N A
Monthly
Denial of Service in Open5GS v2.7.6 targets the NUDM-UECM (Network Unified Data Management - UE Context Management) interface, where a crafted HTTP DELETE request triggers a reachable assertion failure that crashes the UDM process. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and SSVC 'Automatable: yes' rating indicate this is trivially scriptable over the network. No active exploitation or public proof-of-concept code has been identified at time of analysis.
Reachable assertion in Open5GS v2.7.6 SMF crashes the Session Management Function via a crafted DELETE request to the /nsmf-pdusession/v1/sm-contexts endpoint, enabling unauthenticated remote denial of service against the 5G core. Per CVSS PR:N, no authentication is required, though network access to the internal Service Based Interface (SBI) is a practical prerequisite in standard deployments. No active exploitation has been confirmed (not in CISA KEV), no public exploit code is known, and SSVC rates this as non-automatable with partial technical impact - suggesting real-world risk is lower than the 7.5 CVSS score implies.
NULL pointer dereference in FFmpeg development snapshot N-122528-gdd2976b9e1 crashes the FFmpeg process when parsing a maliciously crafted video file via the get_min_buffer_size function in libswscale/slice.c. Any application or automated pipeline using this FFmpeg build to process untrusted video input is exposed to unauthenticated remote denial of service, as confirmed by the AV:N/AC:L/PR:N/UI:N CVSS vector. No public exploit code exists at time of analysis, and EPSS at 0.15% (4th percentile) signals low current threat-actor activity.
Denial of service in free5gc v4.1.0's CreateUEContext handler allows unauthenticated remote attackers to crash or exhaust the 5G core network service by sending crafted UE context creation requests. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) - the handler performs no rate limiting or resource bounding when processing incoming context requests. No active exploitation is confirmed (not in CISA KEV), though SSVC flags the attack as automatable, meaning a single host could sustain a disruptive flood without manual repetition.
Integer overflow in the open5gs 2.7.6 NRF (Network Repository Function) discovery endpoint enables remote unauthenticated denial of service. Sending a crafted HTTP/2 GET request to /nnrf-disc/v1/nf-instances triggers arithmetic overflow that crashes the NRF service, disrupting 5G network function discovery for all dependent core network components. No public exploit has been identified and EPSS at 0.18% (7th percentile) reflects low current exploitation interest, though the unauthenticated network vector lowers the bar for any attacker with access to the SBI interface.
Integer overflow in FFmpeg's libswscale/output.c (yuv2planeX_8_c function) allows a remote attacker to crash the FFmpeg process by supplying a crafted video file, causing denial of service in any pipeline that processes untrusted media. The affected build is development snapshot N-122528-gdd2976b9e1; stable release exposure is unconfirmed. No public exploit code and no CISA KEV listing exist; EPSS of 0.15% (4th percentile) indicates very low near-term exploitation probability despite the high CVSS base score.
Remote code execution in gpt-researcher v0.14.7 and earlier lets an unauthenticated attacker run arbitrary code on the host by pushing malicious Model Context Protocol (MCP) configurations through the application's WebSocket endpoint. Because the endpoint accepts these configurations without authentication, any network-reachable instance is exploitable with no user interaction, and the MCP config path effectively becomes a command-execution primitive. No public exploit and no CISA KEV listing are indicated at time of analysis, and the EPSS probability is low (0.27%), so this appears to be an unexploited-but-severe issue rather than one seeing active campaigns.
Denial of service in free5gc v4.0.1 is exploitable via the HTTPModifySubscription handler, which fails to reject crafted HTTP input before processing, causing the affected 5G core network function to crash. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote, unauthenticated exploitation with no user interaction required, making any network-reachable deployment of the SBI interface a viable target. No public exploit code has been identified and EPSS sits at just 0.15% (4th percentile), indicating low observed attacker interest at time of analysis.
Command injection in the bs_SetLimitCli_info function of the libshare.so library on LB-Link AC450M (V4.0.0) routers lets attackers inject shell metacharacters into a parameter that is passed to a system-level command context, yielding arbitrary OS command execution. The CVSS 3.1 vector (9.8) describes network-reachable, unauthenticated exploitation with full confidentiality, integrity, and availability impact. No CISA KEV listing and no confirmed exploit code, though a public technical write-up describing the flaw exists; EPSS is modest at 0.53% (42nd percentile).
Remote code execution in Cohere North AI v1.1.5 arises from an arbitrary file upload flaw in the /v1/my_drive/batch_upload endpoint, where insufficient validation of uploaded file type/content lets an attacker place a malicious file that the server subsequently executes. The affected component is part of Cohere's North enterprise AI knowledge platform, and successful exploitation yields full compromise of confidentiality, integrity, and availability. No public exploit is identified in the intelligence feeds, though a third-party technical write-up exists on GitHub; EPSS is low (0.15%, 5th percentile), indicating limited observed exploitation activity to date.
Path traversal in UnPoller 2.33.0's password field enables unauthenticated remote attackers to read arbitrary files from the host filesystem and exfiltrate their contents over the network. The CVSS 7.5 (High) vector reflects a fully network-accessible, zero-authentication attack with high confidentiality impact against the affected version. A public exploit repository (github.com/SyntaxSaiyan/CVE-2026-36851) exists, though EPSS stands at just 0.22% (12th percentile) and no CISA KEV listing is present, indicating no public exploit identified at time of analysis as having been broadly weaponized.
Unauthenticated integrity compromise in Cohere North AI v1.1.5 exposes an internal user-management API endpoint with no effective access control, allowing any remote attacker to overwrite arbitrary user account data via crafted HTTP requests to /api/internal/v1/users/{USER_ID}. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and the 'Authentication Bypass' tag both confirm exploitation requires no credentials and no user interaction. A researcher-published PoC exists on GitHub, though EPSS remains low (0.14%, 4th percentile) and no CISA KEV listing has been issued.
Denial of service in qTox v1.18.4 lets an attacker crash the client through the profile-serialization code in src/persistence/serialize.cpp, classified as uncontrolled resource consumption (CWE-400). The description scopes this to a local attacker requiring victim interaction, and SSVC records a proof-of-concept, so publicly available exploit code exists; it is not listed in CISA KEV and EPSS is low (0.13%, 3rd percentile), indicating no evidence of widespread exploitation. Impact is limited to availability of the desktop client for the affected user, not remote code execution.
Privilege escalation in Unraid OS 6.12.14 and earlier is enabled by a CSRF vulnerability rooted in the authentication cookie's lax SameSite policy, allowing a remote attacker to forge authenticated requests on behalf of a logged-in victim. When an authenticated Unraid user visits an attacker-controlled page, the browser's permissive cookie policy causes the session credential to accompany the cross-site request, potentially granting the attacker elevated access to the NAS management interface. No active exploitation is confirmed by CISA KEV; EPSS sits at 0.28% (20th percentile), though public security research at alittleinsecure.com documents the vulnerability in detail.
Man-in-the-middle interception in CTFd v3.7.6, a widely-used Capture The Flag competition platform, exposes high-confidentiality data to adjacent-network attackers with no authentication required. Rooted in CWE-300 (Channel Accessible by Non-Endpoint), the flaw allows an attacker sharing the same network segment to intercept communications, capturing sensitive data such as session tokens or credentials, with limited integrity modification also possible. No active exploitation is confirmed - EPSS sits at 0.15% (4th percentile) and no CISA KEV listing exists - but the attack surface is acutely relevant in live CTF event environments where competitors and organizers routinely share the same LAN or Wi-Fi.
Authentication bypass in DWSurvey v6.14.0 lets remote unauthenticated attackers reach protected API functionality through the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' endpoint paths, which are treated as public and skip access-control checks. A public technical writeup describing the flaw exists; it is not listed in CISA KEV and the EPSS probability is low (0.18%, 8th percentile), indicating no evidence of widespread automated exploitation yet despite the critical 9.8 CVSS rating.
Unauthenticated configuration disclosure in SuperDiamond (super-diamond-server) versions 1.3.3 and earlier exposes the Netty-based configuration distribution service on TCP port 8283 without any authentication mechanism. Any remote attacker who can reach the port can send a raw TCP request and retrieve the complete configuration of any managed project, including database passwords and API keys. A public write-up exists but there is no public exploit identified as weaponized tooling, and the flaw is not in CISA KEV; EPSS is low at 0.17% (6th percentile).
Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validating the Origin header, letting any untrusted website read authenticated API responses in a victim's browser. Affects the North enterprise AI platform; tagged as CORS misconfiguration / information disclosure. No public exploit or active exploitation is identified, and EPSS is low (0.14%, 4th percentile), though the NVD-published CVSS of 9.8 likely overstates real-world impact.
Stored XSS via unrestricted file upload in tamguo 1.5.3 allows authenticated network attackers to execute arbitrary JavaScript in victims' browsers. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java accept arbitrary HTML and JavaScript files without content-type or extension validation, enabling persistent script injection. No public exploit identified at time of analysis and EPSS probability is 0.14% (3rd percentile), indicating low current exploitation pressure.
TCP connection teardown handling in the Vanderbilt/Acre Security SPC5300.000 Main Board firmware v.3.14.1 accepts spoofed TCP FIN packets without validating sequence or acknowledgment numbers, enabling an attacker in physical or network proximity to forcibly terminate active TCP sessions and cause a denial of service. The affected device is a physical access control security panel, meaning exploitation could disrupt building access control operations. No public exploit code has been identified at time of analysis, and EPSS remains at the 4th percentile, reflecting minimal observed exploitation activity.
Replay attack vulnerability in the Acre Security (formerly Vanderbilt Industries) SPC5300.000 access-control panel allows a physically proximate attacker to cause a denial of service by injecting replayed application-layer payloads into an active TCP session handled by SPC Connect Pro software. Affected firmware is version 3.14.1 of the SPC5300.000 Main Board. No public exploit code has been identified at time of analysis, and EPSS probability is extremely low at 0.14% (4th percentile), but the target is life-safety physical security infrastructure where availability impacts carry elevated real-world consequences.
Cross-site scripting across three components of Cockpit CMS (item.php, field-select.js, and tags.js) enables remote attackers to inject and execute malicious JavaScript within authenticated users' browser sessions in versions 2.13.5 and prior. The CVSS Scope:Changed metric signals that impact extends beyond the vulnerable component - successful exploitation against an authenticated administrator can result in session hijacking, credential theft, or persistent content manipulation within the CMS. No active exploitation is confirmed (no CISA KEV listing; EPSS 0.30% / 23rd percentile), though a researcher repository at github.com/Securify-AI/CVE-2026-39275 exists as a potential POC reference.
Arbitrary file read via path traversal in DocSys-master V2.02.85 exposes the server filesystem to unauthenticated remote attackers through the downloadDocEx endpoint in DocController.java, which fails to sanitize user-supplied path parameters. Publicly available exploit code exists per SSVC poc status and the GitHub reference. Despite a CVSS 7.5 score with high confidentiality impact, EPSS of 0.14% (4th percentile) indicates very low observed exploitation activity, likely reflecting the product's obscure deployment footprint rather than low exploitability.
Command injection in Wgcloud 3.6.4 exposes the server to remote code execution: the `content` parameter is unsanitized and directly concatenated into a Java `ProcessBuilder` call, allowing an adjacent-network attacker to inject arbitrary OS commands. The CWE-77 classification and the researcher's own proof-of-concept - titled RCE.md - confirm arbitrary code execution capability, making the submitted CVSS of 4.3 (C:L only) a significant understatement of real impact. No public exploit in CISA KEV, but publicly available exploit code exists per the researcher's GitHub disclosure.
Information disclosure in the OpenRISC OR1200 processor soft-core (commit 83ac6b) arises from a mismatch between the RTL source and the synthesized netlist, meaning the fabricated/synthesized hardware behaves differently than the verified design and can leak confidential state or misbehave. The flaw was surfaced by the academic SynFuzz RTL-vs-netlist fuzzing research (arXiv:2504.18812) rather than by field exploitation; no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile). The NVD CVSS of 9.1 (C:H/A:H) is far more alarming than the vague one-line description supports, so the score should be treated skeptically.
Denial of service in the Vanderbilt Industries / Acre Security SPC5300.000 Main Board running firmware v.3.14.1 allows a physically proximate attacker to crash the device by sending spoofed SYN packets, exploiting the panel's failure to bound resource consumption from crafted TCP traffic. The NVD-assigned CVSS vector uses AV:N (network), but the CVE description explicitly qualifies the attacker as physically proximate - a material, unresolved discrepancy that defenders must clarify with the vendor before assessing remote exploitability. No public exploit code and no active KEV-listed exploitation have been identified; EPSS probability is negligible at 0.14%.
libjpeg-turbo 3.2.0's PNG loader triggers an integer division-by-zero crash when tj3LoadImage12() or tj3LoadImage16() processes a valid indexed-color PNG image bearing a non-gray palette under the default pixel format. The fault occurs inside alloc_sarray(), generating a SIGFPE that terminates any application relying on those APIs to handle externally supplied images. No public exploit code has been identified and EPSS sits at 0.14% (4th percentile), but the crash is reproducible with a standards-compliant PNG file, making any network-facing image-ingestion service a realistic denial-of-service target.
OS command injection in Comfast CF-WR630AX firmware v.2.7.0.2 allows an adjacent-network attacker with administrator-level credentials to execute arbitrary OS commands through the device's web management interface and CGI endpoint via unsanitized parameters. A public proof-of-concept exploit is available on GitHub, though EPSS probability remains very low (0.19%, 9th percentile), indicating minimal observed exploitation activity. No active exploitation has been confirmed by CISA KEV, and the AV:A/PR:H CVSS vector materially constrains the realistic attacker population.
Memory corruption in Das U-Boot's ZFS filesystem driver (all releases before 2026.04) lets an attacker who controls the on-disk ZFS metadata trigger an integer overflow (CWE-190) that leads to undersized allocation and out-of-bounds access, enabling a boot-time crash or arbitrary code execution in the pre-OS bootloader context. Rated CVSS 9.8 by the reporter, but the flaw is reached only when U-Boot parses attacker-supplied ZFS storage during boot, so realistic exploitation is local/physical rather than network-borne. EPSS is low (0.17%, 7th percentile) and there is no confirmed active exploitation.
Denial of service in the openRISC OR1200 soft-core processor (commit 83ac6b) stems from inaccurate program counter updates when Special Purpose Registers are modified, causing the processor to enter an invalid execution state. The flaw, classified under CWE-691 (Insufficient Control Flow Management), was discovered through hardware synthesis fuzzing (SynFuzz) at George Mason University. No public exploit code or active exploitation has been identified, and EPSS places the exploitation probability at 0.14% (4th percentile), consistent with a niche research-grade hardware target.
Unauthenticated path traversal in yx-image-recognition v1.0 exposes arbitrary files on the host filesystem to remote attackers. Parameters `dir` and `filePath` are passed unsanitized directly to Java's `new File()` constructor, enabling directory traversal sequences (e.g., `../../`) to escape the intended working directory. No public exploit identified at time of analysis, and EPSS of 0.14% (4th percentile) indicates low observed exploitation probability, though a researcher-published report with technical detail exists on GitHub.
Unauthenticated information disclosure in Cohere North AI v1.1.5 exposes sensitive data through an improperly secured WebSocket endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact accessible without credentials or user interaction over a network. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% at the 4th percentile indicates negligible observed exploitation activity across the threat landscape.
Denial of service in SpaceDot AcubeSAT On-Board Computer (OBC) software at commit eaf90ec is triggered by a crafted input to the cobs_decode function, exploiting an integer handling flaw (CWE-400) over the UART serial interface. Physical proximity to the hardware is required, rendering the NVD-assigned CVSS vector (AV:N) inconsistent with the description's explicit 'physically-proximate' access requirement - a likely scoring error that significantly overstates remote risk. No public exploit has been identified, EPSS is 0.15% (4th percentile), and this CVE is not listed in CISA KEV.
Remote code execution in D-Link DI-8100G firmware 17.12.20A1 is achievable by unauthenticated attackers positioned on the adjacent network via a crafted `flag` parameter in the `msp_info` CGI handler. The flaw (CWE-94, Code Injection) permits full compromise of device confidentiality and integrity with no privileges or user interaction required, yielding a CVSS 8.1 (High) rating. A researcher-published proof-of-concept exists on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.17% reflects low observed exploitation probability at the time of analysis.
Arbitrary code execution in libtiff's tiffcrop utility (commit 85f2ac8e) stems from the process_command_opts() function in tools/tiffcrop.c, classified as CWE-94 code injection. An attacker who can influence the input processed by tiffcrop can trigger execution of arbitrary code. Publicly referenced proof-of-concept material appears to exist via a linked gist, but the flaw is not in CISA KEV and EPSS is low (0.16%, 5th percentile), indicating no evidence of widespread active exploitation.
Command injection in the D-Link DI-7001 MINI_5G router (firmware 19.10.31A1) allows unauthenticated attackers on the adjacent network to execute arbitrary OS commands via the `flag` parameter of the `msp_info` endpoint. The vulnerability is rooted in CWE-77 (improper neutralization of command-special elements), and a public proof-of-concept writeup has been published on GitHub, lowering the exploitation bar. No active exploitation has been confirmed by CISA KEV, and EPSS sits at 0.17% (6th percentile), indicating limited observed exploitation activity at time of analysis.
Heap-based buffer overflow in libtiff's rgb2ycbcr command-line utility enables potential arbitrary code execution when a user processes a specially crafted TIFF image. The root cause is a CWE-190 integer overflow in the cvtRaster() function's strip buffer size computation: the arithmetic wraps to an undersized value, and subsequent YCbCr conversion writes spill beyond the allocated heap region. A publicly shared GitHub gist (okyfh) suggests proof-of-concept material may be available; an upstream fix commit exists in the libtiff GitLab repository, though no tagged release version has been independently confirmed at time of analysis.
Local privilege escalation in Entevo HMI V2 R5 P0 M4 enables a low-privileged local user to break out of Kiosk Mode and gain administrative command execution on Windows. The escape path exploits the application's built-in PDF manual viewer: opening the manual triggers an external PDF reader, whose Print dialog exposes Windows Explorer shell access, ultimately permitting arbitrary command execution as an administrator. A proof-of-concept demonstration is publicly available via GitHub gist; EPSS is low at 0.17% and CISA SSVC indicates no confirmed active exploitation, though the public POC meaningfully lowers the skill bar for any attacker with local session access.
OneNav 1.2.4's import_link() function allows any authenticated user to delete arbitrary files on the host system via path traversal, scoring CVSS 8.1 with High integrity and availability impact. Publicly available exploit code exists per SSVC assessment (exploitation: poc), though EPSS probability remains very low at 0.14% (4th percentile), indicating limited widespread exploitation activity. The attack requires only low-privilege authentication over the network with no user interaction, making it accessible to any registered user of an exposed OneNav instance.
Out-of-bounds memory corruption in SpaceDot AcubeSAT On-Board Computer software's CAN message parsing crashes the system when processing malformed ECSS telecommand packet headers. The vulnerable component MessageParser::parseECSSTCHeader at commit eaf90ec performs insufficient bounds checking, enabling denial-of-service against the spacecraft's onboard computer via a crafted CAN message. No active exploitation has been confirmed; an EPSS of 0.15% (4th percentile) is consistent with the highly specialized and niche deployment context of this aerospace platform.
Divide-by-zero in Aria2's BitTorrent helper module (src/bittorrent_helper.cc) crashes the download utility when processing malformed BitTorrent data, resulting in denial of service. Aria2 1.37.0 and all prior versions are affected. No public exploit code and no CISA KEV listing have been identified; EPSS places exploitation probability at the 4th percentile, indicating negligible real-world exploitation pressure at time of analysis.
Unauthenticated information disclosure in The Library Corporation LS2 Admin (versions 5.7 through 5.8.0) exposes sensitive administrative export endpoints - including location configuration data - to any remote attacker without credentials. The root cause is CWE-306 (Missing Authentication for Critical Function), confirmed by a CVSS vector of AV:N/AC:L/PR:N/UI:N and the 'Authentication Bypass' tag. A GitHub gist reference may document the technique publicly, though confirmed active exploitation is absent from CISA KEV and EPSS sits at a low 0.17% (6th percentile).
SQL injection in Bottinelli Informatica Vedo Suite 1.2.5 lets a remote attacker with low-level authentication inject malicious SQL through the utente_chat parameter of the api_vedo/chat endpoint, which is reported to escalate to arbitrary code execution on the host. The flaw carries a CVSS 9.9 (scope-changed) rating, but with no public exploit identified at time of analysis and a low EPSS probability (0.29%, 22nd percentile). It affects a niche Italian business-suite product, so risk is concentrated among its specific customer base rather than broadly internet-wide.
Secure boot bypass in the Ingenic T31 SoC allows an attacker with physical write access to boot media to forge SPL (Secondary Program Loader) images that pass RSA signature verification without the OEM signing key. The boot ROM's flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest - rather than validating the full cryptographic outputs - yielding a forgery success rate of approximately 2/3 per attempt. End-to-end hardware acceptance of a forged firmware image on a Wyze Video Doorbell v2 (T31X) has been confirmed by external researchers at opensensor.io; no public exploit is confirmed in CISA KEV, but a working proof-of-concept exists per the researcher disclosure.
Unauthorized access to user chat data in Bottinelli Informatica Vedo Suite 1.2.5 is possible via an Insecure Direct Object Reference (IDOR) flaw in the api_vedo/chat REST endpoint, where the utente_chat parameter is not validated against the requester's session or authorization context. The 'Authentication Bypass' tag alongside a PR:N CVSS vector indicates the endpoint may be reachable without any valid credentials, making this a high-confidence confidentiality breach for any network-accessible deployment. No public exploit code has been confirmed in automated exploit frameworks, and the EPSS score of 0.24% (16th percentile) indicates limited observed exploitation at time of analysis, consistent with a low-prevalence niche product.
Privilege escalation and arbitrary code execution affect the Berkeley Out-of-Order Machine (BOOM) RISC-V processor RTL implementation at commit 2d08d0d8b4563212175212f9db0e69f6e68c9619 (v1.2), specifically within the machine-mode trap-return (MRET) and mstatus.MPRV state-restoration logic in the CSRFile. An attacker who can execute unprivileged or supervisor-mode code on a system running the BOOM core can potentially abuse the flawed privilege-restoration path to gain machine-mode (M-mode) access, achieving full system control. No public exploit code or CISA KEV listing has been identified at time of analysis; the EPSS score of 0.29% (22nd percentile) reflects very limited observed exploitation activity.
Secure boot bypass in Ingenic T41, T32, T40, and A1 SoC boot ROMs allows an attacker with physical write access to boot media to permanently disable secure boot enforcement and execute unsigned or modified firmware. The boot ROM's init table parser applies full 32-bit SRAM write operations from the SPL header before evaluating the secure boot state or invoking signature verification - an ordering flaw that permits an attacker-crafted init-table entry to corrupt the SRAM-resident flag that governs the verification decision. No public exploit identified at time of analysis, though the opensensor.io research disclosure constitutes detailed technical findings including hardware-validated proof of concept on a T41 device with secure boot provisioned; because the flaw resides in mask ROM, no firmware patch is possible for hardware already in the field.
Unauthenticated path traversal in reportico-web <= 8.1.0 allows remote attackers to expose PHP source files or execute existing PHP files on the server by manipulating the target_format parameter of the run.php endpoint combined with the execute_mode=EXECUTE directive. The vulnerability requires no authentication and is reachable over the network, meaning any internet-exposed instance is at risk. Publicly available exploit research exists (kilotel/vulnerability-research); no public exploit identified as confirmed actively exploited (CISA KEV). EPSS stands at 0.37% (30th percentile), suggesting low observed exploitation frequency at time of analysis.
Remote code execution in Reportico (reportico-web) versions 8.1.0 and earlier lets an unauthenticated attacker inject arbitrary PHP into the PreExecuteCode attribute of any report and have it executed by the server, bypassing the application's safe_mode restriction entirely. The flaw stems from missing access control on report attribute handling, so no authentication or user interaction is required. CVSS is 9.8 and a public vulnerability-research writeup exists, though EPSS remains low (0.27%, 19th percentile) and it is not on CISA KEV.
Remote code execution in Halo 2.25.4 is reachable by low-privileged authenticated attackers through the backup restoration workflow, exploiting CWE-73 (External Control of File Name or Path) in MigrationServiceImpl.restoreWorkdir() combined with Spring's FileSystemUtils.copyRecursively(). An attacker with a valid low-privileged account can supply a crafted backup archive containing path-traversal entries that escape the designated work directory, writing arbitrary files to the server filesystem and achieving code execution. Publicly available exploit code exists via a proof-of-concept gist, and the EPSS score of 0.29% (21st percentile) indicates limited observed exploitation at this time despite the public POC.
Reflected XSS in Reportico Web (versions up to and including 8.1.0) enables remote unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a payload in the `reportico_criteria` parameter combined with `execute_mode=CRITERIA` on `run.php`. A public proof-of-concept is available per SSVC data, though no active exploitation is confirmed in CISA KEV. Successful exploitation requires social engineering the victim into clicking a crafted link, enabling session hijacking, credential theft, or malicious in-browser actions.
Stored cross-site scripting in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to inject persistent malicious JavaScript into the user documentation field, which then executes in the browsers of any users who view the affected content. The CVSS scope-change indicator (S:C) confirms that impact propagates beyond the injecting session to other authenticated users, enabling session hijacking, credential theft, or UI redressing. No public exploit confirmation or KEV listing is present, but a detailed researcher disclosure on GitHub (cert-rit, January 2026) documents the stored variant specifically.
Reflected XSS in reportico-web 8.1.0 and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL targeting the run.php endpoint with a malicious payload in the loadTemplate parameter combined with execute_mode=PREPARE. The CVSS vector (PR:N, S:C, UI:R) confirms no authentication is required from the attacker, though user interaction is needed, and the attack scope crosses into the victim's browser context. A public vulnerability research repository exists for this CVE, suggesting exploit code is likely available; no confirmed active exploitation via CISA KEV at time of analysis.
Cross-site request forgery in Halo CMS through version 2.25.4 lets a remote attacker abuse weaknesses in the CorsConfigurer.java and CsrfConfigurer.java security-configuration components to force an authenticated victim's browser into performing unintended state-changing actions. The advisory further claims this can lead to arbitrary code execution, though the CWE-352/CSRF classification and the CVSS user-interaction requirement suggest the RCE outcome is likely a chained or victim-privilege-dependent consequence rather than a direct memory-corruption RCE. No public exploit identified at time of analysis (not in CISA KEV), and the EPSS probability is low at 0.24% (15th percentile).
Arbitrary file write via directory traversal in Reportico (reportico-web) through version 8.1.0 lets remote attackers create or overwrite files anywhere the web server user can write, by supplying a crafted path in the 'saveTemplate' parameter together with 'execute_mode=PREPARE' on the run.php endpoint. Because writes can land inside the web root, this is a realistic path to remote code execution (e.g., dropping a PHP web shell). No CISA KEV listing and a low EPSS score (0.37%) indicate no confirmed active exploitation yet, though a third-party vulnerability-research repository is referenced and the flaw is unauthenticated and low-complexity.
SQL injection in Brainformatik CRM+ through version 2025.6 allows remote unauthenticated attackers to inject arbitrary SQL via the appointment conflict-checking AJAX endpoint (index.php?module=Appointments&action=CheckConflictOfDates), enabling full database compromise. The flaw is time-based (blind) but scores CVSS 9.8 with total technical impact; a public proof-of-concept exists (CISA SSVC: exploitation=poc) though it is not yet in CISA KEV. EPSS is low (0.16%, 6th percentile), indicating no widespread automated exploitation observed to date despite the critical severity.
Remote code execution is achievable in T-Systems International GmbH ImageMaster version 9.14.2.8.1 through an unrestricted file upload flaw in the 'add attachments' feature of the document creation workflow. A remote attacker can upload a malicious executable file (e.g., a webshell) and subsequently trigger its server-side execution, achieving full system compromise. A proof-of-concept exploit is publicly available per SSVC data and a GitHub repository linked in references; however, no CISA KEV listing has been recorded and EPSS exploitation probability is notably low at 0.59% (45th percentile), indicating limited observed in-the-wild activity at time of analysis.
Privilege escalation in Squirro Cognitive Search before v3.14.2 lets a remote attacker submit a crafted request to gain elevated privileges within the enterprise search platform. The flaw is rated CVSS 9.8 with full confidentiality, integrity, and availability impact, and CISA's SSVC framework marks it automatable with total technical impact. No public exploit identified at time of analysis, and EPSS estimates near-term exploitation probability at just 0.21% (11th percentile).
Cross-site scripting in Squirro Cognitive Search versions prior to 3.14.2 allows remote attackers to inject and execute arbitrary JavaScript in victims' browsers via three distinct application functions: Email Notification, Create Evaluation Sets, and HTML Editor. The CVSS scope change (S:C) indicates the injected script executes outside the originating security context, enabling session hijacking, credential theft, or malicious action on behalf of authenticated users. No public exploit identified at time of analysis, though a researcher-published CVE entry with supporting materials exists on GitHub at Henkel-CyberVM/CVEs, suggesting active investigation of the vulnerability.
Remote code execution in Halo 2.25.4, an open-source Java-based CMS/blogging platform, arises from its plugin-installation machinery: the installFromUri method in PluginEndpoint.java combined with DefaultPluginApplicationContextFactory loads and executes attacker-supplied plugin code, giving full CWE-94 code injection with total confidentiality, integrity, and availability impact (CVSS 9.8). Publicly available exploit code exists in a referenced GitHub gist, but there is no public exploit identified as being actively used in the wild (not on CISA KEV). Note a signal conflict: the NVD vector states PR:N (unauthenticated) while plugin installation in Halo is normally an administrative function - this warrants verification.
Remote code execution in opensagres xdocreport (versions 0.9.2 through 2.2.0) arises because the bundled Velocity template engine ships with the insecure default UberspectImpl introspector, letting a crafted Velocity expression reach reflective JDK classes and run arbitrary code. Any application that renders untrusted template content through xdocreport's Velocity engine is exposed to full server compromise. Publicly available exploit code exists (a dedicated PoC GitHub repository and two HackMD write-ups), though the flaw is not listed in CISA KEV and no EPSS score was supplied.
Information disclosure in the Mahara ePortfolio platform before 25.04.5 and 26.04.0 allows remote attackers to retrieve backed-up content belonging to a different Text block/section by crafting a request in a specific way. The flaw (CWE-200) exposes stored draft or historical text that should be isolated per section, potentially leaking other users' or other pages' content. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Sandbox escape in O2OA v.10.0.2's Invoke script execution mechanism allows a locally authenticated low-privileged attacker to bypass code isolation controls and execute arbitrary commands on the host system, achieving full confidentiality, integrity, and availability compromise (C:H/I:H/A:H). The CVSS vector AV:L/AC:L/PR:L/UI:N confirms exploitation requires only a valid low-privileged platform account with access to the Invoke JAX-RS endpoint - no complex conditions or user interaction are needed. A detailed vulnerability analysis document has been publicly disclosed via GitHub, lowering the technical barrier for exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Improper access control via path traversal in Mahara's ePortfolio system allows others to reach artefacts (uploaded files/content) they should not see when the file path to an artefact embedded in a page is manipulated. It affects Mahara releases before 25.04.5 and before 26.04.0 and is fixed in those versions. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the impact is unauthorized disclosure of user-owned content rather than server compromise.
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privilege escalation because the `azuracast:restore` command runs the extracted `db.sql` file verbatim, with no content validation. The flaw carries a critical 9.8 CVSS from the reporter and has publicly available exploit code, though its EPSS probability is low (0.23%, 14th percentile) and it is not on CISA KEV. The real-world attack surface hinges on who can supply and trigger restoration of a crafted backup archive.
Cross-site scripting in JeecgBoot v3.9.2's AI RAG chat upload endpoint allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in the browsers of users who interact with the malicious content. The CVSS 6.1 (Medium) vector confirms Changed Scope, enabling session hijacking, credential theft, or authenticated action hijacking against victims. No public exploit code has been identified and the EPSS score of 0.21% (11th percentile) indicates negligible current exploitation activity; this is not listed in the CISA KEV catalog.
Unauthenticated remote root access affects the Tenda W20E router (firmware V16.01.0.6(2782)) through its /goform/telnet web endpoint, which activates the device's Telnet daemon without any authentication check. Any attacker who can reach the router's management interface can enable Telnet and log in for a root shell, giving full control of the device. A public disclosure/PoC repository exists, though the flaw is not listed in CISA KEV and EPSS-modeled exploitation probability is currently low (0.19%).
OS command injection in the Tenda W20E router firmware version 16.01.0.6(2782) allows remote attackers to execute arbitrary code by abusing the url_need_login function, which fails to sanitize attacker-controlled input before passing it to a system shell (CWE-78). The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, meaning unauthenticated network-based exploitation with full compromise of the device. Publicly available exploit code exists via a GitHub disclosure repository, though EPSS remains low (0.21%) and it is not listed in CISA KEV.
Directory traversal and reported remote code execution in Pronis Loisirs Billetterie CSE (all versions prior to April 2026) expose sensitive server-side files to unauthenticated remote attackers. A public proof-of-concept repository is available on GitHub, materially lowering the skill barrier for exploitation. EPSS sits at 0.40% (34th percentile), indicating limited observed exploitation activity at time of analysis; no CISA KEV listing is confirmed.
Remote code execution in JeecgBoot v3.9.2 allows attackers to run arbitrary code by supplying a malicious value to the 'files' parameter within the AI Chat module. The flaw is a code-injection weakness (CWE-94) carrying a critical 9.8 CVSS rating with a fully remote, low-complexity vector. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.21%, 11th percentile), indicating no observed mass-exploitation activity yet.
Server-side request forgery in DataHub v1.5.0.1 lets a remote attacker coerce the server into fetching an attacker-supplied URL through its image-retrieval feature, with the response body and errors suppressed (blind SSRF). The reporter escalates this to arbitrary code execution, and the SSVC framework marks a proof-of-concept as available and the attack as automatable, though the flaw is not listed in CISA KEV and the EPSS probability is low at 0.24%.
Remote code execution in the Tenda W20E router firmware V16.01.0.6(2782) lets unauthenticated network attackers overflow a stack buffer and run arbitrary code on the device. The flaw is explicitly an incomplete fix for the earlier CVE-2025-44867 and CVE-2026-36819, meaning the same code path remains exploitable despite prior patch attempts. A public vulnerability-disclosure repository exists, but the issue is not in CISA KEV and carries a low EPSS score (0.17%, 7th percentile), indicating no confirmed widespread exploitation yet.
SQL injection in Stud.IP (an open-source learning management system widely used in German-speaking higher education) affects the 6.0.x branch before 6.0.3 and the 5.4.x branch before 5.4.12, where unsanitized input reaching store() persistence functions lets a remote attacker read and manipulate database contents and, per the researcher's write-up, escalate to arbitrary code execution. The flaw carries a CVSS 9.1 (C:H/I:H) rating with a public technical write-up available from the reporting researcher; there is no public exploit identified as weaponized and no CISA KEV listing at time of analysis. Organizations running the affected LMS branches should treat this as high priority given the confidentiality and integrity impact combined with the RCE claim.
Remote code execution in Squirro Cognitive Search before version 3.14.2 lets remote attackers run arbitrary code by sending a crafted payload to the application's password-reset function, a CWE-94 code-injection flaw. The password-reset endpoint is typically pre-authentication and internet-facing, and the CVSS vector (PR:N/UI:N) indicates no credentials or user interaction are needed. Publicly available exploit code exists (SSVC exploitation status 'poc', plus a public GitHub research repo), but this CVE is not in CISA KEV and EPSS is low at 0.24% (15th percentile), indicating credible but not yet widespread exploitation.
Arbitrary code execution in CompuGroup Medical CGM ISIS MED 2510.1.0.20 is achievable when a local attacker plants a crafted DLL in a path searched by the application (CWE-427: Uncontrolled Search Path Element). Despite the description labeling this a 'remote' attack, the NVD CVSS vector is AV:L/UI:R, consistent with classic DLL hijacking - delivery of the malicious DLL may occur remotely (phishing, network share), but exploitation is local and requires the victim to launch the application. A proof-of-concept is publicly available per SSVC data and the researcher's GitHub repository, though no CISA KEV listing confirms active exploitation.
Memory-corruption remote code execution affects SteelSeries GG for macOS v107.0.0, where a classic buffer overflow (CWE-120) in the bundled libSSEdevice.dylib-specifically the CxAudioHidDevice::DeviceGetDescriptionString routine-lets an attacker overwrite memory while the client parses a device description string and thereby run arbitrary code in the context of the GG process. NVD rates it CVSS 9.8 with an unauthenticated network vector, though the affected component is a HID (USB audio device) descriptor parser, which points toward a malicious-device attack surface rather than pure network reachability. A third-party research writeup (Cipher-Security-Labs CSL-2026-03) is referenced, but there is no CISA KEV listing and EPSS is low at 0.21% (12th percentile).
SQL injection in Qcms 6.0.6 lets remote attackers inject arbitrary SQL through the backend tableField action, enabling database compromise and, per the advisory tagging, escalation toward arbitrary code execution. The flaw is documented in a white-box audit write-up but is not listed in CISA KEV, and its EPSS probability is low (0.20%, 10th percentile), indicating no evidence of widespread automated exploitation yet. Qcms is a niche PHP content-management system, so real-world exposure is limited despite the high CVSS score.
Privilege escalation in GAPTEQ Designer v3.5 allows a remote attacker to abuse the Company Manager role to gain elevated privileges, per CWE-269 (improper privilege management). Publicly available exploit code exists (referenced on GitHub), and CISA's SSVC framework rates the technical impact as total and the flaw as automatable, though it is not listed in CISA KEV and EPSS remains low (0.21%, 11th percentile). The scope of affected deployments is limited to the GAPTEQ low-code application platform rather than a widely embedded library.
Arbitrary code execution in SteelSeries GG for macOS v107.0.0 stems from a buffer overflow in the bundled libSSEdevice.dylib, specifically its dup_wcs (wide-character string duplication) routine, letting an attacker who can feed crafted input to the client run code with the privileges of the SteelSeries process. The flaw is disclosed by MITRE with an accompanying Cipher Security Labs research write-up (publicly available research/exploit material), but it is not on the CISA KEV list and EPSS is low at 0.21% (12th percentile). Note a material discrepancy: the CVSS vector is scored AV:N (network) yet the affected component is a local desktop peripheral-management library, which typically implies attacker-supplied data rather than an exposed network service.
Unauthenticated directory traversal in hermes-studio v.0.6.26 exposes arbitrary server-side files through the api/hermes/download endpoint, where the validatePath function fails to adequately restrict path sequences supplied by the caller. The flaw (CWE-22) enables a remote attacker with no credentials to retrieve sensitive files - including configuration files, credentials, and OS artifacts - bounded only by the filesystem permissions of the server process. Publicly available exploit code exists in a GitHub repository; EPSS places current exploitation probability at 0.26% (18th percentile), indicating low observed exploitation volume at time of analysis with no CISA KEV listing.
Polynomial regular expression denial-of-service in the crmne/ruby_llm Ruby gem allows remote unauthenticated attackers to exhaust CPU resources by submitting a crafted, excessively long class, agent, or tool name that triggers the inefficient regex in RubyLLM::Utils.underscore. The vulnerability is constrained to Ruby 3.1.x environments due to engine-specific regex behavior at that commit. A public proof-of-concept exists (hosted as a GitHub Gist), though no active exploitation has been confirmed by CISA KEV.
Cross-site request forgery in basecamp/upright's Alertmanager and Prometheus proxy controllers allows unauthenticated attackers to exploit authenticated user sessions by inducing browser-submitted requests that bypass Rails CSRF protection entirely. At the specific commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f, both proxy controllers skip the Rails authenticity token check, exposing upstream monitoring write and management APIs - including Alertmanager silence creation and Prometheus configuration reload - to attacker-controlled actions without the victim's awareness. A public proof-of-concept gist has been published by the reporting researcher, and no patched release has been confirmed at time of analysis.
Ruby code injection in the amazing_print gem's AwesomeMethodArray#grep enables arbitrary Ruby code execution inside the host process when attacker-controlled strings containing interpolation syntax reach a dynamically constructed eval call. Specifically pinned to commit dc890dfafdf07088ea901df53c19c2710e5c5234, the flaw requires an application code path where externally influenced values can become method names processed by grep with a block. A publicly available proof-of-concept exists on GitHub Gist, and while the CVE is not in CISA KEV, the full-RCE impact in affected deployments warrants urgent remediation review.
Protection-mechanism bypass in CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 lets unsigned code run from temporary filesystems because the product fails to enforce its Integrity Measurement Architecture (IMA) policy across those locations. An attacker able to stage a binary in a tmpfs-style path can execute code that the integrity policy was meant to block, undermining the pre-boot/disk-encryption trust model. The flaw was disclosed in Black Hat USA 2026 research ('The Cost of Obscurity', Burch); no public exploit is identified at time of analysis, EPSS is low (0.17%, 6th percentile), and it is not in CISA KEV.
CryptoPro Secure Disk for BitLocker before v7.7.4 stores initramfs contents in plaintext on disk, allowing a physical attacker to recover cryptographic keys and other secrets without defeating the encryption layer. The vulnerability was publicly disclosed at Black Hat USA 2026 by researcher Burch in a presentation titled 'The Cost of Obscurity,' suggesting the vendor's security model relied on implementation obscurity rather than cryptographic assurance. No public exploit identified at time of analysis; EPSS at 0.17% reflects the physical-access prerequisite that limits widespread automated exploitation.
Boot-stage integrity bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker who can present a LUKS-encrypted volume during the pre-boot phase to cause bootxsa.efi to skip all CryptoPro file integrity checks, enabling execution of tampered EFI boot components. Publicly disclosed at Black Hat USA 2026 with an accompanying whitepaper, substantially raising the bar for exploit development. No CISA KEV listing and EPSS at the 1st percentile indicate no observed mass exploitation, but the research-quality disclosure significantly reduces attacker effort for targeted campaigns against affected endpoints.
Boot partition authentication bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker who can manipulate disk partition layout to redirect boot-time code execution to a crafted Linux partition. The product fails to cryptographically verify the integrity of the intended boot partition and instead selects the first partition whose type matches a hardcoded value - a logic flaw that allows a spoofed partition to preempt the legitimate boot target and execute arbitrary code at elevated privilege. No public exploit or CISA KEV listing is confirmed at time of analysis, though a Black Hat USA 2026 research presentation by Burch ('The Cost of Obscurity') describes the finding, suggesting detailed technical disclosure has occurred.
Full-disk-encryption bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 stems from a default TPM PCR sealing policy that ignores the system boot state, letting an attacker with physical access unseal the TPM through an unintended execution path or by relocating the drive/TPM to another hardware platform and recover the BitLocker keys. The flaw was documented in the Black Hat USA 2026 research 'The Cost of Obscurity' by Burch; there is no public exploit identified at time of analysis, it is not on CISA KEV, and EPSS is low at 0.18% (8th percentile), consistent with a physical-access rather than mass-exploitable weakness.
CryptoPro Secure Disk for BitLocker before v7.7.4 silently falls back to plaintext volume mounting when a decryption error occurs, negating the entire confidentiality guarantee that BitLocker is meant to enforce. Disclosed publicly at Black Hat USA 2026 in research titled 'The Cost of Obscurity' (Burch), the flaw demonstrates how improper error handling in encryption middleware can fully undermine the security layer it wraps. No public exploit code has been identified at time of analysis, though the Black Hat presentation and accompanying whitepaper are publicly available, substantially lowering the knowledge barrier for exploitation; EPSS stands at a low 0.17% but may shift as presentation details circulate.
Integrity validation failure in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker with local or physical disk access to craft malicious DataStore contents that trigger code execution in a high-privilege context or disrupt service availability on the host. The DataStore - a non-partitioned filesystem holding pre-boot configuration and cryptographic material - is parsed without authenticity verification, making it a viable Evil Maid attack surface. No public exploit identified at time of analysis, and EPSS at 0.18% (8th percentile) indicates very limited real-world exploitation activity; however, research presented at Black Hat USA 2026 details the vulnerability class.
Denial of Service in Open5GS v2.7.6 targets the NUDM-UECM (Network Unified Data Management - UE Context Management) interface, where a crafted HTTP DELETE request triggers a reachable assertion failure that crashes the UDM process. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and SSVC 'Automatable: yes' rating indicate this is trivially scriptable over the network. No active exploitation or public proof-of-concept code has been identified at time of analysis.
Reachable assertion in Open5GS v2.7.6 SMF crashes the Session Management Function via a crafted DELETE request to the /nsmf-pdusession/v1/sm-contexts endpoint, enabling unauthenticated remote denial of service against the 5G core. Per CVSS PR:N, no authentication is required, though network access to the internal Service Based Interface (SBI) is a practical prerequisite in standard deployments. No active exploitation has been confirmed (not in CISA KEV), no public exploit code is known, and SSVC rates this as non-automatable with partial technical impact - suggesting real-world risk is lower than the 7.5 CVSS score implies.
NULL pointer dereference in FFmpeg development snapshot N-122528-gdd2976b9e1 crashes the FFmpeg process when parsing a maliciously crafted video file via the get_min_buffer_size function in libswscale/slice.c. Any application or automated pipeline using this FFmpeg build to process untrusted video input is exposed to unauthenticated remote denial of service, as confirmed by the AV:N/AC:L/PR:N/UI:N CVSS vector. No public exploit code exists at time of analysis, and EPSS at 0.15% (4th percentile) signals low current threat-actor activity.
Denial of service in free5gc v4.1.0's CreateUEContext handler allows unauthenticated remote attackers to crash or exhaust the 5G core network service by sending crafted UE context creation requests. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) - the handler performs no rate limiting or resource bounding when processing incoming context requests. No active exploitation is confirmed (not in CISA KEV), though SSVC flags the attack as automatable, meaning a single host could sustain a disruptive flood without manual repetition.
Integer overflow in the open5gs 2.7.6 NRF (Network Repository Function) discovery endpoint enables remote unauthenticated denial of service. Sending a crafted HTTP/2 GET request to /nnrf-disc/v1/nf-instances triggers arithmetic overflow that crashes the NRF service, disrupting 5G network function discovery for all dependent core network components. No public exploit has been identified and EPSS at 0.18% (7th percentile) reflects low current exploitation interest, though the unauthenticated network vector lowers the bar for any attacker with access to the SBI interface.
Integer overflow in FFmpeg's libswscale/output.c (yuv2planeX_8_c function) allows a remote attacker to crash the FFmpeg process by supplying a crafted video file, causing denial of service in any pipeline that processes untrusted media. The affected build is development snapshot N-122528-gdd2976b9e1; stable release exposure is unconfirmed. No public exploit code and no CISA KEV listing exist; EPSS of 0.15% (4th percentile) indicates very low near-term exploitation probability despite the high CVSS base score.
Remote code execution in gpt-researcher v0.14.7 and earlier lets an unauthenticated attacker run arbitrary code on the host by pushing malicious Model Context Protocol (MCP) configurations through the application's WebSocket endpoint. Because the endpoint accepts these configurations without authentication, any network-reachable instance is exploitable with no user interaction, and the MCP config path effectively becomes a command-execution primitive. No public exploit and no CISA KEV listing are indicated at time of analysis, and the EPSS probability is low (0.27%), so this appears to be an unexploited-but-severe issue rather than one seeing active campaigns.
Denial of service in free5gc v4.0.1 is exploitable via the HTTPModifySubscription handler, which fails to reject crafted HTTP input before processing, causing the affected 5G core network function to crash. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote, unauthenticated exploitation with no user interaction required, making any network-reachable deployment of the SBI interface a viable target. No public exploit code has been identified and EPSS sits at just 0.15% (4th percentile), indicating low observed attacker interest at time of analysis.
Command injection in the bs_SetLimitCli_info function of the libshare.so library on LB-Link AC450M (V4.0.0) routers lets attackers inject shell metacharacters into a parameter that is passed to a system-level command context, yielding arbitrary OS command execution. The CVSS 3.1 vector (9.8) describes network-reachable, unauthenticated exploitation with full confidentiality, integrity, and availability impact. No CISA KEV listing and no confirmed exploit code, though a public technical write-up describing the flaw exists; EPSS is modest at 0.53% (42nd percentile).
Remote code execution in Cohere North AI v1.1.5 arises from an arbitrary file upload flaw in the /v1/my_drive/batch_upload endpoint, where insufficient validation of uploaded file type/content lets an attacker place a malicious file that the server subsequently executes. The affected component is part of Cohere's North enterprise AI knowledge platform, and successful exploitation yields full compromise of confidentiality, integrity, and availability. No public exploit is identified in the intelligence feeds, though a third-party technical write-up exists on GitHub; EPSS is low (0.15%, 5th percentile), indicating limited observed exploitation activity to date.
Path traversal in UnPoller 2.33.0's password field enables unauthenticated remote attackers to read arbitrary files from the host filesystem and exfiltrate their contents over the network. The CVSS 7.5 (High) vector reflects a fully network-accessible, zero-authentication attack with high confidentiality impact against the affected version. A public exploit repository (github.com/SyntaxSaiyan/CVE-2026-36851) exists, though EPSS stands at just 0.22% (12th percentile) and no CISA KEV listing is present, indicating no public exploit identified at time of analysis as having been broadly weaponized.
Unauthenticated integrity compromise in Cohere North AI v1.1.5 exposes an internal user-management API endpoint with no effective access control, allowing any remote attacker to overwrite arbitrary user account data via crafted HTTP requests to /api/internal/v1/users/{USER_ID}. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and the 'Authentication Bypass' tag both confirm exploitation requires no credentials and no user interaction. A researcher-published PoC exists on GitHub, though EPSS remains low (0.14%, 4th percentile) and no CISA KEV listing has been issued.
Denial of service in qTox v1.18.4 lets an attacker crash the client through the profile-serialization code in src/persistence/serialize.cpp, classified as uncontrolled resource consumption (CWE-400). The description scopes this to a local attacker requiring victim interaction, and SSVC records a proof-of-concept, so publicly available exploit code exists; it is not listed in CISA KEV and EPSS is low (0.13%, 3rd percentile), indicating no evidence of widespread exploitation. Impact is limited to availability of the desktop client for the affected user, not remote code execution.
Privilege escalation in Unraid OS 6.12.14 and earlier is enabled by a CSRF vulnerability rooted in the authentication cookie's lax SameSite policy, allowing a remote attacker to forge authenticated requests on behalf of a logged-in victim. When an authenticated Unraid user visits an attacker-controlled page, the browser's permissive cookie policy causes the session credential to accompany the cross-site request, potentially granting the attacker elevated access to the NAS management interface. No active exploitation is confirmed by CISA KEV; EPSS sits at 0.28% (20th percentile), though public security research at alittleinsecure.com documents the vulnerability in detail.
Man-in-the-middle interception in CTFd v3.7.6, a widely-used Capture The Flag competition platform, exposes high-confidentiality data to adjacent-network attackers with no authentication required. Rooted in CWE-300 (Channel Accessible by Non-Endpoint), the flaw allows an attacker sharing the same network segment to intercept communications, capturing sensitive data such as session tokens or credentials, with limited integrity modification also possible. No active exploitation is confirmed - EPSS sits at 0.15% (4th percentile) and no CISA KEV listing exists - but the attack surface is acutely relevant in live CTF event environments where competitors and organizers routinely share the same LAN or Wi-Fi.
Authentication bypass in DWSurvey v6.14.0 lets remote unauthenticated attackers reach protected API functionality through the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' endpoint paths, which are treated as public and skip access-control checks. A public technical writeup describing the flaw exists; it is not listed in CISA KEV and the EPSS probability is low (0.18%, 8th percentile), indicating no evidence of widespread automated exploitation yet despite the critical 9.8 CVSS rating.
Unauthenticated configuration disclosure in SuperDiamond (super-diamond-server) versions 1.3.3 and earlier exposes the Netty-based configuration distribution service on TCP port 8283 without any authentication mechanism. Any remote attacker who can reach the port can send a raw TCP request and retrieve the complete configuration of any managed project, including database passwords and API keys. A public write-up exists but there is no public exploit identified as weaponized tooling, and the flaw is not in CISA KEV; EPSS is low at 0.17% (6th percentile).
Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validating the Origin header, letting any untrusted website read authenticated API responses in a victim's browser. Affects the North enterprise AI platform; tagged as CORS misconfiguration / information disclosure. No public exploit or active exploitation is identified, and EPSS is low (0.14%, 4th percentile), though the NVD-published CVSS of 9.8 likely overstates real-world impact.
Stored XSS via unrestricted file upload in tamguo 1.5.3 allows authenticated network attackers to execute arbitrary JavaScript in victims' browsers. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java accept arbitrary HTML and JavaScript files without content-type or extension validation, enabling persistent script injection. No public exploit identified at time of analysis and EPSS probability is 0.14% (3rd percentile), indicating low current exploitation pressure.
TCP connection teardown handling in the Vanderbilt/Acre Security SPC5300.000 Main Board firmware v.3.14.1 accepts spoofed TCP FIN packets without validating sequence or acknowledgment numbers, enabling an attacker in physical or network proximity to forcibly terminate active TCP sessions and cause a denial of service. The affected device is a physical access control security panel, meaning exploitation could disrupt building access control operations. No public exploit code has been identified at time of analysis, and EPSS remains at the 4th percentile, reflecting minimal observed exploitation activity.
Replay attack vulnerability in the Acre Security (formerly Vanderbilt Industries) SPC5300.000 access-control panel allows a physically proximate attacker to cause a denial of service by injecting replayed application-layer payloads into an active TCP session handled by SPC Connect Pro software. Affected firmware is version 3.14.1 of the SPC5300.000 Main Board. No public exploit code has been identified at time of analysis, and EPSS probability is extremely low at 0.14% (4th percentile), but the target is life-safety physical security infrastructure where availability impacts carry elevated real-world consequences.
Cross-site scripting across three components of Cockpit CMS (item.php, field-select.js, and tags.js) enables remote attackers to inject and execute malicious JavaScript within authenticated users' browser sessions in versions 2.13.5 and prior. The CVSS Scope:Changed metric signals that impact extends beyond the vulnerable component - successful exploitation against an authenticated administrator can result in session hijacking, credential theft, or persistent content manipulation within the CMS. No active exploitation is confirmed (no CISA KEV listing; EPSS 0.30% / 23rd percentile), though a researcher repository at github.com/Securify-AI/CVE-2026-39275 exists as a potential POC reference.
Arbitrary file read via path traversal in DocSys-master V2.02.85 exposes the server filesystem to unauthenticated remote attackers through the downloadDocEx endpoint in DocController.java, which fails to sanitize user-supplied path parameters. Publicly available exploit code exists per SSVC poc status and the GitHub reference. Despite a CVSS 7.5 score with high confidentiality impact, EPSS of 0.14% (4th percentile) indicates very low observed exploitation activity, likely reflecting the product's obscure deployment footprint rather than low exploitability.
Command injection in Wgcloud 3.6.4 exposes the server to remote code execution: the `content` parameter is unsanitized and directly concatenated into a Java `ProcessBuilder` call, allowing an adjacent-network attacker to inject arbitrary OS commands. The CWE-77 classification and the researcher's own proof-of-concept - titled RCE.md - confirm arbitrary code execution capability, making the submitted CVSS of 4.3 (C:L only) a significant understatement of real impact. No public exploit in CISA KEV, but publicly available exploit code exists per the researcher's GitHub disclosure.
Information disclosure in the OpenRISC OR1200 processor soft-core (commit 83ac6b) arises from a mismatch between the RTL source and the synthesized netlist, meaning the fabricated/synthesized hardware behaves differently than the verified design and can leak confidential state or misbehave. The flaw was surfaced by the academic SynFuzz RTL-vs-netlist fuzzing research (arXiv:2504.18812) rather than by field exploitation; no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile). The NVD CVSS of 9.1 (C:H/A:H) is far more alarming than the vague one-line description supports, so the score should be treated skeptically.
Denial of service in the Vanderbilt Industries / Acre Security SPC5300.000 Main Board running firmware v.3.14.1 allows a physically proximate attacker to crash the device by sending spoofed SYN packets, exploiting the panel's failure to bound resource consumption from crafted TCP traffic. The NVD-assigned CVSS vector uses AV:N (network), but the CVE description explicitly qualifies the attacker as physically proximate - a material, unresolved discrepancy that defenders must clarify with the vendor before assessing remote exploitability. No public exploit code and no active KEV-listed exploitation have been identified; EPSS probability is negligible at 0.14%.
libjpeg-turbo 3.2.0's PNG loader triggers an integer division-by-zero crash when tj3LoadImage12() or tj3LoadImage16() processes a valid indexed-color PNG image bearing a non-gray palette under the default pixel format. The fault occurs inside alloc_sarray(), generating a SIGFPE that terminates any application relying on those APIs to handle externally supplied images. No public exploit code has been identified and EPSS sits at 0.14% (4th percentile), but the crash is reproducible with a standards-compliant PNG file, making any network-facing image-ingestion service a realistic denial-of-service target.
OS command injection in Comfast CF-WR630AX firmware v.2.7.0.2 allows an adjacent-network attacker with administrator-level credentials to execute arbitrary OS commands through the device's web management interface and CGI endpoint via unsanitized parameters. A public proof-of-concept exploit is available on GitHub, though EPSS probability remains very low (0.19%, 9th percentile), indicating minimal observed exploitation activity. No active exploitation has been confirmed by CISA KEV, and the AV:A/PR:H CVSS vector materially constrains the realistic attacker population.
Memory corruption in Das U-Boot's ZFS filesystem driver (all releases before 2026.04) lets an attacker who controls the on-disk ZFS metadata trigger an integer overflow (CWE-190) that leads to undersized allocation and out-of-bounds access, enabling a boot-time crash or arbitrary code execution in the pre-OS bootloader context. Rated CVSS 9.8 by the reporter, but the flaw is reached only when U-Boot parses attacker-supplied ZFS storage during boot, so realistic exploitation is local/physical rather than network-borne. EPSS is low (0.17%, 7th percentile) and there is no confirmed active exploitation.
Denial of service in the openRISC OR1200 soft-core processor (commit 83ac6b) stems from inaccurate program counter updates when Special Purpose Registers are modified, causing the processor to enter an invalid execution state. The flaw, classified under CWE-691 (Insufficient Control Flow Management), was discovered through hardware synthesis fuzzing (SynFuzz) at George Mason University. No public exploit code or active exploitation has been identified, and EPSS places the exploitation probability at 0.14% (4th percentile), consistent with a niche research-grade hardware target.
Unauthenticated path traversal in yx-image-recognition v1.0 exposes arbitrary files on the host filesystem to remote attackers. Parameters `dir` and `filePath` are passed unsanitized directly to Java's `new File()` constructor, enabling directory traversal sequences (e.g., `../../`) to escape the intended working directory. No public exploit identified at time of analysis, and EPSS of 0.14% (4th percentile) indicates low observed exploitation probability, though a researcher-published report with technical detail exists on GitHub.
Unauthenticated information disclosure in Cohere North AI v1.1.5 exposes sensitive data through an improperly secured WebSocket endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact accessible without credentials or user interaction over a network. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% at the 4th percentile indicates negligible observed exploitation activity across the threat landscape.
Denial of service in SpaceDot AcubeSAT On-Board Computer (OBC) software at commit eaf90ec is triggered by a crafted input to the cobs_decode function, exploiting an integer handling flaw (CWE-400) over the UART serial interface. Physical proximity to the hardware is required, rendering the NVD-assigned CVSS vector (AV:N) inconsistent with the description's explicit 'physically-proximate' access requirement - a likely scoring error that significantly overstates remote risk. No public exploit has been identified, EPSS is 0.15% (4th percentile), and this CVE is not listed in CISA KEV.
Remote code execution in D-Link DI-8100G firmware 17.12.20A1 is achievable by unauthenticated attackers positioned on the adjacent network via a crafted `flag` parameter in the `msp_info` CGI handler. The flaw (CWE-94, Code Injection) permits full compromise of device confidentiality and integrity with no privileges or user interaction required, yielding a CVSS 8.1 (High) rating. A researcher-published proof-of-concept exists on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.17% reflects low observed exploitation probability at the time of analysis.
Arbitrary code execution in libtiff's tiffcrop utility (commit 85f2ac8e) stems from the process_command_opts() function in tools/tiffcrop.c, classified as CWE-94 code injection. An attacker who can influence the input processed by tiffcrop can trigger execution of arbitrary code. Publicly referenced proof-of-concept material appears to exist via a linked gist, but the flaw is not in CISA KEV and EPSS is low (0.16%, 5th percentile), indicating no evidence of widespread active exploitation.
Command injection in the D-Link DI-7001 MINI_5G router (firmware 19.10.31A1) allows unauthenticated attackers on the adjacent network to execute arbitrary OS commands via the `flag` parameter of the `msp_info` endpoint. The vulnerability is rooted in CWE-77 (improper neutralization of command-special elements), and a public proof-of-concept writeup has been published on GitHub, lowering the exploitation bar. No active exploitation has been confirmed by CISA KEV, and EPSS sits at 0.17% (6th percentile), indicating limited observed exploitation activity at time of analysis.
Heap-based buffer overflow in libtiff's rgb2ycbcr command-line utility enables potential arbitrary code execution when a user processes a specially crafted TIFF image. The root cause is a CWE-190 integer overflow in the cvtRaster() function's strip buffer size computation: the arithmetic wraps to an undersized value, and subsequent YCbCr conversion writes spill beyond the allocated heap region. A publicly shared GitHub gist (okyfh) suggests proof-of-concept material may be available; an upstream fix commit exists in the libtiff GitLab repository, though no tagged release version has been independently confirmed at time of analysis.
Local privilege escalation in Entevo HMI V2 R5 P0 M4 enables a low-privileged local user to break out of Kiosk Mode and gain administrative command execution on Windows. The escape path exploits the application's built-in PDF manual viewer: opening the manual triggers an external PDF reader, whose Print dialog exposes Windows Explorer shell access, ultimately permitting arbitrary command execution as an administrator. A proof-of-concept demonstration is publicly available via GitHub gist; EPSS is low at 0.17% and CISA SSVC indicates no confirmed active exploitation, though the public POC meaningfully lowers the skill bar for any attacker with local session access.
OneNav 1.2.4's import_link() function allows any authenticated user to delete arbitrary files on the host system via path traversal, scoring CVSS 8.1 with High integrity and availability impact. Publicly available exploit code exists per SSVC assessment (exploitation: poc), though EPSS probability remains very low at 0.14% (4th percentile), indicating limited widespread exploitation activity. The attack requires only low-privilege authentication over the network with no user interaction, making it accessible to any registered user of an exposed OneNav instance.
Out-of-bounds memory corruption in SpaceDot AcubeSAT On-Board Computer software's CAN message parsing crashes the system when processing malformed ECSS telecommand packet headers. The vulnerable component MessageParser::parseECSSTCHeader at commit eaf90ec performs insufficient bounds checking, enabling denial-of-service against the spacecraft's onboard computer via a crafted CAN message. No active exploitation has been confirmed; an EPSS of 0.15% (4th percentile) is consistent with the highly specialized and niche deployment context of this aerospace platform.
Divide-by-zero in Aria2's BitTorrent helper module (src/bittorrent_helper.cc) crashes the download utility when processing malformed BitTorrent data, resulting in denial of service. Aria2 1.37.0 and all prior versions are affected. No public exploit code and no CISA KEV listing have been identified; EPSS places exploitation probability at the 4th percentile, indicating negligible real-world exploitation pressure at time of analysis.
Unauthenticated information disclosure in The Library Corporation LS2 Admin (versions 5.7 through 5.8.0) exposes sensitive administrative export endpoints - including location configuration data - to any remote attacker without credentials. The root cause is CWE-306 (Missing Authentication for Critical Function), confirmed by a CVSS vector of AV:N/AC:L/PR:N/UI:N and the 'Authentication Bypass' tag. A GitHub gist reference may document the technique publicly, though confirmed active exploitation is absent from CISA KEV and EPSS sits at a low 0.17% (6th percentile).
SQL injection in Bottinelli Informatica Vedo Suite 1.2.5 lets a remote attacker with low-level authentication inject malicious SQL through the utente_chat parameter of the api_vedo/chat endpoint, which is reported to escalate to arbitrary code execution on the host. The flaw carries a CVSS 9.9 (scope-changed) rating, but with no public exploit identified at time of analysis and a low EPSS probability (0.29%, 22nd percentile). It affects a niche Italian business-suite product, so risk is concentrated among its specific customer base rather than broadly internet-wide.
Secure boot bypass in the Ingenic T31 SoC allows an attacker with physical write access to boot media to forge SPL (Secondary Program Loader) images that pass RSA signature verification without the OEM signing key. The boot ROM's flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest - rather than validating the full cryptographic outputs - yielding a forgery success rate of approximately 2/3 per attempt. End-to-end hardware acceptance of a forged firmware image on a Wyze Video Doorbell v2 (T31X) has been confirmed by external researchers at opensensor.io; no public exploit is confirmed in CISA KEV, but a working proof-of-concept exists per the researcher disclosure.
Unauthorized access to user chat data in Bottinelli Informatica Vedo Suite 1.2.5 is possible via an Insecure Direct Object Reference (IDOR) flaw in the api_vedo/chat REST endpoint, where the utente_chat parameter is not validated against the requester's session or authorization context. The 'Authentication Bypass' tag alongside a PR:N CVSS vector indicates the endpoint may be reachable without any valid credentials, making this a high-confidence confidentiality breach for any network-accessible deployment. No public exploit code has been confirmed in automated exploit frameworks, and the EPSS score of 0.24% (16th percentile) indicates limited observed exploitation at time of analysis, consistent with a low-prevalence niche product.
Privilege escalation and arbitrary code execution affect the Berkeley Out-of-Order Machine (BOOM) RISC-V processor RTL implementation at commit 2d08d0d8b4563212175212f9db0e69f6e68c9619 (v1.2), specifically within the machine-mode trap-return (MRET) and mstatus.MPRV state-restoration logic in the CSRFile. An attacker who can execute unprivileged or supervisor-mode code on a system running the BOOM core can potentially abuse the flawed privilege-restoration path to gain machine-mode (M-mode) access, achieving full system control. No public exploit code or CISA KEV listing has been identified at time of analysis; the EPSS score of 0.29% (22nd percentile) reflects very limited observed exploitation activity.
Secure boot bypass in Ingenic T41, T32, T40, and A1 SoC boot ROMs allows an attacker with physical write access to boot media to permanently disable secure boot enforcement and execute unsigned or modified firmware. The boot ROM's init table parser applies full 32-bit SRAM write operations from the SPL header before evaluating the secure boot state or invoking signature verification - an ordering flaw that permits an attacker-crafted init-table entry to corrupt the SRAM-resident flag that governs the verification decision. No public exploit identified at time of analysis, though the opensensor.io research disclosure constitutes detailed technical findings including hardware-validated proof of concept on a T41 device with secure boot provisioned; because the flaw resides in mask ROM, no firmware patch is possible for hardware already in the field.
Unauthenticated path traversal in reportico-web <= 8.1.0 allows remote attackers to expose PHP source files or execute existing PHP files on the server by manipulating the target_format parameter of the run.php endpoint combined with the execute_mode=EXECUTE directive. The vulnerability requires no authentication and is reachable over the network, meaning any internet-exposed instance is at risk. Publicly available exploit research exists (kilotel/vulnerability-research); no public exploit identified as confirmed actively exploited (CISA KEV). EPSS stands at 0.37% (30th percentile), suggesting low observed exploitation frequency at time of analysis.
Remote code execution in Reportico (reportico-web) versions 8.1.0 and earlier lets an unauthenticated attacker inject arbitrary PHP into the PreExecuteCode attribute of any report and have it executed by the server, bypassing the application's safe_mode restriction entirely. The flaw stems from missing access control on report attribute handling, so no authentication or user interaction is required. CVSS is 9.8 and a public vulnerability-research writeup exists, though EPSS remains low (0.27%, 19th percentile) and it is not on CISA KEV.
Remote code execution in Halo 2.25.4 is reachable by low-privileged authenticated attackers through the backup restoration workflow, exploiting CWE-73 (External Control of File Name or Path) in MigrationServiceImpl.restoreWorkdir() combined with Spring's FileSystemUtils.copyRecursively(). An attacker with a valid low-privileged account can supply a crafted backup archive containing path-traversal entries that escape the designated work directory, writing arbitrary files to the server filesystem and achieving code execution. Publicly available exploit code exists via a proof-of-concept gist, and the EPSS score of 0.29% (21st percentile) indicates limited observed exploitation at this time despite the public POC.
Reflected XSS in Reportico Web (versions up to and including 8.1.0) enables remote unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a payload in the `reportico_criteria` parameter combined with `execute_mode=CRITERIA` on `run.php`. A public proof-of-concept is available per SSVC data, though no active exploitation is confirmed in CISA KEV. Successful exploitation requires social engineering the victim into clicking a crafted link, enabling session hijacking, credential theft, or malicious in-browser actions.
Stored cross-site scripting in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to inject persistent malicious JavaScript into the user documentation field, which then executes in the browsers of any users who view the affected content. The CVSS scope-change indicator (S:C) confirms that impact propagates beyond the injecting session to other authenticated users, enabling session hijacking, credential theft, or UI redressing. No public exploit confirmation or KEV listing is present, but a detailed researcher disclosure on GitHub (cert-rit, January 2026) documents the stored variant specifically.
Reflected XSS in reportico-web 8.1.0 and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL targeting the run.php endpoint with a malicious payload in the loadTemplate parameter combined with execute_mode=PREPARE. The CVSS vector (PR:N, S:C, UI:R) confirms no authentication is required from the attacker, though user interaction is needed, and the attack scope crosses into the victim's browser context. A public vulnerability research repository exists for this CVE, suggesting exploit code is likely available; no confirmed active exploitation via CISA KEV at time of analysis.
Cross-site request forgery in Halo CMS through version 2.25.4 lets a remote attacker abuse weaknesses in the CorsConfigurer.java and CsrfConfigurer.java security-configuration components to force an authenticated victim's browser into performing unintended state-changing actions. The advisory further claims this can lead to arbitrary code execution, though the CWE-352/CSRF classification and the CVSS user-interaction requirement suggest the RCE outcome is likely a chained or victim-privilege-dependent consequence rather than a direct memory-corruption RCE. No public exploit identified at time of analysis (not in CISA KEV), and the EPSS probability is low at 0.24% (15th percentile).
Arbitrary file write via directory traversal in Reportico (reportico-web) through version 8.1.0 lets remote attackers create or overwrite files anywhere the web server user can write, by supplying a crafted path in the 'saveTemplate' parameter together with 'execute_mode=PREPARE' on the run.php endpoint. Because writes can land inside the web root, this is a realistic path to remote code execution (e.g., dropping a PHP web shell). No CISA KEV listing and a low EPSS score (0.37%) indicate no confirmed active exploitation yet, though a third-party vulnerability-research repository is referenced and the flaw is unauthenticated and low-complexity.
SQL injection in Brainformatik CRM+ through version 2025.6 allows remote unauthenticated attackers to inject arbitrary SQL via the appointment conflict-checking AJAX endpoint (index.php?module=Appointments&action=CheckConflictOfDates), enabling full database compromise. The flaw is time-based (blind) but scores CVSS 9.8 with total technical impact; a public proof-of-concept exists (CISA SSVC: exploitation=poc) though it is not yet in CISA KEV. EPSS is low (0.16%, 6th percentile), indicating no widespread automated exploitation observed to date despite the critical severity.
Remote code execution is achievable in T-Systems International GmbH ImageMaster version 9.14.2.8.1 through an unrestricted file upload flaw in the 'add attachments' feature of the document creation workflow. A remote attacker can upload a malicious executable file (e.g., a webshell) and subsequently trigger its server-side execution, achieving full system compromise. A proof-of-concept exploit is publicly available per SSVC data and a GitHub repository linked in references; however, no CISA KEV listing has been recorded and EPSS exploitation probability is notably low at 0.59% (45th percentile), indicating limited observed in-the-wild activity at time of analysis.
Privilege escalation in Squirro Cognitive Search before v3.14.2 lets a remote attacker submit a crafted request to gain elevated privileges within the enterprise search platform. The flaw is rated CVSS 9.8 with full confidentiality, integrity, and availability impact, and CISA's SSVC framework marks it automatable with total technical impact. No public exploit identified at time of analysis, and EPSS estimates near-term exploitation probability at just 0.21% (11th percentile).
Cross-site scripting in Squirro Cognitive Search versions prior to 3.14.2 allows remote attackers to inject and execute arbitrary JavaScript in victims' browsers via three distinct application functions: Email Notification, Create Evaluation Sets, and HTML Editor. The CVSS scope change (S:C) indicates the injected script executes outside the originating security context, enabling session hijacking, credential theft, or malicious action on behalf of authenticated users. No public exploit identified at time of analysis, though a researcher-published CVE entry with supporting materials exists on GitHub at Henkel-CyberVM/CVEs, suggesting active investigation of the vulnerability.
Remote code execution in Halo 2.25.4, an open-source Java-based CMS/blogging platform, arises from its plugin-installation machinery: the installFromUri method in PluginEndpoint.java combined with DefaultPluginApplicationContextFactory loads and executes attacker-supplied plugin code, giving full CWE-94 code injection with total confidentiality, integrity, and availability impact (CVSS 9.8). Publicly available exploit code exists in a referenced GitHub gist, but there is no public exploit identified as being actively used in the wild (not on CISA KEV). Note a signal conflict: the NVD vector states PR:N (unauthenticated) while plugin installation in Halo is normally an administrative function - this warrants verification.
Remote code execution in opensagres xdocreport (versions 0.9.2 through 2.2.0) arises because the bundled Velocity template engine ships with the insecure default UberspectImpl introspector, letting a crafted Velocity expression reach reflective JDK classes and run arbitrary code. Any application that renders untrusted template content through xdocreport's Velocity engine is exposed to full server compromise. Publicly available exploit code exists (a dedicated PoC GitHub repository and two HackMD write-ups), though the flaw is not listed in CISA KEV and no EPSS score was supplied.
Information disclosure in the Mahara ePortfolio platform before 25.04.5 and 26.04.0 allows remote attackers to retrieve backed-up content belonging to a different Text block/section by crafting a request in a specific way. The flaw (CWE-200) exposes stored draft or historical text that should be isolated per section, potentially leaking other users' or other pages' content. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Sandbox escape in O2OA v.10.0.2's Invoke script execution mechanism allows a locally authenticated low-privileged attacker to bypass code isolation controls and execute arbitrary commands on the host system, achieving full confidentiality, integrity, and availability compromise (C:H/I:H/A:H). The CVSS vector AV:L/AC:L/PR:L/UI:N confirms exploitation requires only a valid low-privileged platform account with access to the Invoke JAX-RS endpoint - no complex conditions or user interaction are needed. A detailed vulnerability analysis document has been publicly disclosed via GitHub, lowering the technical barrier for exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Improper access control via path traversal in Mahara's ePortfolio system allows others to reach artefacts (uploaded files/content) they should not see when the file path to an artefact embedded in a page is manipulated. It affects Mahara releases before 25.04.5 and before 26.04.0 and is fixed in those versions. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the impact is unauthorized disclosure of user-owned content rather than server compromise.
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privilege escalation because the `azuracast:restore` command runs the extracted `db.sql` file verbatim, with no content validation. The flaw carries a critical 9.8 CVSS from the reporter and has publicly available exploit code, though its EPSS probability is low (0.23%, 14th percentile) and it is not on CISA KEV. The real-world attack surface hinges on who can supply and trigger restoration of a crafted backup archive.
Cross-site scripting in JeecgBoot v3.9.2's AI RAG chat upload endpoint allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in the browsers of users who interact with the malicious content. The CVSS 6.1 (Medium) vector confirms Changed Scope, enabling session hijacking, credential theft, or authenticated action hijacking against victims. No public exploit code has been identified and the EPSS score of 0.21% (11th percentile) indicates negligible current exploitation activity; this is not listed in the CISA KEV catalog.
Unauthenticated remote root access affects the Tenda W20E router (firmware V16.01.0.6(2782)) through its /goform/telnet web endpoint, which activates the device's Telnet daemon without any authentication check. Any attacker who can reach the router's management interface can enable Telnet and log in for a root shell, giving full control of the device. A public disclosure/PoC repository exists, though the flaw is not listed in CISA KEV and EPSS-modeled exploitation probability is currently low (0.19%).
OS command injection in the Tenda W20E router firmware version 16.01.0.6(2782) allows remote attackers to execute arbitrary code by abusing the url_need_login function, which fails to sanitize attacker-controlled input before passing it to a system shell (CWE-78). The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, meaning unauthenticated network-based exploitation with full compromise of the device. Publicly available exploit code exists via a GitHub disclosure repository, though EPSS remains low (0.21%) and it is not listed in CISA KEV.
Directory traversal and reported remote code execution in Pronis Loisirs Billetterie CSE (all versions prior to April 2026) expose sensitive server-side files to unauthenticated remote attackers. A public proof-of-concept repository is available on GitHub, materially lowering the skill barrier for exploitation. EPSS sits at 0.40% (34th percentile), indicating limited observed exploitation activity at time of analysis; no CISA KEV listing is confirmed.
Remote code execution in JeecgBoot v3.9.2 allows attackers to run arbitrary code by supplying a malicious value to the 'files' parameter within the AI Chat module. The flaw is a code-injection weakness (CWE-94) carrying a critical 9.8 CVSS rating with a fully remote, low-complexity vector. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.21%, 11th percentile), indicating no observed mass-exploitation activity yet.
Server-side request forgery in DataHub v1.5.0.1 lets a remote attacker coerce the server into fetching an attacker-supplied URL through its image-retrieval feature, with the response body and errors suppressed (blind SSRF). The reporter escalates this to arbitrary code execution, and the SSVC framework marks a proof-of-concept as available and the attack as automatable, though the flaw is not listed in CISA KEV and the EPSS probability is low at 0.24%.
Remote code execution in the Tenda W20E router firmware V16.01.0.6(2782) lets unauthenticated network attackers overflow a stack buffer and run arbitrary code on the device. The flaw is explicitly an incomplete fix for the earlier CVE-2025-44867 and CVE-2026-36819, meaning the same code path remains exploitable despite prior patch attempts. A public vulnerability-disclosure repository exists, but the issue is not in CISA KEV and carries a low EPSS score (0.17%, 7th percentile), indicating no confirmed widespread exploitation yet.
SQL injection in Stud.IP (an open-source learning management system widely used in German-speaking higher education) affects the 6.0.x branch before 6.0.3 and the 5.4.x branch before 5.4.12, where unsanitized input reaching store() persistence functions lets a remote attacker read and manipulate database contents and, per the researcher's write-up, escalate to arbitrary code execution. The flaw carries a CVSS 9.1 (C:H/I:H) rating with a public technical write-up available from the reporting researcher; there is no public exploit identified as weaponized and no CISA KEV listing at time of analysis. Organizations running the affected LMS branches should treat this as high priority given the confidentiality and integrity impact combined with the RCE claim.
Remote code execution in Squirro Cognitive Search before version 3.14.2 lets remote attackers run arbitrary code by sending a crafted payload to the application's password-reset function, a CWE-94 code-injection flaw. The password-reset endpoint is typically pre-authentication and internet-facing, and the CVSS vector (PR:N/UI:N) indicates no credentials or user interaction are needed. Publicly available exploit code exists (SSVC exploitation status 'poc', plus a public GitHub research repo), but this CVE is not in CISA KEV and EPSS is low at 0.24% (15th percentile), indicating credible but not yet widespread exploitation.
Arbitrary code execution in CompuGroup Medical CGM ISIS MED 2510.1.0.20 is achievable when a local attacker plants a crafted DLL in a path searched by the application (CWE-427: Uncontrolled Search Path Element). Despite the description labeling this a 'remote' attack, the NVD CVSS vector is AV:L/UI:R, consistent with classic DLL hijacking - delivery of the malicious DLL may occur remotely (phishing, network share), but exploitation is local and requires the victim to launch the application. A proof-of-concept is publicly available per SSVC data and the researcher's GitHub repository, though no CISA KEV listing confirms active exploitation.
Memory-corruption remote code execution affects SteelSeries GG for macOS v107.0.0, where a classic buffer overflow (CWE-120) in the bundled libSSEdevice.dylib-specifically the CxAudioHidDevice::DeviceGetDescriptionString routine-lets an attacker overwrite memory while the client parses a device description string and thereby run arbitrary code in the context of the GG process. NVD rates it CVSS 9.8 with an unauthenticated network vector, though the affected component is a HID (USB audio device) descriptor parser, which points toward a malicious-device attack surface rather than pure network reachability. A third-party research writeup (Cipher-Security-Labs CSL-2026-03) is referenced, but there is no CISA KEV listing and EPSS is low at 0.21% (12th percentile).
SQL injection in Qcms 6.0.6 lets remote attackers inject arbitrary SQL through the backend tableField action, enabling database compromise and, per the advisory tagging, escalation toward arbitrary code execution. The flaw is documented in a white-box audit write-up but is not listed in CISA KEV, and its EPSS probability is low (0.20%, 10th percentile), indicating no evidence of widespread automated exploitation yet. Qcms is a niche PHP content-management system, so real-world exposure is limited despite the high CVSS score.
Privilege escalation in GAPTEQ Designer v3.5 allows a remote attacker to abuse the Company Manager role to gain elevated privileges, per CWE-269 (improper privilege management). Publicly available exploit code exists (referenced on GitHub), and CISA's SSVC framework rates the technical impact as total and the flaw as automatable, though it is not listed in CISA KEV and EPSS remains low (0.21%, 11th percentile). The scope of affected deployments is limited to the GAPTEQ low-code application platform rather than a widely embedded library.
Arbitrary code execution in SteelSeries GG for macOS v107.0.0 stems from a buffer overflow in the bundled libSSEdevice.dylib, specifically its dup_wcs (wide-character string duplication) routine, letting an attacker who can feed crafted input to the client run code with the privileges of the SteelSeries process. The flaw is disclosed by MITRE with an accompanying Cipher Security Labs research write-up (publicly available research/exploit material), but it is not on the CISA KEV list and EPSS is low at 0.21% (12th percentile). Note a material discrepancy: the CVSS vector is scored AV:N (network) yet the affected component is a local desktop peripheral-management library, which typically implies attacker-supplied data rather than an exposed network service.
Unauthenticated directory traversal in hermes-studio v.0.6.26 exposes arbitrary server-side files through the api/hermes/download endpoint, where the validatePath function fails to adequately restrict path sequences supplied by the caller. The flaw (CWE-22) enables a remote attacker with no credentials to retrieve sensitive files - including configuration files, credentials, and OS artifacts - bounded only by the filesystem permissions of the server process. Publicly available exploit code exists in a GitHub repository; EPSS places current exploitation probability at 0.26% (18th percentile), indicating low observed exploitation volume at time of analysis with no CISA KEV listing.
Polynomial regular expression denial-of-service in the crmne/ruby_llm Ruby gem allows remote unauthenticated attackers to exhaust CPU resources by submitting a crafted, excessively long class, agent, or tool name that triggers the inefficient regex in RubyLLM::Utils.underscore. The vulnerability is constrained to Ruby 3.1.x environments due to engine-specific regex behavior at that commit. A public proof-of-concept exists (hosted as a GitHub Gist), though no active exploitation has been confirmed by CISA KEV.
Cross-site request forgery in basecamp/upright's Alertmanager and Prometheus proxy controllers allows unauthenticated attackers to exploit authenticated user sessions by inducing browser-submitted requests that bypass Rails CSRF protection entirely. At the specific commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f, both proxy controllers skip the Rails authenticity token check, exposing upstream monitoring write and management APIs - including Alertmanager silence creation and Prometheus configuration reload - to attacker-controlled actions without the victim's awareness. A public proof-of-concept gist has been published by the reporting researcher, and no patched release has been confirmed at time of analysis.
Ruby code injection in the amazing_print gem's AwesomeMethodArray#grep enables arbitrary Ruby code execution inside the host process when attacker-controlled strings containing interpolation syntax reach a dynamically constructed eval call. Specifically pinned to commit dc890dfafdf07088ea901df53c19c2710e5c5234, the flaw requires an application code path where externally influenced values can become method names processed by grep with a block. A publicly available proof-of-concept exists on GitHub Gist, and while the CVE is not in CISA KEV, the full-RCE impact in affected deployments warrants urgent remediation review.
Protection-mechanism bypass in CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 lets unsigned code run from temporary filesystems because the product fails to enforce its Integrity Measurement Architecture (IMA) policy across those locations. An attacker able to stage a binary in a tmpfs-style path can execute code that the integrity policy was meant to block, undermining the pre-boot/disk-encryption trust model. The flaw was disclosed in Black Hat USA 2026 research ('The Cost of Obscurity', Burch); no public exploit is identified at time of analysis, EPSS is low (0.17%, 6th percentile), and it is not in CISA KEV.
CryptoPro Secure Disk for BitLocker before v7.7.4 stores initramfs contents in plaintext on disk, allowing a physical attacker to recover cryptographic keys and other secrets without defeating the encryption layer. The vulnerability was publicly disclosed at Black Hat USA 2026 by researcher Burch in a presentation titled 'The Cost of Obscurity,' suggesting the vendor's security model relied on implementation obscurity rather than cryptographic assurance. No public exploit identified at time of analysis; EPSS at 0.17% reflects the physical-access prerequisite that limits widespread automated exploitation.
Boot-stage integrity bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker who can present a LUKS-encrypted volume during the pre-boot phase to cause bootxsa.efi to skip all CryptoPro file integrity checks, enabling execution of tampered EFI boot components. Publicly disclosed at Black Hat USA 2026 with an accompanying whitepaper, substantially raising the bar for exploit development. No CISA KEV listing and EPSS at the 1st percentile indicate no observed mass exploitation, but the research-quality disclosure significantly reduces attacker effort for targeted campaigns against affected endpoints.
Boot partition authentication bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker who can manipulate disk partition layout to redirect boot-time code execution to a crafted Linux partition. The product fails to cryptographically verify the integrity of the intended boot partition and instead selects the first partition whose type matches a hardcoded value - a logic flaw that allows a spoofed partition to preempt the legitimate boot target and execute arbitrary code at elevated privilege. No public exploit or CISA KEV listing is confirmed at time of analysis, though a Black Hat USA 2026 research presentation by Burch ('The Cost of Obscurity') describes the finding, suggesting detailed technical disclosure has occurred.
Full-disk-encryption bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 stems from a default TPM PCR sealing policy that ignores the system boot state, letting an attacker with physical access unseal the TPM through an unintended execution path or by relocating the drive/TPM to another hardware platform and recover the BitLocker keys. The flaw was documented in the Black Hat USA 2026 research 'The Cost of Obscurity' by Burch; there is no public exploit identified at time of analysis, it is not on CISA KEV, and EPSS is low at 0.18% (8th percentile), consistent with a physical-access rather than mass-exploitable weakness.
CryptoPro Secure Disk for BitLocker before v7.7.4 silently falls back to plaintext volume mounting when a decryption error occurs, negating the entire confidentiality guarantee that BitLocker is meant to enforce. Disclosed publicly at Black Hat USA 2026 in research titled 'The Cost of Obscurity' (Burch), the flaw demonstrates how improper error handling in encryption middleware can fully undermine the security layer it wraps. No public exploit code has been identified at time of analysis, though the Black Hat presentation and accompanying whitepaper are publicly available, substantially lowering the knowledge barrier for exploitation; EPSS stands at a low 0.17% but may shift as presentation details circulate.
Integrity validation failure in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker with local or physical disk access to craft malicious DataStore contents that trigger code execution in a high-privilege context or disrupt service availability on the host. The DataStore - a non-partitioned filesystem holding pre-boot configuration and cryptographic material - is parsed without authenticity verification, making it a viable Evil Maid attack surface. No public exploit identified at time of analysis, and EPSS at 0.18% (8th percentile) indicates very limited real-world exploitation activity; however, research presented at Black Hat USA 2026 details the vulnerability class.