N A
Monthly
Escalation of privilege in Intel Endpoint Management Assistant (EMA) software before version 1.14.5 allows an unauthenticated adversary on an adjacent network to gain elevated privileges on the vulnerable host, fully compromising its confidentiality, integrity, and availability. The flaw stems from improper input validation in a Ring 3 user-application component and carries a CVSS 4.0 base score of 8.7 (High). There is no public exploit identified at time of analysis, exploitation is not observed per CISA SSVC (Exploitation: none), and EPSS is very low at 0.03%.
Transient execution information disclosure in Intel processors allows unprivileged guest VM code to leak sensitive data from co-resident workloads by exploiting shared microarchitectural predictor state during VMX non-root operation. Confidentiality impact is rated high at both the vulnerable-system and subsequent-system level, indicating potential cross-VM or host-to-guest data leakage consistent with Spectre-class side-channel behavior. No public exploit has been identified at time of analysis, EPSS sits at the 3rd percentile, and CISA SSVC rates exploitation as none - but the cross-boundary confidentiality impact makes this relevant to any multi-tenant virtualized environment running affected Intel silicon.
Privilege escalation in Intel Server Firmware Update Utility Software before version 16.0.12 exposes authenticated local users to an uncontrolled search path (DLL/library hijacking) condition within the Ring 3 user-application layer. A low-privileged local attacker who can plant a malicious library or executable in a directory the utility searches at launch can escalate privileges with high impact to confidentiality, integrity, and availability of the affected system. No public exploit is identified at time of analysis, and EPSS sits at the 3rd percentile, consistent with SSVC exploitation status of 'none'.
Use-after-free in the Linux kernel ice driver for Intel Ethernet 800 series adapters before version 2.3.14 enables a local authenticated attacker with low privileges to trigger a kernel-level denial of service. The flaw resides in Ring 0 (kernel space), meaning heap corruption in the driver can cause kernel panics or system hangs with high availability impact to both the vulnerable system and subsequent dependent systems. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.01% (3rd percentile) reflects negligible near-term weaponization probability.
Null pointer dereference in Intel Quick Assist Technology (QAT) software drivers for Windows before version 2.6.0 enables denial of service by local authenticated users operating within Ring 3 (user-space). The flaw requires low complexity and no user interaction, allowing a low-privileged local adversary to crash the affected driver component, producing availability loss with no confidentiality or integrity impact. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.01% (3rd percentile), indicating negligible real-world exploitation activity at time of analysis.
Denial of service in Intel Quick Assist Technology (QAT) software drivers for Windows before version 2.6 can be triggered by a low-privileged local user through improper input validation at the Ring 3 (user application) boundary. An authenticated but unprivileged local attacker can cause high availability impact to the affected system with low complexity, also producing minor confidentiality and integrity side effects. No public exploit code has been identified at time of analysis, and SSVC assessment classifies exploitation as none with non-automatable attack surface.
Divide-by-zero in Intel Quick Assist Technology (QAT) software drivers for Windows before version 1.13 allows a low-privileged authenticated local user to cause a denial of service. The flaw resides in the Ring 3 (user application) layer of the driver stack, meaning no kernel-level access or elevated privileges are required to trigger the crash. No active exploitation has been identified - EPSS is 0.01% at the 3rd percentile, the vulnerability is absent from the CISA KEV catalog, and SSVC rates exploitation as 'none' with automatable set to 'no.'
Intel QAT (Quick Assist Technology) software drivers for Windows before version 1.13 contain an unchecked return value flaw in Ring 3 user-space application code, enabling a local authenticated attacker to cause a denial of service. The vulnerability carries a CVSS 4.0 score of 4.8 with strictly local access and low-privilege requirements, limiting blast radius to availability of the affected system only. No public exploit code exists and CISA has not listed this in KEV; EPSS at the 3rd percentile and SSVC exploitation status of 'none' confirm this is currently theoretical rather than actively targeted.
Buffer overflow in Intel QAT (Quick Assist Technology) software drivers for Windows before version 1.13 allows an authenticated local user to trigger a denial of service condition via the Ring 3 user-application interface. The flaw (CWE-120) resides in the user-space driver layer and does not require special internal knowledge or user interaction to exploit, though local authenticated access is a hard prerequisite. No active exploitation has been identified (not in CISA KEV), and EPSS remains at the 3rd percentile, placing real-world risk firmly in the low-to-medium range despite a moderate CVSS 4.0 score of 6.9.
Privilege escalation in Intel Connectivity Performance Suite software installers before version 50.25.1121.193 allows a local, low-privileged authenticated attacker to gain elevated privileges through an uncontrolled search path (CWE-427) triggered during installer execution in Ring 3 user space. Exploitation is constrained by high attack complexity, a mandatory specific attack configuration (AT:P), and a requirement for active user interaction, making this a targeted rather than opportunistic risk. No active exploitation has been confirmed - EPSS sits at 0.01% (3rd percentile), SSVC lists exploitation as none, and no CISA KEV listing exists.
Null pointer dereference in Intel QAT (Quick Assist Technology) software drivers for Windows before version 1.13 permits a low-privileged authenticated local user to crash the driver's Ring 3 user-mode component, causing a denial of service with high availability impact and minor confidentiality exposure. No active exploitation is confirmed - the vulnerability is absent from CISA KEV, EPSS sits at 0.01% (3rd percentile), and SSVC classifies exploitation status as none. Real-world risk is constrained to environments with Intel QAT explicitly deployed, which is typical of data-center and high-performance computing workloads rather than general enterprise endpoints.
Denial of service in Intel Neural Processing Unit (NPU) firmware drivers (Ring 1: Device Drivers) allows a low-privileged local user to crash or impair NPU availability through an improper conditions check (CWE-754). Affected are systems running Intel NPU Drivers as identified under Intel Security Advisory INTEL-SA-01424. No public exploit or active exploitation has been identified; EPSS is 0.01% (3rd percentile) and CISA SSVC rates exploitation as none - making this a low-urgency patching item despite the driver-level impact.
Privilege escalation in Intel NPU Driver software installers before version 32.0.100.4511 stems from incorrect default permissions applied to Ring 3 (user-space) components during installation, classified under CWE-276. A local authenticated low-privileged user on an affected system can exploit these misconfigured permissions under high-complexity conditions - requiring specific attack prerequisites and active user interaction - to achieve full confidentiality, integrity, and availability compromise of the vulnerable system. No active exploitation is confirmed (not in CISA KEV), EPSS is at the 1st percentile (0.01%), and SSVC designates exploitation status as none, indicating this is a theoretical but not currently weaponized risk.
Improper input validation in Intel Quick Assist Technology (QAT) software drivers for Windows prior to version 1.13 allows a local authenticated user to trigger a denial of service condition. The flaw resides in the Ring 3 (user-space application) layer of the driver stack, meaning an unprivileged but authenticated local adversary can cause high availability impact - potentially crashing the driver or the system - with minor confidentiality and integrity side effects. No public exploit code has been identified at time of analysis, EPSS sits at 0.02% (6th percentile), and CISA SSVC classifies exploitation as none and the attack as non-automatable, indicating negligible current threat activity.
An arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted PHP file. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
mem0 1.0.0 server exposes an unauthenticated memory deletion API endpoint (DELETE /memories) that allows remote attackers to delete arbitrary user memory records by specifying user identifiers in query parameters, resulting in unauthorized data loss and denial of service. No authentication or authorization validation is performed before processing deletion requests, enabling any network-accessible attacker to target any user's data without credentials.
Remote code execution in Kubectl MCP Server v1.1.1 allows unauthenticated network attackers to execute arbitrary commands on systems running the vulnerable server through crafted HTML-based exploitation vectors. Despite a critical 9.8 CVSS score, EPSS rates exploitation likelihood at only 0.02% (4th percentile), suggesting limited real-world targeting thus far. The vulnerability is classified as CWE-94 (Code Injection), affecting an open-source Model Context Protocol (MCP) server implementation for Kubernetes management. No CISA KEV listing indicates absence of confirmed widespread exploitation at time of analysis.
An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation of the chamado parameter through a crafted GET request. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting (XSS) in FluentCMS 1.2.3 File Management module allows authenticated administrators to upload SVG files with embedded malicious JavaScript that executes when any user-including unauthenticated visitors-accesses the image URL directly. The vulnerability has public proof-of-concept code available via GitHub pull request, and CISA SSVC framework confirms exploitability is feasible but requires user interaction and is not automatable. CVSS 5.4 reflects the attack complexity introduced by authentication requirement and user interaction, but the cross-origin scope and ability to affect multiple users elevates real-world risk.
Authentication bypass in OpenClaw's BlueBubbles webhook handler allows remote attackers to send crafted webhook requests without credentials. The handleBlueBubblesWebhookRequest function in extensions/bluebubbles/src/monitor.ts incorrectly exempts localhost requests from authentication, enabling IP spoofing attacks to bypass security controls. Exploit code is publicly available on GitHub. Patch released in version 2026.2.12 (commit a6653be). CVSS 7.3 reflects network-accessible unauthenticated attack with low complexity affecting confidentiality, integrity, and availability.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the NRF component by manipulating the hnrf-uri argument passed to the yuarel_parse function in /lib/sbi/conv.c. The vulnerability has a publicly available exploit and low CVSS score (4.3) due to authentication requirement and limited scope, but affects a critical 5G network function with potential operational impact.
Denial of service in Open5GS NRF component up to version 2.7.7 allows remote authenticated attackers to exhaust the nf_service memory pool via the ogs_nnrf_nfm_handle_nf_profile function, causing the process to abort via failed assertion. Publicly available exploit code exists, and a vendor patch is available but awaits acceptance into the main branch.
Denial of service in Open5GS through version 2.7.7 allows authenticated remote attackers to crash the Service Management Function (SMF) by manipulating the smf_nsmf_handle_update_data_in_vsmf function in nsmf-handler.c. Publicly available exploit code exists, and the project maintainers have not yet responded to the early disclosure notification despite awareness of the issue.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Session Management Function (SMF) by manipulating the qosFlowProfile argument in the smf_nsmf_handle_update_data_in_vsmf function. Publicly available exploit code exists, and the vulnerability affects the 5G core network's ability to manage quality-of-service parameters, though the project maintainers have not yet responded to early disclosure.
Denial of service in Open5GS SMF (Session Management Function) via crafted PDU Session Modification messages allows remote authenticated attackers to trigger unvalidated parameter processing in gsm_handle_pdu_session_modification_qos_flow_descriptions(), causing service disruption. The vulnerability stems from insufficient pre-validation of QoS flow parameter identifiers and bitrate units before state mutation, potentially leaving the SMF in an inconsistent state. Publicly available exploit code exists, and a fix awaits upstream acceptance in PR #4513.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Session Management Function (SMF) via manipulation of QoS rule parsing in the ogs_nas_parse_qos_rules function. The vulnerability has a low CVSS score of 2.1 but public exploit code is available; however, exploitation requires prior authentication and causes only availability impact without confidentiality or integrity compromise.
Denial of service vulnerability in Open5GS up to version 2.7.7 affects the SMF (Session Management Function) component's smf_nsmf_handle_create_sm_context function, allowing authenticated remote attackers to crash or degrade the 5G core network service through malformed session context creation requests. Public exploit code exists and the vulnerability has low real-world severity (CVSS 2.1) due to requirement for authenticated access and availability impact only, though active 5G infrastructure targeting remains a concern given the critical nature of SMF in telecom deployments.
Denial of service in Open5GS up to version 2.7.7 affects the SMF component's OpenAPI_list_create function, allowing authenticated remote attackers to cause service unavailability through resource manipulation. The vulnerability has low to moderate severity (CVSS 4.3) with publicly disclosed proof-of-concept code, though the vendor has not yet responded to early disclosure notification.
Remote authenticated denial of service in Open5GS up to version 2.7.7 affects the SMF (Session Management Function) component, specifically in the smf_nsmf_handle_created_data_in_vsmf function. An authenticated attacker can remotely trigger a denial of service condition by sending crafted requests. Public exploit code is available (CVE-2026-8267 GitHub issue #4448), though the vendor has not yet released a patched version despite early notification.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Management Function (SMF) via manipulation of the PDU session establishment acceptance function, resulting in service unavailability. The CVSS score of 4.3 reflects low severity due to authentication requirements and availability-only impact, though publicly available exploit code exists and the vulnerability has been reported to the project without acknowledged response.
Stack-based buffer overflow in Squirrel up to version 3.2 within the validate_format function of sqstdlib/sqstdstring.cpp allows local authenticated attackers to corrupt stack memory, potentially achieving code execution or denial of service. Public exploit code is available, and the vulnerability has been reported to the project with no vendor response documented at time of analysis.
Reflected cross-site scripting in Mercury Managed Print Services docuForm v11.11c allows authenticated attackers with low privileges to execute arbitrary JavaScript in victim browsers via the acc-menu_pricess.php component. Public proof-of-concept exploit code exists on GitHub (ZeroBreach-GmbH). EPSS data not available, not listed in CISA KEV. Attack requires user interaction (phishing/social engineering to click malicious link), limiting automated exploitation but enabling credential theft and session hijacking for authenticated users.
Reflected cross-site scripting in Mercury docuForm v11.11c allows authenticated attackers to execute arbitrary JavaScript in victim browsers via crafted payloads to dfm-menu_alerts.php. Attack requires low complexity and user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R). Public proof-of-concept exists on GitHub (ZeroBreach-GmbH gist), but no CISA KEV listing indicates targeted or low-volume exploitation. EPSS data not available, but the authentication requirement and user interaction dependency reduce attack surface compared to stored XSS.
Reflected cross-site scripting (XSS) in GmbH Mercury Managed Print Services docuForm v11.11c allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting a malicious payload into an unfiltered variable in the dfm-menu_departments.php component. The vulnerability requires user interaction (clicking a crafted link) and affects confidentiality and integrity with limited scope. No public exploit code has been independently confirmed at this time, though the detailed nature of the component reference suggests proof-of-concept research exists.
Reflected cross-site scripting (XSS) in GmbH Mercury docuForm v11.11c allows remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious payloads into an unfiltered variable in the dfm-menu_maintenance.php component. The vulnerability requires user interaction (clicking a crafted link) but affects all site visitors, making it suitable for credential theft, session hijacking, or malware delivery. No public active exploitation has been confirmed at time of analysis.
Reflected XSS in docuForm v11.11c allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious payloads into the acc-menu_papers.php component. The vulnerability requires user interaction (clicking a crafted link) and has limited scope (session-based impact), with a CVSS score of 6.1. No public exploit code availability or CISA KEV listing confirmed at time of analysis, though a reference repository exists.
Reflected cross-site scripting (XSS) in docuForm v11.11c allows unauthenticated remote attackers to execute arbitrary JavaScript in a user's browser by crafting a malicious URL containing a payload injected into an unfiltered variable in the dfm-menu_coveragealerts.php component. Successful exploitation requires user interaction (clicking a malicious link) and can lead to session hijacking, credential theft, or malware delivery. CVSS 6.1 reflects moderate impact with low attack complexity; no public patch version has been identified.
Reflected XSS in docuForm v11.11c allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious payloads into the dfm-menu_firmware.php component, requiring the victim to click a crafted link. CVSS 6.1 reflects moderate impact (confidentiality and integrity compromise) with required user interaction. Exploit code is publicly available via GitHub.
Reflected XSS in docuForm v11.11c acc-menu_billings.php component allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious payloads into unfiltered variables, requiring user interaction to click a crafted link. CVSS 6.1 reflects limited confidentiality and integrity impact with required user interaction, but successful exploitation can lead to session hijacking, credential theft, or account takeover depending on application context.
HireFlow v1.2 contains reflected cross-site scripting (XSS) vulnerabilities in the candidate detail interface that allow authenticated users to inject malicious scripts via the Resume or Feedback Comment fields when submitting data to POST /candidates/add or POST /feedback/add endpoints. An attacker with user-level access can craft a malicious request containing JavaScript payloads that execute in the browsers of other users viewing the affected pages, potentially compromising session tokens, stealing credentials, or performing actions on behalf of victims. The CVSS score of 5.4 reflects the requirement for user interaction and authenticated access, though the cross-site scope indicates broader application impact beyond the attacker's session.
Stored cross-site scripting in iotgateway v.3.0.1 allows remote unauthenticated attackers to inject malicious JavaScript through the Log Record Function, which then executes in the browser of any user who views the affected log entries. The CVSS scope change (S:C) confirms the injected script breaks out of the application's security context to operate within the victim's browser session, enabling session hijacking or credential theft. No active exploitation is confirmed by CISA KEV; however, SSVC intelligence indicates a proof-of-concept exists, and EPSS stands at a low 0.05%, suggesting targeted rather than widespread opportunistic exploitation.
Insecure deserialization in CosyVoice's model loading pipeline permits arbitrary code execution on any system that loads a maliciously crafted model directory via the Web UI. The framework invokes torch.load() on model weight files (llm.pt, flow.pt, hift.pt) without the weights_only=True safety parameter, allowing Python's pickle module to deserialize and execute arbitrary objects embedded in those files. An attacker who can persuade a victim to point the CosyVoice Web UI at an attacker-controlled model directory - whether via a trojanized download, a shared malicious repository, or direct filesystem access - achieves code execution on the victim's machine at the moment of model loading. No public exploit code or CISA KEV listing is recorded at time of analysis; EPSS is 0.02% (5th percentile) and SSVC assesses exploitation as none, consistent with the social-engineering precondition required.
Command injection in GPT-Pilot's Executor.run() method enables arbitrary shell command execution through the interactive command confirmation workflow, affecting all versions through commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03). An actor with access to the confirmation prompt - locally or via a network-exposed deployment - can substitute malicious shell commands that are passed unsanitized to asyncio.create_subprocess_shell(), executing with the full privileges of the GPT-Pilot process. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.14% (33rd percentile) reflects low current exploitation activity, though the RCE impact class warrants attention in multi-user or network-exposed deployments.
Arbitrary file read in docuFORM Managed Print Service Client 11.11c lets remote unauthenticated attackers retrieve any file the service account can access by supplying a crafted URL that escapes the intended directory. The flaw is a classic path traversal (CWE-22) scored CVSS 7.5 for full confidentiality loss with no impact to integrity or availability. A public gist attributed to ZeroBreach GmbH suggests publicly available exploit code exists, though EPSS remains very low (0.05%) and it is not listed in CISA KEV, so no public confirmation of active exploitation exists.
Reflected cross-site scripting in the login page of docuFORM Managed Print Service Client 11.11c enables remote, unauthenticated attackers to inject malicious JavaScript into victim browsers via crafted URLs. Because the login page is publicly accessible and requires no prior authentication, the attack surface is wide - though exploitation still requires a victim to click a attacker-controlled link (UI:R). A public proof-of-concept is referenced via a ZeroBreach GmbH GitHub gist; however, EPSS at 0.03% (8th percentile) and SSVC exploitation status of 'none' indicate no public exploitation activity at the time of analysis.
docuFORM Managed Print Service Client 11.11c allows authenticated remote attackers to upload arbitrary files via the pmupdate.php endpoint, enabling potential remote code execution or system compromise. The vulnerability requires valid user credentials (PR:L per CVSS) but no user interaction, and affects confidentiality, integrity, and availability. No public exploit code or active exploitation has been confirmed at time of analysis.
Session fixation vulnerability in docuFORM Managed Print Service Client 11.11c allows unauthenticated remote attackers to hijack user sessions via the login page, enabling unauthorized access to application functions and potential disclosure of sensitive print job data. The vulnerability requires user interaction (clicking a malicious link) and affects confidentiality and integrity with a CVSS score of 5.4. No public exploit code or active exploitation has been confirmed at the time of analysis.
Reflected XSS in docuForm Managed Print Services 11.11c enables authenticated attackers to execute malicious JavaScript in victim browsers via crafted links. The dfm-menu_orderopt.php component fails to sanitize input parameters, allowing session hijacking and account takeover when low-privilege users click attacker-controlled URLs. EPSS data unavailable; no CISA KEV listing indicates exploitation remains opportunistic rather than widespread. Public exploit code exists via GitHub Gist, lowering barrier to attack.
Reflected cross-site scripting in Mercury docuForm (Managed Print Services) v11.11c enables authenticated attackers to execute arbitrary JavaScript in victim browsers when users click malicious links. The vulnerability exists in dfm-menu_markeralerts.php due to unfiltered variable handling. CVSS 7.3 (High) reflects network-accessible attack requiring low-privilege authentication and user interaction. No public exploit confirmed, but proof-of-concept code published by ZeroBreach GmbH demonstrates feasibility. EPSS data unavailable; not in CISA KEV, indicating no confirmed widespread exploitation at time of analysis.
Null pointer dereference in Open5GS Session Management Function (SMF) up to version 2.7.7 allows authenticated remote attackers to cause denial of service by manipulating the smf_nsmf_handle_create_data_in_hsmf function. Publicly available exploit code exists, and the project has been notified but has not yet released a patch.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Mobile Function (SMF) component via manipulation of the update_authorized_pcc_rule_and_qos function in the Policy and Charging Control (PCC) handler. The vulnerability has a CVSS score of 2.1 with low availability impact; publicly available exploit code exists, and the project maintainers have not yet responded to early disclosure.
Denial of service in Open5GS up to version 2.7.7 via the smf_n4_build_qos_flow_to_modify_list function in the SMF (Session Management Function) component allows remote authenticated attackers to crash the service with low attack complexity. The vulnerability has been publicly disclosed with exploit code available; the vendor was notified early but has not yet released a fix.
Denial of service vulnerability in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Measurement Function (SMF) component via improper handling in the update_authorized_pcc_rule_and_qos function. The vulnerability has a publicly available exploit and moderate CVSS score (4.3) but is limited to authenticated access and results in availability impact only. The vendor has not yet released a patch despite early notification through a GitHub issue.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Mobility Function (SMF) component via manipulation of the update_authorized_pcc_rule_and_qos function in npcf-handler.c. Publicly available exploit code exists, and the vendor has not released a patch despite early notification through issue tracking.
Denial of service vulnerability in Open5GS up to version 2.7.7 allows remote unauthenticated attackers to crash the service by triggering improper exception handling in the ogs_pcc_rule_install_flow_from_media function within the PCC rule processing library. Publicly available exploit code exists, and the project maintainers have not responded to the early notification despite issue tracking.
Denial of service in Open5GS up to version 2.7.7 allows remote unauthenticated attackers to crash the Policy Control Function (PCF) service by sending crafted requests to the delete endpoint in the SM policy control handler (pcf_npcf_smpolicycontrol_handle_delete). The vulnerability has a publicly available proof of concept and impacts the availability of 5G network policy enforcement, though the vendor has not yet released a patch despite early notification.
Authentication bypass in JeecgBoot 3.9.1 mLogin endpoint allows remote attackers to circumvent login controls via manipulation of an unspecified function in LoginController.java, resulting in unauthorized access with confidentiality impact. The vulnerability has high attack complexity and difficult exploitability, but publicly available exploit code exists and the vendor has not responded to disclosure.
Cross-site request forgery in osTicket up to version 1.18.3 allows remote attackers to bypass CSRF token validation by manipulating the _method parameter via GET requests, enabling unauthorized state-changing operations without user interaction beyond clicking a malicious link. The vulnerability exploits improper HTTP method emulation in the Dispatcher component and has publicly available proof-of-concept code; a vendor patch is available.
Server-side request forgery in Akaunting 3.1.21 allows authenticated attackers to manipulate the Invoice PDF Rendering component via the config/dompdf.php file, enabling arbitrary HTTP requests from the server to internal or external systems. The vulnerability has CVSS score 2.1 with low severity impact across confidentiality, integrity, and availability; however, publicly available exploit code exists and the vendor did not respond to early disclosure, increasing real-world exploitation risk despite low CVSS metrics.
Out-of-bounds read in Open5GS up to version 2.7.7 allows remote attackers to trigger information disclosure via manipulation of the ogs_sbi_client_send_via_scp_or_sepp function in lib/sbi/client.c during Service-Based Interface (SBI) communication. The vulnerability exploits improper bounds checking when extracting paths from URIs, affecting the Network Function (NF) component. CVSS 6.9 (network-accessible, low complexity, no privileges required) with availability impact. Upstream patch commit d5bc487fcf9ea87d2b03f2ef95123af344773bfb available.
PgBouncer before version 1.25.2 fails to properly restrict the KILL_CLIENT admin command to authorized users, allowing any user with access to the administration console to terminate client connections. The vulnerability affects all PgBouncer versions before 1.25.2 and requires prior authentication to the admin console, limiting the real-world risk despite the authorization bypass. CVSS 4.3 reflects low availability impact but highlights a privilege escalation within authenticated contexts.
Improper access controls in eladmin up to version 2.7 allow authenticated remote attackers to bypass user level checks through the checkLevel function in the Users API Endpoint (/rest/UserController.java), resulting in unauthorized access to resources. Publicly available exploit code exists, and the vendor has not responded to early notification of the vulnerability.
Resource exhaustion in GPAC up to version 26.02.0 allows local attackers with limited privileges to trigger a denial-of-service condition via the sidx_box_read function in src/isomedia/box_code_base.c. The vulnerability stems from improper validation of allocation size parameters when parsing ISO media files, enabling exhaustion of system memory without requiring elevated privileges. Publicly available exploit code exists, and a patch is available from the vendor.
Denial of service in Open5GS up to version 2.7.7 affects the NSSF component's ogs_sbi_discovery_option_add_snssais function, allowing authenticated remote attackers to crash the service via a network request. The vulnerability has been publicly disclosed with exploit code available on GitHub, though the vendor has not yet responded to early notification.
Denial of service vulnerability in Open5GS up to version 2.7.7 affects the NSSF component's service discovery function, allowing remote authenticated attackers to cause availability impact through manipulation of the ogs_sbi_discovery_option_add_service_names function. Public exploit code exists and the vulnerability carries low CVSS score (2.1) reflecting limited impact scope, though the project has not yet responded to early notification.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the NSSF (Network Slice Selection Function) component via a crafted PLMN list in the SBI (Service Based Interface) parser. The vulnerability exists in the ogs_sbi_parse_plmn_list function within /lib/sbi/conv.c and has been publicly disclosed with exploit code available; the vendor has not yet released a patch despite early notification.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to manipulate the NSSF network selection function via the nssf_nnrf_nsselection_handle_get_from_amf_or_vnssf handler in /src/nssf/nnssf-handler.c, causing service unavailability. Public exploit code exists and the vulnerability has been reported to the project, though no patch has been released as of analysis time.
Denial of service in Open5GS up to version 2.7.7 affects the NSSF component's stream identification function in the nghttp2-server library. Local authenticated attackers can manipulate the ogs_sbi_stream_find_by_id function to cause service unavailability. Publicly available exploit code exists, though the vendor has not yet responded to early disclosure notification.
Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted packet data to the SMB service on TCP port 445. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the Log Scanner Search Pattern field. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in kernel mode or cause a denial of service. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in kernel mode or cause a denial of service. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid SQL statement and a valid regular. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated code execution in Netgate pfSense CE 2.8.0 is claimed via the XMLRPC API method pfsense.exec_php, which runs attacker-supplied PHP on the firewall. Netgate publicly disputes this as a vulnerability because pfsense.exec_php is restricted to administrators, who are by design permitted to execute PHP, meaning the CVSS 9.9 rating reflects an intended admin capability rather than a privilege boundary being crossed. Publicly available exploit code exists (SSVC PoC), but EPSS is 0.01% and it is not in CISA KEV, indicating no observed active exploitation.
Authenticated PHP code execution in Netgate pfSense CE 2.7.2 arises when the module installer processes a backup file containing a serialized PHP object whose post_reboot_commands property is unserialized (CWE-502), causing attacker-defined commands to run after reboot. Exploitation requires an authenticated administrator (PR:H), and the vendor disputes the report because the installer is an admin-only feature that is intentionally permitted to execute PHP. Publicly available exploit code exists (SSVC exploitation: poc) via a Full Disclosure post, but there is no active-exploitation evidence and EPSS is negligible at 0.01%.
Local privilege escalation in Raynet RayVentory Scan Engine through version 12.6 Update 8 stems from an uncontrolled search path (CWE-427): if an attacker can set the PATH environment variable used by the process, they can force execution of a malicious binary and gain elevated privileges. Publicly available exploit code exists (GitHub, Wise-Security), and CISA's SSVC framework marks technical impact as total and the flaw as automatable, but there is no confirmed active exploitation and EPSS is negligible (0.02%). Note the CVE is officially DISPUTED, since controlling the PATH environment is characterized as a site-specific misconfiguration rather than an inherent product flaw.
Code injection in 1C-Bitrix (Bitrix Site Manager) through 25.100.500 lets an actor holding SOURCE/WRITE permissions on the Translate Module upload a PHP file together with a .htaccess file and have it executed by the web server, yielding arbitrary code execution on the host. Publicly available exploit code exists (karmainsecurity PoC), but there is no public exploit identified as actively used in attacks, and EPSS is very low at 0.02%. Notably, the vendor disputes this as a vulnerability, calling it intended behavior for high-privileged users who legitimately upload translated pages.
Remote code execution in Bitrix24 through version 25.100.300 allows authenticated users with SOURCE/WRITE permissions on the Translate Module to execute arbitrary PHP code by uploading malicious PHP and .htaccess files. The vulnerability exploits unrestricted file upload capability in a high-privilege context; while the vendor disputes this as intended behavior for administrative users, the low EPSS score (0.02%) and lack of evidence of active exploitation suggest this poses minimal real-world risk despite the moderate CVSS rating.
Remote unauthenticated attackers can forge JWT authentication tokens in AstrBot 3.5.15 by exploiting a hardcoded private key ('Advanced_System_for_Text_Response_and_Bot_Operations_Tool'), enabling full authentication bypass with subsequent remote code execution capabilities. Public exploit code exists on GitHub (Marven11/CVE-2025-55449-AstrBot-RCE) demonstrating weaponization of this cryptographic flaw. EPSS score of 0.00% suggests limited automated scanning activity, but the availability of working RCE exploit code significantly elevates practical risk for exposed instances.
yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other than SECRET). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[]. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the Admin login page. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Escalation of privilege in Intel Endpoint Management Assistant (EMA) software before version 1.14.5 allows an unauthenticated adversary on an adjacent network to gain elevated privileges on the vulnerable host, fully compromising its confidentiality, integrity, and availability. The flaw stems from improper input validation in a Ring 3 user-application component and carries a CVSS 4.0 base score of 8.7 (High). There is no public exploit identified at time of analysis, exploitation is not observed per CISA SSVC (Exploitation: none), and EPSS is very low at 0.03%.
Transient execution information disclosure in Intel processors allows unprivileged guest VM code to leak sensitive data from co-resident workloads by exploiting shared microarchitectural predictor state during VMX non-root operation. Confidentiality impact is rated high at both the vulnerable-system and subsequent-system level, indicating potential cross-VM or host-to-guest data leakage consistent with Spectre-class side-channel behavior. No public exploit has been identified at time of analysis, EPSS sits at the 3rd percentile, and CISA SSVC rates exploitation as none - but the cross-boundary confidentiality impact makes this relevant to any multi-tenant virtualized environment running affected Intel silicon.
Privilege escalation in Intel Server Firmware Update Utility Software before version 16.0.12 exposes authenticated local users to an uncontrolled search path (DLL/library hijacking) condition within the Ring 3 user-application layer. A low-privileged local attacker who can plant a malicious library or executable in a directory the utility searches at launch can escalate privileges with high impact to confidentiality, integrity, and availability of the affected system. No public exploit is identified at time of analysis, and EPSS sits at the 3rd percentile, consistent with SSVC exploitation status of 'none'.
Use-after-free in the Linux kernel ice driver for Intel Ethernet 800 series adapters before version 2.3.14 enables a local authenticated attacker with low privileges to trigger a kernel-level denial of service. The flaw resides in Ring 0 (kernel space), meaning heap corruption in the driver can cause kernel panics or system hangs with high availability impact to both the vulnerable system and subsequent dependent systems. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.01% (3rd percentile) reflects negligible near-term weaponization probability.
Null pointer dereference in Intel Quick Assist Technology (QAT) software drivers for Windows before version 2.6.0 enables denial of service by local authenticated users operating within Ring 3 (user-space). The flaw requires low complexity and no user interaction, allowing a low-privileged local adversary to crash the affected driver component, producing availability loss with no confidentiality or integrity impact. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.01% (3rd percentile), indicating negligible real-world exploitation activity at time of analysis.
Denial of service in Intel Quick Assist Technology (QAT) software drivers for Windows before version 2.6 can be triggered by a low-privileged local user through improper input validation at the Ring 3 (user application) boundary. An authenticated but unprivileged local attacker can cause high availability impact to the affected system with low complexity, also producing minor confidentiality and integrity side effects. No public exploit code has been identified at time of analysis, and SSVC assessment classifies exploitation as none with non-automatable attack surface.
Divide-by-zero in Intel Quick Assist Technology (QAT) software drivers for Windows before version 1.13 allows a low-privileged authenticated local user to cause a denial of service. The flaw resides in the Ring 3 (user application) layer of the driver stack, meaning no kernel-level access or elevated privileges are required to trigger the crash. No active exploitation has been identified - EPSS is 0.01% at the 3rd percentile, the vulnerability is absent from the CISA KEV catalog, and SSVC rates exploitation as 'none' with automatable set to 'no.'
Intel QAT (Quick Assist Technology) software drivers for Windows before version 1.13 contain an unchecked return value flaw in Ring 3 user-space application code, enabling a local authenticated attacker to cause a denial of service. The vulnerability carries a CVSS 4.0 score of 4.8 with strictly local access and low-privilege requirements, limiting blast radius to availability of the affected system only. No public exploit code exists and CISA has not listed this in KEV; EPSS at the 3rd percentile and SSVC exploitation status of 'none' confirm this is currently theoretical rather than actively targeted.
Buffer overflow in Intel QAT (Quick Assist Technology) software drivers for Windows before version 1.13 allows an authenticated local user to trigger a denial of service condition via the Ring 3 user-application interface. The flaw (CWE-120) resides in the user-space driver layer and does not require special internal knowledge or user interaction to exploit, though local authenticated access is a hard prerequisite. No active exploitation has been identified (not in CISA KEV), and EPSS remains at the 3rd percentile, placing real-world risk firmly in the low-to-medium range despite a moderate CVSS 4.0 score of 6.9.
Privilege escalation in Intel Connectivity Performance Suite software installers before version 50.25.1121.193 allows a local, low-privileged authenticated attacker to gain elevated privileges through an uncontrolled search path (CWE-427) triggered during installer execution in Ring 3 user space. Exploitation is constrained by high attack complexity, a mandatory specific attack configuration (AT:P), and a requirement for active user interaction, making this a targeted rather than opportunistic risk. No active exploitation has been confirmed - EPSS sits at 0.01% (3rd percentile), SSVC lists exploitation as none, and no CISA KEV listing exists.
Null pointer dereference in Intel QAT (Quick Assist Technology) software drivers for Windows before version 1.13 permits a low-privileged authenticated local user to crash the driver's Ring 3 user-mode component, causing a denial of service with high availability impact and minor confidentiality exposure. No active exploitation is confirmed - the vulnerability is absent from CISA KEV, EPSS sits at 0.01% (3rd percentile), and SSVC classifies exploitation status as none. Real-world risk is constrained to environments with Intel QAT explicitly deployed, which is typical of data-center and high-performance computing workloads rather than general enterprise endpoints.
Denial of service in Intel Neural Processing Unit (NPU) firmware drivers (Ring 1: Device Drivers) allows a low-privileged local user to crash or impair NPU availability through an improper conditions check (CWE-754). Affected are systems running Intel NPU Drivers as identified under Intel Security Advisory INTEL-SA-01424. No public exploit or active exploitation has been identified; EPSS is 0.01% (3rd percentile) and CISA SSVC rates exploitation as none - making this a low-urgency patching item despite the driver-level impact.
Privilege escalation in Intel NPU Driver software installers before version 32.0.100.4511 stems from incorrect default permissions applied to Ring 3 (user-space) components during installation, classified under CWE-276. A local authenticated low-privileged user on an affected system can exploit these misconfigured permissions under high-complexity conditions - requiring specific attack prerequisites and active user interaction - to achieve full confidentiality, integrity, and availability compromise of the vulnerable system. No active exploitation is confirmed (not in CISA KEV), EPSS is at the 1st percentile (0.01%), and SSVC designates exploitation status as none, indicating this is a theoretical but not currently weaponized risk.
Improper input validation in Intel Quick Assist Technology (QAT) software drivers for Windows prior to version 1.13 allows a local authenticated user to trigger a denial of service condition. The flaw resides in the Ring 3 (user-space application) layer of the driver stack, meaning an unprivileged but authenticated local adversary can cause high availability impact - potentially crashing the driver or the system - with minor confidentiality and integrity side effects. No public exploit code has been identified at time of analysis, EPSS sits at 0.02% (6th percentile), and CISA SSVC classifies exploitation as none and the attack as non-automatable, indicating negligible current threat activity.
An arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted PHP file. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
mem0 1.0.0 server exposes an unauthenticated memory deletion API endpoint (DELETE /memories) that allows remote attackers to delete arbitrary user memory records by specifying user identifiers in query parameters, resulting in unauthorized data loss and denial of service. No authentication or authorization validation is performed before processing deletion requests, enabling any network-accessible attacker to target any user's data without credentials.
Remote code execution in Kubectl MCP Server v1.1.1 allows unauthenticated network attackers to execute arbitrary commands on systems running the vulnerable server through crafted HTML-based exploitation vectors. Despite a critical 9.8 CVSS score, EPSS rates exploitation likelihood at only 0.02% (4th percentile), suggesting limited real-world targeting thus far. The vulnerability is classified as CWE-94 (Code Injection), affecting an open-source Model Context Protocol (MCP) server implementation for Kubernetes management. No CISA KEV listing indicates absence of confirmed widespread exploitation at time of analysis.
An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation of the chamado parameter through a crafted GET request. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting (XSS) in FluentCMS 1.2.3 File Management module allows authenticated administrators to upload SVG files with embedded malicious JavaScript that executes when any user-including unauthenticated visitors-accesses the image URL directly. The vulnerability has public proof-of-concept code available via GitHub pull request, and CISA SSVC framework confirms exploitability is feasible but requires user interaction and is not automatable. CVSS 5.4 reflects the attack complexity introduced by authentication requirement and user interaction, but the cross-origin scope and ability to affect multiple users elevates real-world risk.
Authentication bypass in OpenClaw's BlueBubbles webhook handler allows remote attackers to send crafted webhook requests without credentials. The handleBlueBubblesWebhookRequest function in extensions/bluebubbles/src/monitor.ts incorrectly exempts localhost requests from authentication, enabling IP spoofing attacks to bypass security controls. Exploit code is publicly available on GitHub. Patch released in version 2026.2.12 (commit a6653be). CVSS 7.3 reflects network-accessible unauthenticated attack with low complexity affecting confidentiality, integrity, and availability.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the NRF component by manipulating the hnrf-uri argument passed to the yuarel_parse function in /lib/sbi/conv.c. The vulnerability has a publicly available exploit and low CVSS score (4.3) due to authentication requirement and limited scope, but affects a critical 5G network function with potential operational impact.
Denial of service in Open5GS NRF component up to version 2.7.7 allows remote authenticated attackers to exhaust the nf_service memory pool via the ogs_nnrf_nfm_handle_nf_profile function, causing the process to abort via failed assertion. Publicly available exploit code exists, and a vendor patch is available but awaits acceptance into the main branch.
Denial of service in Open5GS through version 2.7.7 allows authenticated remote attackers to crash the Service Management Function (SMF) by manipulating the smf_nsmf_handle_update_data_in_vsmf function in nsmf-handler.c. Publicly available exploit code exists, and the project maintainers have not yet responded to the early disclosure notification despite awareness of the issue.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Session Management Function (SMF) by manipulating the qosFlowProfile argument in the smf_nsmf_handle_update_data_in_vsmf function. Publicly available exploit code exists, and the vulnerability affects the 5G core network's ability to manage quality-of-service parameters, though the project maintainers have not yet responded to early disclosure.
Denial of service in Open5GS SMF (Session Management Function) via crafted PDU Session Modification messages allows remote authenticated attackers to trigger unvalidated parameter processing in gsm_handle_pdu_session_modification_qos_flow_descriptions(), causing service disruption. The vulnerability stems from insufficient pre-validation of QoS flow parameter identifiers and bitrate units before state mutation, potentially leaving the SMF in an inconsistent state. Publicly available exploit code exists, and a fix awaits upstream acceptance in PR #4513.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Session Management Function (SMF) via manipulation of QoS rule parsing in the ogs_nas_parse_qos_rules function. The vulnerability has a low CVSS score of 2.1 but public exploit code is available; however, exploitation requires prior authentication and causes only availability impact without confidentiality or integrity compromise.
Denial of service vulnerability in Open5GS up to version 2.7.7 affects the SMF (Session Management Function) component's smf_nsmf_handle_create_sm_context function, allowing authenticated remote attackers to crash or degrade the 5G core network service through malformed session context creation requests. Public exploit code exists and the vulnerability has low real-world severity (CVSS 2.1) due to requirement for authenticated access and availability impact only, though active 5G infrastructure targeting remains a concern given the critical nature of SMF in telecom deployments.
Denial of service in Open5GS up to version 2.7.7 affects the SMF component's OpenAPI_list_create function, allowing authenticated remote attackers to cause service unavailability through resource manipulation. The vulnerability has low to moderate severity (CVSS 4.3) with publicly disclosed proof-of-concept code, though the vendor has not yet responded to early disclosure notification.
Remote authenticated denial of service in Open5GS up to version 2.7.7 affects the SMF (Session Management Function) component, specifically in the smf_nsmf_handle_created_data_in_vsmf function. An authenticated attacker can remotely trigger a denial of service condition by sending crafted requests. Public exploit code is available (CVE-2026-8267 GitHub issue #4448), though the vendor has not yet released a patched version despite early notification.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Management Function (SMF) via manipulation of the PDU session establishment acceptance function, resulting in service unavailability. The CVSS score of 4.3 reflects low severity due to authentication requirements and availability-only impact, though publicly available exploit code exists and the vulnerability has been reported to the project without acknowledged response.
Stack-based buffer overflow in Squirrel up to version 3.2 within the validate_format function of sqstdlib/sqstdstring.cpp allows local authenticated attackers to corrupt stack memory, potentially achieving code execution or denial of service. Public exploit code is available, and the vulnerability has been reported to the project with no vendor response documented at time of analysis.
Reflected cross-site scripting in Mercury Managed Print Services docuForm v11.11c allows authenticated attackers with low privileges to execute arbitrary JavaScript in victim browsers via the acc-menu_pricess.php component. Public proof-of-concept exploit code exists on GitHub (ZeroBreach-GmbH). EPSS data not available, not listed in CISA KEV. Attack requires user interaction (phishing/social engineering to click malicious link), limiting automated exploitation but enabling credential theft and session hijacking for authenticated users.
Reflected cross-site scripting in Mercury docuForm v11.11c allows authenticated attackers to execute arbitrary JavaScript in victim browsers via crafted payloads to dfm-menu_alerts.php. Attack requires low complexity and user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R). Public proof-of-concept exists on GitHub (ZeroBreach-GmbH gist), but no CISA KEV listing indicates targeted or low-volume exploitation. EPSS data not available, but the authentication requirement and user interaction dependency reduce attack surface compared to stored XSS.
Reflected cross-site scripting (XSS) in GmbH Mercury Managed Print Services docuForm v11.11c allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting a malicious payload into an unfiltered variable in the dfm-menu_departments.php component. The vulnerability requires user interaction (clicking a crafted link) and affects confidentiality and integrity with limited scope. No public exploit code has been independently confirmed at this time, though the detailed nature of the component reference suggests proof-of-concept research exists.
Reflected cross-site scripting (XSS) in GmbH Mercury docuForm v11.11c allows remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious payloads into an unfiltered variable in the dfm-menu_maintenance.php component. The vulnerability requires user interaction (clicking a crafted link) but affects all site visitors, making it suitable for credential theft, session hijacking, or malware delivery. No public active exploitation has been confirmed at time of analysis.
Reflected XSS in docuForm v11.11c allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious payloads into the acc-menu_papers.php component. The vulnerability requires user interaction (clicking a crafted link) and has limited scope (session-based impact), with a CVSS score of 6.1. No public exploit code availability or CISA KEV listing confirmed at time of analysis, though a reference repository exists.
Reflected cross-site scripting (XSS) in docuForm v11.11c allows unauthenticated remote attackers to execute arbitrary JavaScript in a user's browser by crafting a malicious URL containing a payload injected into an unfiltered variable in the dfm-menu_coveragealerts.php component. Successful exploitation requires user interaction (clicking a malicious link) and can lead to session hijacking, credential theft, or malware delivery. CVSS 6.1 reflects moderate impact with low attack complexity; no public patch version has been identified.
Reflected XSS in docuForm v11.11c allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious payloads into the dfm-menu_firmware.php component, requiring the victim to click a crafted link. CVSS 6.1 reflects moderate impact (confidentiality and integrity compromise) with required user interaction. Exploit code is publicly available via GitHub.
Reflected XSS in docuForm v11.11c acc-menu_billings.php component allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious payloads into unfiltered variables, requiring user interaction to click a crafted link. CVSS 6.1 reflects limited confidentiality and integrity impact with required user interaction, but successful exploitation can lead to session hijacking, credential theft, or account takeover depending on application context.
HireFlow v1.2 contains reflected cross-site scripting (XSS) vulnerabilities in the candidate detail interface that allow authenticated users to inject malicious scripts via the Resume or Feedback Comment fields when submitting data to POST /candidates/add or POST /feedback/add endpoints. An attacker with user-level access can craft a malicious request containing JavaScript payloads that execute in the browsers of other users viewing the affected pages, potentially compromising session tokens, stealing credentials, or performing actions on behalf of victims. The CVSS score of 5.4 reflects the requirement for user interaction and authenticated access, though the cross-site scope indicates broader application impact beyond the attacker's session.
Stored cross-site scripting in iotgateway v.3.0.1 allows remote unauthenticated attackers to inject malicious JavaScript through the Log Record Function, which then executes in the browser of any user who views the affected log entries. The CVSS scope change (S:C) confirms the injected script breaks out of the application's security context to operate within the victim's browser session, enabling session hijacking or credential theft. No active exploitation is confirmed by CISA KEV; however, SSVC intelligence indicates a proof-of-concept exists, and EPSS stands at a low 0.05%, suggesting targeted rather than widespread opportunistic exploitation.
Insecure deserialization in CosyVoice's model loading pipeline permits arbitrary code execution on any system that loads a maliciously crafted model directory via the Web UI. The framework invokes torch.load() on model weight files (llm.pt, flow.pt, hift.pt) without the weights_only=True safety parameter, allowing Python's pickle module to deserialize and execute arbitrary objects embedded in those files. An attacker who can persuade a victim to point the CosyVoice Web UI at an attacker-controlled model directory - whether via a trojanized download, a shared malicious repository, or direct filesystem access - achieves code execution on the victim's machine at the moment of model loading. No public exploit code or CISA KEV listing is recorded at time of analysis; EPSS is 0.02% (5th percentile) and SSVC assesses exploitation as none, consistent with the social-engineering precondition required.
Command injection in GPT-Pilot's Executor.run() method enables arbitrary shell command execution through the interactive command confirmation workflow, affecting all versions through commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03). An actor with access to the confirmation prompt - locally or via a network-exposed deployment - can substitute malicious shell commands that are passed unsanitized to asyncio.create_subprocess_shell(), executing with the full privileges of the GPT-Pilot process. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.14% (33rd percentile) reflects low current exploitation activity, though the RCE impact class warrants attention in multi-user or network-exposed deployments.
Arbitrary file read in docuFORM Managed Print Service Client 11.11c lets remote unauthenticated attackers retrieve any file the service account can access by supplying a crafted URL that escapes the intended directory. The flaw is a classic path traversal (CWE-22) scored CVSS 7.5 for full confidentiality loss with no impact to integrity or availability. A public gist attributed to ZeroBreach GmbH suggests publicly available exploit code exists, though EPSS remains very low (0.05%) and it is not listed in CISA KEV, so no public confirmation of active exploitation exists.
Reflected cross-site scripting in the login page of docuFORM Managed Print Service Client 11.11c enables remote, unauthenticated attackers to inject malicious JavaScript into victim browsers via crafted URLs. Because the login page is publicly accessible and requires no prior authentication, the attack surface is wide - though exploitation still requires a victim to click a attacker-controlled link (UI:R). A public proof-of-concept is referenced via a ZeroBreach GmbH GitHub gist; however, EPSS at 0.03% (8th percentile) and SSVC exploitation status of 'none' indicate no public exploitation activity at the time of analysis.
docuFORM Managed Print Service Client 11.11c allows authenticated remote attackers to upload arbitrary files via the pmupdate.php endpoint, enabling potential remote code execution or system compromise. The vulnerability requires valid user credentials (PR:L per CVSS) but no user interaction, and affects confidentiality, integrity, and availability. No public exploit code or active exploitation has been confirmed at time of analysis.
Session fixation vulnerability in docuFORM Managed Print Service Client 11.11c allows unauthenticated remote attackers to hijack user sessions via the login page, enabling unauthorized access to application functions and potential disclosure of sensitive print job data. The vulnerability requires user interaction (clicking a malicious link) and affects confidentiality and integrity with a CVSS score of 5.4. No public exploit code or active exploitation has been confirmed at the time of analysis.
Reflected XSS in docuForm Managed Print Services 11.11c enables authenticated attackers to execute malicious JavaScript in victim browsers via crafted links. The dfm-menu_orderopt.php component fails to sanitize input parameters, allowing session hijacking and account takeover when low-privilege users click attacker-controlled URLs. EPSS data unavailable; no CISA KEV listing indicates exploitation remains opportunistic rather than widespread. Public exploit code exists via GitHub Gist, lowering barrier to attack.
Reflected cross-site scripting in Mercury docuForm (Managed Print Services) v11.11c enables authenticated attackers to execute arbitrary JavaScript in victim browsers when users click malicious links. The vulnerability exists in dfm-menu_markeralerts.php due to unfiltered variable handling. CVSS 7.3 (High) reflects network-accessible attack requiring low-privilege authentication and user interaction. No public exploit confirmed, but proof-of-concept code published by ZeroBreach GmbH demonstrates feasibility. EPSS data unavailable; not in CISA KEV, indicating no confirmed widespread exploitation at time of analysis.
Null pointer dereference in Open5GS Session Management Function (SMF) up to version 2.7.7 allows authenticated remote attackers to cause denial of service by manipulating the smf_nsmf_handle_create_data_in_hsmf function. Publicly available exploit code exists, and the project has been notified but has not yet released a patch.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Mobile Function (SMF) component via manipulation of the update_authorized_pcc_rule_and_qos function in the Policy and Charging Control (PCC) handler. The vulnerability has a CVSS score of 2.1 with low availability impact; publicly available exploit code exists, and the project maintainers have not yet responded to early disclosure.
Denial of service in Open5GS up to version 2.7.7 via the smf_n4_build_qos_flow_to_modify_list function in the SMF (Session Management Function) component allows remote authenticated attackers to crash the service with low attack complexity. The vulnerability has been publicly disclosed with exploit code available; the vendor was notified early but has not yet released a fix.
Denial of service vulnerability in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Measurement Function (SMF) component via improper handling in the update_authorized_pcc_rule_and_qos function. The vulnerability has a publicly available exploit and moderate CVSS score (4.3) but is limited to authenticated access and results in availability impact only. The vendor has not yet released a patch despite early notification through a GitHub issue.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Mobility Function (SMF) component via manipulation of the update_authorized_pcc_rule_and_qos function in npcf-handler.c. Publicly available exploit code exists, and the vendor has not released a patch despite early notification through issue tracking.
Denial of service vulnerability in Open5GS up to version 2.7.7 allows remote unauthenticated attackers to crash the service by triggering improper exception handling in the ogs_pcc_rule_install_flow_from_media function within the PCC rule processing library. Publicly available exploit code exists, and the project maintainers have not responded to the early notification despite issue tracking.
Denial of service in Open5GS up to version 2.7.7 allows remote unauthenticated attackers to crash the Policy Control Function (PCF) service by sending crafted requests to the delete endpoint in the SM policy control handler (pcf_npcf_smpolicycontrol_handle_delete). The vulnerability has a publicly available proof of concept and impacts the availability of 5G network policy enforcement, though the vendor has not yet released a patch despite early notification.
Authentication bypass in JeecgBoot 3.9.1 mLogin endpoint allows remote attackers to circumvent login controls via manipulation of an unspecified function in LoginController.java, resulting in unauthorized access with confidentiality impact. The vulnerability has high attack complexity and difficult exploitability, but publicly available exploit code exists and the vendor has not responded to disclosure.
Cross-site request forgery in osTicket up to version 1.18.3 allows remote attackers to bypass CSRF token validation by manipulating the _method parameter via GET requests, enabling unauthorized state-changing operations without user interaction beyond clicking a malicious link. The vulnerability exploits improper HTTP method emulation in the Dispatcher component and has publicly available proof-of-concept code; a vendor patch is available.
Server-side request forgery in Akaunting 3.1.21 allows authenticated attackers to manipulate the Invoice PDF Rendering component via the config/dompdf.php file, enabling arbitrary HTTP requests from the server to internal or external systems. The vulnerability has CVSS score 2.1 with low severity impact across confidentiality, integrity, and availability; however, publicly available exploit code exists and the vendor did not respond to early disclosure, increasing real-world exploitation risk despite low CVSS metrics.
Out-of-bounds read in Open5GS up to version 2.7.7 allows remote attackers to trigger information disclosure via manipulation of the ogs_sbi_client_send_via_scp_or_sepp function in lib/sbi/client.c during Service-Based Interface (SBI) communication. The vulnerability exploits improper bounds checking when extracting paths from URIs, affecting the Network Function (NF) component. CVSS 6.9 (network-accessible, low complexity, no privileges required) with availability impact. Upstream patch commit d5bc487fcf9ea87d2b03f2ef95123af344773bfb available.
PgBouncer before version 1.25.2 fails to properly restrict the KILL_CLIENT admin command to authorized users, allowing any user with access to the administration console to terminate client connections. The vulnerability affects all PgBouncer versions before 1.25.2 and requires prior authentication to the admin console, limiting the real-world risk despite the authorization bypass. CVSS 4.3 reflects low availability impact but highlights a privilege escalation within authenticated contexts.
Improper access controls in eladmin up to version 2.7 allow authenticated remote attackers to bypass user level checks through the checkLevel function in the Users API Endpoint (/rest/UserController.java), resulting in unauthorized access to resources. Publicly available exploit code exists, and the vendor has not responded to early notification of the vulnerability.
Resource exhaustion in GPAC up to version 26.02.0 allows local attackers with limited privileges to trigger a denial-of-service condition via the sidx_box_read function in src/isomedia/box_code_base.c. The vulnerability stems from improper validation of allocation size parameters when parsing ISO media files, enabling exhaustion of system memory without requiring elevated privileges. Publicly available exploit code exists, and a patch is available from the vendor.
Denial of service in Open5GS up to version 2.7.7 affects the NSSF component's ogs_sbi_discovery_option_add_snssais function, allowing authenticated remote attackers to crash the service via a network request. The vulnerability has been publicly disclosed with exploit code available on GitHub, though the vendor has not yet responded to early notification.
Denial of service vulnerability in Open5GS up to version 2.7.7 affects the NSSF component's service discovery function, allowing remote authenticated attackers to cause availability impact through manipulation of the ogs_sbi_discovery_option_add_service_names function. Public exploit code exists and the vulnerability carries low CVSS score (2.1) reflecting limited impact scope, though the project has not yet responded to early notification.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the NSSF (Network Slice Selection Function) component via a crafted PLMN list in the SBI (Service Based Interface) parser. The vulnerability exists in the ogs_sbi_parse_plmn_list function within /lib/sbi/conv.c and has been publicly disclosed with exploit code available; the vendor has not yet released a patch despite early notification.
Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to manipulate the NSSF network selection function via the nssf_nnrf_nsselection_handle_get_from_amf_or_vnssf handler in /src/nssf/nnssf-handler.c, causing service unavailability. Public exploit code exists and the vulnerability has been reported to the project, though no patch has been released as of analysis time.
Denial of service in Open5GS up to version 2.7.7 affects the NSSF component's stream identification function in the nghttp2-server library. Local authenticated attackers can manipulate the ogs_sbi_stream_find_by_id function to cause service unavailability. Publicly available exploit code exists, though the vendor has not yet responded to early disclosure notification.
Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted packet data to the SMB service on TCP port 445. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the Log Scanner Search Pattern field. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in kernel mode or cause a denial of service. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in kernel mode or cause a denial of service. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid SQL statement and a valid regular. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated code execution in Netgate pfSense CE 2.8.0 is claimed via the XMLRPC API method pfsense.exec_php, which runs attacker-supplied PHP on the firewall. Netgate publicly disputes this as a vulnerability because pfsense.exec_php is restricted to administrators, who are by design permitted to execute PHP, meaning the CVSS 9.9 rating reflects an intended admin capability rather than a privilege boundary being crossed. Publicly available exploit code exists (SSVC PoC), but EPSS is 0.01% and it is not in CISA KEV, indicating no observed active exploitation.
Authenticated PHP code execution in Netgate pfSense CE 2.7.2 arises when the module installer processes a backup file containing a serialized PHP object whose post_reboot_commands property is unserialized (CWE-502), causing attacker-defined commands to run after reboot. Exploitation requires an authenticated administrator (PR:H), and the vendor disputes the report because the installer is an admin-only feature that is intentionally permitted to execute PHP. Publicly available exploit code exists (SSVC exploitation: poc) via a Full Disclosure post, but there is no active-exploitation evidence and EPSS is negligible at 0.01%.
Local privilege escalation in Raynet RayVentory Scan Engine through version 12.6 Update 8 stems from an uncontrolled search path (CWE-427): if an attacker can set the PATH environment variable used by the process, they can force execution of a malicious binary and gain elevated privileges. Publicly available exploit code exists (GitHub, Wise-Security), and CISA's SSVC framework marks technical impact as total and the flaw as automatable, but there is no confirmed active exploitation and EPSS is negligible (0.02%). Note the CVE is officially DISPUTED, since controlling the PATH environment is characterized as a site-specific misconfiguration rather than an inherent product flaw.
Code injection in 1C-Bitrix (Bitrix Site Manager) through 25.100.500 lets an actor holding SOURCE/WRITE permissions on the Translate Module upload a PHP file together with a .htaccess file and have it executed by the web server, yielding arbitrary code execution on the host. Publicly available exploit code exists (karmainsecurity PoC), but there is no public exploit identified as actively used in attacks, and EPSS is very low at 0.02%. Notably, the vendor disputes this as a vulnerability, calling it intended behavior for high-privileged users who legitimately upload translated pages.
Remote code execution in Bitrix24 through version 25.100.300 allows authenticated users with SOURCE/WRITE permissions on the Translate Module to execute arbitrary PHP code by uploading malicious PHP and .htaccess files. The vulnerability exploits unrestricted file upload capability in a high-privilege context; while the vendor disputes this as intended behavior for administrative users, the low EPSS score (0.02%) and lack of evidence of active exploitation suggest this poses minimal real-world risk despite the moderate CVSS rating.
Remote unauthenticated attackers can forge JWT authentication tokens in AstrBot 3.5.15 by exploiting a hardcoded private key ('Advanced_System_for_Text_Response_and_Bot_Operations_Tool'), enabling full authentication bypass with subsequent remote code execution capabilities. Public exploit code exists on GitHub (Marven11/CVE-2025-55449-AstrBot-RCE) demonstrating weaponization of this cryptographic flaw. EPSS score of 0.00% suggests limited automated scanning activity, but the availability of working RCE exploit code significantly elevates practical risk for exposed instances.
yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other than SECRET). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[]. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the Admin login page. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.