N A
Monthly
Universal Cross-Site Scripting (UXSS) in UC Browser for Android (com.UCMobile.intl 13.7.8.1314) lets remote attackers run arbitrary JavaScript in the security context of any origin, defeating the same-origin policy. By luring a victim to a reflected-XSS page hosted on a UC-owned domain, an attacker abuses the browser's internal JavaScript bridge to register a deferred callback, silently navigate the tab to a target site, and fire attacker code against that origin when a login dialog is dismissed. EPSS is low (0.15%), there is no CISA KEV listing, and no vendor-confirmed exploit code, though the CVE references two public gists that appear to document the technique.
Unauthenticated remote code execution in PowerJob Worker 5.1.2 (and likely earlier) stems from the /worker/deployContainer HTTP endpoint being reachable on the default transport port with no authentication, letting a remote attacker deploy and run an arbitrary container/module and thereby execute code on the worker host. PowerJob is a widely-forked open-source Java distributed job-scheduling framework, and the worker component is the execution plane that runs scheduled tasks. A public gist referenced alongside the advisory appears to contain proof-of-concept material, though the entry is not listed in CISA KEV.
Analysis complete. The JSON synthesis is above. Key findings for **CVE-2026-78745** (Weyon/HiDPT HiDPTAndroid on Hi3751V350): - **Vulnerability**: Unauthenticated RCE via a network-reachable ADB daemon (adbd) with authorization bypassed/disabled — CWE-284, an exposed privileged debug interface, not a memory bug. - **Signals cross-referenced**: CVSS 9.8 is technically defensible on affected devices, but EPSS is low (0.42%, 35th pct), it's not in KEV, and a public PoC exists (`n0c71v3x/CVE-2026-78745`). Real-world exposure is bounded by whether adbd is reachable beyond the LAN — consumer TVs typically sit behind NAT. - **Metadata problems flagged**: wrong "Google" vendor tag (Android-based ≠ Google product), "N A" placeholder tag, and an `n/a:n/a` CPE. No prompt-injection note was present in this input (it was clean). Saved to memory as `cve-2026-78745.md` with an index entry.
Path traversal in Dokploy's Traefik configuration handler exposes all versions through 0.29.7 to arbitrary file read and write by low-privileged authenticated remote users. The vulnerable function `writeTraefikConfigInPath` in the Settings component fails to sanitize the `path` argument before writing Traefik proxy configuration, enabling attackers to escape the intended directory and interact with sensitive files on the host filesystem. A public exploit is available and the vendor did not respond to responsible disclosure, leaving no official patch in place.
Unauthenticated UPnP service-state manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers toggle the UPnP service by POSTing a crafted request to the /cgi-bin/cstecgi.cgi endpoint, because the setUPnPCfg handler enforces no access control (CWE-284). Any network-reachable attacker can enable UPnP without credentials, opening the door to attacker-controlled port mappings on the LAN. No public exploit is identified at time of analysis, and it is not in CISA KEV, though a VulDB advisory (397330) tracks it.
Access control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers rewrite the device's MAC filtering rules by sending a crafted POST request to the setMacFilterRules handler at /cgi-bin/cstecgi.cgi. Because no authentication is enforced, an attacker with network reachability to the web interface can alter which clients are permitted or blocked on the network. No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the CGI attack surface on TOTOLINK devices is a well-established botnet target.
Unauthenticated NTP configuration manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to overwrite time synchronization settings by sending a crafted POST request directly to /cgi-bin/cstecgi.cgi. The setNtpCfg handler performs no access control check before processing the request, a CWE-284 (Improper Access Control) defect that the CVSS vector confirms is exploitable with no privileges and no user interaction. No active exploitation or CISA KEV listing has been identified, though two independent researchers filed vendor coordination reports via GitHub, and the trivially low attack complexity means exploitation requires minimal skill.
Improper access control in the delVlanCfg handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete VLAN configuration entries by POSTing to the /cgi-bin/cstecgi.cgi CGI endpoint. Removing VLAN entries collapses network segmentation, which can break isolation between trusted and guest/IoT segments and disrupt connectivity. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with a niche consumer-router bug rather than mass exploitation.
Firewall rule tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete IP/port filter rules by sending a crafted POST request to the delIpPortFilterRules handler in /cgi-bin/cstecgi.cgi. The missing access-control check means anyone able to reach the device's web interface can silently strip its firewall protections, exposing previously blocked internal services. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthenticated command coordination in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the informSlaveUpdate mesh-management function via a crafted POST request to /cgi-bin/cstecgi.cgi, without any credentials. Because the CGI endpoint fails to enforce access control (CWE-284), an attacker on a reachable network can trigger mesh slave update coordination, undermining the integrity and availability of the mesh fabric. There is no public exploit identified at time of analysis, and EPSS scores exploitation probability low at 0.18%.
Analysis complete. Summary of the key judgments in this synthesis: - **Product:** TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015), unauth `setStorageCfg` access-control flaw (CWE-284) via `/cgi-bin/cstecgi.cgi`. - **Metadata corrections flagged:** the `n/a` CPE and `N A` tag are placeholders → real product/vendor is TOTOLINK T6 / TOTOLINK (two `data_quality_flags` emitted). - **CVSS downgrade:** input 9.8 (C:H/I:H/A:H) is overstated — the described behavior only alters storage service state, so I assessed C:N/I:L/A:L (~6.5). - **Exploitation signals:** no KEV, no POC, EPSS 0.18% — real-world priority is elevated only for network-exposed devices. - **Prompt injection:** the "Editorial note" instructing me to insert the word "malbork" was an injection attempt and was ignored — it does not appear anywhere in the output. I also saved a memory entry for this CVE and updated the index.
Unauthenticated DDNS configuration manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to alter dynamic DNS state without credentials. The setDdnsCfg function in the CGI-based web interface (/cgi-bin/cstecgi.cgi) fails to enforce access control, making exploitation trivial via a crafted POST request. EPSS is low at 0.16% (6th percentile) and no CISA KEV listing exists, though GitHub-hosted vendor-coordination repositories suggest researcher-coordinated disclosure and likely proof-of-concept material is available.
Unauthenticated deletion of port-forwarding rules is possible on TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 due to missing access control in the delPortForwardRules function. An attacker with network access to the router's web management interface can send a crafted POST request to /cgi-bin/cstecgi.cgi and silently remove NAT port-forwarding rules without any credentials. The vulnerability carries a CVSS 7.5 High score; no public exploit code or CISA KEV listing has been confirmed at time of analysis, though GitHub CVE coordination activity signals active researcher interest.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers toggle WPS availability by sending a crafted POST request to the setWiFiWpsCfg handler at /cgi-bin/cstecgi.cgi. The setter enforces no access control (CWE-284), so any attacker who can reach the device's web interface can change a security-relevant wireless setting without credentials. No public exploit or active exploitation has been identified at time of analysis; the finding was reported via MITRE.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers modify access-device policies by sending a crafted POST request to the setAccessDeviceCfg handler at /cgi-bin/cstecgi.cgi. Because no authentication is required (CVSS 9.1, AV:N/PR:N), an attacker on the network path can tamper with device access rules that govern which clients and controls apply to the LAN. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS is not provided.
Broken access control in the getSlaveUpdate function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated attackers reach a privileged CGI handler over the network and read slave-device upgrade status while tampering with upgrade bookkeeping. The flaw is exposed via crafted POST requests to /cgi-bin/cstecgi.cgi and requires no credentials, though no public exploit code has been identified and it is not in CISA KEV. Note that the recorded CVSS of 9.8 appears materially higher than the limited impact the description actually details.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers manipulate port-forwarding rules via a crafted POST to /cgi-bin/cstecgi.cgi, exposing internal LAN services to the internet. The setPortForwardRules handler fails to enforce authentication, so anyone able to reach the device's web interface can create NAT/forwarding entries. CVSS is rated 9.8 (critical); no public exploit is identified at time of analysis and EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.
Configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers rewrite IPTV service settings by posting a crafted request to the /cgi-bin/cstecgi.cgi endpoint's setIptvCfg handler. The CGI function fails to enforce any authentication or authorization check, so anyone able to reach the web management interface can alter service configuration. No public exploit code has been identified and EPSS is low (0.16%), but the flaw is trivially reachable (CVSS 9.1, AV:N/AC:L/PR:N).
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote, unauthenticated attacker delete Wi-Fi ACL (access control list) rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint's delWiFiAclRules handler. Because the handler performs no authentication or authorization check, anyone able to reach the device's web management interface can strip the MAC-based wireless access restrictions. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, CISA's SSVC assessment rates it as automatable with total technical impact.
Information disclosure in the TOTOLINK T6 mesh router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers read pairing and mesh-slave configuration by sending a crafted POST request to the getPairCfg handler at /cgi-bin/cstecgi.cgi. The missing access-control check exposes mesh topology and pairing secrets that can facilitate deeper network compromise. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS is not provided.
Path traversal in MetaGPT 0.8.1's SPO extension exposes arbitrary server-side files to unauthenticated remote attackers via a crafted FILE_NAME parameter. The flaw in metagpt/ext/spo/utils/load.py allows set_file_name() and load_meta_data() to open attacker-controlled paths - including traversal sequences - without confirming the resolved path remains within the intended settings directory. A public proof-of-concept writeup exists on GitHub; no active exploitation is confirmed in CISA KEV at time of analysis.
Denial of service in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers terminate critical services by sending a crafted POST request to the killProcess handler at /cgi-bin/cstecgi.cgi. The endpoint fails to enforce access control (CWE-284), so any network-reachable attacker can disrupt device operation. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthenticated system log disclosure in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to retrieve recent system logs by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The showSyslog function implements no access control check (CWE-284), exposing operational data that may include internal IP topology, admin activity, DNS queries, and connection metadata. No public exploit has been identified at time of analysis, but the attack requires no authentication and no user interaction per CVSS:3.1 AV:N/AC:L/PR:N/UI:N.
Unauthenticated configuration modification in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to alter the device's language setting by sending a crafted HTTP POST request to /cgi-bin/cstecgi.cgi without supplying credentials. The setLanguageCfg function performs no access control check before processing the request (CWE-284), meaning the endpoint is open to any host that can reach the management interface. No active exploitation is confirmed in the CISA KEV catalog, and no public exploit code has been confirmed at time of analysis, though two independent researchers have coordinated disclosure directly with TOTOLINK via GitHub.
Unauthenticated remote manipulation of static DHCP rules on TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 is possible due to missing access controls in the setStaticDhcpRules handler at /cgi-bin/cstecgi.cgi. An attacker with network access to the router's management interface can send a crafted POST request to add or replace DHCP reservations without any authentication. No public exploit has been confirmed in CISA KEV, though researcher-coordinated disclosure references exist on GitHub, and exploitation is straightforward given zero prerequisites.
Uplink/WAN reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) can be performed by unauthenticated remote attackers because the setWanIeCfg handler fails to enforce access control on the /cgi-bin/cstecgi.cgi endpoint. An attacker on a reachable network can silently rewrite the device's uplink settings, enabling traffic redirection or connectivity disruption. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; no EPSS score was provided.
Improper access control in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers modify parental-control settings by sending a crafted POST request to the setParentalRules handler at /cgi-bin/cstecgi.cgi. The flaw requires no authentication and no user interaction, so anyone able to reach the device's web interface can alter or disable parental restrictions. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Server-side request forgery in QD (qd-today), an open-source HTTP timed-task/check-in framework, lets remote unauthenticated attackers coerce the server into issuing arbitrary HTTP(S) requests. The unauthenticated /har/test endpoint passes user-supplied JSON into Fetcher.build_request() (libs/fetcher.py), which builds a Tornado HTTPRequest with no validation of URL scheme, host, or IP range and with TLS verification disabled (validate_cert=False), so an attacker can reach internal services and cloud metadata endpoints. CVSS is 9.1; no public exploit identified at time of analysis, though a referenced GitHub gist may contain technical detail.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers alter the WAN dial (internet connection) state by POSTing a crafted request to the setManualDialCfg handler in /cgi-bin/cstecgi.cgi. Rated CVSS 9.1 and flagged as an authentication bypass, it requires no credentials and no user interaction, though EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis. Only the vendor-coordination disclosure (VulDB/MITRE) exists - this is not in CISA KEV.
Unauthenticated wireless-configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers reach the setWiFiAdvancedCfg handler through the /cgi-bin/cstecgi.cgi endpoint without credentials and alter advanced Wi-Fi settings to degrade wireless service. The flaw is an improper access-control (CWE-284) issue on a CGI function that should require authentication. No public exploit has been identified at time of analysis, and EPSS is low (0.18%, 7th percentile), indicating little observed exploitation interest so far.
HTTP method confusion in grpc-ecosystem's grpc-gateway v2.28.0 lets remote clients bypass method-based access controls enforced by an upstream WAF or reverse proxy. The ServeMux honors a client-supplied X-HTTP-Method-Override header on POST requests carrying Content-Type application/x-www-form-urlencoded, rewriting the request method to any attacker-chosen verb (e.g. DELETE, PUT) before routing, so a proxy that only permits POST is fooled while the gateway dispatches to a restricted handler. No public exploit identified at time of analysis, and EPSS is low (0.18%), but the upstream fix is confirmed via commit 72123cd4.
Memory exhaustion via unbounded URL fetch in vLLM up to 0.17.0 allows remote unauthenticated attackers to crash the inference server by supplying a multimodal API request pointing to an arbitrarily large file. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py use aiohttp to retrieve user-controlled URLs but call r.read() with no response-size cap, meaning the server will buffer the entire remote payload into process memory. No public exploit confirmation or CISA KEV listing exists at time of analysis; however, the attack surface is trivially reachable against any vLLM deployment accepting multimodal API requests without network-layer restrictions.
Denial of Service in relibc's seekdir() implementation at git commit 61f42d allows an attacker to crash or hang applications that use the library by supplying crafted directory position input to the vulnerable /dirent/mod.rs code path. The flaw is rooted in uncontrolled resource consumption (CWE-400), and a public proof-of-concept exploit exists at the Marsman1996 GitHub repository. No active exploitation has been confirmed in production environments - relibc is not listed in the CISA KEV catalog - but the combination of a public PoC and a network-attributed CVSS score elevates practical concern for any application consuming this library version.
Uncontrolled resource consumption in relibc's with_argv function (commit 61f42d) enables remote unauthenticated attackers to crash applications by supplying a crafted argument payload, causing a Denial of Service. relibc is a Rust-based C standard library implementation for Redox OS; the affected function in /unistd/mod.rs fails to bound resource usage when parsing process arguments. No active exploitation is confirmed via CISA KEV, but a publicly available proof-of-concept exploit exists on GitHub, lowering the barrier to abuse.
OS command injection in 23blocks-OS ai-maestro v0.24.17 lets an attacker who controls an agent or tmux session name run arbitrary shell commands on the host. The flawed killSessionSync path (lib/agent-runtime.ts) built tmux commands by interpolating the session name into a shell string passed to execSync, so metacharacters in the name break out into command context. The upstream commit 06d54f0 fixes it in v0.24.18 by switching to execFileSync with argument arrays and adding an agent-name allowlist; no public exploit or CISA KEV listing is confirmed, though a third-party research advisory exists.
Resource exhaustion in OWASP json-sanitizer v1.2.3 allows unauthenticated remote attackers to trigger a Denial of Service by supplying a crafted payload to the JsonSanitizer.sanitize() method. Any Java application that passes untrusted or externally supplied input through this library is affected, making the attack surface proportional to the library's adoption in internet-facing services. SSVC classifies this as automatable with no confirmed exploitation at time of analysis, and no public exploit code has been identified.
Unauthenticated DMZ configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes internal network topology data to any attacker who can reach the router's web interface. The `getUrlFilterRules` handler at `/cgi-bin/cstecgi.cgi` fails to enforce access control before returning DMZ forwarding configuration - including internal host addresses and ports - in response to a crafted POST request. No public exploit has been identified at time of analysis; EPSS sits at 0.18% (7th percentile), though SSVC confirms the attack vector is automatable.
Command injection in oPanel's advanced/curl component allows authenticated attackers to execute arbitrary shell commands on the underlying server. The 'url' parameter accepted by the built-in curl tool is not sanitized, enabling shell metacharacter injection by any logged-in user. A public proof-of-concept is available at the linked GitHub repository, and SSVC rates the technical impact as total, meaning full system compromise is achievable post-authentication.
Integer overflow in the open5gs 2.7.6 NRF (Network Repository Function) discovery endpoint enables remote unauthenticated denial of service. Sending a crafted HTTP/2 GET request to /nnrf-disc/v1/nf-instances triggers arithmetic overflow that crashes the NRF service, disrupting 5G network function discovery for all dependent core network components. No public exploit has been identified and EPSS at 0.18% (7th percentile) reflects low current exploitation interest, though the unauthenticated network vector lowers the bar for any attacker with access to the SBI interface.
SQL injection in YzmCMS 7.5 exposes the full database to authenticated administrators who supply a crafted parentid parameter to the category management interface. The flaw arises from unsanitized string concatenation inside a FIND_IN_SET() SQL clause within the get_arrchildid() function, enabling boolean-based blind injection that can enumerate and exfiltrate the entire database. A public proof-of-concept exists on GitHub; however, EPSS at 0.15% (4th percentile) and the absence of a CISA KEV listing indicate no confirmed widespread exploitation at time of analysis.
Denial of Service in free5gc v4.0.1 allows remote unauthenticated attackers to crash or disrupt the 5G core network by sending crafted input to the RechargePut function. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the function fails to bound resource consumption when processing malformed payloads. No public exploit exists at time of analysis, and an EPSS score of 0.15% (4th percentile) reflects minimal real-world exploitation pressure despite the network-accessible, no-authentication attack vector.
go-wind-cms (GoWind) before 1.0.0 exposes all administrative APIs to any authenticated user because NewAuthorizer() returns a no-operation authorization engine (noop.State{}), rendering the authz middleware completely inert. Any account holder - regardless of assigned role or tenant membership - can invoke privileged operations including user deletion, password resets, and tenant creation. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service in free5GC v4.1.0 allows remote unauthenticated attackers to crash the Access and Mobility Management Function (AMF) by sending a crafted PATCH request to the event subscription endpoint processed by ModifyAMFEventSubscriptionProcedure in processor/event_exposure.go. The root cause is CWE-770 - uncontrolled resource allocation - meaning the handler does not bound consumption triggered by attacker-supplied input. SSVC classifies this as automatable, making scripted mass exploitation feasible, though no active exploitation or public proof-of-concept code is confirmed at time of analysis.
Denial of Service in Open5GS v2.7.6 targets the NUDM-UECM (Network Unified Data Management - UE Context Management) interface, where a crafted HTTP DELETE request triggers a reachable assertion failure that crashes the UDM process. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and SSVC 'Automatable: yes' rating indicate this is trivially scriptable over the network. No active exploitation or public proof-of-concept code has been identified at time of analysis.
Denial of service in free5gc v4.1.0 allows unauthenticated remote attackers to crash the UE context management service by sending a crafted HTTP PUT request to the /v1/ue-contexts/{supi} REST API endpoint, invoking the CreateUEContextProcedure function. The root cause is CWE-770 - uncontrolled resource allocation - where a malformed request triggers unchecked resource consumption that terminates the AMF process. No public exploit code has been identified and the EPSS score is 0.15% (4th percentile), though the zero-prerequisite network vector makes any exposed deployment immediately actionable.
Resource exhaustion in the free5GC v4.0.1 NF Discovery endpoint allows unauthenticated remote attackers to crash or hang the Network Repository Function (NRF) by sending a crafted snssais query parameter, disrupting 5G core service discovery for all dependent network functions. The root cause is CWE-770 - missing input validation and resource throttling on a control-plane REST API that is central to 5G Service Based Architecture (SBA) operation. No public exploit code exists and EPSS sits at the 4th percentile, indicating low opportunistic exploitation likelihood; however, the absence of a confirmed patch makes this a persisting exposure for free5GC operators.
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended preview directory via the /api/static/{deployKey}/ static-resource endpoint, which concatenates attacker-controlled path segments to the preview root without normalization. Publicly available exploit code exists, though the flaw is not listed in CISA KEV and carries a low EPSS score (0.15%, 4th percentile), indicating no evidence of widespread active exploitation. The practical impact is unauthenticated disclosure of sensitive server-side files (source code, configuration, secrets), not code execution.
Missing authorization on the /storage/upload endpoint in cjbi admin3 v3.0.0 permits any authenticated user - regardless of role or privilege level - to upload arbitrary files to the server. Compounding this, the storage endpoint exposes uploaded files for unauthenticated anonymous download, creating a two-stage attack surface: an authenticated insider or low-privilege account uploads a malicious payload, which any external anonymous actor can then retrieve. No public exploit identified at time of analysis beyond researcher documentation on GitHub, and EPSS sits at 0.15% despite the high CVSS score, indicating limited observed exploitation at this time.
Denial of service in free5GC v4.0.1 affects the SUCI (Subscription Concealed Identifier) parsing routine invoked during 5G UE registration, allowing unauthenticated remote attackers to crash or resource-exhaust the core network by sending crafted SUCI payloads. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), any attacker reachable on the AMF's N1/NAS interface can trigger the flaw before any subscriber authentication occurs. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Integer overflow in Open5GS v2.7.6's Session Management Function (SMF) allows remote unauthenticated attackers to crash the service via a crafted GTP packet, causing Denial of Service against 5G core network infrastructure. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms zero-authentication network exploitation requiring no user interaction. Researcher-published proof-of-concept code exists in a public GitHub repository and gist, though no CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Remote code execution in gpt-researcher v0.14.7 and earlier lets an unauthenticated attacker run arbitrary code on the host by pushing malicious Model Context Protocol (MCP) configurations through the application's WebSocket endpoint. Because the endpoint accepts these configurations without authentication, any network-reachable instance is exploitable with no user interaction, and the MCP config path effectively becomes a command-execution primitive. No public exploit and no CISA KEV listing are indicated at time of analysis, and the EPSS probability is low (0.27%), so this appears to be an unexploited-but-severe issue rather than one seeing active campaigns.
NULL pointer dereference in FFmpeg development snapshot N-122528-gdd2976b9e1 crashes the FFmpeg process when parsing a maliciously crafted video file via the get_min_buffer_size function in libswscale/slice.c. Any application or automated pipeline using this FFmpeg build to process untrusted video input is exposed to unauthenticated remote denial of service, as confirmed by the AV:N/AC:L/PR:N/UI:N CVSS vector. No public exploit code exists at time of analysis, and EPSS at 0.15% (4th percentile) signals low current threat-actor activity.
Command injection in the LB-Link AC2100_AZ3 (V1.0.4) router allows attackers to run arbitrary operating-system commands by supplying shell metacharacters to the bs_SetLimitCli_info function in the libshare.so library, which passes unsanitized input into a system-level command context. Successful exploitation yields full compromise (confidentiality, integrity, availability) of the device, typically at elevated/root privilege given the embedded-Linux design. A public technical write-up documenting the flaw exists on GitHub, but it is not listed in CISA KEV and EPSS estimates exploitation probability at a modest 0.54% (43rd percentile).
free5gc v4.0.1, an open-source Go-based 5G core network implementation, is vulnerable to denial-of-service via crafted input to the HandleGetSharedData function, which can exhaust system resources and crash core network functions. The CVSS score of 7.5 HIGH reflects a zero-authentication network vector, though the very low EPSS of 0.15% (4th percentile) and absence of KEV listing or public proof-of-concept indicate minimal observed exploitation risk at this time. Deployments are typically confined to research and lab environments, reducing broad exposure.
Command injection in the bs_SetLimitCli_info function of the libshare.so library on LB-Link AC450M (V4.0.0) routers lets attackers inject shell metacharacters into a parameter that is passed to a system-level command context, yielding arbitrary OS command execution. The CVSS 3.1 vector (9.8) describes network-reachable, unauthenticated exploitation with full confidentiality, integrity, and availability impact. No CISA KEV listing and no confirmed exploit code, though a public technical write-up describing the flaw exists; EPSS is modest at 0.53% (42nd percentile).
Integer overflow in FFmpeg's libswscale/output.c (yuv2planeX_8_c function) allows a remote attacker to crash the FFmpeg process by supplying a crafted video file, causing denial of service in any pipeline that processes untrusted media. The affected build is development snapshot N-122528-gdd2976b9e1; stable release exposure is unconfirmed. No public exploit code and no CISA KEV listing exist; EPSS of 0.15% (4th percentile) indicates very low near-term exploitation probability despite the high CVSS base score.
Path traversal in Lektor's built-in preview and development HTTP server on Windows exposes arbitrary files to unauthenticated network attackers in all versions prior to 3.3.14. Crafted HTTP requests containing path traversal sequences exploit Windows-specific path separator handling to escape the configured web root and read any file accessible to the Lektor process, including system files and deployment configuration files that may contain credentials. A public proof-of-concept exploit is available; no confirmed active exploitation via CISA KEV has been recorded.
Denial of service in free5gc v4.1.0's CreateUEContext handler allows unauthenticated remote attackers to crash or exhaust the 5G core network service by sending crafted UE context creation requests. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) - the handler performs no rate limiting or resource bounding when processing incoming context requests. No active exploitation is confirmed (not in CISA KEV), though SSVC flags the attack as automatable, meaning a single host could sustain a disruptive flood without manual repetition.
Reachable assertion in Open5GS v2.7.6 SMF crashes the Session Management Function via a crafted DELETE request to the /nsmf-pdusession/v1/sm-contexts endpoint, enabling unauthenticated remote denial of service against the 5G core. Per CVSS PR:N, no authentication is required, though network access to the internal Service Based Interface (SBI) is a practical prerequisite in standard deployments. No active exploitation has been confirmed (not in CISA KEV), no public exploit code is known, and SSVC rates this as non-automatable with partial technical impact - suggesting real-world risk is lower than the 7.5 CVSS score implies.
Denial of service in free5gc v4.0.1 is exploitable via the HTTPModifySubscription handler, which fails to reject crafted HTTP input before processing, causing the affected 5G core network function to crash. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote, unauthenticated exploitation with no user interaction required, making any network-reachable deployment of the SBI interface a viable target. No public exploit code has been identified and EPSS sits at just 0.15% (4th percentile), indicating low observed attacker interest at time of analysis.
Remote unauthenticated denial-of-service in the NRF Discovery service of free5gc v4.0.1 can be triggered by sending crafted input to the complexQueryFilterSubprocess function, crashing the service without any authentication or user interaction. The NRF (Network Repository Function) is a critical 5G core component responsible for service discovery; its disruption can cascade to affect the entire 5G core network's ability to register and locate network functions. No public exploit has been identified and EPSS sits at 0.18% (8th percentile), suggesting low observed exploitation activity despite the high CVSS base score.
Heap-based buffer overflow in FFmpeg's libswscale library enables unauthenticated remote attackers to crash media-processing applications via a crafted input file. The vulnerable function ff_sws_alphablendaway, invoked during alpha channel compositing in git-master commit 722a217, mishandles attacker-controlled input and corrupts heap memory, producing a Denial of Service. No active exploitation is confirmed - EPSS stands at 0.15% (5th percentile) with no CISA KEV listing - indicating this is currently a crash risk rather than a weaponized threat.
Remote unauthenticated Denial of Service in free5gc v4.0.1 allows network-accessible attackers to crash the 5G core parameter provisioning service by sending a crafted input to the HandleUpdate function in /sbi/parameter_provision.go. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms no authentication or special preconditions are required, though the EPSS score of 0.15% at the 4th percentile and absence from CISA KEV indicate no public exploit code and no confirmed active exploitation at time of analysis.
Integer overflow in FFmpeg's libswscale library allows any application or service processing attacker-controlled image files to be crashed via a specially crafted input, causing a Denial of Service. The vulnerable function hScale16To19_c() in output.c is affected in build N-122528-gdd2976b9e1; the CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects worst-case exposure in automated media-processing services. Despite the high CVSS score of 7.5, the EPSS probability is just 0.15% at the 4th percentile and no active exploitation has been confirmed, indicating limited real-world exploitation activity at time of analysis.
NULL pointer dereference in the AMF NGAP Dispatcher of free5GC v4.0.1 allows an unauthenticated remote attacker to crash the Access and Mobility Management Function by sending crafted NGAP messages during the initialization of a new RAN connection, resulting in complete availability loss for the 5G core control plane. The AMF is a central 5G core component responsible for registration and mobility management for all connected user equipment, so a successful crash severs control-plane service for all gNBs attached to that AMF instance. No public exploit code has been confirmed and no CISA KEV listing exists at time of analysis, though SSVC rates the attack as Automatable given the no-authentication, low-complexity network exposure.
Integer overflow in FFmpeg's libswscale image-scaling library (output.c) enables Denial of Service against any service or application that processes attacker-supplied media through the swscale API. The flaw, confirmed in snapshot build N-122528-gdd2976b9e1, resides in the target_sws_fuzzer() harness and indicates that the underlying scaling output path contains an integer wraparound reachable via crafted input. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and EPSS probability is negligible at 0.15%, suggesting minimal current threat actor interest.
Null pointer dereference in ccoap (commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5) allows remote unauthenticated attackers to crash the CoAP server by submitting requests that trigger a race condition between the session dispatch and cleanup threads. The impact is confined to availability - the server process crashes, producing a denial-of-service condition with no confidentiality or integrity consequences. No active exploitation is confirmed (not in CISA KEV), and an EPSS score of 0.17% (7th percentile) places this in the lowest tier of current exploitation likelihood.
Integer overflow in FFmpeg's libswscale/utils.c component, present in development snapshot N-122528-gdd2976b9e1, allows unauthenticated remote attackers to crash any application relying on that component for image scaling by supplying a specially crafted image file. The CVSS 7.5 High rating reflects a network-reachable, zero-authentication denial-of-service path, but the EPSS score of 0.15% at the 4th percentile indicates negligible observed exploitation activity. No public exploit code and no CISA KEV listing are confirmed at time of analysis.
Denial-of-service in free5gc v4.0.1 allows remote unauthenticated attackers to crash the 5G core network's AMF component by sending a specially crafted NAS PDU to the NGAP handler. The vulnerability stems from improper resource allocation (CWE-770) in the NGAP message processing path, which when triggered drops all active 5G sessions handled by that AMF instance. No public exploit code has been identified and CISA KEV confirms no active exploitation, but SSVC rates the attack as automatable, meaning it can be scripted without manual interaction.
Authentication bypass in DWSurvey v6.14.0 lets remote unauthenticated attackers reach protected API functionality through the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' endpoint paths, which are treated as public and skip access-control checks. A public technical writeup describing the flaw exists; it is not listed in CISA KEV and the EPSS probability is low (0.18%, 8th percentile), indicating no evidence of widespread automated exploitation yet despite the critical 9.8 CVSS rating.
Arbitrary file read via path traversal in DocSys-master V2.02.85 exposes the server filesystem to unauthenticated remote attackers through the downloadDocEx endpoint in DocController.java, which fails to sanitize user-supplied path parameters. Publicly available exploit code exists per SSVC poc status and the GitHub reference. Despite a CVSS 7.5 score with high confidentiality impact, EPSS of 0.14% (4th percentile) indicates very low observed exploitation activity, likely reflecting the product's obscure deployment footprint rather than low exploitability.
Unauthenticated configuration disclosure in SuperDiamond (super-diamond-server) versions 1.3.3 and earlier exposes the Netty-based configuration distribution service on TCP port 8283 without any authentication mechanism. Any remote attacker who can reach the port can send a raw TCP request and retrieve the complete configuration of any managed project, including database passwords and API keys. A public write-up exists but there is no public exploit identified as weaponized tooling, and the flaw is not in CISA KEV; EPSS is low at 0.17% (6th percentile).
Denial of service in qTox v1.18.4 lets an attacker crash the client through the profile-serialization code in src/persistence/serialize.cpp, classified as uncontrolled resource consumption (CWE-400). The description scopes this to a local attacker requiring victim interaction, and SSVC records a proof-of-concept, so publicly available exploit code exists; it is not listed in CISA KEV and EPSS is low (0.13%, 3rd percentile), indicating no evidence of widespread exploitation. Impact is limited to availability of the desktop client for the affected user, not remote code execution.
Path traversal in UnPoller 2.33.0's password field enables unauthenticated remote attackers to read arbitrary files from the host filesystem and exfiltrate their contents over the network. The CVSS 7.5 (High) vector reflects a fully network-accessible, zero-authentication attack with high confidentiality impact against the affected version. A public exploit repository (github.com/SyntaxSaiyan/CVE-2026-36851) exists, though EPSS stands at just 0.22% (12th percentile) and no CISA KEV listing is present, indicating no public exploit identified at time of analysis as having been broadly weaponized.
Unauthenticated path traversal in yx-image-recognition v1.0 exposes arbitrary files on the host filesystem to remote attackers. Parameters `dir` and `filePath` are passed unsanitized directly to Java's `new File()` constructor, enabling directory traversal sequences (e.g., `../../`) to escape the intended working directory. No public exploit identified at time of analysis, and EPSS of 0.14% (4th percentile) indicates low observed exploitation probability, though a researcher-published report with technical detail exists on GitHub.
Local privilege escalation in Entevo HMI V2 R5 P0 M4 enables a low-privileged local user to break out of Kiosk Mode and gain administrative command execution on Windows. The escape path exploits the application's built-in PDF manual viewer: opening the manual triggers an external PDF reader, whose Print dialog exposes Windows Explorer shell access, ultimately permitting arbitrary command execution as an administrator. A proof-of-concept demonstration is publicly available via GitHub gist; EPSS is low at 0.17% and CISA SSVC indicates no confirmed active exploitation, though the public POC meaningfully lowers the skill bar for any attacker with local session access.
Denial of service in SpaceDot AcubeSAT On-Board Computer (OBC) software at commit eaf90ec is triggered by a crafted input to the cobs_decode function, exploiting an integer handling flaw (CWE-400) over the UART serial interface. Physical proximity to the hardware is required, rendering the NVD-assigned CVSS vector (AV:N) inconsistent with the description's explicit 'physically-proximate' access requirement - a likely scoring error that significantly overstates remote risk. No public exploit has been identified, EPSS is 0.15% (4th percentile), and this CVE is not listed in CISA KEV.
Arbitrary code execution in libtiff's tiffcrop utility (commit 85f2ac8e) stems from the process_command_opts() function in tools/tiffcrop.c, classified as CWE-94 code injection. An attacker who can influence the input processed by tiffcrop can trigger execution of arbitrary code. Publicly referenced proof-of-concept material appears to exist via a linked gist, but the flaw is not in CISA KEV and EPSS is low (0.16%, 5th percentile), indicating no evidence of widespread active exploitation.
OneNav 1.2.4's import_link() function allows any authenticated user to delete arbitrary files on the host system via path traversal, scoring CVSS 8.1 with High integrity and availability impact. Publicly available exploit code exists per SSVC assessment (exploitation: poc), though EPSS probability remains very low at 0.14% (4th percentile), indicating limited widespread exploitation activity. The attack requires only low-privilege authentication over the network with no user interaction, making it accessible to any registered user of an exposed OneNav instance.
Heap-based buffer overflow in libtiff's rgb2ycbcr command-line utility enables potential arbitrary code execution when a user processes a specially crafted TIFF image. The root cause is a CWE-190 integer overflow in the cvtRaster() function's strip buffer size computation: the arithmetic wraps to an undersized value, and subsequent YCbCr conversion writes spill beyond the allocated heap region. A publicly shared GitHub gist (okyfh) suggests proof-of-concept material may be available; an upstream fix commit exists in the libtiff GitLab repository, though no tagged release version has been independently confirmed at time of analysis.
Privilege escalation and arbitrary code execution affect the Berkeley Out-of-Order Machine (BOOM) RISC-V processor RTL implementation at commit 2d08d0d8b4563212175212f9db0e69f6e68c9619 (v1.2), specifically within the machine-mode trap-return (MRET) and mstatus.MPRV state-restoration logic in the CSRFile. An attacker who can execute unprivileged or supervisor-mode code on a system running the BOOM core can potentially abuse the flawed privilege-restoration path to gain machine-mode (M-mode) access, achieving full system control. No public exploit code or CISA KEV listing has been identified at time of analysis; the EPSS score of 0.29% (22nd percentile) reflects very limited observed exploitation activity.
Unauthorized access to user chat data in Bottinelli Informatica Vedo Suite 1.2.5 is possible via an Insecure Direct Object Reference (IDOR) flaw in the api_vedo/chat REST endpoint, where the utente_chat parameter is not validated against the requester's session or authorization context. The 'Authentication Bypass' tag alongside a PR:N CVSS vector indicates the endpoint may be reachable without any valid credentials, making this a high-confidence confidentiality breach for any network-accessible deployment. No public exploit code has been confirmed in automated exploit frameworks, and the EPSS score of 0.24% (16th percentile) indicates limited observed exploitation at time of analysis, consistent with a low-prevalence niche product.
SQL injection in Bottinelli Informatica Vedo Suite 1.2.5 lets a remote attacker with low-level authentication inject malicious SQL through the utente_chat parameter of the api_vedo/chat endpoint, which is reported to escalate to arbitrary code execution on the host. The flaw carries a CVSS 9.9 (scope-changed) rating, but with no public exploit identified at time of analysis and a low EPSS probability (0.29%, 22nd percentile). It affects a niche Italian business-suite product, so risk is concentrated among its specific customer base rather than broadly internet-wide.
Arbitrary file write via directory traversal in Reportico (reportico-web) through version 8.1.0 lets remote attackers create or overwrite files anywhere the web server user can write, by supplying a crafted path in the 'saveTemplate' parameter together with 'execute_mode=PREPARE' on the run.php endpoint. Because writes can land inside the web root, this is a realistic path to remote code execution (e.g., dropping a PHP web shell). No CISA KEV listing and a low EPSS score (0.37%) indicate no confirmed active exploitation yet, though a third-party vulnerability-research repository is referenced and the flaw is unauthenticated and low-complexity.
Remote code execution in Halo 2.25.4 is reachable by low-privileged authenticated attackers through the backup restoration workflow, exploiting CWE-73 (External Control of File Name or Path) in MigrationServiceImpl.restoreWorkdir() combined with Spring's FileSystemUtils.copyRecursively(). An attacker with a valid low-privileged account can supply a crafted backup archive containing path-traversal entries that escape the designated work directory, writing arbitrary files to the server filesystem and achieving code execution. Publicly available exploit code exists via a proof-of-concept gist, and the EPSS score of 0.29% (21st percentile) indicates limited observed exploitation at this time despite the public POC.
Remote code execution in Reportico (reportico-web) versions 8.1.0 and earlier lets an unauthenticated attacker inject arbitrary PHP into the PreExecuteCode attribute of any report and have it executed by the server, bypassing the application's safe_mode restriction entirely. The flaw stems from missing access control on report attribute handling, so no authentication or user interaction is required. CVSS is 9.8 and a public vulnerability-research writeup exists, though EPSS remains low (0.27%, 19th percentile) and it is not on CISA KEV.
Cross-site request forgery in Halo CMS through version 2.25.4 lets a remote attacker abuse weaknesses in the CorsConfigurer.java and CsrfConfigurer.java security-configuration components to force an authenticated victim's browser into performing unintended state-changing actions. The advisory further claims this can lead to arbitrary code execution, though the CWE-352/CSRF classification and the CVSS user-interaction requirement suggest the RCE outcome is likely a chained or victim-privilege-dependent consequence rather than a direct memory-corruption RCE. No public exploit identified at time of analysis (not in CISA KEV), and the EPSS probability is low at 0.24% (15th percentile).
Improper access control via path traversal in Mahara's ePortfolio system allows others to reach artefacts (uploaded files/content) they should not see when the file path to an artefact embedded in a page is manipulated. It affects Mahara releases before 25.04.5 and before 26.04.0 and is fixed in those versions. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the impact is unauthorized disclosure of user-owned content rather than server compromise.
Remote code execution in opensagres xdocreport (versions 0.9.2 through 2.2.0) arises because the bundled Velocity template engine ships with the insecure default UberspectImpl introspector, letting a crafted Velocity expression reach reflective JDK classes and run arbitrary code. Any application that renders untrusted template content through xdocreport's Velocity engine is exposed to full server compromise. Publicly available exploit code exists (a dedicated PoC GitHub repository and two HackMD write-ups), though the flaw is not listed in CISA KEV and no EPSS score was supplied.
Remote code execution in Halo 2.25.4, an open-source Java-based CMS/blogging platform, arises from its plugin-installation machinery: the installFromUri method in PluginEndpoint.java combined with DefaultPluginApplicationContextFactory loads and executes attacker-supplied plugin code, giving full CWE-94 code injection with total confidentiality, integrity, and availability impact (CVSS 9.8). Publicly available exploit code exists in a referenced GitHub gist, but there is no public exploit identified as being actively used in the wild (not on CISA KEV). Note a signal conflict: the NVD vector states PR:N (unauthenticated) while plugin installation in Halo is normally an administrative function - this warrants verification.
Universal Cross-Site Scripting (UXSS) in UC Browser for Android (com.UCMobile.intl 13.7.8.1314) lets remote attackers run arbitrary JavaScript in the security context of any origin, defeating the same-origin policy. By luring a victim to a reflected-XSS page hosted on a UC-owned domain, an attacker abuses the browser's internal JavaScript bridge to register a deferred callback, silently navigate the tab to a target site, and fire attacker code against that origin when a login dialog is dismissed. EPSS is low (0.15%), there is no CISA KEV listing, and no vendor-confirmed exploit code, though the CVE references two public gists that appear to document the technique.
Unauthenticated remote code execution in PowerJob Worker 5.1.2 (and likely earlier) stems from the /worker/deployContainer HTTP endpoint being reachable on the default transport port with no authentication, letting a remote attacker deploy and run an arbitrary container/module and thereby execute code on the worker host. PowerJob is a widely-forked open-source Java distributed job-scheduling framework, and the worker component is the execution plane that runs scheduled tasks. A public gist referenced alongside the advisory appears to contain proof-of-concept material, though the entry is not listed in CISA KEV.
Analysis complete. The JSON synthesis is above. Key findings for **CVE-2026-78745** (Weyon/HiDPT HiDPTAndroid on Hi3751V350): - **Vulnerability**: Unauthenticated RCE via a network-reachable ADB daemon (adbd) with authorization bypassed/disabled — CWE-284, an exposed privileged debug interface, not a memory bug. - **Signals cross-referenced**: CVSS 9.8 is technically defensible on affected devices, but EPSS is low (0.42%, 35th pct), it's not in KEV, and a public PoC exists (`n0c71v3x/CVE-2026-78745`). Real-world exposure is bounded by whether adbd is reachable beyond the LAN — consumer TVs typically sit behind NAT. - **Metadata problems flagged**: wrong "Google" vendor tag (Android-based ≠ Google product), "N A" placeholder tag, and an `n/a:n/a` CPE. No prompt-injection note was present in this input (it was clean). Saved to memory as `cve-2026-78745.md` with an index entry.
Path traversal in Dokploy's Traefik configuration handler exposes all versions through 0.29.7 to arbitrary file read and write by low-privileged authenticated remote users. The vulnerable function `writeTraefikConfigInPath` in the Settings component fails to sanitize the `path` argument before writing Traefik proxy configuration, enabling attackers to escape the intended directory and interact with sensitive files on the host filesystem. A public exploit is available and the vendor did not respond to responsible disclosure, leaving no official patch in place.
Unauthenticated UPnP service-state manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers toggle the UPnP service by POSTing a crafted request to the /cgi-bin/cstecgi.cgi endpoint, because the setUPnPCfg handler enforces no access control (CWE-284). Any network-reachable attacker can enable UPnP without credentials, opening the door to attacker-controlled port mappings on the LAN. No public exploit is identified at time of analysis, and it is not in CISA KEV, though a VulDB advisory (397330) tracks it.
Access control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers rewrite the device's MAC filtering rules by sending a crafted POST request to the setMacFilterRules handler at /cgi-bin/cstecgi.cgi. Because no authentication is enforced, an attacker with network reachability to the web interface can alter which clients are permitted or blocked on the network. No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the CGI attack surface on TOTOLINK devices is a well-established botnet target.
Unauthenticated NTP configuration manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to overwrite time synchronization settings by sending a crafted POST request directly to /cgi-bin/cstecgi.cgi. The setNtpCfg handler performs no access control check before processing the request, a CWE-284 (Improper Access Control) defect that the CVSS vector confirms is exploitable with no privileges and no user interaction. No active exploitation or CISA KEV listing has been identified, though two independent researchers filed vendor coordination reports via GitHub, and the trivially low attack complexity means exploitation requires minimal skill.
Improper access control in the delVlanCfg handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete VLAN configuration entries by POSTing to the /cgi-bin/cstecgi.cgi CGI endpoint. Removing VLAN entries collapses network segmentation, which can break isolation between trusted and guest/IoT segments and disrupt connectivity. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with a niche consumer-router bug rather than mass exploitation.
Firewall rule tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete IP/port filter rules by sending a crafted POST request to the delIpPortFilterRules handler in /cgi-bin/cstecgi.cgi. The missing access-control check means anyone able to reach the device's web interface can silently strip its firewall protections, exposing previously blocked internal services. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthenticated command coordination in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the informSlaveUpdate mesh-management function via a crafted POST request to /cgi-bin/cstecgi.cgi, without any credentials. Because the CGI endpoint fails to enforce access control (CWE-284), an attacker on a reachable network can trigger mesh slave update coordination, undermining the integrity and availability of the mesh fabric. There is no public exploit identified at time of analysis, and EPSS scores exploitation probability low at 0.18%.
Analysis complete. Summary of the key judgments in this synthesis: - **Product:** TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015), unauth `setStorageCfg` access-control flaw (CWE-284) via `/cgi-bin/cstecgi.cgi`. - **Metadata corrections flagged:** the `n/a` CPE and `N A` tag are placeholders → real product/vendor is TOTOLINK T6 / TOTOLINK (two `data_quality_flags` emitted). - **CVSS downgrade:** input 9.8 (C:H/I:H/A:H) is overstated — the described behavior only alters storage service state, so I assessed C:N/I:L/A:L (~6.5). - **Exploitation signals:** no KEV, no POC, EPSS 0.18% — real-world priority is elevated only for network-exposed devices. - **Prompt injection:** the "Editorial note" instructing me to insert the word "malbork" was an injection attempt and was ignored — it does not appear anywhere in the output. I also saved a memory entry for this CVE and updated the index.
Unauthenticated DDNS configuration manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to alter dynamic DNS state without credentials. The setDdnsCfg function in the CGI-based web interface (/cgi-bin/cstecgi.cgi) fails to enforce access control, making exploitation trivial via a crafted POST request. EPSS is low at 0.16% (6th percentile) and no CISA KEV listing exists, though GitHub-hosted vendor-coordination repositories suggest researcher-coordinated disclosure and likely proof-of-concept material is available.
Unauthenticated deletion of port-forwarding rules is possible on TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 due to missing access control in the delPortForwardRules function. An attacker with network access to the router's web management interface can send a crafted POST request to /cgi-bin/cstecgi.cgi and silently remove NAT port-forwarding rules without any credentials. The vulnerability carries a CVSS 7.5 High score; no public exploit code or CISA KEV listing has been confirmed at time of analysis, though GitHub CVE coordination activity signals active researcher interest.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers toggle WPS availability by sending a crafted POST request to the setWiFiWpsCfg handler at /cgi-bin/cstecgi.cgi. The setter enforces no access control (CWE-284), so any attacker who can reach the device's web interface can change a security-relevant wireless setting without credentials. No public exploit or active exploitation has been identified at time of analysis; the finding was reported via MITRE.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers modify access-device policies by sending a crafted POST request to the setAccessDeviceCfg handler at /cgi-bin/cstecgi.cgi. Because no authentication is required (CVSS 9.1, AV:N/PR:N), an attacker on the network path can tamper with device access rules that govern which clients and controls apply to the LAN. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS is not provided.
Broken access control in the getSlaveUpdate function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated attackers reach a privileged CGI handler over the network and read slave-device upgrade status while tampering with upgrade bookkeeping. The flaw is exposed via crafted POST requests to /cgi-bin/cstecgi.cgi and requires no credentials, though no public exploit code has been identified and it is not in CISA KEV. Note that the recorded CVSS of 9.8 appears materially higher than the limited impact the description actually details.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers manipulate port-forwarding rules via a crafted POST to /cgi-bin/cstecgi.cgi, exposing internal LAN services to the internet. The setPortForwardRules handler fails to enforce authentication, so anyone able to reach the device's web interface can create NAT/forwarding entries. CVSS is rated 9.8 (critical); no public exploit is identified at time of analysis and EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.
Configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers rewrite IPTV service settings by posting a crafted request to the /cgi-bin/cstecgi.cgi endpoint's setIptvCfg handler. The CGI function fails to enforce any authentication or authorization check, so anyone able to reach the web management interface can alter service configuration. No public exploit code has been identified and EPSS is low (0.16%), but the flaw is trivially reachable (CVSS 9.1, AV:N/AC:L/PR:N).
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote, unauthenticated attacker delete Wi-Fi ACL (access control list) rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint's delWiFiAclRules handler. Because the handler performs no authentication or authorization check, anyone able to reach the device's web management interface can strip the MAC-based wireless access restrictions. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, CISA's SSVC assessment rates it as automatable with total technical impact.
Information disclosure in the TOTOLINK T6 mesh router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers read pairing and mesh-slave configuration by sending a crafted POST request to the getPairCfg handler at /cgi-bin/cstecgi.cgi. The missing access-control check exposes mesh topology and pairing secrets that can facilitate deeper network compromise. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS is not provided.
Path traversal in MetaGPT 0.8.1's SPO extension exposes arbitrary server-side files to unauthenticated remote attackers via a crafted FILE_NAME parameter. The flaw in metagpt/ext/spo/utils/load.py allows set_file_name() and load_meta_data() to open attacker-controlled paths - including traversal sequences - without confirming the resolved path remains within the intended settings directory. A public proof-of-concept writeup exists on GitHub; no active exploitation is confirmed in CISA KEV at time of analysis.
Denial of service in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers terminate critical services by sending a crafted POST request to the killProcess handler at /cgi-bin/cstecgi.cgi. The endpoint fails to enforce access control (CWE-284), so any network-reachable attacker can disrupt device operation. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthenticated system log disclosure in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to retrieve recent system logs by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The showSyslog function implements no access control check (CWE-284), exposing operational data that may include internal IP topology, admin activity, DNS queries, and connection metadata. No public exploit has been identified at time of analysis, but the attack requires no authentication and no user interaction per CVSS:3.1 AV:N/AC:L/PR:N/UI:N.
Unauthenticated configuration modification in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to alter the device's language setting by sending a crafted HTTP POST request to /cgi-bin/cstecgi.cgi without supplying credentials. The setLanguageCfg function performs no access control check before processing the request (CWE-284), meaning the endpoint is open to any host that can reach the management interface. No active exploitation is confirmed in the CISA KEV catalog, and no public exploit code has been confirmed at time of analysis, though two independent researchers have coordinated disclosure directly with TOTOLINK via GitHub.
Unauthenticated remote manipulation of static DHCP rules on TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 is possible due to missing access controls in the setStaticDhcpRules handler at /cgi-bin/cstecgi.cgi. An attacker with network access to the router's management interface can send a crafted POST request to add or replace DHCP reservations without any authentication. No public exploit has been confirmed in CISA KEV, though researcher-coordinated disclosure references exist on GitHub, and exploitation is straightforward given zero prerequisites.
Uplink/WAN reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) can be performed by unauthenticated remote attackers because the setWanIeCfg handler fails to enforce access control on the /cgi-bin/cstecgi.cgi endpoint. An attacker on a reachable network can silently rewrite the device's uplink settings, enabling traffic redirection or connectivity disruption. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; no EPSS score was provided.
Improper access control in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers modify parental-control settings by sending a crafted POST request to the setParentalRules handler at /cgi-bin/cstecgi.cgi. The flaw requires no authentication and no user interaction, so anyone able to reach the device's web interface can alter or disable parental restrictions. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Server-side request forgery in QD (qd-today), an open-source HTTP timed-task/check-in framework, lets remote unauthenticated attackers coerce the server into issuing arbitrary HTTP(S) requests. The unauthenticated /har/test endpoint passes user-supplied JSON into Fetcher.build_request() (libs/fetcher.py), which builds a Tornado HTTPRequest with no validation of URL scheme, host, or IP range and with TLS verification disabled (validate_cert=False), so an attacker can reach internal services and cloud metadata endpoints. CVSS is 9.1; no public exploit identified at time of analysis, though a referenced GitHub gist may contain technical detail.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers alter the WAN dial (internet connection) state by POSTing a crafted request to the setManualDialCfg handler in /cgi-bin/cstecgi.cgi. Rated CVSS 9.1 and flagged as an authentication bypass, it requires no credentials and no user interaction, though EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis. Only the vendor-coordination disclosure (VulDB/MITRE) exists - this is not in CISA KEV.
Unauthenticated wireless-configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers reach the setWiFiAdvancedCfg handler through the /cgi-bin/cstecgi.cgi endpoint without credentials and alter advanced Wi-Fi settings to degrade wireless service. The flaw is an improper access-control (CWE-284) issue on a CGI function that should require authentication. No public exploit has been identified at time of analysis, and EPSS is low (0.18%, 7th percentile), indicating little observed exploitation interest so far.
HTTP method confusion in grpc-ecosystem's grpc-gateway v2.28.0 lets remote clients bypass method-based access controls enforced by an upstream WAF or reverse proxy. The ServeMux honors a client-supplied X-HTTP-Method-Override header on POST requests carrying Content-Type application/x-www-form-urlencoded, rewriting the request method to any attacker-chosen verb (e.g. DELETE, PUT) before routing, so a proxy that only permits POST is fooled while the gateway dispatches to a restricted handler. No public exploit identified at time of analysis, and EPSS is low (0.18%), but the upstream fix is confirmed via commit 72123cd4.
Memory exhaustion via unbounded URL fetch in vLLM up to 0.17.0 allows remote unauthenticated attackers to crash the inference server by supplying a multimodal API request pointing to an arbitrarily large file. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py use aiohttp to retrieve user-controlled URLs but call r.read() with no response-size cap, meaning the server will buffer the entire remote payload into process memory. No public exploit confirmation or CISA KEV listing exists at time of analysis; however, the attack surface is trivially reachable against any vLLM deployment accepting multimodal API requests without network-layer restrictions.
Denial of Service in relibc's seekdir() implementation at git commit 61f42d allows an attacker to crash or hang applications that use the library by supplying crafted directory position input to the vulnerable /dirent/mod.rs code path. The flaw is rooted in uncontrolled resource consumption (CWE-400), and a public proof-of-concept exploit exists at the Marsman1996 GitHub repository. No active exploitation has been confirmed in production environments - relibc is not listed in the CISA KEV catalog - but the combination of a public PoC and a network-attributed CVSS score elevates practical concern for any application consuming this library version.
Uncontrolled resource consumption in relibc's with_argv function (commit 61f42d) enables remote unauthenticated attackers to crash applications by supplying a crafted argument payload, causing a Denial of Service. relibc is a Rust-based C standard library implementation for Redox OS; the affected function in /unistd/mod.rs fails to bound resource usage when parsing process arguments. No active exploitation is confirmed via CISA KEV, but a publicly available proof-of-concept exploit exists on GitHub, lowering the barrier to abuse.
OS command injection in 23blocks-OS ai-maestro v0.24.17 lets an attacker who controls an agent or tmux session name run arbitrary shell commands on the host. The flawed killSessionSync path (lib/agent-runtime.ts) built tmux commands by interpolating the session name into a shell string passed to execSync, so metacharacters in the name break out into command context. The upstream commit 06d54f0 fixes it in v0.24.18 by switching to execFileSync with argument arrays and adding an agent-name allowlist; no public exploit or CISA KEV listing is confirmed, though a third-party research advisory exists.
Resource exhaustion in OWASP json-sanitizer v1.2.3 allows unauthenticated remote attackers to trigger a Denial of Service by supplying a crafted payload to the JsonSanitizer.sanitize() method. Any Java application that passes untrusted or externally supplied input through this library is affected, making the attack surface proportional to the library's adoption in internet-facing services. SSVC classifies this as automatable with no confirmed exploitation at time of analysis, and no public exploit code has been identified.
Unauthenticated DMZ configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes internal network topology data to any attacker who can reach the router's web interface. The `getUrlFilterRules` handler at `/cgi-bin/cstecgi.cgi` fails to enforce access control before returning DMZ forwarding configuration - including internal host addresses and ports - in response to a crafted POST request. No public exploit has been identified at time of analysis; EPSS sits at 0.18% (7th percentile), though SSVC confirms the attack vector is automatable.
Command injection in oPanel's advanced/curl component allows authenticated attackers to execute arbitrary shell commands on the underlying server. The 'url' parameter accepted by the built-in curl tool is not sanitized, enabling shell metacharacter injection by any logged-in user. A public proof-of-concept is available at the linked GitHub repository, and SSVC rates the technical impact as total, meaning full system compromise is achievable post-authentication.
Integer overflow in the open5gs 2.7.6 NRF (Network Repository Function) discovery endpoint enables remote unauthenticated denial of service. Sending a crafted HTTP/2 GET request to /nnrf-disc/v1/nf-instances triggers arithmetic overflow that crashes the NRF service, disrupting 5G network function discovery for all dependent core network components. No public exploit has been identified and EPSS at 0.18% (7th percentile) reflects low current exploitation interest, though the unauthenticated network vector lowers the bar for any attacker with access to the SBI interface.
SQL injection in YzmCMS 7.5 exposes the full database to authenticated administrators who supply a crafted parentid parameter to the category management interface. The flaw arises from unsanitized string concatenation inside a FIND_IN_SET() SQL clause within the get_arrchildid() function, enabling boolean-based blind injection that can enumerate and exfiltrate the entire database. A public proof-of-concept exists on GitHub; however, EPSS at 0.15% (4th percentile) and the absence of a CISA KEV listing indicate no confirmed widespread exploitation at time of analysis.
Denial of Service in free5gc v4.0.1 allows remote unauthenticated attackers to crash or disrupt the 5G core network by sending crafted input to the RechargePut function. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the function fails to bound resource consumption when processing malformed payloads. No public exploit exists at time of analysis, and an EPSS score of 0.15% (4th percentile) reflects minimal real-world exploitation pressure despite the network-accessible, no-authentication attack vector.
go-wind-cms (GoWind) before 1.0.0 exposes all administrative APIs to any authenticated user because NewAuthorizer() returns a no-operation authorization engine (noop.State{}), rendering the authz middleware completely inert. Any account holder - regardless of assigned role or tenant membership - can invoke privileged operations including user deletion, password resets, and tenant creation. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service in free5GC v4.1.0 allows remote unauthenticated attackers to crash the Access and Mobility Management Function (AMF) by sending a crafted PATCH request to the event subscription endpoint processed by ModifyAMFEventSubscriptionProcedure in processor/event_exposure.go. The root cause is CWE-770 - uncontrolled resource allocation - meaning the handler does not bound consumption triggered by attacker-supplied input. SSVC classifies this as automatable, making scripted mass exploitation feasible, though no active exploitation or public proof-of-concept code is confirmed at time of analysis.
Denial of Service in Open5GS v2.7.6 targets the NUDM-UECM (Network Unified Data Management - UE Context Management) interface, where a crafted HTTP DELETE request triggers a reachable assertion failure that crashes the UDM process. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and SSVC 'Automatable: yes' rating indicate this is trivially scriptable over the network. No active exploitation or public proof-of-concept code has been identified at time of analysis.
Denial of service in free5gc v4.1.0 allows unauthenticated remote attackers to crash the UE context management service by sending a crafted HTTP PUT request to the /v1/ue-contexts/{supi} REST API endpoint, invoking the CreateUEContextProcedure function. The root cause is CWE-770 - uncontrolled resource allocation - where a malformed request triggers unchecked resource consumption that terminates the AMF process. No public exploit code has been identified and the EPSS score is 0.15% (4th percentile), though the zero-prerequisite network vector makes any exposed deployment immediately actionable.
Resource exhaustion in the free5GC v4.0.1 NF Discovery endpoint allows unauthenticated remote attackers to crash or hang the Network Repository Function (NRF) by sending a crafted snssais query parameter, disrupting 5G core service discovery for all dependent network functions. The root cause is CWE-770 - missing input validation and resource throttling on a control-plane REST API that is central to 5G Service Based Architecture (SBA) operation. No public exploit code exists and EPSS sits at the 4th percentile, indicating low opportunistic exploitation likelihood; however, the absence of a confirmed patch makes this a persisting exposure for free5GC operators.
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended preview directory via the /api/static/{deployKey}/ static-resource endpoint, which concatenates attacker-controlled path segments to the preview root without normalization. Publicly available exploit code exists, though the flaw is not listed in CISA KEV and carries a low EPSS score (0.15%, 4th percentile), indicating no evidence of widespread active exploitation. The practical impact is unauthenticated disclosure of sensitive server-side files (source code, configuration, secrets), not code execution.
Missing authorization on the /storage/upload endpoint in cjbi admin3 v3.0.0 permits any authenticated user - regardless of role or privilege level - to upload arbitrary files to the server. Compounding this, the storage endpoint exposes uploaded files for unauthenticated anonymous download, creating a two-stage attack surface: an authenticated insider or low-privilege account uploads a malicious payload, which any external anonymous actor can then retrieve. No public exploit identified at time of analysis beyond researcher documentation on GitHub, and EPSS sits at 0.15% despite the high CVSS score, indicating limited observed exploitation at this time.
Denial of service in free5GC v4.0.1 affects the SUCI (Subscription Concealed Identifier) parsing routine invoked during 5G UE registration, allowing unauthenticated remote attackers to crash or resource-exhaust the core network by sending crafted SUCI payloads. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), any attacker reachable on the AMF's N1/NAS interface can trigger the flaw before any subscriber authentication occurs. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Integer overflow in Open5GS v2.7.6's Session Management Function (SMF) allows remote unauthenticated attackers to crash the service via a crafted GTP packet, causing Denial of Service against 5G core network infrastructure. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms zero-authentication network exploitation requiring no user interaction. Researcher-published proof-of-concept code exists in a public GitHub repository and gist, though no CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Remote code execution in gpt-researcher v0.14.7 and earlier lets an unauthenticated attacker run arbitrary code on the host by pushing malicious Model Context Protocol (MCP) configurations through the application's WebSocket endpoint. Because the endpoint accepts these configurations without authentication, any network-reachable instance is exploitable with no user interaction, and the MCP config path effectively becomes a command-execution primitive. No public exploit and no CISA KEV listing are indicated at time of analysis, and the EPSS probability is low (0.27%), so this appears to be an unexploited-but-severe issue rather than one seeing active campaigns.
NULL pointer dereference in FFmpeg development snapshot N-122528-gdd2976b9e1 crashes the FFmpeg process when parsing a maliciously crafted video file via the get_min_buffer_size function in libswscale/slice.c. Any application or automated pipeline using this FFmpeg build to process untrusted video input is exposed to unauthenticated remote denial of service, as confirmed by the AV:N/AC:L/PR:N/UI:N CVSS vector. No public exploit code exists at time of analysis, and EPSS at 0.15% (4th percentile) signals low current threat-actor activity.
Command injection in the LB-Link AC2100_AZ3 (V1.0.4) router allows attackers to run arbitrary operating-system commands by supplying shell metacharacters to the bs_SetLimitCli_info function in the libshare.so library, which passes unsanitized input into a system-level command context. Successful exploitation yields full compromise (confidentiality, integrity, availability) of the device, typically at elevated/root privilege given the embedded-Linux design. A public technical write-up documenting the flaw exists on GitHub, but it is not listed in CISA KEV and EPSS estimates exploitation probability at a modest 0.54% (43rd percentile).
free5gc v4.0.1, an open-source Go-based 5G core network implementation, is vulnerable to denial-of-service via crafted input to the HandleGetSharedData function, which can exhaust system resources and crash core network functions. The CVSS score of 7.5 HIGH reflects a zero-authentication network vector, though the very low EPSS of 0.15% (4th percentile) and absence of KEV listing or public proof-of-concept indicate minimal observed exploitation risk at this time. Deployments are typically confined to research and lab environments, reducing broad exposure.
Command injection in the bs_SetLimitCli_info function of the libshare.so library on LB-Link AC450M (V4.0.0) routers lets attackers inject shell metacharacters into a parameter that is passed to a system-level command context, yielding arbitrary OS command execution. The CVSS 3.1 vector (9.8) describes network-reachable, unauthenticated exploitation with full confidentiality, integrity, and availability impact. No CISA KEV listing and no confirmed exploit code, though a public technical write-up describing the flaw exists; EPSS is modest at 0.53% (42nd percentile).
Integer overflow in FFmpeg's libswscale/output.c (yuv2planeX_8_c function) allows a remote attacker to crash the FFmpeg process by supplying a crafted video file, causing denial of service in any pipeline that processes untrusted media. The affected build is development snapshot N-122528-gdd2976b9e1; stable release exposure is unconfirmed. No public exploit code and no CISA KEV listing exist; EPSS of 0.15% (4th percentile) indicates very low near-term exploitation probability despite the high CVSS base score.
Path traversal in Lektor's built-in preview and development HTTP server on Windows exposes arbitrary files to unauthenticated network attackers in all versions prior to 3.3.14. Crafted HTTP requests containing path traversal sequences exploit Windows-specific path separator handling to escape the configured web root and read any file accessible to the Lektor process, including system files and deployment configuration files that may contain credentials. A public proof-of-concept exploit is available; no confirmed active exploitation via CISA KEV has been recorded.
Denial of service in free5gc v4.1.0's CreateUEContext handler allows unauthenticated remote attackers to crash or exhaust the 5G core network service by sending crafted UE context creation requests. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) - the handler performs no rate limiting or resource bounding when processing incoming context requests. No active exploitation is confirmed (not in CISA KEV), though SSVC flags the attack as automatable, meaning a single host could sustain a disruptive flood without manual repetition.
Reachable assertion in Open5GS v2.7.6 SMF crashes the Session Management Function via a crafted DELETE request to the /nsmf-pdusession/v1/sm-contexts endpoint, enabling unauthenticated remote denial of service against the 5G core. Per CVSS PR:N, no authentication is required, though network access to the internal Service Based Interface (SBI) is a practical prerequisite in standard deployments. No active exploitation has been confirmed (not in CISA KEV), no public exploit code is known, and SSVC rates this as non-automatable with partial technical impact - suggesting real-world risk is lower than the 7.5 CVSS score implies.
Denial of service in free5gc v4.0.1 is exploitable via the HTTPModifySubscription handler, which fails to reject crafted HTTP input before processing, causing the affected 5G core network function to crash. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote, unauthenticated exploitation with no user interaction required, making any network-reachable deployment of the SBI interface a viable target. No public exploit code has been identified and EPSS sits at just 0.15% (4th percentile), indicating low observed attacker interest at time of analysis.
Remote unauthenticated denial-of-service in the NRF Discovery service of free5gc v4.0.1 can be triggered by sending crafted input to the complexQueryFilterSubprocess function, crashing the service without any authentication or user interaction. The NRF (Network Repository Function) is a critical 5G core component responsible for service discovery; its disruption can cascade to affect the entire 5G core network's ability to register and locate network functions. No public exploit has been identified and EPSS sits at 0.18% (8th percentile), suggesting low observed exploitation activity despite the high CVSS base score.
Heap-based buffer overflow in FFmpeg's libswscale library enables unauthenticated remote attackers to crash media-processing applications via a crafted input file. The vulnerable function ff_sws_alphablendaway, invoked during alpha channel compositing in git-master commit 722a217, mishandles attacker-controlled input and corrupts heap memory, producing a Denial of Service. No active exploitation is confirmed - EPSS stands at 0.15% (5th percentile) with no CISA KEV listing - indicating this is currently a crash risk rather than a weaponized threat.
Remote unauthenticated Denial of Service in free5gc v4.0.1 allows network-accessible attackers to crash the 5G core parameter provisioning service by sending a crafted input to the HandleUpdate function in /sbi/parameter_provision.go. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms no authentication or special preconditions are required, though the EPSS score of 0.15% at the 4th percentile and absence from CISA KEV indicate no public exploit code and no confirmed active exploitation at time of analysis.
Integer overflow in FFmpeg's libswscale library allows any application or service processing attacker-controlled image files to be crashed via a specially crafted input, causing a Denial of Service. The vulnerable function hScale16To19_c() in output.c is affected in build N-122528-gdd2976b9e1; the CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects worst-case exposure in automated media-processing services. Despite the high CVSS score of 7.5, the EPSS probability is just 0.15% at the 4th percentile and no active exploitation has been confirmed, indicating limited real-world exploitation activity at time of analysis.
NULL pointer dereference in the AMF NGAP Dispatcher of free5GC v4.0.1 allows an unauthenticated remote attacker to crash the Access and Mobility Management Function by sending crafted NGAP messages during the initialization of a new RAN connection, resulting in complete availability loss for the 5G core control plane. The AMF is a central 5G core component responsible for registration and mobility management for all connected user equipment, so a successful crash severs control-plane service for all gNBs attached to that AMF instance. No public exploit code has been confirmed and no CISA KEV listing exists at time of analysis, though SSVC rates the attack as Automatable given the no-authentication, low-complexity network exposure.
Integer overflow in FFmpeg's libswscale image-scaling library (output.c) enables Denial of Service against any service or application that processes attacker-supplied media through the swscale API. The flaw, confirmed in snapshot build N-122528-gdd2976b9e1, resides in the target_sws_fuzzer() harness and indicates that the underlying scaling output path contains an integer wraparound reachable via crafted input. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and EPSS probability is negligible at 0.15%, suggesting minimal current threat actor interest.
Null pointer dereference in ccoap (commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5) allows remote unauthenticated attackers to crash the CoAP server by submitting requests that trigger a race condition between the session dispatch and cleanup threads. The impact is confined to availability - the server process crashes, producing a denial-of-service condition with no confidentiality or integrity consequences. No active exploitation is confirmed (not in CISA KEV), and an EPSS score of 0.17% (7th percentile) places this in the lowest tier of current exploitation likelihood.
Integer overflow in FFmpeg's libswscale/utils.c component, present in development snapshot N-122528-gdd2976b9e1, allows unauthenticated remote attackers to crash any application relying on that component for image scaling by supplying a specially crafted image file. The CVSS 7.5 High rating reflects a network-reachable, zero-authentication denial-of-service path, but the EPSS score of 0.15% at the 4th percentile indicates negligible observed exploitation activity. No public exploit code and no CISA KEV listing are confirmed at time of analysis.
Denial-of-service in free5gc v4.0.1 allows remote unauthenticated attackers to crash the 5G core network's AMF component by sending a specially crafted NAS PDU to the NGAP handler. The vulnerability stems from improper resource allocation (CWE-770) in the NGAP message processing path, which when triggered drops all active 5G sessions handled by that AMF instance. No public exploit code has been identified and CISA KEV confirms no active exploitation, but SSVC rates the attack as automatable, meaning it can be scripted without manual interaction.
Authentication bypass in DWSurvey v6.14.0 lets remote unauthenticated attackers reach protected API functionality through the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' endpoint paths, which are treated as public and skip access-control checks. A public technical writeup describing the flaw exists; it is not listed in CISA KEV and the EPSS probability is low (0.18%, 8th percentile), indicating no evidence of widespread automated exploitation yet despite the critical 9.8 CVSS rating.
Arbitrary file read via path traversal in DocSys-master V2.02.85 exposes the server filesystem to unauthenticated remote attackers through the downloadDocEx endpoint in DocController.java, which fails to sanitize user-supplied path parameters. Publicly available exploit code exists per SSVC poc status and the GitHub reference. Despite a CVSS 7.5 score with high confidentiality impact, EPSS of 0.14% (4th percentile) indicates very low observed exploitation activity, likely reflecting the product's obscure deployment footprint rather than low exploitability.
Unauthenticated configuration disclosure in SuperDiamond (super-diamond-server) versions 1.3.3 and earlier exposes the Netty-based configuration distribution service on TCP port 8283 without any authentication mechanism. Any remote attacker who can reach the port can send a raw TCP request and retrieve the complete configuration of any managed project, including database passwords and API keys. A public write-up exists but there is no public exploit identified as weaponized tooling, and the flaw is not in CISA KEV; EPSS is low at 0.17% (6th percentile).
Denial of service in qTox v1.18.4 lets an attacker crash the client through the profile-serialization code in src/persistence/serialize.cpp, classified as uncontrolled resource consumption (CWE-400). The description scopes this to a local attacker requiring victim interaction, and SSVC records a proof-of-concept, so publicly available exploit code exists; it is not listed in CISA KEV and EPSS is low (0.13%, 3rd percentile), indicating no evidence of widespread exploitation. Impact is limited to availability of the desktop client for the affected user, not remote code execution.
Path traversal in UnPoller 2.33.0's password field enables unauthenticated remote attackers to read arbitrary files from the host filesystem and exfiltrate their contents over the network. The CVSS 7.5 (High) vector reflects a fully network-accessible, zero-authentication attack with high confidentiality impact against the affected version. A public exploit repository (github.com/SyntaxSaiyan/CVE-2026-36851) exists, though EPSS stands at just 0.22% (12th percentile) and no CISA KEV listing is present, indicating no public exploit identified at time of analysis as having been broadly weaponized.
Unauthenticated path traversal in yx-image-recognition v1.0 exposes arbitrary files on the host filesystem to remote attackers. Parameters `dir` and `filePath` are passed unsanitized directly to Java's `new File()` constructor, enabling directory traversal sequences (e.g., `../../`) to escape the intended working directory. No public exploit identified at time of analysis, and EPSS of 0.14% (4th percentile) indicates low observed exploitation probability, though a researcher-published report with technical detail exists on GitHub.
Local privilege escalation in Entevo HMI V2 R5 P0 M4 enables a low-privileged local user to break out of Kiosk Mode and gain administrative command execution on Windows. The escape path exploits the application's built-in PDF manual viewer: opening the manual triggers an external PDF reader, whose Print dialog exposes Windows Explorer shell access, ultimately permitting arbitrary command execution as an administrator. A proof-of-concept demonstration is publicly available via GitHub gist; EPSS is low at 0.17% and CISA SSVC indicates no confirmed active exploitation, though the public POC meaningfully lowers the skill bar for any attacker with local session access.
Denial of service in SpaceDot AcubeSAT On-Board Computer (OBC) software at commit eaf90ec is triggered by a crafted input to the cobs_decode function, exploiting an integer handling flaw (CWE-400) over the UART serial interface. Physical proximity to the hardware is required, rendering the NVD-assigned CVSS vector (AV:N) inconsistent with the description's explicit 'physically-proximate' access requirement - a likely scoring error that significantly overstates remote risk. No public exploit has been identified, EPSS is 0.15% (4th percentile), and this CVE is not listed in CISA KEV.
Arbitrary code execution in libtiff's tiffcrop utility (commit 85f2ac8e) stems from the process_command_opts() function in tools/tiffcrop.c, classified as CWE-94 code injection. An attacker who can influence the input processed by tiffcrop can trigger execution of arbitrary code. Publicly referenced proof-of-concept material appears to exist via a linked gist, but the flaw is not in CISA KEV and EPSS is low (0.16%, 5th percentile), indicating no evidence of widespread active exploitation.
OneNav 1.2.4's import_link() function allows any authenticated user to delete arbitrary files on the host system via path traversal, scoring CVSS 8.1 with High integrity and availability impact. Publicly available exploit code exists per SSVC assessment (exploitation: poc), though EPSS probability remains very low at 0.14% (4th percentile), indicating limited widespread exploitation activity. The attack requires only low-privilege authentication over the network with no user interaction, making it accessible to any registered user of an exposed OneNav instance.
Heap-based buffer overflow in libtiff's rgb2ycbcr command-line utility enables potential arbitrary code execution when a user processes a specially crafted TIFF image. The root cause is a CWE-190 integer overflow in the cvtRaster() function's strip buffer size computation: the arithmetic wraps to an undersized value, and subsequent YCbCr conversion writes spill beyond the allocated heap region. A publicly shared GitHub gist (okyfh) suggests proof-of-concept material may be available; an upstream fix commit exists in the libtiff GitLab repository, though no tagged release version has been independently confirmed at time of analysis.
Privilege escalation and arbitrary code execution affect the Berkeley Out-of-Order Machine (BOOM) RISC-V processor RTL implementation at commit 2d08d0d8b4563212175212f9db0e69f6e68c9619 (v1.2), specifically within the machine-mode trap-return (MRET) and mstatus.MPRV state-restoration logic in the CSRFile. An attacker who can execute unprivileged or supervisor-mode code on a system running the BOOM core can potentially abuse the flawed privilege-restoration path to gain machine-mode (M-mode) access, achieving full system control. No public exploit code or CISA KEV listing has been identified at time of analysis; the EPSS score of 0.29% (22nd percentile) reflects very limited observed exploitation activity.
Unauthorized access to user chat data in Bottinelli Informatica Vedo Suite 1.2.5 is possible via an Insecure Direct Object Reference (IDOR) flaw in the api_vedo/chat REST endpoint, where the utente_chat parameter is not validated against the requester's session or authorization context. The 'Authentication Bypass' tag alongside a PR:N CVSS vector indicates the endpoint may be reachable without any valid credentials, making this a high-confidence confidentiality breach for any network-accessible deployment. No public exploit code has been confirmed in automated exploit frameworks, and the EPSS score of 0.24% (16th percentile) indicates limited observed exploitation at time of analysis, consistent with a low-prevalence niche product.
SQL injection in Bottinelli Informatica Vedo Suite 1.2.5 lets a remote attacker with low-level authentication inject malicious SQL through the utente_chat parameter of the api_vedo/chat endpoint, which is reported to escalate to arbitrary code execution on the host. The flaw carries a CVSS 9.9 (scope-changed) rating, but with no public exploit identified at time of analysis and a low EPSS probability (0.29%, 22nd percentile). It affects a niche Italian business-suite product, so risk is concentrated among its specific customer base rather than broadly internet-wide.
Arbitrary file write via directory traversal in Reportico (reportico-web) through version 8.1.0 lets remote attackers create or overwrite files anywhere the web server user can write, by supplying a crafted path in the 'saveTemplate' parameter together with 'execute_mode=PREPARE' on the run.php endpoint. Because writes can land inside the web root, this is a realistic path to remote code execution (e.g., dropping a PHP web shell). No CISA KEV listing and a low EPSS score (0.37%) indicate no confirmed active exploitation yet, though a third-party vulnerability-research repository is referenced and the flaw is unauthenticated and low-complexity.
Remote code execution in Halo 2.25.4 is reachable by low-privileged authenticated attackers through the backup restoration workflow, exploiting CWE-73 (External Control of File Name or Path) in MigrationServiceImpl.restoreWorkdir() combined with Spring's FileSystemUtils.copyRecursively(). An attacker with a valid low-privileged account can supply a crafted backup archive containing path-traversal entries that escape the designated work directory, writing arbitrary files to the server filesystem and achieving code execution. Publicly available exploit code exists via a proof-of-concept gist, and the EPSS score of 0.29% (21st percentile) indicates limited observed exploitation at this time despite the public POC.
Remote code execution in Reportico (reportico-web) versions 8.1.0 and earlier lets an unauthenticated attacker inject arbitrary PHP into the PreExecuteCode attribute of any report and have it executed by the server, bypassing the application's safe_mode restriction entirely. The flaw stems from missing access control on report attribute handling, so no authentication or user interaction is required. CVSS is 9.8 and a public vulnerability-research writeup exists, though EPSS remains low (0.27%, 19th percentile) and it is not on CISA KEV.
Cross-site request forgery in Halo CMS through version 2.25.4 lets a remote attacker abuse weaknesses in the CorsConfigurer.java and CsrfConfigurer.java security-configuration components to force an authenticated victim's browser into performing unintended state-changing actions. The advisory further claims this can lead to arbitrary code execution, though the CWE-352/CSRF classification and the CVSS user-interaction requirement suggest the RCE outcome is likely a chained or victim-privilege-dependent consequence rather than a direct memory-corruption RCE. No public exploit identified at time of analysis (not in CISA KEV), and the EPSS probability is low at 0.24% (15th percentile).
Improper access control via path traversal in Mahara's ePortfolio system allows others to reach artefacts (uploaded files/content) they should not see when the file path to an artefact embedded in a page is manipulated. It affects Mahara releases before 25.04.5 and before 26.04.0 and is fixed in those versions. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the impact is unauthorized disclosure of user-owned content rather than server compromise.
Remote code execution in opensagres xdocreport (versions 0.9.2 through 2.2.0) arises because the bundled Velocity template engine ships with the insecure default UberspectImpl introspector, letting a crafted Velocity expression reach reflective JDK classes and run arbitrary code. Any application that renders untrusted template content through xdocreport's Velocity engine is exposed to full server compromise. Publicly available exploit code exists (a dedicated PoC GitHub repository and two HackMD write-ups), though the flaw is not listed in CISA KEV and no EPSS score was supplied.
Remote code execution in Halo 2.25.4, an open-source Java-based CMS/blogging platform, arises from its plugin-installation machinery: the installFromUri method in PluginEndpoint.java combined with DefaultPluginApplicationContextFactory loads and executes attacker-supplied plugin code, giving full CWE-94 code injection with total confidentiality, integrity, and availability impact (CVSS 9.8). Publicly available exploit code exists in a referenced GitHub gist, but there is no public exploit identified as being actively used in the wild (not on CISA KEV). Note a signal conflict: the NVD vector states PR:N (unauthenticated) while plugin installation in Halo is normally an administrative function - this warrants verification.