N A
Monthly
Session hijacking in ntopng versions through 6.6 arises because HTTP session identifiers are generated with weak, time-seeded pseudo-randomness in src/HTTPserver.cpp, making freshly issued authenticated session cookies predictable or collision-prone. Remote attackers who can influence or observe login timing can forecast a valid session token and take over an authenticated user's session without credentials. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile) despite the 9.8 CVSS rating.
Denial of service in the UTT nv518G security gateway/router (firmware nv518GV3v3.2.7-210919-161313) lets remote attackers crash the device by triggering a buffer overflow in the gohead web-management component's sub_487330 (FUN_00487330) function. The CVSS vector indicates unauthenticated network exploitation with availability-only impact, EPSS is low at 0.22% (13th percentile), and no active exploitation is recorded, though a public technical write-up of the flawed function exists on GitHub.
Remote denial of service in the UTT nv518G security gateway/router (firmware nv518GV3v3.2.7-210919-161313) allows an unauthenticated attacker to crash the device by triggering a buffer overflow in the gohead/sub_444C8C function of its embedded web management service. The flaw impacts availability only - no code execution, data disclosure, or integrity loss is indicated - and CVSS rates it 7.5 (High). No public exploit identified at time of analysis, though a GitHub reverse-engineering report documents the vulnerable function; EPSS is low at 0.22% (13th percentile) and it is not on the CISA KEV list.
Out-of-bounds read in ArduPilot's MAVLink ground-control-station handler (through Plane-4.6.3) lets a remote attacker on the MAVLink link send a crafted SERIAL_CONTROL message that reads memory beyond intended bounds in GCS_MAVLINK::handle_serial_control(), potentially disclosing adjacent flight-controller memory and/or crashing the autopilot. The CVSS 9.1 rating reflects high confidentiality and availability impact over an unauthenticated network vector, though EPSS is low (0.17%, 6th percentile) and no public exploit is identified at time of analysis. An upstream fix is proposed via GitHub PR #32587 (issue #32524), but no tagged patched release is independently confirmed.
Denial of service in the UTT nv518G security gateway (firmware nv518GV3 v3.2.7-210919-210919/161313) lets a remote, unauthenticated attacker crash or hang the device by triggering uncontrolled resource consumption in the gohead/sub_445C5C (FUN_00445c5c) handler of the built-in GoAhead-style web management daemon. No public exploit is identified in the source data, though a GitHub technical write-up reverse-engineering the vulnerable function is available; EPSS is low (0.20%, 10th percentile) and the CVE is not on CISA KEV, so exploitation is theoretical rather than confirmed. Impact is limited to availability (network outage of the gateway) with no confidentiality or integrity loss.
Denial of service in Aleksoid1978 MPC-BE (Media Player Classic - Black Edition) prior to commit 4341cb3 lets an attacker crash the player by supplying a crafted MP4 file that triggers a NULL pointer dereference in the bundled Bento4 AP4_AtomSampleTable::GetSample() routine. A proof-of-concept is referenced (SSVC exploitation: poc), but there is no public exploit identified as weaponized and it is not in CISA KEV; impact is limited to availability with no code execution, data disclosure, or integrity loss. EPSS is low at 0.15% (5th percentile), consistent with a crash-only bug that requires a victim to open a malicious file.
Remote code execution in Pivotal CRM 6.6.4.08 (Aurea) arises from insecure deserialization in the Pivotal.Engine.Client.Services.Conversion.dll component, letting remote attackers run arbitrary code on the server. This is a bypass of the incomplete fix for CVE-2026-39253, and it remains exploitable on systems that only applied the earlier patch-ghi-15381-cwe-502-20251225.zip. No public exploit code has been identified, though public advisories exist for both this issue and its predecessor; EPSS is modest at 0.57% (43rd percentile) and it is not in CISA KEV.
Denial of service in the UTT nv518G gateway/router (firmware nv518GV3 v3.2.7-210919-161313) allows a remote, unauthenticated attacker to crash the device by triggering a buffer overflow in the gohead web-service handler at function sub_472f08 (FUN_00472f08). The CVSS 3.1 score of 7.5 reflects availability-only impact (A:H, C:N/I:N) over the network with no privileges or user interaction. EPSS is low (0.22%, 13th percentile) and the CVE is not in CISA KEV; a third-party technical write-up exists on GitHub, but no active exploitation is confirmed.
Denial of service in the UTT nv518G router (firmware nv518GV3v3.2.7-210919-161313) allows a remote attacker to crash or hang the device by sending crafted input to the gohead/sub_44af70 (FUN_0044af70) component of its embedded web/management service. Rated CVSS 7.5 (availability-only impact), the flaw is network-reachable without authentication or user interaction but does not expose or alter data. A public technical writeup analyzing the vulnerable function exists on GitHub; there is no public evidence of active exploitation and EPSS scores it low (0.20%, 11th percentile).
Heap buffer overflow in snap7 v1.4.3 crashes the embedded S7 server when processing a specially crafted write function packet targeting TS7Worker::PerformFunctionWrite() in /core/s7_server.cpp. Systems deploying snap7 as an S7-compatible communication server - common in industrial SCADA, HMI, and IoT gateway applications bridging to Siemens S7-series PLCs - can be disrupted remotely with no privileges required per the CVSS PR:N designation. No public exploit identified at time of analysis, and the EPSS score of 0.19% (8th percentile) reflects minimal current exploitation activity; however, operational impact in OT environments can exceed what the CVSS Availability score alone suggests.
Remote code execution in Alexantr filemanager v1.0 lets remote attackers run arbitrary code through the filemanager.php component, mapped to CWE-94 (code injection). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable flaw requiring no authentication or user interaction, and publicly available exploit code exists (GitHub POC by SLO-CYBER-SEC). SSVC rates exploitation as proof-of-concept with total technical impact and automatable=yes, but it is not on CISA KEV and no EPSS score was provided.
Denial of service in EIPStackGroup OpENer (commit 76b95c), an open-source EtherNet/IP stack, allows remote attackers to crash the device by sending a crafted Common Packet Format (CPF) packet that triggers a buffer overflow in the Get_Attribute_List handler. The flaw is network-reachable without authentication or user interaction (CVSS 7.5, availability-only impact), and SSVC indicates proof-of-concept exploit code exists and that exploitation is automatable. EPSS is low (0.17%, 7th percentile) and the CVE is not on CISA KEV, so there is no public evidence of active exploitation yet.
Heap buffer overflow in lib60870 versions 2.3.3 through 2.3.6 allows remote unauthenticated attackers to crash processes handling IEC 60870-5 protocol traffic by sending crafted Application Service Data Unit (ASDU) messages. The overflow occurs in the HighPriorityASDUQueue_hasUnconfirmedIMessages function, which manages high-priority message queuing in the IEC 60870-5-104 telecontrol protocol stack - making this particularly relevant to SCADA and industrial control system deployments where availability is operationally critical. No active exploitation is confirmed by CISA KEV; however, SSVC indicates a proof-of-concept exists, and EPSS of 0.18% (8th percentile) suggests minimal current exploitation activity.
Local privilege escalation in Matrix42 Empirum (versions before 25.5 and 26.x before 26.2) lets any authenticated low-privileged user gain SYSTEM execution by abusing the PBackupVSS.exe service's named pipe. The pipe \\.\pipe\PBackupVSS is created with an overly permissive DACL granting GENERIC_READ/GENERIC_WRITE to all authenticated users, so an attacker can send crafted IPC messages that drive the SYSTEM-level service into running an attacker-supplied shadow.exe from a controlled working directory. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but exploitation is mechanically straightforward once on the host.
Remote denial-of-service in Technitium DNS Server versions 14.3 and earlier lets an unauthenticated network attacker exhaust server resources (CWE-400) through the DNS client handling logic in TechnitiumLibrary.Net/Dns/DnsClient.cs, crashing or hanging the DNS service. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) indicates trivially reachable remote triggering with high availability impact but no confidentiality or integrity loss. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), consistent with SSVC recording exploitation status as 'none'.
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by getting it to load a maliciously crafted shared library, which mishandles resources in the DSO::mmap_and_copy dynamic-linking routine (CWE-404). Publicly available exploit code exists, but the flaw is not in CISA KEV and EPSS is very low (0.17%, 6th percentile), indicating no observed in-the-wild exploitation. Impact is confined to availability - no confidentiality or integrity loss.
Denial of service in relibc — the Redox OS C standard library implemented in Rust — allows attackers to crash applications by supplying a crafted time string to strptime(), which mishandles month parsing in the parse_month function of time/strptime.rs at commit ab6a2e. Publicly available exploit code exists (a dedicated PoC in the Marsman1996 repository), though there is no evidence of active exploitation; the EPSS score is low at 0.17% (6th percentile). Impact is availability-only (application crash/hang) with no confidentiality or integrity loss.
Sensitive information disclosure in MSI NBFoundation Service v2.0.2506.1201 lets remote attackers recover confidential data protected by the service's weak 3DES-ECB encryption scheme. The ECB cipher mode leaks structural patterns and, combined with insecure permissions (CWE-200), exposes data an attacker can decrypt or infer without authentication. No public exploit is identified at time of analysis, though a GitHub research repository is referenced and EPSS remains low (0.15%).
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a process by supplying a crafted string that reaches a panicking `unwrap()` inside the `__assert_fail` function in /assert/mod.rs. Any program linked against the affected relibc that routes attacker-influenced data through an assertion failure path can be forced to abort. Publicly available exploit code exists, but the issue is not listed in CISA KEV and EPSS is low (0.17%, 6th percentile), indicating no observed widespread exploitation.
Information disclosure in MSI NBFoundation Service v2.0.2506.1201 lets remote attackers read sensitive data exposed through the named pipe MSI_SERVICE_2, which is configured with overly permissive access controls. The flaw scores CVSS 7.5 (high) for confidentiality-only impact with no authentication required; publicly available exploit code exists in a GitHub proof-of-concept, though there is no evidence of active exploitation and the EPSS probability is low (0.22%, 13th percentile).
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to exhaust availability by passing crafted input to the pthread_rwlockattr_setpshared() function, classified as uncontrolled resource consumption (CWE-400). Publicly available exploit code exists (Marsman1996 PoC), though the flaw is not listed in CISA KEV and carries a low EPSS score of 0.17% (6th percentile). The reported CVSS 3.1 vector (7.5, AV:N) appears inconsistent with the local nature of a libc threading API and should be treated cautiously.
SQL injection in the open-source Grocery Store Management System (PHP/MySQL, v1.0 by anirudhkannanvp) lets attackers read arbitrary database contents by injecting a crafted SQL payload through the unsanitized 'scost' parameter of /grocery/search_products.php. The flaw (CWE-89) carries a CVSS of 7.7 and exposes credentials, customer records, and other sensitive data; publicly available exploit code exists in a dedicated GitHub repository, though it is not listed in CISA KEV and its EPSS exploitation probability is low (0.24%, 16th percentile).
Information disclosure in MSI's NBFoundation Service version 2.0.2506.1201 lets a remote attacker read sensitive data exposed by the bundled MSIAPService.exe component due to insecure permissions (CWE-200). Publicly available exploit code exists (GitHub, LittleSuRii/CVE-2026-MSIAPService), but there is no public evidence of active exploitation and the EPSS score is low at 0.22% (13th percentile). Rated CVSS 7.5 for a high-confidentiality, no-integrity, no-availability impact against MSI notebook systems running the affected service.
Stored cross-site scripting in the ARForms WordPress plugin (versions ≤7.1.3) allows unauthenticated remote attackers to inject arbitrary JavaScript via the `value` parameter of the `arf_save_incomplete_form_data` AJAX endpoint, with the payload executing in an administrator's browser when they view the Partial Filled Form Entries dashboard page. No public exploit identified at time of analysis, though Wordfence's disclosure provides enough technical detail to reproduce the injection. Successful exploitation typically leads to admin account takeover and full WordPress site compromise.
Cross-process information disclosure in Apple M1 GPUs allows a sandboxed Metal application to recover secrets from another sandboxed process by reading stale GPU register-file contents left over between compute-shader dispatches. A demonstrated proof-of-concept (published gist) shows an attacker app fully recovering a fresh 128-bit SecRandomCopyBytes secret loaded into GPU registers by a separate victim app, breaking the sandbox isolation boundary. Publicly available exploit code exists, but this is not listed in CISA KEV and EPSS is low (0.30%); the vendor states the issue affects only legacy M1-class hardware and has been fixed at the hardware level in current-generation Apple Silicon.
Arbitrary JavaScript code execution in the expr-eval npm package affects all released versions when applications pass user-controlled expressions to the toJSFunction() API, which compiles them via new Function() and executes them in the host process context. Snyk discloses no public exploit identified at time of analysis, but the trivial attack pattern (sandbox escape via crafted math expressions) and CVSS 4.0 score of 9.2 make this a high-priority issue for any Node.js or browser application that exposes expr-eval to untrusted input.
Remote code execution in Pivotal CRM 6.6.04.08 Smart Client arises from insecure deserialization in the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components, allowing remote attackers to execute arbitrary code on affected installations. The vendor (Aurea/Pivotal) has published a remediation advisory and a researcher has released a public technical advisory, but the issue is not currently listed in CISA KEV and SSVC indicates no observed exploitation. CVSS 8.1 reflects high impact tempered by high attack complexity, while no public exploit identified at time of analysis is corroborated by SSVC's 'Exploitation: none'.
Denial of service in InHand Networks IR912 and IR915 industrial cellular routers (firmware V1.0.0.r20042 and earlier) lets a remote attacker crash the device by overflowing a buffer in the device registration function. Reachable over the network without authentication (CVSS 7.5, AV:N/PR:N), the flaw impacts only availability - no code execution or data exposure is claimed. There is no public exploit identified at time of analysis, and EPSS is low (0.33%, 25th percentile) with CISA SSVC recording exploitation status 'none'.
Unauthenticated remote command execution affects InHand Networks IR912 and IR915 industrial cellular routers running firmware V1.0.0.r20042 and earlier, where the file upload function fails to sanitize input and passes attacker-controlled data to a shell context. Successful exploitation yields code execution as root on the device. No public exploit identified at time of analysis, but the CVSS 9.8 rating and network-reachable file upload endpoint make this a high-priority patching target for any operator with these routers exposed to untrusted networks.
Command injection in InHand Networks IR912 and IR915 industrial cellular routers (firmware V1.0.0.r20042 and earlier) lets remote attackers run arbitrary operating-system commands as root through the device's Python configuration function. CISA's SSVC framework rates the technical impact as total and the flaw as automatable, and the CVSS 9.8 score reflects full compromise of confidentiality, integrity and availability. There is no public exploit identified at time of analysis, and the EPSS probability sits at a modest 1.32% (67th percentile).
Remote command injection in InHand Networks IR912 and IR915 industrial cellular routers (firmware V1.0.0.r20042 and earlier) lets attackers execute arbitrary OS commands as root through crafted input to the device's log viewing function (CWE-77). The flaw carries a CVSS 9.8 and CISA SSVC rates its technical impact as total and exploitation as automatable, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is a modest 1.32% (67th percentile), indicating credible but not yet widespread exploitation pressure.
Remote code execution in InHand Networks IR912 and IR915 industrial cellular routers (firmware V1.0.0.r20042 and earlier) lets unauthenticated network attackers run arbitrary OS commands as root by abusing the Python application export function, which passes crafted input into a shell context. The flaw carries a CVSS 9.8 and SSVC rates its technical impact as total with automatable exploitation, though it is not yet listed in CISA KEV and no public exploit has been identified; EPSS places exploitation probability at a modest 1.32% (67th percentile).
Remote code execution in JimuReport 2.3.4 and earlier lets attackers run arbitrary code by injecting AviatorScript expressions into the /jmreport/executeSelectApi endpoint, which forwards user input straight into the Aviator expression engine without validation. The CVSS vector marks it as network-reachable and unauthenticated (PR:N), giving remote attackers full server compromise. No public exploit is identified at time of analysis, though a third-party technical writeup exists; EPSS is low (0.47%) and it is not on the CISA KEV list.
Denial of service in anna-is-cute paste v0.1.1 allows remote unauthenticated attackers to disrupt service availability by sending a crafted POST request to the /api/v0/pastes endpoint. The flaw is categorized under CWE-400 (Uncontrolled Resource Consumption) and carries a CVSS 3.1 score of 7.5 with availability-only impact; no public exploit identified at time of analysis, and EPSS is low at 0.15% (4th percentile), suggesting minimal observed interest. The vulnerability is not listed in CISA KEV.
Stored HTML/script injection in matze wastebin v3.4.1 allows remote unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who views a crafted paste, by abusing improper output encoding in the /src/highlight.rs syntax-highlighting component. A public gist appears to demonstrate the issue, but no public exploit identified at time of analysis as weaponized tooling, and EPSS exploitation probability is low at 0.18% (8th percentile).
Privilege escalation in impworks Bonsai v6.0 lets an authenticated user holding only Editor rights bypass access controls (CWE-284) to gain full Administrator control, enabling unauthorized account, password, and configuration changes. Exploitation is network-based and low-complexity but requires valid Editor credentials (CVSS 8.1, PR:L). Publicly available exploit code exists (a proof-of-concept gist is referenced and SSVC marks exploitation as 'poc'), though EPSS is low at 0.15% and the flaw is not in CISA KEV - no public exploit identified as actively weaponized at time of analysis.
Remote code execution in YouTransfer v1.0.6 allows unauthenticated attackers to run arbitrary code by sending a crafted request to the sendmail transport integration component. The flaw is a CWE-94 code injection issue with a critical CVSS 9.8 score and publicly available exploit code exists via a referenced GitHub gist, though no active exploitation has been confirmed by CISA KEV.
Privilege escalation in Statping-ng v0.93.0 lets an authenticated low-privileged user elevate to Administrator and reach sensitive components, effectively bypassing the application's authorization model (CWE-284). The flaw carries a high CVSS of 8.8 and total technical impact per CISA SSVC, and a public gist reference suggests exploit details are available, though CISA KEV shows no confirmed active exploitation and EPSS probability is low (0.15%, 4th percentile).
Authenticated command injection in kanishka-linux Reminiscence v0.3.0 lets remote attackers execute arbitrary OS commands by submitting crafted input to the /manage/features/media endpoint. The flaw maps to CWE-78 with CVSS 8.1 (PR:L), and publicly available exploit code exists in a referenced gist; EPSS is modest at 0.66% (47th percentile) and the issue is not on CISA KEV.
Cross-tenant webhook tampering in Deck9 Input v2.0.1 lets any authenticated user modify or delete webhooks belonging to other tenants by targeting the /{form}/webhooks/{webhook} endpoint with a crafted request. Because the endpoint fails to verify that the requesting tenant owns the referenced webhook (a classic broken-access-control / IDOR pattern), attackers can silently redirect, corrupt, or destroy another organization's integration data. Publicly available exploit code exists (proof-of-concept gist), though EPSS remains low at 0.15% and the flaw is not listed in CISA KEV.
Denial of service in Andrei Marcu linx-server v2.3.8 allows remote unauthenticated attackers to crash or exhaust the file-upload service by sending a crafted POST request to the uploadPostHandler component. CVSS 3.1 rates availability impact High (7.5) with no confidentiality or integrity loss, and publicly available exploit code exists via a referenced GitHub gist, though there is no public exploit identified as actively exploited at time of analysis.
Arbitrary code execution in flatnotes v5.5.4 is achievable by uploading crafted HTML or SVG files through the attachment handling component, enabling remote attackers to run code in the context of the application. The CVSS 9.8 rating reflects network-reachable, unauthenticated exploitation with full impact on confidentiality, integrity, and availability. Publicly available exploit code exists via a referenced GitHub gist, though there is no public exploit identified as actively exploited in the CISA KEV catalog at time of analysis.
Remote code execution in fossar selfoss v2.20-SNAPSHOT allows unauthenticated attackers to execute arbitrary commands and retrieve sensitive data by sending a crafted HTTP request to the loopback request handling component. The flaw carries a CVSS 9.8 score and a public gist (likely containing proof-of-concept material) is referenced, though EPSS exploitation probability remains low at 0.19% and the issue is not listed in CISA KEV.
Directory traversal in Zhoros SuperBin v1.0.0 allows remote unauthenticated attackers to read or write files outside intended directories by uploading files whose names contain traversal sequences such as '../'. The flaw stems from inadequate sanitization of user-supplied filenames during file handling operations. Publicly available exploit code exists via a referenced GitHub gist, though there is no public exploit identified as weaponized at scale and the vulnerability is not listed in CISA KEV.
Unauthorized information disclosure in Sismics Docs (Teedy) v1.11 allows remote attackers to bypass access controls on share-based read endpoints and retrieve sensitive document data via crafted requests. The flaw stems from broken access control logic (CWE-284) on endpoints intended for shared documents, enabling unauthenticated retrieval of resources that should be restricted. There is no public exploit identified at time of analysis, EPSS is low (0.15%), and the vulnerability is not listed in CISA KEV.
Remote code execution in kanishka-linux Reminiscence v0.3.0 allows unauthenticated attackers to execute arbitrary OS commands by supplying crafted input to the media archiving and export pipeline component. The CVSS 9.8 rating reflects network-reachable, unauthenticated exploitation with full impact to confidentiality, integrity, and availability, though no public exploit identified at time of analysis and EPSS sits at 0.67% (47th percentile) indicating limited observed exploitation pressure so far.
Path traversal in Bludit 3.19.0's api/plugin.php endpoint allows remote attackers to escape the intended directory and access arbitrary files on the server via crafted requests. The CVSS 9.8 rating reflects unauthenticated network-based exploitation with high impact across confidentiality, integrity, and availability, and publicly available exploit code exists in a public gist, though EPSS remains low at 0.25%.
Information disclosure in Whoogle Search v1.2.3 lets remote unauthenticated attackers retrieve sensitive data by sending a crafted GET request to the application's configuration endpoint. The flaw carries a CVSS 7.5 (high, confidentiality-only) rating, and publicly available exploit code exists via a published gist, though it is not listed in CISA KEV and its EPSS exploitation probability is low (0.15%, 4th percentile).
Denial of service in Feuerhamster MailForm v1.1.0 allows remote unauthenticated attackers to exhaust server resources by sending a crafted request to the attachment handling component. The flaw aligns with CWE-400 (Uncontrolled Resource Consumption) and carries a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/A:H), with no public exploit identified at time of analysis and no inclusion in CISA KEV.
Server impersonation in OCaml-TLS before 2.1.0 allows a malicious TLS server to present a certificate not intended for server authentication and still be accepted by client code, enabling man-in-the-middle and impersonation attacks against any application linking the library as a TLS client. The client fails to validate KeyUsage and ExtendedKeyUsage extensions properly, breaking a core PKIX trust assumption. No public exploit identified at time of analysis and EPSS sits at 0.15% (4th percentile), but the CVSS 9.1 reflects the broad confidentiality and integrity impact on encrypted sessions.
Authentication bypass in OCaml-TLS server implementations before version 2.1.0 allows remote attackers to impersonate legitimate clients during mutual TLS authentication by presenting certificates whose KeyUsage and ExtendedKeyUsage extensions do not authorize client authentication. The server fails to enforce these X.509 certificate purpose constraints, so any valid certificate chain trusted by the server may be accepted regardless of intended use. EPSS probability is low (0.12%, 2nd percentile) and no public exploit identified at time of analysis, but the CVSS 9.1 reflects the high impact on confidentiality and integrity of mTLS-protected services.
SQL injection in Datadog Vector v0.54.0 reportedly lets remote attackers read sensitive database contents by injecting crafted SQL through the set_uri_query parameter processed in the KeyPartitioner::partition function (CWE-89). Publicly available exploit code exists (a GitHub gist), but the report is low-confidence: it is a MITRE-reserved record with placeholder vendor/CPE metadata and no vendor advisory, and a SQL-injection sink is architecturally unusual for Vector, which is an observability data-routing pipeline rather than a database application. EPSS is low (0.15%, 5th percentile) and the CVE is not in CISA KEV.
Local privilege escalation in Iru, Inc Kandji Agent versions prior to 4.7.5(5374) allows a local attacker to invoke restricted agent functionality by exploiting a client-side validation gap. The flaw maps to CWE-269 (Improper Privilege Management) and carries a CVSS 8.4 rating due to high impact on confidentiality, integrity, and availability, though no public exploit identified at time of analysis and EPSS is low at 0.14%.
Arbitrary file write in ocaml-tar before 3.4.0 lets remote attackers escape the intended extraction directory using '../' path segments embedded in archive member names. Unlike the standard tar(1) utility, which rejects such traversal, ocaml-tar decompresses the crafted entries anyway, writing files to attacker-chosen locations outside the target directory. There is publicly available exploit code exists per SSVC (POC), though EPSS remains low at 0.15% and it is not listed in CISA KEV.
OS command injection in the Tenda 5G03 5G router (firmware V05.03.02.04, hardware version 1.0) lets attackers inject arbitrary shell commands through the unsanitized dialNumber parameter of the action_dial_call handler. The reported CVSS 3.1 vector rates it 9.8 (network, no privileges, no user interaction) with total technical impact, and publicly available exploit code exists in the sezangel/IOT-vul repository, though there is no public exploit identified as weaponized and no CISA KEV listing. EPSS is modest at 0.45% (36th percentile), indicating the flaw is disclosed with a POC but not yet showing broad exploitation activity.
OS command injection in the Tenda 5G03 5G CPE router (firmware V05.03.02.04, hardware version 1.0) allows remote attackers to execute arbitrary shell commands by injecting metacharacters into the ims_apn parameter processed by the action_ims_on_with_apn function. Because the injected commands run with the router's elevated (typically root) web-server privileges, an attacker gains full control of the device. Publicly available exploit/proof-of-concept material exists in a third-party IoT vulnerability repository, though there is no public exploit identified as weaponized and the issue is not on the CISA KEV list; EPSS is low at 0.52%.
Remote code execution in Bludit CMS before 3.18.4 allows attackers with a valid API token to upload a malicious PHP script via the API plugin's /api/files/{key} endpoint. The vulnerability arises from missing authorization checks and lack of file extension validation, enabling arbitrary code execution on the server. A public proof-of-concept exists, but no active exploitation has been confirmed (not in CISA KEV) and EPSS score is low (0.21%).
Command injection in the Tenda 5G03 5G/LTE router (firmware V05.03.02.04, hardware version 1.0) allows remote attackers to inject arbitrary OS commands through the 'ia' parameter processed by the action_radio_on_with_ia_apn function. The flaw carries a 9.8 CVSS and, per its CVSS vector, is network-reachable without authentication or user interaction, giving full command execution on the device. There is publicly available exploit code (a public PoC/write-up on GitHub), though EPSS remains modest at 0.45% and there is no evidence of active exploitation.
OS command injection in the Tenda 5G03 5G CPE router (firmware V05.03.02.04) lets remote attackers inject arbitrary system commands through the ratMode parameter of the action_set_rat_mode function. Because the CVSS vector rates the flaw as network-reachable with no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), an attacker who can reach the device's web interface gains full command execution on the underlying firmware. A public technical write-up/PoC exists on GitHub, though EPSS remains modest at 0.45% and there is no evidence of active exploitation.
Authentication bypass in ThingsBoard IoT platform v4.3.0.1 lets a remote, unauthenticated attacker take over any account by tampering with the user-supplied 'user' JSON parameter during the OAuth2 authorization-code exchange at /login/oauth2/code/. Because the application trusts the attacker-controlled email in that object, swapping it for a victim's address yields a fully authenticated session with no credentials required. Publicly available exploit code exists (a POC gist), SSVC rates it automatable with total technical impact, but EPSS is low at 0.23% (14th percentile) and it is not on CISA KEV.
Authenticated SQL injection in OpenSIPS Control Panel (opensips-cp) versions prior to 9.3.3 allows attackers with valid panel credentials to execute arbitrary SQL via the 'table' GET parameter in alias_management.php using time-based blind techniques. The flaw resides in the alias_management module and yields full database confidentiality, integrity, and availability impact per CVSS 8.8. No public exploit identified at time of analysis, and EPSS is low (0.28%, 19th percentile), but a third-party advisory documents the issue on GitHub.
Local privilege escalation in Microvirt MEmu Android Emulator 9.2.7.0 allows a low-privileged local user to abuse the MemuService.exe component to gain elevated rights on the host Windows system. Mapped to CWE-269 (Improper Privilege Management), with no public exploit identified at time of analysis and an EPSS score of 0.21% indicating low predicted exploitation likelihood. Researcher PoC repository exists on GitHub (sec-zone/CVE-2026-36213) but active exploitation has not been reported.
Command injection in the Tenda 5G03 5G CPE router (firmware V05.03.02.04) lets remote unauthenticated attackers inject arbitrary OS commands through the pin parameter handled by the action_unlock_sim function. The flaw carries a critical 9.8 CVSS and gives total control over the device, and a public write-up/exploit exists in a third-party IoT vulnerability repository, though it is not listed in CISA KEV. EPSS is modest at 0.45% (36th percentile), indicating no observed mass exploitation yet.
Remote code execution affects remotion-dev's Remotion framework at version 4.0.409, enabling attackers to execute arbitrary code on systems running the affected version per CWE-94 code injection semantics. The CVSS 9.8 vector indicates network-reachable, unauthenticated exploitation without user interaction, though no public exploit identified at time of analysis and EPSS probability remains low at 0.25% (16th percentile). The vulnerability is reported by MITRE with a third-party advisory on GitHub but lacks detailed exploitation specifics.
Arbitrary file write in remotion-dev Remotion v4.0.409 allows remote attackers to write attacker-controlled content to arbitrary filesystem locations without authentication, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) and CWE-123 (Write-what-where) classification. Remotion is a React-based programmatic video rendering framework, and the flaw can lead to integrity and availability compromise of the host running the rendering engine. No public exploit identified at time of analysis, and the EPSS score of 0.15% (4th percentile) indicates low predicted exploitation likelihood despite the high CVSS score.
OS command injection in the Tenda 5G03 5G CPE router (firmware V05.03.02.04) lets an attacker inject shell commands through the volume parameter of the action_set_volume handler, yielding full command execution on the device. Per the published CVSS vector the flaw is remotely reachable without authentication or user interaction, and publicly available exploit code exists (a proof-of-concept in the sezangel/IOT-vul research repository); it is not listed in CISA KEV and carries a modest EPSS of 0.45% (36th percentile), indicating no confirmed active exploitation yet. SSVC rates technical impact as total and the flaw as automatable, so successful exploitation gives complete control of the router.
SQL injection in RuoYi v4.8.2 lets an administrative user abuse the /tool/gen/createTable endpoint of the code-generation module to inject arbitrary SQL and read sensitive database contents. The advisory (CWE-89) and a public proof-of-concept on GitHub confirm the flaw, though it is not listed in CISA KEV and carries a low EPSS score of 0.28%. Note a data conflict: the description states administrative privileges are required, yet the supplied CVSS vector marks it PR:N (unauthenticated).
Remote code execution in SNMP4J-Agent 3.8.3 is enabled through the snmp4jCfgStoragePath component, allowing remote attackers to run arbitrary code on hosts running the agent. The CWE-73 (External Control of File Name or Path) classification indicates the storage path parameter can be manipulated to influence file operations, and no public exploit identified at time of analysis though a third-party advisory has been published on GitHub. EPSS is low at 0.21% (11th percentile) despite the 9.8 CVSS, suggesting limited current exploitation activity.
Privilege escalation in Filestash v0.4.0 lets a low-privileged authenticated user reach the administrative /admin/api/config endpoint by sending a crafted request, because that endpoint fails to enforce proper access control (CWE-284). An attacker who already holds a limited session can read and rewrite the server's global configuration, effectively gaining admin control. SSVC rates technical impact as total; publicly available exploit code exists (a proof-of-concept gist), but there is no evidence of active exploitation and EPSS is low at 0.18% (8th percentile).
Server-side request forgery in Shlink v5.0.1's automatic short URL title resolution allows remote unauthenticated attackers to probe internal network resources by submitting a crafted longUrl value. The flaw carries a CVSS 9.1 rating reflecting high confidentiality and integrity impact, though EPSS exploitation probability remains low at 0.15% and there is no public exploit identified at time of analysis beyond a referenced gist. Shlink is a self-hosted URL shortener, making this a meaningful pivot point for attackers targeting internal infrastructure behind the shortener host.
Server-Side Request Forgery in Koillection 1.8.0's custom scraper subsystem lets an authenticated user supply a crafted URL that the application fetches server-side, enabling reconnaissance and access to internal-only resources otherwise unreachable from the internet. The CVSS vector requires low privileges (PR:L), so an ordinary logged-in account is sufficient, and the flaw yields high confidentiality and integrity impact (C:H/I:H). Publicly available exploit code exists via a referenced gist, though there is no public exploit identified as being used in active attacks and EPSS probability is low at 0.15%.
Denial of service in LLDAP v0.6.2 allows remote unauthenticated attackers to disrupt the authentication service by sending a crafted refresh-token header to the HTTP refresh endpoint. The flaw is a CWE-400 resource handling defect with CVSS 7.5 (availability-only impact); no public exploit is identified, though a referenced gist may contain proof-of-concept material. EPSS is low at 0.18% (8th percentile) and the issue is not on CISA KEV.
Information disclosure in Observe (the Observeinc observability/log-analytics platform) versions dated 2026-01-28 and earlier allows remote attackers to obtain sensitive data through the CSV Log export component. Rated CVSS 7.5 with a high-confidentiality, no-integrity/availability impact, the flaw exposes log contents that may include secrets, PII, or operational telemetry. Publicly available exploit code exists (SSVC 'poc') and CISA's SSVC framework marks it automatable, though EPSS remains very low at 0.18% (8th percentile) and it is not on the CISA KEV list.
Server-Side Request Forgery in Project Firefly III v6.5.9 allows remote attackers to scan internal network resources by abusing improper access controls in the webhook management component via crafted POST requests. SSVC indicates a proof-of-concept exists and exploitation is automatable with total technical impact, though EPSS remains low (0.15%) and no public exploit identified at time of analysis beyond a referenced gist. The flaw is unauthenticated per the CVSS vector (PR:N) and provides a pivot point into otherwise unreachable internal services.
SQL injection in Bernd Bestel grocy v4.6.0 lets remote attackers extract sensitive database contents by injecting a crafted SQL statement through the product-group parameter of the /stockreports/spendings endpoint. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) and SSVC rates technical impact as total with automatable exploitation, though EPSS remains low at 0.15%; publicly available exploit code exists via a published gist, but there is no public exploit identified as actively exploited (not in CISA KEV).
Denial of service in Tenda W3 Wireless Router firmware v1.0.0.3(2204) allows unauthenticated remote attackers to crash the device by sending crafted HTTP requests with oversized username or password parameters that overflow stack buffers in the R7WebsSecurityHandler function. The flaw affects the router's web management interface and carries a CVSS 7.5 (availability-only impact); no public exploit identified at time of analysis and EPSS exploitation probability is very low at 0.01%.
Denial of service in Tenda G0 router firmware v15.11.0.5 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request with an oversized picCropName parameter to the formCropAndSetWewifiPic handler. The flaw is a classic stack buffer overflow in the web management interface, and while no public weaponized exploit is identified, proof-of-concept research artifacts are published on GitHub. EPSS scores exploitation probability at just 0.01%, reflecting limited attacker interest despite trivial reachability.
Denial of service in Tenda W3 Wireless Router firmware v1.0.0.3(2204) allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request containing a malicious wl_radio parameter to the formWifiRadioSet function. EPSS scoring (0.01%, 2nd percentile) indicates very low real-world exploitation probability, and no public exploit identified at time of analysis beyond a research repository referencing the vulnerable function.
Denial of service in Tenda O3v3 firmware v1.0.0.5 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a stack buffer overflow in the formSetCfm handler. No public exploit identified at time of analysis, and EPSS is very low (0.01%), but the network-reachable, no-authentication attack surface on a CPE/router device makes this relevant for exposed deployments.
Denial of service in Tenda G0 router firmware v15.11.0.5 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that overflows the portalAuth parameter handled by the formPortalAuth function. No public exploit is identified at time of analysis and EPSS exploitation probability is very low (0.01%), but a public proof-of-concept research repository on GitHub references the vulnerable function.
Denial of service in the Tenda O3 Wireless Router (firmware v1.0.0.5(4180)) allows unauthenticated remote attackers to crash the device by sending a crafted HTTP request that triggers a stack-based buffer overflow in the ip parameter of the fromNetToolGet function. Publicly available exploit code exists in a GitHub research repository, though EPSS rates exploitation probability at only 0.02% and the issue is not on CISA KEV. Impact is limited to availability (the CVSS A:H, C:N, I:N profile), making this primarily a device-crash bug rather than a code-execution vector based on the reported analysis.
Denial of service in Tenda W3 Wireless Router firmware v1.0.0.3(2204) allows remote unauthenticated attackers to crash the device by sending crafted HTTP requests that trigger stack-based buffer overflows in the formwrlSSIDset handler. The flaw is reachable without authentication or user interaction (CVSS 7.5, AV:N/AC:L/PR:N), but EPSS is only 0.01% and no public exploit identified at time of analysis suggests low near-term mass-exploitation likelihood despite the trivial attack surface.
Denial of service in Tenda O3 Wireless Router firmware v1.0.0.5(4180) allows remote unauthenticated attackers to crash the device by sending crafted HTTP requests that trigger stack buffer overflows in the fromVirtualSer function. Five distinct overflow sinks (puVar2, puVar1, __s2, __s1_00, puVar3) are reachable via the same handler. No public exploit identified at time of analysis, and EPSS rates exploitation likelihood at 0.01%, but a research repository with vulnerability artifacts is referenced.
Denial of service in Tenda G0 router firmware v15.11.0.5 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a buffer overflow in the IPMacBindIndex parameter handler of the formIPMacBindDel function. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.01%, 2nd percentile), but the network-reachable, no-auth attack surface on an edge networking device warrants attention from operators of affected hardware.
Denial-of-service via stack buffer overflow affects the Tenda O3 wireless router firmware v1.0.0.5(4180), where the fromNetToolGet handler fails to bound-check the domain parameter supplied in HTTP requests. Remote attackers can crash the router's web management service by sending a crafted request, disrupting network connectivity for downstream clients. SSVC flags the issue as proof-of-concept with automatable exploitation and partial technical impact, though EPSS remains low at 0.01% and no in-the-wild exploitation has been confirmed.
Remote code execution and denial-of-service in bitbank2 AnimatedGIF v2.2.0 arises from a buffer overflow in the DecodeLZW function when processing a crafted GIF file. SSVC data indicates a proof-of-concept exists and exploitation is automatable, though it is not listed in CISA KEV; with CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) the vulnerability is network-reachable wherever this library decodes attacker-supplied GIFs.
Denial of service in Tenda W20E router firmware v15.11.0.6 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a stack-based buffer overflow in the webAuthWhiteUserInfo parameter of the formAddWebAuthWhiteUser function. No public exploit identified at time of analysis, though a research repository documenting the flaw is referenced. The CVSS 7.5 (High) score reflects pure availability impact with no confidentiality or integrity loss.
Denial of service in Tenda W20E router firmware v15.11.0.6 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a stack-based buffer overflow in the picCropName parameter of the formCropAndSetWewifiPic function. No public exploit identified at time of analysis, though a research write-up referencing the vulnerable function exists in a public GitHub repository. The combination of network-reachable attack surface, no authentication requirement, and low complexity makes opportunistic abuse against exposed admin interfaces realistic.
Denial of service in Tenda W20E router firmware v15.11.0.6 allows unauthenticated remote attackers to crash the device by sending a crafted HTTP request containing an oversized macAddr parameter to the formDelStaState handler. The flaw is a stack-based buffer overflow with high availability impact and no confidentiality/integrity loss per CVSS, and no public exploit identified at time of analysis beyond a research repository on GitHub.
Denial of service in Tenda W20E router firmware v15.11.0.6 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a stack buffer overflow in the webAuthUserInfo parameter of the formAddWebAuthUser function. No public exploit identified at time of analysis, though a researcher-published proof-of-concept repository on GitHub documents the issue. EPSS and KEV data are not provided, but the network-reachable, no-auth, no-interaction CVSS vector makes this a credible risk for any exposed management interface.
Session hijacking in ntopng versions through 6.6 arises because HTTP session identifiers are generated with weak, time-seeded pseudo-randomness in src/HTTPserver.cpp, making freshly issued authenticated session cookies predictable or collision-prone. Remote attackers who can influence or observe login timing can forecast a valid session token and take over an authenticated user's session without credentials. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile) despite the 9.8 CVSS rating.
Denial of service in the UTT nv518G security gateway/router (firmware nv518GV3v3.2.7-210919-161313) lets remote attackers crash the device by triggering a buffer overflow in the gohead web-management component's sub_487330 (FUN_00487330) function. The CVSS vector indicates unauthenticated network exploitation with availability-only impact, EPSS is low at 0.22% (13th percentile), and no active exploitation is recorded, though a public technical write-up of the flawed function exists on GitHub.
Remote denial of service in the UTT nv518G security gateway/router (firmware nv518GV3v3.2.7-210919-161313) allows an unauthenticated attacker to crash the device by triggering a buffer overflow in the gohead/sub_444C8C function of its embedded web management service. The flaw impacts availability only - no code execution, data disclosure, or integrity loss is indicated - and CVSS rates it 7.5 (High). No public exploit identified at time of analysis, though a GitHub reverse-engineering report documents the vulnerable function; EPSS is low at 0.22% (13th percentile) and it is not on the CISA KEV list.
Out-of-bounds read in ArduPilot's MAVLink ground-control-station handler (through Plane-4.6.3) lets a remote attacker on the MAVLink link send a crafted SERIAL_CONTROL message that reads memory beyond intended bounds in GCS_MAVLINK::handle_serial_control(), potentially disclosing adjacent flight-controller memory and/or crashing the autopilot. The CVSS 9.1 rating reflects high confidentiality and availability impact over an unauthenticated network vector, though EPSS is low (0.17%, 6th percentile) and no public exploit is identified at time of analysis. An upstream fix is proposed via GitHub PR #32587 (issue #32524), but no tagged patched release is independently confirmed.
Denial of service in the UTT nv518G security gateway (firmware nv518GV3 v3.2.7-210919-210919/161313) lets a remote, unauthenticated attacker crash or hang the device by triggering uncontrolled resource consumption in the gohead/sub_445C5C (FUN_00445c5c) handler of the built-in GoAhead-style web management daemon. No public exploit is identified in the source data, though a GitHub technical write-up reverse-engineering the vulnerable function is available; EPSS is low (0.20%, 10th percentile) and the CVE is not on CISA KEV, so exploitation is theoretical rather than confirmed. Impact is limited to availability (network outage of the gateway) with no confidentiality or integrity loss.
Denial of service in Aleksoid1978 MPC-BE (Media Player Classic - Black Edition) prior to commit 4341cb3 lets an attacker crash the player by supplying a crafted MP4 file that triggers a NULL pointer dereference in the bundled Bento4 AP4_AtomSampleTable::GetSample() routine. A proof-of-concept is referenced (SSVC exploitation: poc), but there is no public exploit identified as weaponized and it is not in CISA KEV; impact is limited to availability with no code execution, data disclosure, or integrity loss. EPSS is low at 0.15% (5th percentile), consistent with a crash-only bug that requires a victim to open a malicious file.
Remote code execution in Pivotal CRM 6.6.4.08 (Aurea) arises from insecure deserialization in the Pivotal.Engine.Client.Services.Conversion.dll component, letting remote attackers run arbitrary code on the server. This is a bypass of the incomplete fix for CVE-2026-39253, and it remains exploitable on systems that only applied the earlier patch-ghi-15381-cwe-502-20251225.zip. No public exploit code has been identified, though public advisories exist for both this issue and its predecessor; EPSS is modest at 0.57% (43rd percentile) and it is not in CISA KEV.
Denial of service in the UTT nv518G gateway/router (firmware nv518GV3 v3.2.7-210919-161313) allows a remote, unauthenticated attacker to crash the device by triggering a buffer overflow in the gohead web-service handler at function sub_472f08 (FUN_00472f08). The CVSS 3.1 score of 7.5 reflects availability-only impact (A:H, C:N/I:N) over the network with no privileges or user interaction. EPSS is low (0.22%, 13th percentile) and the CVE is not in CISA KEV; a third-party technical write-up exists on GitHub, but no active exploitation is confirmed.
Denial of service in the UTT nv518G router (firmware nv518GV3v3.2.7-210919-161313) allows a remote attacker to crash or hang the device by sending crafted input to the gohead/sub_44af70 (FUN_0044af70) component of its embedded web/management service. Rated CVSS 7.5 (availability-only impact), the flaw is network-reachable without authentication or user interaction but does not expose or alter data. A public technical writeup analyzing the vulnerable function exists on GitHub; there is no public evidence of active exploitation and EPSS scores it low (0.20%, 11th percentile).
Heap buffer overflow in snap7 v1.4.3 crashes the embedded S7 server when processing a specially crafted write function packet targeting TS7Worker::PerformFunctionWrite() in /core/s7_server.cpp. Systems deploying snap7 as an S7-compatible communication server - common in industrial SCADA, HMI, and IoT gateway applications bridging to Siemens S7-series PLCs - can be disrupted remotely with no privileges required per the CVSS PR:N designation. No public exploit identified at time of analysis, and the EPSS score of 0.19% (8th percentile) reflects minimal current exploitation activity; however, operational impact in OT environments can exceed what the CVSS Availability score alone suggests.
Remote code execution in Alexantr filemanager v1.0 lets remote attackers run arbitrary code through the filemanager.php component, mapped to CWE-94 (code injection). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable flaw requiring no authentication or user interaction, and publicly available exploit code exists (GitHub POC by SLO-CYBER-SEC). SSVC rates exploitation as proof-of-concept with total technical impact and automatable=yes, but it is not on CISA KEV and no EPSS score was provided.
Denial of service in EIPStackGroup OpENer (commit 76b95c), an open-source EtherNet/IP stack, allows remote attackers to crash the device by sending a crafted Common Packet Format (CPF) packet that triggers a buffer overflow in the Get_Attribute_List handler. The flaw is network-reachable without authentication or user interaction (CVSS 7.5, availability-only impact), and SSVC indicates proof-of-concept exploit code exists and that exploitation is automatable. EPSS is low (0.17%, 7th percentile) and the CVE is not on CISA KEV, so there is no public evidence of active exploitation yet.
Heap buffer overflow in lib60870 versions 2.3.3 through 2.3.6 allows remote unauthenticated attackers to crash processes handling IEC 60870-5 protocol traffic by sending crafted Application Service Data Unit (ASDU) messages. The overflow occurs in the HighPriorityASDUQueue_hasUnconfirmedIMessages function, which manages high-priority message queuing in the IEC 60870-5-104 telecontrol protocol stack - making this particularly relevant to SCADA and industrial control system deployments where availability is operationally critical. No active exploitation is confirmed by CISA KEV; however, SSVC indicates a proof-of-concept exists, and EPSS of 0.18% (8th percentile) suggests minimal current exploitation activity.
Local privilege escalation in Matrix42 Empirum (versions before 25.5 and 26.x before 26.2) lets any authenticated low-privileged user gain SYSTEM execution by abusing the PBackupVSS.exe service's named pipe. The pipe \\.\pipe\PBackupVSS is created with an overly permissive DACL granting GENERIC_READ/GENERIC_WRITE to all authenticated users, so an attacker can send crafted IPC messages that drive the SYSTEM-level service into running an attacker-supplied shadow.exe from a controlled working directory. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but exploitation is mechanically straightforward once on the host.
Remote denial-of-service in Technitium DNS Server versions 14.3 and earlier lets an unauthenticated network attacker exhaust server resources (CWE-400) through the DNS client handling logic in TechnitiumLibrary.Net/Dns/DnsClient.cs, crashing or hanging the DNS service. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) indicates trivially reachable remote triggering with high availability impact but no confidentiality or integrity loss. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), consistent with SSVC recording exploitation status as 'none'.
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by getting it to load a maliciously crafted shared library, which mishandles resources in the DSO::mmap_and_copy dynamic-linking routine (CWE-404). Publicly available exploit code exists, but the flaw is not in CISA KEV and EPSS is very low (0.17%, 6th percentile), indicating no observed in-the-wild exploitation. Impact is confined to availability - no confidentiality or integrity loss.
Denial of service in relibc — the Redox OS C standard library implemented in Rust — allows attackers to crash applications by supplying a crafted time string to strptime(), which mishandles month parsing in the parse_month function of time/strptime.rs at commit ab6a2e. Publicly available exploit code exists (a dedicated PoC in the Marsman1996 repository), though there is no evidence of active exploitation; the EPSS score is low at 0.17% (6th percentile). Impact is availability-only (application crash/hang) with no confidentiality or integrity loss.
Sensitive information disclosure in MSI NBFoundation Service v2.0.2506.1201 lets remote attackers recover confidential data protected by the service's weak 3DES-ECB encryption scheme. The ECB cipher mode leaks structural patterns and, combined with insecure permissions (CWE-200), exposes data an attacker can decrypt or infer without authentication. No public exploit is identified at time of analysis, though a GitHub research repository is referenced and EPSS remains low (0.15%).
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a process by supplying a crafted string that reaches a panicking `unwrap()` inside the `__assert_fail` function in /assert/mod.rs. Any program linked against the affected relibc that routes attacker-influenced data through an assertion failure path can be forced to abort. Publicly available exploit code exists, but the issue is not listed in CISA KEV and EPSS is low (0.17%, 6th percentile), indicating no observed widespread exploitation.
Information disclosure in MSI NBFoundation Service v2.0.2506.1201 lets remote attackers read sensitive data exposed through the named pipe MSI_SERVICE_2, which is configured with overly permissive access controls. The flaw scores CVSS 7.5 (high) for confidentiality-only impact with no authentication required; publicly available exploit code exists in a GitHub proof-of-concept, though there is no evidence of active exploitation and the EPSS probability is low (0.22%, 13th percentile).
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to exhaust availability by passing crafted input to the pthread_rwlockattr_setpshared() function, classified as uncontrolled resource consumption (CWE-400). Publicly available exploit code exists (Marsman1996 PoC), though the flaw is not listed in CISA KEV and carries a low EPSS score of 0.17% (6th percentile). The reported CVSS 3.1 vector (7.5, AV:N) appears inconsistent with the local nature of a libc threading API and should be treated cautiously.
SQL injection in the open-source Grocery Store Management System (PHP/MySQL, v1.0 by anirudhkannanvp) lets attackers read arbitrary database contents by injecting a crafted SQL payload through the unsanitized 'scost' parameter of /grocery/search_products.php. The flaw (CWE-89) carries a CVSS of 7.7 and exposes credentials, customer records, and other sensitive data; publicly available exploit code exists in a dedicated GitHub repository, though it is not listed in CISA KEV and its EPSS exploitation probability is low (0.24%, 16th percentile).
Information disclosure in MSI's NBFoundation Service version 2.0.2506.1201 lets a remote attacker read sensitive data exposed by the bundled MSIAPService.exe component due to insecure permissions (CWE-200). Publicly available exploit code exists (GitHub, LittleSuRii/CVE-2026-MSIAPService), but there is no public evidence of active exploitation and the EPSS score is low at 0.22% (13th percentile). Rated CVSS 7.5 for a high-confidentiality, no-integrity, no-availability impact against MSI notebook systems running the affected service.
Stored cross-site scripting in the ARForms WordPress plugin (versions ≤7.1.3) allows unauthenticated remote attackers to inject arbitrary JavaScript via the `value` parameter of the `arf_save_incomplete_form_data` AJAX endpoint, with the payload executing in an administrator's browser when they view the Partial Filled Form Entries dashboard page. No public exploit identified at time of analysis, though Wordfence's disclosure provides enough technical detail to reproduce the injection. Successful exploitation typically leads to admin account takeover and full WordPress site compromise.
Cross-process information disclosure in Apple M1 GPUs allows a sandboxed Metal application to recover secrets from another sandboxed process by reading stale GPU register-file contents left over between compute-shader dispatches. A demonstrated proof-of-concept (published gist) shows an attacker app fully recovering a fresh 128-bit SecRandomCopyBytes secret loaded into GPU registers by a separate victim app, breaking the sandbox isolation boundary. Publicly available exploit code exists, but this is not listed in CISA KEV and EPSS is low (0.30%); the vendor states the issue affects only legacy M1-class hardware and has been fixed at the hardware level in current-generation Apple Silicon.
Arbitrary JavaScript code execution in the expr-eval npm package affects all released versions when applications pass user-controlled expressions to the toJSFunction() API, which compiles them via new Function() and executes them in the host process context. Snyk discloses no public exploit identified at time of analysis, but the trivial attack pattern (sandbox escape via crafted math expressions) and CVSS 4.0 score of 9.2 make this a high-priority issue for any Node.js or browser application that exposes expr-eval to untrusted input.
Remote code execution in Pivotal CRM 6.6.04.08 Smart Client arises from insecure deserialization in the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components, allowing remote attackers to execute arbitrary code on affected installations. The vendor (Aurea/Pivotal) has published a remediation advisory and a researcher has released a public technical advisory, but the issue is not currently listed in CISA KEV and SSVC indicates no observed exploitation. CVSS 8.1 reflects high impact tempered by high attack complexity, while no public exploit identified at time of analysis is corroborated by SSVC's 'Exploitation: none'.
Denial of service in InHand Networks IR912 and IR915 industrial cellular routers (firmware V1.0.0.r20042 and earlier) lets a remote attacker crash the device by overflowing a buffer in the device registration function. Reachable over the network without authentication (CVSS 7.5, AV:N/PR:N), the flaw impacts only availability - no code execution or data exposure is claimed. There is no public exploit identified at time of analysis, and EPSS is low (0.33%, 25th percentile) with CISA SSVC recording exploitation status 'none'.
Unauthenticated remote command execution affects InHand Networks IR912 and IR915 industrial cellular routers running firmware V1.0.0.r20042 and earlier, where the file upload function fails to sanitize input and passes attacker-controlled data to a shell context. Successful exploitation yields code execution as root on the device. No public exploit identified at time of analysis, but the CVSS 9.8 rating and network-reachable file upload endpoint make this a high-priority patching target for any operator with these routers exposed to untrusted networks.
Command injection in InHand Networks IR912 and IR915 industrial cellular routers (firmware V1.0.0.r20042 and earlier) lets remote attackers run arbitrary operating-system commands as root through the device's Python configuration function. CISA's SSVC framework rates the technical impact as total and the flaw as automatable, and the CVSS 9.8 score reflects full compromise of confidentiality, integrity and availability. There is no public exploit identified at time of analysis, and the EPSS probability sits at a modest 1.32% (67th percentile).
Remote command injection in InHand Networks IR912 and IR915 industrial cellular routers (firmware V1.0.0.r20042 and earlier) lets attackers execute arbitrary OS commands as root through crafted input to the device's log viewing function (CWE-77). The flaw carries a CVSS 9.8 and CISA SSVC rates its technical impact as total and exploitation as automatable, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is a modest 1.32% (67th percentile), indicating credible but not yet widespread exploitation pressure.
Remote code execution in InHand Networks IR912 and IR915 industrial cellular routers (firmware V1.0.0.r20042 and earlier) lets unauthenticated network attackers run arbitrary OS commands as root by abusing the Python application export function, which passes crafted input into a shell context. The flaw carries a CVSS 9.8 and SSVC rates its technical impact as total with automatable exploitation, though it is not yet listed in CISA KEV and no public exploit has been identified; EPSS places exploitation probability at a modest 1.32% (67th percentile).
Remote code execution in JimuReport 2.3.4 and earlier lets attackers run arbitrary code by injecting AviatorScript expressions into the /jmreport/executeSelectApi endpoint, which forwards user input straight into the Aviator expression engine without validation. The CVSS vector marks it as network-reachable and unauthenticated (PR:N), giving remote attackers full server compromise. No public exploit is identified at time of analysis, though a third-party technical writeup exists; EPSS is low (0.47%) and it is not on the CISA KEV list.
Denial of service in anna-is-cute paste v0.1.1 allows remote unauthenticated attackers to disrupt service availability by sending a crafted POST request to the /api/v0/pastes endpoint. The flaw is categorized under CWE-400 (Uncontrolled Resource Consumption) and carries a CVSS 3.1 score of 7.5 with availability-only impact; no public exploit identified at time of analysis, and EPSS is low at 0.15% (4th percentile), suggesting minimal observed interest. The vulnerability is not listed in CISA KEV.
Stored HTML/script injection in matze wastebin v3.4.1 allows remote unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who views a crafted paste, by abusing improper output encoding in the /src/highlight.rs syntax-highlighting component. A public gist appears to demonstrate the issue, but no public exploit identified at time of analysis as weaponized tooling, and EPSS exploitation probability is low at 0.18% (8th percentile).
Privilege escalation in impworks Bonsai v6.0 lets an authenticated user holding only Editor rights bypass access controls (CWE-284) to gain full Administrator control, enabling unauthorized account, password, and configuration changes. Exploitation is network-based and low-complexity but requires valid Editor credentials (CVSS 8.1, PR:L). Publicly available exploit code exists (a proof-of-concept gist is referenced and SSVC marks exploitation as 'poc'), though EPSS is low at 0.15% and the flaw is not in CISA KEV - no public exploit identified as actively weaponized at time of analysis.
Remote code execution in YouTransfer v1.0.6 allows unauthenticated attackers to run arbitrary code by sending a crafted request to the sendmail transport integration component. The flaw is a CWE-94 code injection issue with a critical CVSS 9.8 score and publicly available exploit code exists via a referenced GitHub gist, though no active exploitation has been confirmed by CISA KEV.
Privilege escalation in Statping-ng v0.93.0 lets an authenticated low-privileged user elevate to Administrator and reach sensitive components, effectively bypassing the application's authorization model (CWE-284). The flaw carries a high CVSS of 8.8 and total technical impact per CISA SSVC, and a public gist reference suggests exploit details are available, though CISA KEV shows no confirmed active exploitation and EPSS probability is low (0.15%, 4th percentile).
Authenticated command injection in kanishka-linux Reminiscence v0.3.0 lets remote attackers execute arbitrary OS commands by submitting crafted input to the /manage/features/media endpoint. The flaw maps to CWE-78 with CVSS 8.1 (PR:L), and publicly available exploit code exists in a referenced gist; EPSS is modest at 0.66% (47th percentile) and the issue is not on CISA KEV.
Cross-tenant webhook tampering in Deck9 Input v2.0.1 lets any authenticated user modify or delete webhooks belonging to other tenants by targeting the /{form}/webhooks/{webhook} endpoint with a crafted request. Because the endpoint fails to verify that the requesting tenant owns the referenced webhook (a classic broken-access-control / IDOR pattern), attackers can silently redirect, corrupt, or destroy another organization's integration data. Publicly available exploit code exists (proof-of-concept gist), though EPSS remains low at 0.15% and the flaw is not listed in CISA KEV.
Denial of service in Andrei Marcu linx-server v2.3.8 allows remote unauthenticated attackers to crash or exhaust the file-upload service by sending a crafted POST request to the uploadPostHandler component. CVSS 3.1 rates availability impact High (7.5) with no confidentiality or integrity loss, and publicly available exploit code exists via a referenced GitHub gist, though there is no public exploit identified as actively exploited at time of analysis.
Arbitrary code execution in flatnotes v5.5.4 is achievable by uploading crafted HTML or SVG files through the attachment handling component, enabling remote attackers to run code in the context of the application. The CVSS 9.8 rating reflects network-reachable, unauthenticated exploitation with full impact on confidentiality, integrity, and availability. Publicly available exploit code exists via a referenced GitHub gist, though there is no public exploit identified as actively exploited in the CISA KEV catalog at time of analysis.
Remote code execution in fossar selfoss v2.20-SNAPSHOT allows unauthenticated attackers to execute arbitrary commands and retrieve sensitive data by sending a crafted HTTP request to the loopback request handling component. The flaw carries a CVSS 9.8 score and a public gist (likely containing proof-of-concept material) is referenced, though EPSS exploitation probability remains low at 0.19% and the issue is not listed in CISA KEV.
Directory traversal in Zhoros SuperBin v1.0.0 allows remote unauthenticated attackers to read or write files outside intended directories by uploading files whose names contain traversal sequences such as '../'. The flaw stems from inadequate sanitization of user-supplied filenames during file handling operations. Publicly available exploit code exists via a referenced GitHub gist, though there is no public exploit identified as weaponized at scale and the vulnerability is not listed in CISA KEV.
Unauthorized information disclosure in Sismics Docs (Teedy) v1.11 allows remote attackers to bypass access controls on share-based read endpoints and retrieve sensitive document data via crafted requests. The flaw stems from broken access control logic (CWE-284) on endpoints intended for shared documents, enabling unauthenticated retrieval of resources that should be restricted. There is no public exploit identified at time of analysis, EPSS is low (0.15%), and the vulnerability is not listed in CISA KEV.
Remote code execution in kanishka-linux Reminiscence v0.3.0 allows unauthenticated attackers to execute arbitrary OS commands by supplying crafted input to the media archiving and export pipeline component. The CVSS 9.8 rating reflects network-reachable, unauthenticated exploitation with full impact to confidentiality, integrity, and availability, though no public exploit identified at time of analysis and EPSS sits at 0.67% (47th percentile) indicating limited observed exploitation pressure so far.
Path traversal in Bludit 3.19.0's api/plugin.php endpoint allows remote attackers to escape the intended directory and access arbitrary files on the server via crafted requests. The CVSS 9.8 rating reflects unauthenticated network-based exploitation with high impact across confidentiality, integrity, and availability, and publicly available exploit code exists in a public gist, though EPSS remains low at 0.25%.
Information disclosure in Whoogle Search v1.2.3 lets remote unauthenticated attackers retrieve sensitive data by sending a crafted GET request to the application's configuration endpoint. The flaw carries a CVSS 7.5 (high, confidentiality-only) rating, and publicly available exploit code exists via a published gist, though it is not listed in CISA KEV and its EPSS exploitation probability is low (0.15%, 4th percentile).
Denial of service in Feuerhamster MailForm v1.1.0 allows remote unauthenticated attackers to exhaust server resources by sending a crafted request to the attachment handling component. The flaw aligns with CWE-400 (Uncontrolled Resource Consumption) and carries a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/A:H), with no public exploit identified at time of analysis and no inclusion in CISA KEV.
Server impersonation in OCaml-TLS before 2.1.0 allows a malicious TLS server to present a certificate not intended for server authentication and still be accepted by client code, enabling man-in-the-middle and impersonation attacks against any application linking the library as a TLS client. The client fails to validate KeyUsage and ExtendedKeyUsage extensions properly, breaking a core PKIX trust assumption. No public exploit identified at time of analysis and EPSS sits at 0.15% (4th percentile), but the CVSS 9.1 reflects the broad confidentiality and integrity impact on encrypted sessions.
Authentication bypass in OCaml-TLS server implementations before version 2.1.0 allows remote attackers to impersonate legitimate clients during mutual TLS authentication by presenting certificates whose KeyUsage and ExtendedKeyUsage extensions do not authorize client authentication. The server fails to enforce these X.509 certificate purpose constraints, so any valid certificate chain trusted by the server may be accepted regardless of intended use. EPSS probability is low (0.12%, 2nd percentile) and no public exploit identified at time of analysis, but the CVSS 9.1 reflects the high impact on confidentiality and integrity of mTLS-protected services.
SQL injection in Datadog Vector v0.54.0 reportedly lets remote attackers read sensitive database contents by injecting crafted SQL through the set_uri_query parameter processed in the KeyPartitioner::partition function (CWE-89). Publicly available exploit code exists (a GitHub gist), but the report is low-confidence: it is a MITRE-reserved record with placeholder vendor/CPE metadata and no vendor advisory, and a SQL-injection sink is architecturally unusual for Vector, which is an observability data-routing pipeline rather than a database application. EPSS is low (0.15%, 5th percentile) and the CVE is not in CISA KEV.
Local privilege escalation in Iru, Inc Kandji Agent versions prior to 4.7.5(5374) allows a local attacker to invoke restricted agent functionality by exploiting a client-side validation gap. The flaw maps to CWE-269 (Improper Privilege Management) and carries a CVSS 8.4 rating due to high impact on confidentiality, integrity, and availability, though no public exploit identified at time of analysis and EPSS is low at 0.14%.
Arbitrary file write in ocaml-tar before 3.4.0 lets remote attackers escape the intended extraction directory using '../' path segments embedded in archive member names. Unlike the standard tar(1) utility, which rejects such traversal, ocaml-tar decompresses the crafted entries anyway, writing files to attacker-chosen locations outside the target directory. There is publicly available exploit code exists per SSVC (POC), though EPSS remains low at 0.15% and it is not listed in CISA KEV.
OS command injection in the Tenda 5G03 5G router (firmware V05.03.02.04, hardware version 1.0) lets attackers inject arbitrary shell commands through the unsanitized dialNumber parameter of the action_dial_call handler. The reported CVSS 3.1 vector rates it 9.8 (network, no privileges, no user interaction) with total technical impact, and publicly available exploit code exists in the sezangel/IOT-vul repository, though there is no public exploit identified as weaponized and no CISA KEV listing. EPSS is modest at 0.45% (36th percentile), indicating the flaw is disclosed with a POC but not yet showing broad exploitation activity.
OS command injection in the Tenda 5G03 5G CPE router (firmware V05.03.02.04, hardware version 1.0) allows remote attackers to execute arbitrary shell commands by injecting metacharacters into the ims_apn parameter processed by the action_ims_on_with_apn function. Because the injected commands run with the router's elevated (typically root) web-server privileges, an attacker gains full control of the device. Publicly available exploit/proof-of-concept material exists in a third-party IoT vulnerability repository, though there is no public exploit identified as weaponized and the issue is not on the CISA KEV list; EPSS is low at 0.52%.
Remote code execution in Bludit CMS before 3.18.4 allows attackers with a valid API token to upload a malicious PHP script via the API plugin's /api/files/{key} endpoint. The vulnerability arises from missing authorization checks and lack of file extension validation, enabling arbitrary code execution on the server. A public proof-of-concept exists, but no active exploitation has been confirmed (not in CISA KEV) and EPSS score is low (0.21%).
Command injection in the Tenda 5G03 5G/LTE router (firmware V05.03.02.04, hardware version 1.0) allows remote attackers to inject arbitrary OS commands through the 'ia' parameter processed by the action_radio_on_with_ia_apn function. The flaw carries a 9.8 CVSS and, per its CVSS vector, is network-reachable without authentication or user interaction, giving full command execution on the device. There is publicly available exploit code (a public PoC/write-up on GitHub), though EPSS remains modest at 0.45% and there is no evidence of active exploitation.
OS command injection in the Tenda 5G03 5G CPE router (firmware V05.03.02.04) lets remote attackers inject arbitrary system commands through the ratMode parameter of the action_set_rat_mode function. Because the CVSS vector rates the flaw as network-reachable with no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), an attacker who can reach the device's web interface gains full command execution on the underlying firmware. A public technical write-up/PoC exists on GitHub, though EPSS remains modest at 0.45% and there is no evidence of active exploitation.
Authentication bypass in ThingsBoard IoT platform v4.3.0.1 lets a remote, unauthenticated attacker take over any account by tampering with the user-supplied 'user' JSON parameter during the OAuth2 authorization-code exchange at /login/oauth2/code/. Because the application trusts the attacker-controlled email in that object, swapping it for a victim's address yields a fully authenticated session with no credentials required. Publicly available exploit code exists (a POC gist), SSVC rates it automatable with total technical impact, but EPSS is low at 0.23% (14th percentile) and it is not on CISA KEV.
Authenticated SQL injection in OpenSIPS Control Panel (opensips-cp) versions prior to 9.3.3 allows attackers with valid panel credentials to execute arbitrary SQL via the 'table' GET parameter in alias_management.php using time-based blind techniques. The flaw resides in the alias_management module and yields full database confidentiality, integrity, and availability impact per CVSS 8.8. No public exploit identified at time of analysis, and EPSS is low (0.28%, 19th percentile), but a third-party advisory documents the issue on GitHub.
Local privilege escalation in Microvirt MEmu Android Emulator 9.2.7.0 allows a low-privileged local user to abuse the MemuService.exe component to gain elevated rights on the host Windows system. Mapped to CWE-269 (Improper Privilege Management), with no public exploit identified at time of analysis and an EPSS score of 0.21% indicating low predicted exploitation likelihood. Researcher PoC repository exists on GitHub (sec-zone/CVE-2026-36213) but active exploitation has not been reported.
Command injection in the Tenda 5G03 5G CPE router (firmware V05.03.02.04) lets remote unauthenticated attackers inject arbitrary OS commands through the pin parameter handled by the action_unlock_sim function. The flaw carries a critical 9.8 CVSS and gives total control over the device, and a public write-up/exploit exists in a third-party IoT vulnerability repository, though it is not listed in CISA KEV. EPSS is modest at 0.45% (36th percentile), indicating no observed mass exploitation yet.
Remote code execution affects remotion-dev's Remotion framework at version 4.0.409, enabling attackers to execute arbitrary code on systems running the affected version per CWE-94 code injection semantics. The CVSS 9.8 vector indicates network-reachable, unauthenticated exploitation without user interaction, though no public exploit identified at time of analysis and EPSS probability remains low at 0.25% (16th percentile). The vulnerability is reported by MITRE with a third-party advisory on GitHub but lacks detailed exploitation specifics.
Arbitrary file write in remotion-dev Remotion v4.0.409 allows remote attackers to write attacker-controlled content to arbitrary filesystem locations without authentication, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) and CWE-123 (Write-what-where) classification. Remotion is a React-based programmatic video rendering framework, and the flaw can lead to integrity and availability compromise of the host running the rendering engine. No public exploit identified at time of analysis, and the EPSS score of 0.15% (4th percentile) indicates low predicted exploitation likelihood despite the high CVSS score.
OS command injection in the Tenda 5G03 5G CPE router (firmware V05.03.02.04) lets an attacker inject shell commands through the volume parameter of the action_set_volume handler, yielding full command execution on the device. Per the published CVSS vector the flaw is remotely reachable without authentication or user interaction, and publicly available exploit code exists (a proof-of-concept in the sezangel/IOT-vul research repository); it is not listed in CISA KEV and carries a modest EPSS of 0.45% (36th percentile), indicating no confirmed active exploitation yet. SSVC rates technical impact as total and the flaw as automatable, so successful exploitation gives complete control of the router.
SQL injection in RuoYi v4.8.2 lets an administrative user abuse the /tool/gen/createTable endpoint of the code-generation module to inject arbitrary SQL and read sensitive database contents. The advisory (CWE-89) and a public proof-of-concept on GitHub confirm the flaw, though it is not listed in CISA KEV and carries a low EPSS score of 0.28%. Note a data conflict: the description states administrative privileges are required, yet the supplied CVSS vector marks it PR:N (unauthenticated).
Remote code execution in SNMP4J-Agent 3.8.3 is enabled through the snmp4jCfgStoragePath component, allowing remote attackers to run arbitrary code on hosts running the agent. The CWE-73 (External Control of File Name or Path) classification indicates the storage path parameter can be manipulated to influence file operations, and no public exploit identified at time of analysis though a third-party advisory has been published on GitHub. EPSS is low at 0.21% (11th percentile) despite the 9.8 CVSS, suggesting limited current exploitation activity.
Privilege escalation in Filestash v0.4.0 lets a low-privileged authenticated user reach the administrative /admin/api/config endpoint by sending a crafted request, because that endpoint fails to enforce proper access control (CWE-284). An attacker who already holds a limited session can read and rewrite the server's global configuration, effectively gaining admin control. SSVC rates technical impact as total; publicly available exploit code exists (a proof-of-concept gist), but there is no evidence of active exploitation and EPSS is low at 0.18% (8th percentile).
Server-side request forgery in Shlink v5.0.1's automatic short URL title resolution allows remote unauthenticated attackers to probe internal network resources by submitting a crafted longUrl value. The flaw carries a CVSS 9.1 rating reflecting high confidentiality and integrity impact, though EPSS exploitation probability remains low at 0.15% and there is no public exploit identified at time of analysis beyond a referenced gist. Shlink is a self-hosted URL shortener, making this a meaningful pivot point for attackers targeting internal infrastructure behind the shortener host.
Server-Side Request Forgery in Koillection 1.8.0's custom scraper subsystem lets an authenticated user supply a crafted URL that the application fetches server-side, enabling reconnaissance and access to internal-only resources otherwise unreachable from the internet. The CVSS vector requires low privileges (PR:L), so an ordinary logged-in account is sufficient, and the flaw yields high confidentiality and integrity impact (C:H/I:H). Publicly available exploit code exists via a referenced gist, though there is no public exploit identified as being used in active attacks and EPSS probability is low at 0.15%.
Denial of service in LLDAP v0.6.2 allows remote unauthenticated attackers to disrupt the authentication service by sending a crafted refresh-token header to the HTTP refresh endpoint. The flaw is a CWE-400 resource handling defect with CVSS 7.5 (availability-only impact); no public exploit is identified, though a referenced gist may contain proof-of-concept material. EPSS is low at 0.18% (8th percentile) and the issue is not on CISA KEV.
Information disclosure in Observe (the Observeinc observability/log-analytics platform) versions dated 2026-01-28 and earlier allows remote attackers to obtain sensitive data through the CSV Log export component. Rated CVSS 7.5 with a high-confidentiality, no-integrity/availability impact, the flaw exposes log contents that may include secrets, PII, or operational telemetry. Publicly available exploit code exists (SSVC 'poc') and CISA's SSVC framework marks it automatable, though EPSS remains very low at 0.18% (8th percentile) and it is not on the CISA KEV list.
Server-Side Request Forgery in Project Firefly III v6.5.9 allows remote attackers to scan internal network resources by abusing improper access controls in the webhook management component via crafted POST requests. SSVC indicates a proof-of-concept exists and exploitation is automatable with total technical impact, though EPSS remains low (0.15%) and no public exploit identified at time of analysis beyond a referenced gist. The flaw is unauthenticated per the CVSS vector (PR:N) and provides a pivot point into otherwise unreachable internal services.
SQL injection in Bernd Bestel grocy v4.6.0 lets remote attackers extract sensitive database contents by injecting a crafted SQL statement through the product-group parameter of the /stockreports/spendings endpoint. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) and SSVC rates technical impact as total with automatable exploitation, though EPSS remains low at 0.15%; publicly available exploit code exists via a published gist, but there is no public exploit identified as actively exploited (not in CISA KEV).
Denial of service in Tenda W3 Wireless Router firmware v1.0.0.3(2204) allows unauthenticated remote attackers to crash the device by sending crafted HTTP requests with oversized username or password parameters that overflow stack buffers in the R7WebsSecurityHandler function. The flaw affects the router's web management interface and carries a CVSS 7.5 (availability-only impact); no public exploit identified at time of analysis and EPSS exploitation probability is very low at 0.01%.
Denial of service in Tenda G0 router firmware v15.11.0.5 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request with an oversized picCropName parameter to the formCropAndSetWewifiPic handler. The flaw is a classic stack buffer overflow in the web management interface, and while no public weaponized exploit is identified, proof-of-concept research artifacts are published on GitHub. EPSS scores exploitation probability at just 0.01%, reflecting limited attacker interest despite trivial reachability.
Denial of service in Tenda W3 Wireless Router firmware v1.0.0.3(2204) allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request containing a malicious wl_radio parameter to the formWifiRadioSet function. EPSS scoring (0.01%, 2nd percentile) indicates very low real-world exploitation probability, and no public exploit identified at time of analysis beyond a research repository referencing the vulnerable function.
Denial of service in Tenda O3v3 firmware v1.0.0.5 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a stack buffer overflow in the formSetCfm handler. No public exploit identified at time of analysis, and EPSS is very low (0.01%), but the network-reachable, no-authentication attack surface on a CPE/router device makes this relevant for exposed deployments.
Denial of service in Tenda G0 router firmware v15.11.0.5 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that overflows the portalAuth parameter handled by the formPortalAuth function. No public exploit is identified at time of analysis and EPSS exploitation probability is very low (0.01%), but a public proof-of-concept research repository on GitHub references the vulnerable function.
Denial of service in the Tenda O3 Wireless Router (firmware v1.0.0.5(4180)) allows unauthenticated remote attackers to crash the device by sending a crafted HTTP request that triggers a stack-based buffer overflow in the ip parameter of the fromNetToolGet function. Publicly available exploit code exists in a GitHub research repository, though EPSS rates exploitation probability at only 0.02% and the issue is not on CISA KEV. Impact is limited to availability (the CVSS A:H, C:N, I:N profile), making this primarily a device-crash bug rather than a code-execution vector based on the reported analysis.
Denial of service in Tenda W3 Wireless Router firmware v1.0.0.3(2204) allows remote unauthenticated attackers to crash the device by sending crafted HTTP requests that trigger stack-based buffer overflows in the formwrlSSIDset handler. The flaw is reachable without authentication or user interaction (CVSS 7.5, AV:N/AC:L/PR:N), but EPSS is only 0.01% and no public exploit identified at time of analysis suggests low near-term mass-exploitation likelihood despite the trivial attack surface.
Denial of service in Tenda O3 Wireless Router firmware v1.0.0.5(4180) allows remote unauthenticated attackers to crash the device by sending crafted HTTP requests that trigger stack buffer overflows in the fromVirtualSer function. Five distinct overflow sinks (puVar2, puVar1, __s2, __s1_00, puVar3) are reachable via the same handler. No public exploit identified at time of analysis, and EPSS rates exploitation likelihood at 0.01%, but a research repository with vulnerability artifacts is referenced.
Denial of service in Tenda G0 router firmware v15.11.0.5 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a buffer overflow in the IPMacBindIndex parameter handler of the formIPMacBindDel function. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.01%, 2nd percentile), but the network-reachable, no-auth attack surface on an edge networking device warrants attention from operators of affected hardware.
Denial-of-service via stack buffer overflow affects the Tenda O3 wireless router firmware v1.0.0.5(4180), where the fromNetToolGet handler fails to bound-check the domain parameter supplied in HTTP requests. Remote attackers can crash the router's web management service by sending a crafted request, disrupting network connectivity for downstream clients. SSVC flags the issue as proof-of-concept with automatable exploitation and partial technical impact, though EPSS remains low at 0.01% and no in-the-wild exploitation has been confirmed.
Remote code execution and denial-of-service in bitbank2 AnimatedGIF v2.2.0 arises from a buffer overflow in the DecodeLZW function when processing a crafted GIF file. SSVC data indicates a proof-of-concept exists and exploitation is automatable, though it is not listed in CISA KEV; with CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) the vulnerability is network-reachable wherever this library decodes attacker-supplied GIFs.
Denial of service in Tenda W20E router firmware v15.11.0.6 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a stack-based buffer overflow in the webAuthWhiteUserInfo parameter of the formAddWebAuthWhiteUser function. No public exploit identified at time of analysis, though a research repository documenting the flaw is referenced. The CVSS 7.5 (High) score reflects pure availability impact with no confidentiality or integrity loss.
Denial of service in Tenda W20E router firmware v15.11.0.6 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a stack-based buffer overflow in the picCropName parameter of the formCropAndSetWewifiPic function. No public exploit identified at time of analysis, though a research write-up referencing the vulnerable function exists in a public GitHub repository. The combination of network-reachable attack surface, no authentication requirement, and low complexity makes opportunistic abuse against exposed admin interfaces realistic.
Denial of service in Tenda W20E router firmware v15.11.0.6 allows unauthenticated remote attackers to crash the device by sending a crafted HTTP request containing an oversized macAddr parameter to the formDelStaState handler. The flaw is a stack-based buffer overflow with high availability impact and no confidentiality/integrity loss per CVSS, and no public exploit identified at time of analysis beyond a research repository on GitHub.
Denial of service in Tenda W20E router firmware v15.11.0.6 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a stack buffer overflow in the webAuthUserInfo parameter of the formAddWebAuthUser function. No public exploit identified at time of analysis, though a researcher-published proof-of-concept repository on GitHub documents the issue. EPSS and KEV data are not provided, but the network-reachable, no-auth, no-interaction CVSS vector makes this a credible risk for any exposed management interface.