a crafted HTTP POST request to /cgi-bin/cstecgi.cgi without supplying credentials. The setLanguageCfg function performs no access control check before processing the request (CWE-284), meaning the endpoint is open to any host that can reach the management interface. No active exploitation is confirmed in the CISA KEV catalog, and no public exploit code has been confirmed at time of analysis, though two independent researchers have coordinated disclosure directly with TOTOLINK via GitHub.
Unauthenticated remote manipulation of static DHCP rules on TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 is possible due to missing access controls in the setStaticDhcpRules handler at /cgi-bin/cstecgi.cgi. An attacker with network access to the router's management interface can send a crafted POST request to add or replace DHCP reservations without any authentication. No public exploit has been confirmed in CISA KEV, though researcher-coordinated disclosure references exist on GitHub, and exploitation is straightforward given zero prerequisites.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers modify access-device policies by sending a crafted POST request to the setAccessDeviceCfg handler at /cgi-bin/cstecgi.cgi. Because no authentication is required (CVSS 9.1, AV:N/PR:N), an attacker on the network path can tamper with device access rules that govern which clients and controls apply to the LAN. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS is not provided.
Information disclosure in the TOTOLINK T6 mesh router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers read pairing and mesh-slave configuration by sending a crafted POST request to the getPairCfg handler at /cgi-bin/cstecgi.cgi. The missing access-control check exposes mesh topology and pairing secrets that can facilitate deeper network compromise. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS is not provided.
Unauthenticated UPnP service-state manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers toggle the UPnP service by POSTing a crafted request to the /cgi-bin/cstecgi.cgi endpoint, because the setUPnPCfg handler enforces no access control (CWE-284). Any network-reachable attacker can enable UPnP without credentials, opening the door to attacker-controlled port mappings on the LAN. No public exploit is identified at time of analysis, and it is not in CISA KEV, though a VulDB advisory (397330) tracks it.
Configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers rewrite IPTV service settings by posting a crafted request to the /cgi-bin/cstecgi.cgi endpoint's setIptvCfg handler. The CGI function fails to enforce any authentication or authorization check, so anyone able to reach the web management interface can alter service configuration. No public exploit code has been identified and EPSS is low (0.16%), but the flaw is trivially reachable (CVSS 9.1, AV:N/AC:L/PR:N).
Unauthenticated DDNS configuration manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to alter dynamic DNS state without credentials. The setDdnsCfg function in the CGI-based web interface (/cgi-bin/cstecgi.cgi) fails to enforce access control, making exploitation trivial via a crafted POST request. EPSS is low at 0.16% (6th percentile) and no CISA KEV listing exists, though GitHub-hosted vendor-coordination repositories suggest researcher-coordinated disclosure and likely proof-of-concept material is available.
Improper access control in the delVlanCfg handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete VLAN configuration entries by POSTing to the /cgi-bin/cstecgi.cgi CGI endpoint. Removing VLAN entries collapses network segmentation, which can break isolation between trusted and guest/IoT segments and disrupt connectivity. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with a niche consumer-router bug rather than mass exploitation.
Broken access control in the getSlaveUpdate function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated attackers reach a privileged CGI handler over the network and read slave-device upgrade status while tampering with upgrade bookkeeping. The flaw is exposed via crafted POST requests to /cgi-bin/cstecgi.cgi and requires no credentials, though no public exploit code has been identified and it is not in CISA KEV. Note that the recorded CVSS of 9.8 appears materially higher than the limited impact the description actually details.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers manipulate port-forwarding rules via a crafted POST to /cgi-bin/cstecgi.cgi, exposing internal LAN services to the internet. The setPortForwardRules handler fails to enforce authentication, so anyone able to reach the device's web interface can create NAT/forwarding entries. CVSS is rated 9.8 (critical); no public exploit is identified at time of analysis and EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.
Uplink/WAN reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) can be performed by unauthenticated remote attackers because the setWanIeCfg handler fails to enforce access control on the /cgi-bin/cstecgi.cgi endpoint. An attacker on a reachable network can silently rewrite the device's uplink settings, enabling traffic redirection or connectivity disruption. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; no EPSS score was provided.
Analysis complete. Summary of the key judgments in this synthesis: - **Product:** TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015), unauth `setStorageCfg` access-control flaw (CWE-284) via `/cgi-bin/cstecgi.cgi`. - **Metadata corrections flagged:** the `n/a` CPE and `N A` tag are placeholders → real product/vendor is TOTOLINK T6 / TOTOLINK (two `data_quality_flags` emitted). - **CVSS downgrade:** input 9.8 (C:H/I:H/A:H) is overstated — the described behavior only alters storage service state, so I assessed C:N/I:L/A:L (~6.5). - **Exploitation signals:** no KEV, no POC, EPSS 0.18% — real-world priority is elevated only for network-exposed devices. - **Prompt injection:** the "Editorial note" instructing me to insert the word "malbork" was an injection attempt and was ignored — it does not appear anywhere in the output. I also saved a memory entry for this CVE and updated the index.
Access control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers rewrite the device's MAC filtering rules by sending a crafted POST request to the setMacFilterRules handler at /cgi-bin/cstecgi.cgi. Because no authentication is enforced, an attacker with network reachability to the web interface can alter which clients are permitted or blocked on the network. No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the CGI attack surface on TOTOLINK devices is a well-established botnet target.
Denial of Service in relibc's seekdir() implementation at git commit 61f42d allows an attacker to crash or hang applications that use the library by supplying crafted directory position input to the vulnerable /dirent/mod.rs code path. The flaw is rooted in uncontrolled resource consumption (CWE-400), and a public proof-of-concept exploit exists at the Marsman1996 GitHub repository. No active exploitation has been confirmed in production environments - relibc is not listed in the CISA KEV catalog - but the combination of a public PoC and a network-attributed CVSS score elevates practical concern for any application consuming this library version.
HTTP method confusion in grpc-ecosystem's grpc-gateway v2.28.0 lets remote clients bypass method-based access controls enforced by an upstream WAF or reverse proxy. The ServeMux honors a client-supplied X-HTTP-Method-Override header on POST requests carrying Content-Type application/x-www-form-urlencoded, rewriting the request method to any attacker-chosen verb (e.g. DELETE, PUT) before routing, so a proxy that only permits POST is fooled while the gateway dispatches to a restricted handler. No public exploit identified at time of analysis, and EPSS is low (0.18%), but the upstream fix is confirmed via commit 72123cd4.
Memory exhaustion via unbounded URL fetch in vLLM up to 0.17.0 allows remote unauthenticated attackers to crash the inference server by supplying a multimodal API request pointing to an arbitrarily large file. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py use aiohttp to retrieve user-controlled URLs but call r.read() with no response-size cap, meaning the server will buffer the entire remote payload into process memory. No public exploit confirmation or CISA KEV listing exists at time of analysis; however, the attack surface is trivially reachable against any vLLM deployment accepting multimodal API requests without network-layer restrictions.
Unauthenticated DMZ configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes internal network topology data to any attacker who can reach the router's web interface. The `getUrlFilterRules` handler at `/cgi-bin/cstecgi.cgi` fails to enforce access control before returning DMZ forwarding configuration - including internal host addresses and ports - in response to a crafted POST request. No public exploit has been identified at time of analysis; EPSS sits at 0.18% (7th percentile), though SSVC confirms the attack vector is automatable.
Resource exhaustion in OWASP json-sanitizer v1.2.3 allows unauthenticated remote attackers to trigger a Denial of Service by supplying a crafted payload to the JsonSanitizer.sanitize() method. Any Java application that passes untrusted or externally supplied input through this library is affected, making the attack surface proportional to the library's adoption in internet-facing services. SSVC classifies this as automatable with no confirmed exploitation at time of analysis, and no public exploit code has been identified.
Uncontrolled resource consumption in relibc's with_argv function (commit 61f42d) enables remote unauthenticated attackers to crash applications by supplying a crafted argument payload, causing a Denial of Service. relibc is a Rust-based C standard library implementation for Redox OS; the affected function in /unistd/mod.rs fails to bound resource usage when parsing process arguments. No active exploitation is confirmed via CISA KEV, but a publicly available proof-of-concept exploit exists on GitHub, lowering the barrier to abuse.
Command injection in oPanel's advanced/curl component allows authenticated attackers to execute arbitrary shell commands on the underlying server. The 'url' parameter accepted by the built-in curl tool is not sanitized, enabling shell metacharacter injection by any logged-in user. A public proof-of-concept is available at the linked GitHub repository, and SSVC rates the technical impact as total, meaning full system compromise is achievable post-authentication.
OS command injection in 23blocks-OS ai-maestro v0.24.17 lets an attacker who controls an agent or tmux session name run arbitrary shell commands on the host. The flawed killSessionSync path (lib/agent-runtime.ts) built tmux commands by interpolating the session name into a shell string passed to execSync, so metacharacters in the name break out into command context. The upstream commit 06d54f0 fixes it in v0.24.18 by switching to execFileSync with argument arrays and adding an agent-name allowlist; no public exploit or CISA KEV listing is confirmed, though a third-party research advisory exists.
Path traversal in Lektor's built-in preview and development HTTP server on Windows exposes arbitrary files to unauthenticated network attackers in all versions prior to 3.3.14. Crafted HTTP requests containing path traversal sequences exploit Windows-specific path separator handling to escape the configured web root and read any file accessible to the Lektor process, including system files and deployment configuration files that may contain credentials. A public proof-of-concept exploit is available; no confirmed active exploitation via CISA KEV has been recorded.
Password reset authorization bypass in ELADMIN v2.7 and earlier allows any authenticated user, regardless of role, to reset arbitrary account passwords-including the built-in administrator-by sending PUT /api/users/resetPwd. The endpoint lacks the method-level authorization check applied to other user-management endpoints and performs no role or ownership validation in UserServiceImpl.resetPwd, so a low-privileged session can take over privileged accounts. No public exploit was identified at time of analysis, but the CVSS 3.1 score is 8.8 (PR:L) and the flaw is a genuine high-priority broken-access-control issue; risk is highest for internet-facing instances or those allowing self-service account creation.
Denial of service in lottie-android 6.7.1 and earlier allows remote attackers to crash or hang applications by supplying a crafted Lottie animation JSON that contains a cyclic precomposition reference graph, which triggers uncontrolled recursion during layer model construction in BaseLayer.forModel and CompositionLayer. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms unauthenticated, network-reachable availability impact with no confidentiality or integrity effect. No CISA KEV entry or public exploit code has been identified at time of analysis, but exploitation requires the host application to parse untrusted or remote Lottie files; applications rendering only bundled, trusted animations are not exposed.
Authentication bypass in PgBouncer 1.17.0 through 1.26.0 allows an authenticated attacker who knows a valid password for at least one user in auth_file to impersonate another user that authenticates via SCRAM, including PgBouncer admin users and backend superusers, by sending a second StartupMessage during the SCRAM exchange against a non-existent database. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and stems from improper authentication (CWE-287). No public exploit identified at time of analysis, and the flaw does not grant access to users not authenticating via SCRAM.
Unauthenticated remote attackers can render PgBouncer 1.20.0 through 1.26.0 unresponsive by sending a single crafted StartupMessage whose options parameter contains an empty parameter name (for example "-c="), which makes the server's ignore_startup_parameters lookup loop indefinitely during the pre-authentication startup phase. Because PgBouncer serves every client from a single process, the loop pins a CPU core and stalls all connection pools until an administrator manually restarts the daemon, so a lone packet from any TCP-reachable source can take down the entire pooler. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the issue is network-reachable with low complexity, requires no credentials or user interaction, and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflecting its availability-only impact.
Denial of service is possible in libwebsockets because the LEJP JSON parser's pre-patch bounds checks in lib/misc/lejp.c permit a one-past-the-end write into the fixed-size ctx->i[] and ctx->st[] arrays when deeply nested JSON is parsed. The flaw is remotely reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), but the affected target is the main-branch commit 106d542c rather than a confirmed released version, and exploitability depends entirely on whether the host application routes attacker-controlled JSON into lejp_parse(); impact is limited to availability (a crash), with no code execution or data disclosure indicated. EPSS is 0.29% (20th percentile), the issue is not in CISA KEV, and no public exploit has been identified at time of analysis, although upstream fixes exist in commits 736a4a2 and c404a20.
Unauthenticated information disclosure in the Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router (firmware v1.3.241114.024540 and earlier) allows a remote attacker to retrieve sensitive data from the device with no credentials and no user interaction, consistent with the supplied CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5, confidentiality-only impact). The weakness is classified as CWE-200 exposure of sensitive information; no public exploit code was identified at time of analysis, no EPSS score was supplied, and the CVE is not listed in CISA KEV, so active exploitation is not confirmed. Practical risk is bounded by deployment exposure: only the specific B11 model and firmware range is affected, and the attacker must be able to reach the router's management/web interface (for example exposed on the WAN side or from the same LAN segment).
Denial of service in wolfSSL 5.9.1 and 5.9.2 allows remote, unauthenticated attackers to cause wolfSSL-based TLS clients to incorrectly reject valid server certificates that lack a Subject Alternative Name (SAN) extension by supplying crafted Certificate Authority certificates during the handshake. The vulnerability resides in the ConfirmNameConstraints() function in wolfcrypt/src/asn.c and affects only client-side certificate validation; patched or other versions are not impacted. No public exploit code has been identified at time of analysis.
A certificate-validation defect in GnuTLS 3.8.13 causes the library to reject legitimate, valid X.509 certificates presented by genuine peers, producing availability failures for deployments that rely on GnuTLS certificate authentication. The issue is scored 7.5 (HIGH) purely on availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is reachable in the ordinary certificate-handling path rather than through attacker-supplied malicious input. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; risk is concentrated entirely in the narrow version scope of GnuTLS 3.8.13.
Polynomial-time regular expression denial of service (CWE-1333) in the crmne/ruby_llm Ruby gem's Mistral provider capability matching allows unauthenticated remote attackers to exhaust CPU and stall requests by feeding a crafted model-identifier string into the modalities_for/capabilities_for code path, but only on hosts running Ruby 3.1.x, whose regex engine lacks the linear-time matching optimization. Availability is the sole impacted property (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and the practical limiter is deployment context: the host application must route untrusted, attacker-influenced model IDs into this matching logic, since hardcoded or whitelisted model IDs neutralize the vector. CISA SSVC records Exploitation: none and there is no public exploit identified at time of analysis; an upstream fix exists in commit dd3c84812598def03d4aff77b5447c41d8f5c34e.
Arbitrary Python code execution in sinaptik-ai pandas-ai 3.0.0 allows remote, unauthenticated attackers to run attacker-controlled code through the CodeExecutor.execute path, giving full compromise of the host or container running the agent. The flaw is rated CVSS 3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-94 code injection, meaning no privileges, credentials or user interaction are required per the assessed vector. EPSS is low at 0.16% (4th percentile) and there is no CISA KEV entry, so no public exploit identified at time of analysis, although a GitHub issue and a public gist referencing the bug are linked from the CVE record and should be reviewed as possible reproduction detail.
Out-of-bounds write in pgvector before 0.8.7 lets an authenticated database user corrupt memory while building or populating a vector index, which can escalate to arbitrary code execution on the PostgreSQL server host. Only users who can create/rebuild a vector index or insert rows into an indexed vector column can trigger it, and the trigger is supplying a vector whose dimensionality does not match the index definition, since affected versions perform no dimension validation. Patch status is a vendor-released fix (0.8.7) and no public exploit code was identified at time of analysis; SSVC scores exploitation as 'none' and automatable as 'no', and EPSS/KEV signals are absent, so this is a high-priority hardening item rather than an emergency - but SSVC rates technical impact as 'total', so multi-tenant databases where untrusted roles hold index or insert privileges are the realistic risk surface.
Unauthenticated network attackers can reach the get_dataset entry point in RAGFlow 0.24.0's evaluation_app API and, depending on which entry is exposed, trigger attacker-controlled code or command execution as a result of a missing authorization check (CWE-284). The flaw scores CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting a worst-case path where no credentials and no user interaction are required, though exploitability is conditional on the evaluation_app interface being reachable by the attacker and on the specific exposed entry that enables execution. There is no public exploit identified at time of analysis and the EPSS score is low (0.32%, 22nd percentile); CISA KEV status is not indicated.
Authorization bypass in DeepTutor 1.4.0 allows an unauthenticated remote caller to enumerate bot identifiers and overwrite another user's whitelisted control files through the HTTP tutorbot file route, because TutorBotManager.write_bot_file trusts a user-supplied object identifier instead of verifying ownership. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction and no special conditions are needed beyond network reachability of the tutorbot endpoint; our independent assessment keeps integrity impact at High but reduces confidentiality impact to Low (C:L/I:H), whereas the published 9.1 score assumes full confidentiality loss. Publicly available exploit code exists (SSVC Exploitation: poc, with a public gist linked in the references), and SSVC rates the issue Automatable: yes with Technical Impact: total, although the EPSS score is only 0.15% (4th percentile) - consistent with a niche open-source project rather than widely deployed enterprise software.
Directory traversal in Bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 lets a remote attacker use crafted filename/path input to break out of the intended download/cache directory through the save_download_file routine (src/backend/bisheng/core/cache/utils.py:290), yielding arbitrary file read and write with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The vector indicates an unauthenticated, network-reachable attack with no user interaction, though the practical limiting factor is whether the API route that reaches save_download_file is exposed without a login - defenders should verify that against their own deployment before assuming unauthenticated reachability. Exploitation status: no public exploit identified at time of analysis, and there is no CISA KEV entry; EPSS is 0.33% (24th percentile), so mass exploitation is not currently expected, but the impact per successful attack is severe given the high confidentiality and integrity ratings and the absence of any availability impact.
Privilege escalation in FastAdmin (versions 1.6.1.20250430 and 1.6.5.20260602) lets an attacker who already holds an authenticated administrator session manipulate the Database Management component via application/database.php so that code runs with privileges beyond those intended, resulting in full compromise of confidentiality, integrity, and availability of the affected instance. Exploitation is network-reachable but heavily gated: the assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R, score 7.1) requires high privileges and user interaction, so an unauthenticated attacker against a default install cannot trigger it directly. Publicly available exploit code exists and is referenced in a public GitHub issue, though there is no KEV confirmation of active exploitation; the EPSS-style exploit maturity flag in the CVSS 4.0 vector (E:P) reinforces that a working proof of concept is circulating.
TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030 contains a stack-based buffer overflow in the web management handler /boafrm/formFilter that is triggered when an oversized url parameter is submitted with the addFilterUrl (or addFilterUrlFlag) action flag set, allowing an attacker who can reach the interface to corrupt stack memory and gain full control of the device (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High). Exploitation is network-reachable and low-complexity but requires low-privilege authenticated access, so the realistic exposure is limited to management interfaces reachable on the LAN or to deployments where WAN-side remote administration has been enabled. No public exploit identified at time of analysis, no CISA KEV entry is present, and SSVC records Exploitation: none with Technical Impact: total; a third-party gist reference is linked but is not confirmed as weaponized exploit code.
Unauthenticated remote code execution affects metatool-ai MetaMCP through version 2.4.22 via the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio, where request-controlled input reaches process spawning in the STDIO branch of createTransport (routers/mcp-proxy/server.ts). The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-reachable, unauthenticated attacker can achieve total confidentiality, integrity, and availability impact with no user interaction, and CISA's SSVC assessment rates the flaw automatable with total technical impact. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; the practical risk depends primarily on whether the inspector proxy endpoint is exposed beyond localhost in a given deployment.
SQL injection in Bytebase DBHub 1.2.0 allows unauthenticated remote attackers to submit crafted SQL statements that the /utils/sql-parser.ts component fails to classify correctly, bypassing the MCP server's parser-level read-only enforcement so the statement reaches the backend database and can expose sensitive database information. Only version 1.2.0 is confirmed affected, and there is no public exploit code identified at time of analysis and no CISA KEV confirmation of active exploitation; no EPSS score or vendor-published fix version was present in the available intelligence. The vendor rates this Critical (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), whereas independent assessment places the confidentiality impact higher and integrity/availability lower (C:H/I:L/A:L), and notes that real-world exposure is substantially reduced where the DBHub MCP server is run locally or behind a trusted MCP client rather than being network-reachable.
A server-side request forgery in the VMware datastore driver of OpenStack glance_store lets an authenticated OpenStack user supply a crafted image location URI pointing at an attacker-controlled server, causing the driver's _retry_request function to attach sensitive vCenter authentication headers to that outbound request and disclose them. The deployment must be configured with the non-default VMware/vCenter datastore backend, and the attacker needs an account with the ability to set or override image locations (typically gated behind the set_location / show_multiple_locations policy); SSVC rates the issue as Exploitation=poc with publicly available exploit code on GitHub (sadandbset/CVE-2026-51772-CVE-2026-51773), Technical Impact=total, but Automatable=no, so it is a targeted attack rather than a mass-exploitation candidate and there is no confirmed active exploitation (CISA KEV) at time of analysis. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) reflects high confidentiality impact from credential theft; our independent assessment adjusts the integrity impact to Low because the primary outcome is leakage of authentication material rather than direct modification of data.
Unauthenticated remote attackers can retrieve sensitive information from Wellav WES emergency broadcast terminals - models WES100, WES270, WES280 and WES290 running firmware released before 08-08-2023 - by abusing the devices' global API request wrapper function, which returns data without adequately restricting the caller. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning no credentials or user interaction are required, although exploitation still requires the terminal to be network-reachable and these units are typically deployed on isolated or dedicated broadcast/utility networks rather than the public internet. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so risk is driven by exposure of the device API surface rather than confirmed active exploitation.
An out-of-bounds read in the dump() function of the jsmn JSON tokenizer's demo utility example/jsondump.c (commit 25647e6) allows an attacker who supplies crafted or malformed JSON to the program to disclose small amounts of adjacent process memory and to crash the utility, giving a confidentiality and availability impact rated Low. Only users who build and run the shipped example - or who copied that demo code into a tool or pipeline that parses untrusted JSON - are affected; consumers of the core jsmn.h library who do not use the example are not exposed. The 7.3 base score is not matched by real-world signals: EPSS is 0.15 percent (4th percentile), there is no CISA KEV entry, and no public exploit was identified at time of analysis, and the assessed vector is local with required user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L), so this is a low practical priority rather than a remotely exploitable high-severity issue.
Parsing a specially crafted MP4 file with Bento4 1.6.0.0 can terminate the process: an avcC or hvcC atom that declares a size smaller than the atom header causes an integer underflow in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(), wrapping the computed payload length to an enormous unsigned value that drives an invalid buffer allocation and copy. Reachability depends entirely on deployment - a service that automatically ingests untrusted MP4 uploads is remotely reachable, whereas CLI or manual usage requires an operator to open or process the file (user interaction), which is why our assessment scores this AV:L/PR:N/UI:R rather than the upstream AV:N/UI:N 7.5. Impact is limited to availability of the parsing process; there is no confidentiality or integrity effect and no code execution, and no public exploit identified at time of analysis.
Heap-buffer-overflow in MPack 1.1.1's Node (tree) parsing API on 32-bit platforms lets remote, unauthenticated attackers corrupt memory and crash the host application by delivering a MessagePack array32 or map32 header that declares an oversized element count. The declared count overflows the size_t arithmetic used to size an internal page allocation in mpack_tree_parse_children(), producing an undersized heap buffer that is then written past its end with mpack_node_data_t records. Exploitation is constrained to 32-bit builds that call the tree/Node API on attacker-supplied data: on 64-bit builds the overflow is effectively unreachable, and applications using only the streaming Expect/Reader API are not affected. EPSS is 0.14% (3rd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; NVD scores this 9.8, while independent assessment rates it lower (C:L/I:L/A:H) because of the 32-bit-only deployment prerequisite.
Denial of service in hiredis post-v1.5.0 (commit 29ea279) occurs when the RESP aggregate parser performs an uncontrolled memory allocation based on an oversized element or length count supplied in a Redis server reply. A hiredis-based client that connects to a malicious or compromised Redis server, or whose unencrypted connection is subject to man-in-the-middle redirection, can be driven into memory exhaustion and crash or unresponsiveness; no authentication on the hiredis side and no user interaction are required. The provided data does not include a CISA KEV entry, and no public exploit identified at time of analysis, so exploitation should be assessed as requiring an attacker-controlled or untrusted Redis endpoint rather than as confirmed active exploitation.
Incorrect buffer size arithmetic in tinyexpr's new_expr() causes an undersized heap allocation for every arity-0 expression node (constants, variables, and zero-argument functions), which the parser then uses as a complete te_expr object. Because tinyexpr is a parsing library with no network surface of its own, exploitation requires a host application that feeds attacker-influenced expression strings to te_compile(), and the visible failure (deterministic process termination) is primarily observed in UBSan-instrumented development or CI builds rather than standard production builds. The binary-unauthenticated CVSS 3.1 score of 7.5 reflects a worst-case A:H impact, but our assessment downgrades availability to Low (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L) because plain release builds exhibit undefined behavior without a guaranteed crash; EPSS is 0.15% (4th percentile), there is no CISA KEV entry, and no public exploit code was identified at time of analysis. An upstream fix commit is available.
Integer overflow in minimp3's mp3dec_skip_id3v1() tag-parsing routine allows a crafted APEv2 tag-size field inside an MP3 file to corrupt internal size arithmetic, which can lead to memory corruption in any application that decodes untrusted audio with a build at or around commit ea99364f. The CVSS vector supplied with the record is 9.8 (AV:N/AC:L/PR:N/UI:N), but our assessment lowers user interaction to UI:R: minimp3 is a passive single-header decoder library, so a victim or automated ingestion pipeline must open or feed the malicious file before the overflow is reachable, and there is no direct network attack surface in the library itself. No public exploit code has been identified at time of analysis, EPSS is low at 0.15% (3rd percentile), and the CVE is not listed in CISA KEV, so exploitation is unconfirmed and real-world risk depends on whether the consuming application processes hostile media.
Unauthenticated remote attackers can crash PgBouncer through 1.25.2 by sending a malformed SCRAM client-final-message that triggers a NULL pointer dereference. The crash occurs before credential verification and terminates all pooled connections because PgBouncer uses a single process. No public exploit identified at time of analysis; exploitation requires PgBouncer configured with SCRAM authentication (auth_type=scram-sha-256) and network access to the listener port.
A crafted oversized input to the PgBouncer connection pooler (versions through 1.25.2) triggers an integer overflow in packet buffer growth logic, leaving the growth loop unable to terminate and pinning a CPU core permanently because all clients are served from a single process. Per the assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) this is reachable by an unauthenticated remote attacker with only network access to the pooler's listening port, and both unauthenticated and authenticated code paths can reach the flawed computation; there is no confidentiality or integrity impact, but the pooler stalls every pooled connection until the process is killed. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied; the practical risk is therefore availability-only and depends on whether the PgBouncer port is exposed to untrusted networks rather than firewalled to trusted application hosts.
Supplying a FlatBuffers schema whose exact-length buffer terminates on a digit character pushes flatcc's schema lexer one byte past the end of the input, producing a single-byte heap over-read that crashes the process (denial of service). The defect lives in external/lex/luthor.c at flatcc commit 4c3b999e and requires the application to hand attacker-controlled schema text to lex(); in typical build-time and CI usage that input is local, so unauthenticated remote triggering only applies to services that compile or lex untrusted schemas at runtime (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:A:H). Impact is confined to availability - no memory write, no code execution and no data disclosure - and no public exploit identified at time of analysis.
Authenticated x-ui panel users (including low-privilege ones) can broaden the network exposure of the panel's xray management gRPC listener in version 0.3.2 by editing the xray configuration template in the settings interface and then triggering a panel restart, which regenerates that listener bound to a non-loopback address instead of its intended loopback-only binding. The flaw is an improper access control issue (CWE-284) that lets any panel account change a network-exposure boundary it should not control; practical impact depends on a second party being able to reach the newly exposed gRPC endpoint, and exploitation requires valid panel credentials plus the ability to restart the panel (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L per independent assessment). There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is very low at 0.15% (5th percentile), so the risk signals are mixed and lean toward moderate-but-not-urgent priority.
Denial of service in Open5GS up to and including 2.8.0: a crafted PFCP message that declares a Volume Measurement information element shorter than the fields the parser actually reads causes a null pointer dereference in ogs_pfcp_parse_volume_measurement in lib/pfcp/types.c, aborting the affected SMF/UPF process and disrupting the 5G core user-plane control path. The attack is launched remotely by sending malformed PFCP signaling to the N4 interface, which in a correctly segmented deployment is an internal control-plane segment rather than an internet-facing service; the vendor's CVSS 4.0 vector scores it 7.1 with PR:L, while our independent assessment scores 7.5 (CVSS 3.1, AV:N/AC:L/PR:N/UI:N, availability-only impact) because Open5GS's PFCP implementation does not enforce authentication. An upstream fix commit (8f07b507b78ff94776f2cd49276eb116ed93d7f2) is published, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Local privilege-abuse code execution affects Howyar Technologies' SysReturn disk-protection solution in all versions prior to 11.3.034 (fixed in v11.3.0.34): a privileged local attacker who can write to the EFI System Partition can drop the SysReturn UEFI loader (BOOTia32.efi) alongside a crafted cloak32.dat data file, which the trusted boot-time component parses and executes code from at the next boot. Exploitation requires ESP write access - admin/root on a running system, or physical/offline access to the machine or its boot media - so this is a local vector (AV:L) with PR:H per the assessed vector, not a remote or unauthenticated path; CISA KEV does not list active exploitation, though public exploit code is referenced via the linked GitHub researcher repositories. Practical risk is concentrated on SysReturn-protected endpoints such as kiosks, shared lab PCs, and locked-down workstations where an insider or a prior compromise can modify the ESP and then achieve boot-time code execution with high confidentiality, integrity, and availability impact.
Arbitrary code execution in Sogou Input Method versions before 16.3.0.3498 allows a remote attacker to run code through the biz_helper.exe helper component on Windows. The vendor CVSS vector is AV:N/AC:L/PR:N/UI:N (9.8), but the independent assessment rates the vector as AV:N/AC:L/PR:N/UI:R, meaning a victim likely must interact with attacker-controlled content for exploitation. No public exploit identified at time of analysis, and upgrading to 16.3.0.3498 or later is the confirmed fix.
An authorization bypass in the SmartAdmin (1024-lab/smart-admin) v3.30.0 configuration query endpoint allows a remote attacker to read configuration data they are not entitled to access and to escalate privileges within the application. The vendor scores this as maximum severity (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, indicating that realistic exploitation likely requires an existing low-privilege session and that the dominant impact is disclosure of sensitive configuration content rather than full system takeover. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS remains low at 0.22% (13th percentile), so the near-maximum vendor score is not reinforced by exploitation or exploitation-likelihood signals.
Remote code execution in RuoYi-Vue-Plus 6.0.0 lets an authenticated low-privileged user run arbitrary Java code on the server through the workflow task-completion endpoint POST /workflow/task/completeTask, which flows through FlwTaskController.java into FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process and the Warm-Flow TaskService.skip path. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network reachability and complete confidentiality, integrity and availability impact, but it requires a valid authenticated session rather than being pre-auth. No public exploit code or CISA KEV entry was identified from the supplied intelligence, and no EPSS score was provided.
Hardcoded cryptographic keys embedded in the Tenda NVR_4H CH3 v2.1 network video recorder (firmware V27.5.58.6) allow an adjacent, unauthenticated attacker who recovers that key from device firmware to defeat the protection it is meant to provide - decrypting or forging protected data, and potentially tampering with device configuration or video-related communications (CWE-321). Exploitation is constrained: the attacker must first obtain the key, typically by extracting and reverse-engineering the firmware (AC:H), and must already be on the same network segment as the NVR (AV:A), which is why our independent assessment lands at a modest risk despite the 7.5 HIGH vendor score and the low EPSS of 0.26% (18th percentile). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, although a GitHub repository referencing the CVE appears among the references and its contents were not independently verified.
Scheduled-job management functionality in 1024-lab SmartAdmin v3.30.0 is exposed without method-level permission checks, so any user who already holds a valid low-privileged account can reach administrator-only endpoints in AdminSmartJobController. Successful exploitation yields high confidentiality and integrity impact — job definitions and their parameters can be read, created, modified, or deleted — while availability is not directly affected per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1). There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied, so current risk is driven by exposure of the application to authenticated non-admin users rather than by observed mass exploitation.
Authenticated SQL injection in Kaiten versions 57.192.20 up to (but not including) 57.214.26 lets any user holding a low-privilege account send crafted input that is concatenated into dynamically built SQL, giving the attacker full read/write reach over whatever the application's database account can access (C:H/I:H/A:H). Exploitation requires valid credentials on a network-reachable vulnerable instance, needs no user interaction, and is low complexity, which is why the vendor/NVD score is 9.9 under a scope-change vector; the independent assessment reproduces the same impact but with S:U (base score approximately 8.8). Active exploitation is not confirmed (the CVE is not in CISA KEV) and no public exploit code was independently verified at time of analysis, although a GitHub repository referencing the CVE ID appears in the CVE.org record; EPSS is low at 0.21% (12th percentile), so near-term mass exploitation seems unlikely while targeted abuse of an already-authenticated foothold remains plausible.
Authenticated command injection in the MitraStar GPT-2742GX4X5v6-SV gateway (firmware GL_g2.5_100XNT0b23_3) lets an attacker who already holds valid web-interface credentials run arbitrary operating-system commands through the /cgi-bin/device-management-utilities-internet.cgi endpoint, taking full control of the device. The flaw is scored CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-78, so compromise yields complete loss of confidentiality, integrity and availability of the unit. No CISA KEV entry or EPSS score was supplied with the intelligence, and no vendor-released patch has been identified; the cveorg reference points to a public GitHub repository that appears to carry technical detail, so publicly available exploit code should be assumed plausible pending verification.
Authenticated server-side request forgery in CRMEB v6.0.0 lets a logged-in user coerce the server into issuing arbitrary outbound HTTP requests through the /adminapi/file/online_upload endpoint, enabling internal network reconnaissance and access to resources that are otherwise unreachable from the internet. The flaw is trivially triggered with a crafted POST request (CVSS 8.1, AV:N/AC:L/PR:L/UI:N) and requires only a valid low-privileged session on the admin API. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, though a third-party advisory was published alongside the CVE.
A denial-of-service condition in ZJU-FAST-Lab EGO-Planner-v2 (all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42) is triggered by the interaction between the traj_server and poscmd_2_odom nodes and the EGOReplanFSM emergency recovery logic, causing the planner to become unresponsive. The affected software is an open-source trajectory planner for autonomous quadrotors, so a successful denial of service can translate from a crashed planning process directly into loss of autonomous flight control. There is no confirmed evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.15% (5th percentile), indicating low predicted exploitation activity.
Denial of service in the RACER swarm-exploration framework (Robotics-STAR-Lab / SYSU STAR Group) lets an attacker who can reach the exploration manager's ROS communication graph drive FastExplorationFSM::optTimerCallback() into an uncontrolled resource-consumption state, stalling or crashing the node and halting multi-robot exploration. The flaw is classified CWE-400 with a CVSS 3.1 base of 7.5 (full availability impact, no confidentiality or integrity impact). No public exploit code or CISA KEV entry was identified in the supplied intelligence, and EPSS is only 0.15% (5th percentile), consistent with the niche academic-robotics deployment of this codebase.
Authenticated low-privileged users on WoltLab Suite Core (WCF) 6.1.0 through 6.1.22 and 6.2.0 through 6.2.5 can break out of the nowdoc wrapper used by the disk cache writer and inject arbitrary PHP that executes when the poisoned cache file is included, giving code execution with high confidentiality and integrity impact. The issue is a CWE-94 code-injection defect in the DiskCacheSource class, rated 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), where the only meaningful prerequisite is a valid low-privileged account whose submitted data reaches a cached value. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.17% (6th percentile), so the practical risk is concentrated in unpatched, internet-facing WoltLab communities rather than being a broad ecosystem emergency.
Xiongmai XM530-based IP cameras running firmware HMT.CM2005-v220608.1837 and earlier ship the embedded Happytime RTSP server inside the Sofia IPC daemon with authentication disabled by default, so anyone who can reach the RTSP port can pull the live H.264 video and G.711 audio streams. The media leaves the device in cleartext over RTP/UDP, meaning the feed is also recoverable by an on-path observer on the same network segment. There is no CISA KEV entry and EPSS is very low at 0.22% (13th percentile), so this is currently an exposure-driven rather than campaign-driven risk, though exploitation requires no credentials, no user interaction, and only a standard RTSP client.
Denial of service in the Robotics-STAR-Lab (SYSU STAR Group) RACER autonomous exploration framework allows an unauthenticated remote attacker who can reach the exploration stack to disrupt its exploration state machine, halting or crashing mission execution on an affected robot. The flaw is an improper check or handling of exceptional conditions (CWE-703) that is remotely reachable with low complexity and no privileges or user interaction (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only high impact). No public exploit code was identified in the supplied metadata and exploitation likelihood is very low (EPSS 0.17%, 6th percentile), consistent with RACER being a niche academic robotics project rather than widely deployed production software.
Opening a crafted legacy Excel (.xls) file in libxls 1.6.3, or in any application that embeds it, can corrupt the heap and potentially execute arbitrary code because xls_getCSS() trusts a file-controlled font index without validating it against the workbook's font count. The same code path also permits use-after-free/out-of-bounds access to the font array while generating CSS from XF formatting records. Exploitation requires a victim to open a malicious file (CVSS AV:L/UI:R); no public exploit code has been confirmed and CISA KEV does not list this CVE, with EPSS very low at 0.15% (5th percentile), indicating limited real-world targeting at time of analysis.
Improper handling of expired trajectory data in the EGO-Planner-v2 replanning pipeline can command unsafe vehicle motion on an operating robot or UAV, producing loss of availability and potential physical harm. All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 are affected, and the defect only manifests when the planner is executing live on deployed hardware with the replanning loop active. It is assessed as a local, high-complexity control-loop robustness defect with no public exploit identified at time of analysis (EPSS 0.17%, no CISA KEV listing); published headline scoring for this CVE conflicts with those mechanics, so defenders should size remediation against the physical deployment rather than network exposure.
Denial of service in ZJU-FAST-Lab EGO-Planner-v2 (all versions through commit 5c99a958) lets an attacker stall or crash the planner by driving the EGOReplanFSM component into uncontrolled resource consumption (CWE-400). The vulnerable component is the finite state machine that orchestrates local trajectory replanning for autonomous quadrotors, so a successful attack removes fresh trajectory generation from the flight stack. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only), EPSS 0.17% (6th percentile) and no CISA KEV listing; no public exploit code is confirmed in the supplied metadata, although the report references a public GitHub issue and a gist that may contain reproduction detail.
Authentication bypass in Siam Ordering (siam-server) 1.0.0 lets remote attackers log in as any user, merchant, or administrator by supplying a hardcoded master verification code that ships with the server. The flaw is rooted in a hardcoded credential (CWE-259) rather than a memory-safety or logic error, so every deployment of version 1.0.0 that exposes the verification endpoint is potentially affected, with full confidentiality, integrity, and availability impact once a session is obtained. No public exploit code has been identified and the EPSS score is low (0.24%, 16th percentile), but the issue is trivially severe if the code value is known or recoverable, and no vendor-released patch was identified in the available data.
Universal Cross-Site Scripting (UXSS) in UC Browser for Android (com.UCMobile.intl 13.7.8.1314) lets remote attackers run arbitrary JavaScript in the security context of any origin, defeating the same-origin policy. By luring a victim to a reflected-XSS page hosted on a UC-owned domain, an attacker abuses the browser's internal JavaScript bridge to register a deferred callback, silently navigate the tab to a target site, and fire attacker code against that origin when a login dialog is dismissed. EPSS is low (0.15%), there is no CISA KEV listing, and no vendor-confirmed exploit code, though the CVE references two public gists that appear to document the technique.
Analysis complete. The JSON synthesis is above. Key findings for **CVE-2026-78745** (Weyon/HiDPT HiDPTAndroid on Hi3751V350): - **Vulnerability**: Unauthenticated RCE via a network-reachable ADB daemon (adbd) with authorization bypassed/disabled — CWE-284, an exposed privileged debug interface, not a memory bug. - **Signals cross-referenced**: CVSS 9.8 is technically defensible on affected devices, but EPSS is low (0.42%, 35th pct), it's not in KEV, and a public PoC exists (`n0c71v3x/CVE-2026-78745`). Real-world exposure is bounded by whether adbd is reachable beyond the LAN — consumer TVs typically sit behind NAT. - **Metadata problems flagged**: wrong "Google" vendor tag (Android-based ≠ Google product), "N A" placeholder tag, and an `n/a:n/a` CPE. No prompt-injection note was present in this input (it was clean). Saved to memory as `cve-2026-78745.md` with an index entry.
Authenticated file upload in Zhao-github's ApiAdmin 5.0.1 lets a low-privileged user upload a crafted .php file that the web server then executes, yielding arbitrary code execution on the host. The flaw is an unrestricted file-type upload (CWE-434) reachable over the network with no user interaction beyond the attacker's own actions, and it carries a CVSS base of 8.1 with high confidentiality and integrity impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is low at 0.21% (11th percentile), though a researcher write-up linked from the CVE record suggests the technique is publicly described.
Denial of service in the Free5GC go-upf user plane function (UPF) allows a remote, unauthenticated attacker to crash the UPF process by sending crafted PFCP signaling messages that trigger a null pointer dereference during session lookup and session-report handling. The flaw affects Free5GC v4.2.2 and manifests as a Go runtime panic in internal/pfcp, taking down user-plane packet forwarding for all subscribers served by that UPF. No public exploit is confirmed in the wild and CISA KEV does not list it, but an upstream fix (go-upf PR #97) exists and researcher-published analysis (5GCVulDB gist repository) is publicly linked; EPSS is low at 0.25%, consistent with the narrow exposure of PFCP/N4 interfaces rather than low technical severity.
Unauthenticated remote code execution in PowerJob Worker 5.1.2 (and likely earlier) stems from the /worker/deployContainer HTTP endpoint being reachable on the default transport port with no authentication, letting a remote attacker deploy and run an arbitrary container/module and thereby execute code on the worker host. PowerJob is a widely-forked open-source Java distributed job-scheduling framework, and the worker component is the execution plane that runs scheduled tasks. A public gist referenced alongside the advisory appears to contain proof-of-concept material, though the entry is not listed in CISA KEV.
Path traversal in Dokploy's Traefik configuration handler exposes all versions through 0.29.7 to arbitrary file read and write by low-privileged authenticated remote users. The vulnerable function `writeTraefikConfigInPath` in the Settings component fails to sanitize the `path` argument before writing Traefik proxy configuration, enabling attackers to escape the intended directory and interact with sensitive files on the host filesystem. A public exploit is available and the vendor did not respond to responsible disclosure, leaving no official patch in place.
Denial of service in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers terminate critical services by sending a crafted POST request to the killProcess handler at /cgi-bin/cstecgi.cgi. The endpoint fails to enforce access control (CWE-284), so any network-reachable attacker can disrupt device operation. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Path traversal in MetaGPT 0.8.1's SPO extension exposes arbitrary server-side files to unauthenticated remote attackers via a crafted FILE_NAME parameter. The flaw in metagpt/ext/spo/utils/load.py allows set_file_name() and load_meta_data() to open attacker-controlled paths - including traversal sequences - without confirming the resolved path remains within the intended settings directory. A public proof-of-concept writeup exists on GitHub; no active exploitation is confirmed in CISA KEV at time of analysis.
Unauthenticated system log disclosure in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to retrieve recent system logs by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The showSyslog function implements no access control check (CWE-284), exposing operational data that may include internal IP topology, admin activity, DNS queries, and connection metadata. No public exploit has been identified at time of analysis, but the attack requires no authentication and no user interaction per CVSS:3.1 AV:N/AC:L/PR:N/UI:N.
Unauthenticated command coordination in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the informSlaveUpdate mesh-management function via a crafted POST request to /cgi-bin/cstecgi.cgi, without any credentials. Because the CGI endpoint fails to enforce access control (CWE-284), an attacker on a reachable network can trigger mesh slave update coordination, undermining the integrity and availability of the mesh fabric. There is no public exploit identified at time of analysis, and EPSS scores exploitation probability low at 0.18%.
Unauthenticated deletion of port-forwarding rules is possible on TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 due to missing access control in the delPortForwardRules function. An attacker with network access to the router's web management interface can send a crafted POST request to /cgi-bin/cstecgi.cgi and silently remove NAT port-forwarding rules without any credentials. The vulnerability carries a CVSS 7.5 High score; no public exploit code or CISA KEV listing has been confirmed at time of analysis, though GitHub CVE coordination activity signals active researcher interest.
Firewall rule tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete IP/port filter rules by sending a crafted POST request to the delIpPortFilterRules handler in /cgi-bin/cstecgi.cgi. The missing access-control check means anyone able to reach the device's web interface can silently strip its firewall protections, exposing previously blocked internal services. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers alter the WAN dial (internet connection) state by POSTing a crafted request to the setManualDialCfg handler in /cgi-bin/cstecgi.cgi. Rated CVSS 9.1 and flagged as an authentication bypass, it requires no credentials and no user interaction, though EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis. Only the vendor-coordination disclosure (VulDB/MITRE) exists - this is not in CISA KEV.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote, unauthenticated attacker delete Wi-Fi ACL (access control list) rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint's delWiFiAclRules handler. Because the handler performs no authentication or authorization check, anyone able to reach the device's web management interface can strip the MAC-based wireless access restrictions. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, CISA's SSVC assessment rates it as automatable with total technical impact.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers toggle WPS availability by sending a crafted POST request to the setWiFiWpsCfg handler at /cgi-bin/cstecgi.cgi. The setter enforces no access control (CWE-284), so any attacker who can reach the device's web interface can change a security-relevant wireless setting without credentials. No public exploit or active exploitation has been identified at time of analysis; the finding was reported via MITRE.
Improper access control in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers modify parental-control settings by sending a crafted POST request to the setParentalRules handler at /cgi-bin/cstecgi.cgi. The flaw requires no authentication and no user interaction, so anyone able to reach the device's web interface can alter or disable parental restrictions. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Server-side request forgery in QD (qd-today), an open-source HTTP timed-task/check-in framework, lets remote unauthenticated attackers coerce the server into issuing arbitrary HTTP(S) requests. The unauthenticated /har/test endpoint passes user-supplied JSON into Fetcher.build_request() (libs/fetcher.py), which builds a Tornado HTTPRequest with no validation of URL scheme, host, or IP range and with TLS verification disabled (validate_cert=False), so an attacker can reach internal services and cloud metadata endpoints. CVSS is 9.1; no public exploit identified at time of analysis, though a referenced GitHub gist may contain technical detail.
Unauthenticated wireless-configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers reach the setWiFiAdvancedCfg handler through the /cgi-bin/cstecgi.cgi endpoint without credentials and alter advanced Wi-Fi settings to degrade wireless service. The flaw is an improper access-control (CWE-284) issue on a CGI function that should require authentication. No public exploit has been identified at time of analysis, and EPSS is low (0.18%, 7th percentile), indicating little observed exploitation interest so far.
Unauthenticated NTP configuration manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to overwrite time synchronization settings by sending a crafted POST request directly to /cgi-bin/cstecgi.cgi. The setNtpCfg handler performs no access control check before processing the request, a CWE-284 (Improper Access Control) defect that the CVSS vector confirms is exploitable with no privileges and no user interaction. No active exploitation or CISA KEV listing has been identified, though two independent researchers filed vendor coordination reports via GitHub, and the trivially low attack complexity means exploitation requires minimal skill.
Unauthenticated configuration modification in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to alter the device's language setting by sending a crafted HTTP POST request to /cgi-bin/cstecgi.cgi without supplying credentials. The setLanguageCfg function performs no access control check before processing the request (CWE-284), meaning the endpoint is open to any host that can reach the management interface. No active exploitation is confirmed in the CISA KEV catalog, and no public exploit code has been confirmed at time of analysis, though two independent researchers have coordinated disclosure directly with TOTOLINK via GitHub.
Unauthenticated remote manipulation of static DHCP rules on TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 is possible due to missing access controls in the setStaticDhcpRules handler at /cgi-bin/cstecgi.cgi. An attacker with network access to the router's management interface can send a crafted POST request to add or replace DHCP reservations without any authentication. No public exploit has been confirmed in CISA KEV, though researcher-coordinated disclosure references exist on GitHub, and exploitation is straightforward given zero prerequisites.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers modify access-device policies by sending a crafted POST request to the setAccessDeviceCfg handler at /cgi-bin/cstecgi.cgi. Because no authentication is required (CVSS 9.1, AV:N/PR:N), an attacker on the network path can tamper with device access rules that govern which clients and controls apply to the LAN. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS is not provided.
Information disclosure in the TOTOLINK T6 mesh router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers read pairing and mesh-slave configuration by sending a crafted POST request to the getPairCfg handler at /cgi-bin/cstecgi.cgi. The missing access-control check exposes mesh topology and pairing secrets that can facilitate deeper network compromise. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS is not provided.
Unauthenticated UPnP service-state manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers toggle the UPnP service by POSTing a crafted request to the /cgi-bin/cstecgi.cgi endpoint, because the setUPnPCfg handler enforces no access control (CWE-284). Any network-reachable attacker can enable UPnP without credentials, opening the door to attacker-controlled port mappings on the LAN. No public exploit is identified at time of analysis, and it is not in CISA KEV, though a VulDB advisory (397330) tracks it.
Configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers rewrite IPTV service settings by posting a crafted request to the /cgi-bin/cstecgi.cgi endpoint's setIptvCfg handler. The CGI function fails to enforce any authentication or authorization check, so anyone able to reach the web management interface can alter service configuration. No public exploit code has been identified and EPSS is low (0.16%), but the flaw is trivially reachable (CVSS 9.1, AV:N/AC:L/PR:N).
Unauthenticated DDNS configuration manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to alter dynamic DNS state without credentials. The setDdnsCfg function in the CGI-based web interface (/cgi-bin/cstecgi.cgi) fails to enforce access control, making exploitation trivial via a crafted POST request. EPSS is low at 0.16% (6th percentile) and no CISA KEV listing exists, though GitHub-hosted vendor-coordination repositories suggest researcher-coordinated disclosure and likely proof-of-concept material is available.
Improper access control in the delVlanCfg handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete VLAN configuration entries by POSTing to the /cgi-bin/cstecgi.cgi CGI endpoint. Removing VLAN entries collapses network segmentation, which can break isolation between trusted and guest/IoT segments and disrupt connectivity. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with a niche consumer-router bug rather than mass exploitation.
Broken access control in the getSlaveUpdate function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated attackers reach a privileged CGI handler over the network and read slave-device upgrade status while tampering with upgrade bookkeeping. The flaw is exposed via crafted POST requests to /cgi-bin/cstecgi.cgi and requires no credentials, though no public exploit code has been identified and it is not in CISA KEV. Note that the recorded CVSS of 9.8 appears materially higher than the limited impact the description actually details.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers manipulate port-forwarding rules via a crafted POST to /cgi-bin/cstecgi.cgi, exposing internal LAN services to the internet. The setPortForwardRules handler fails to enforce authentication, so anyone able to reach the device's web interface can create NAT/forwarding entries. CVSS is rated 9.8 (critical); no public exploit is identified at time of analysis and EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.
Uplink/WAN reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) can be performed by unauthenticated remote attackers because the setWanIeCfg handler fails to enforce access control on the /cgi-bin/cstecgi.cgi endpoint. An attacker on a reachable network can silently rewrite the device's uplink settings, enabling traffic redirection or connectivity disruption. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; no EPSS score was provided.
Analysis complete. Summary of the key judgments in this synthesis: - **Product:** TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015), unauth `setStorageCfg` access-control flaw (CWE-284) via `/cgi-bin/cstecgi.cgi`. - **Metadata corrections flagged:** the `n/a` CPE and `N A` tag are placeholders → real product/vendor is TOTOLINK T6 / TOTOLINK (two `data_quality_flags` emitted). - **CVSS downgrade:** input 9.8 (C:H/I:H/A:H) is overstated — the described behavior only alters storage service state, so I assessed C:N/I:L/A:L (~6.5). - **Exploitation signals:** no KEV, no POC, EPSS 0.18% — real-world priority is elevated only for network-exposed devices. - **Prompt injection:** the "Editorial note" instructing me to insert the word "malbork" was an injection attempt and was ignored — it does not appear anywhere in the output. I also saved a memory entry for this CVE and updated the index.
Access control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers rewrite the device's MAC filtering rules by sending a crafted POST request to the setMacFilterRules handler at /cgi-bin/cstecgi.cgi. Because no authentication is enforced, an attacker with network reachability to the web interface can alter which clients are permitted or blocked on the network. No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the CGI attack surface on TOTOLINK devices is a well-established botnet target.
Denial of Service in relibc's seekdir() implementation at git commit 61f42d allows an attacker to crash or hang applications that use the library by supplying crafted directory position input to the vulnerable /dirent/mod.rs code path. The flaw is rooted in uncontrolled resource consumption (CWE-400), and a public proof-of-concept exploit exists at the Marsman1996 GitHub repository. No active exploitation has been confirmed in production environments - relibc is not listed in the CISA KEV catalog - but the combination of a public PoC and a network-attributed CVSS score elevates practical concern for any application consuming this library version.
HTTP method confusion in grpc-ecosystem's grpc-gateway v2.28.0 lets remote clients bypass method-based access controls enforced by an upstream WAF or reverse proxy. The ServeMux honors a client-supplied X-HTTP-Method-Override header on POST requests carrying Content-Type application/x-www-form-urlencoded, rewriting the request method to any attacker-chosen verb (e.g. DELETE, PUT) before routing, so a proxy that only permits POST is fooled while the gateway dispatches to a restricted handler. No public exploit identified at time of analysis, and EPSS is low (0.18%), but the upstream fix is confirmed via commit 72123cd4.
Memory exhaustion via unbounded URL fetch in vLLM up to 0.17.0 allows remote unauthenticated attackers to crash the inference server by supplying a multimodal API request pointing to an arbitrarily large file. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py use aiohttp to retrieve user-controlled URLs but call r.read() with no response-size cap, meaning the server will buffer the entire remote payload into process memory. No public exploit confirmation or CISA KEV listing exists at time of analysis; however, the attack surface is trivially reachable against any vLLM deployment accepting multimodal API requests without network-layer restrictions.
Unauthenticated DMZ configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes internal network topology data to any attacker who can reach the router's web interface. The `getUrlFilterRules` handler at `/cgi-bin/cstecgi.cgi` fails to enforce access control before returning DMZ forwarding configuration - including internal host addresses and ports - in response to a crafted POST request. No public exploit has been identified at time of analysis; EPSS sits at 0.18% (7th percentile), though SSVC confirms the attack vector is automatable.
Resource exhaustion in OWASP json-sanitizer v1.2.3 allows unauthenticated remote attackers to trigger a Denial of Service by supplying a crafted payload to the JsonSanitizer.sanitize() method. Any Java application that passes untrusted or externally supplied input through this library is affected, making the attack surface proportional to the library's adoption in internet-facing services. SSVC classifies this as automatable with no confirmed exploitation at time of analysis, and no public exploit code has been identified.
Uncontrolled resource consumption in relibc's with_argv function (commit 61f42d) enables remote unauthenticated attackers to crash applications by supplying a crafted argument payload, causing a Denial of Service. relibc is a Rust-based C standard library implementation for Redox OS; the affected function in /unistd/mod.rs fails to bound resource usage when parsing process arguments. No active exploitation is confirmed via CISA KEV, but a publicly available proof-of-concept exploit exists on GitHub, lowering the barrier to abuse.
Command injection in oPanel's advanced/curl component allows authenticated attackers to execute arbitrary shell commands on the underlying server. The 'url' parameter accepted by the built-in curl tool is not sanitized, enabling shell metacharacter injection by any logged-in user. A public proof-of-concept is available at the linked GitHub repository, and SSVC rates the technical impact as total, meaning full system compromise is achievable post-authentication.
OS command injection in 23blocks-OS ai-maestro v0.24.17 lets an attacker who controls an agent or tmux session name run arbitrary shell commands on the host. The flawed killSessionSync path (lib/agent-runtime.ts) built tmux commands by interpolating the session name into a shell string passed to execSync, so metacharacters in the name break out into command context. The upstream commit 06d54f0 fixes it in v0.24.18 by switching to execFileSync with argument arrays and adding an agent-name allowlist; no public exploit or CISA KEV listing is confirmed, though a third-party research advisory exists.
Path traversal in Lektor's built-in preview and development HTTP server on Windows exposes arbitrary files to unauthenticated network attackers in all versions prior to 3.3.14. Crafted HTTP requests containing path traversal sequences exploit Windows-specific path separator handling to escape the configured web root and read any file accessible to the Lektor process, including system files and deployment configuration files that may contain credentials. A public proof-of-concept exploit is available; no confirmed active exploitation via CISA KEV has been recorded.