Vulnerabilities

Kubero, a self-hosted PaaS for deploying applications on Kubernetes, fails to enforce authentication on its notifications API endpoints through version 3.1.1 (CWE-306). Any unauthenticated attacker with network access to the Kubero API can call these endpoints directly, with no privileges or user interaction required (CVSS 4.0: 9.3 critical, AV:N/PR:N). An attacker can read stored webhook secrets and service URLs, harvest credentials for connected notification services, register malicious webhooks to intercept pipeline event data, or delete existing webhook configurations to suppress alerting. All deployments running Kubero up to and including 3.1.1 are affected, especially those with the API reachable from untrusted networks. There is currently no known public proof-of-concept, the issue is not listed in CISA's KEV, and exploitation has not been observed in the wild.

Do: Upgrade Kubero to the latest patched release once available (the flaw affects everything through 3.1.1) and restrict network access to the Kubero API/dashboard port via firewall rules, VPN, or an authenticating reverse proxy. Rotate any webhook secrets and service credentials that were configured in Kubero's notification integrations, and audit the notifications configuration for unrecognized webhooks or deleted alerting entries that could indicate compromise.

Quickwit through 0.9.0 is vulnerable to server-side request forgery (CWE-918) because it does not validate the host or scheme of the queue_url parameter used by SQS file sources. An attacker who can reach the create-source API submits a malicious queue_url, causing the Quickwit node to issue requests to arbitrary attacker-chosen internal addresses; the CVSS 4.0 score of 8.7 reflects network exploitation with no privileges or user interaction required. By observing connection response differences (success, failure, timing, error messages), the attacker can scan internal networks and fingerprint internal services, potentially including sensitive targets such as cloud metadata endpoints. Any Quickwit deployment running version 0.9.0 or earlier whose REST API is reachable by untrusted clients is affected, particularly self-hosted clusters exposed beyond trusted networks. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known.

Do: Restrict access to the Quickwit REST API (default port 7280) to trusted networks and enforce authentication, and audit existing sources for queue_url values pointing at unexpected hosts or schemes. Where possible, block Quickwit node egress to cloud metadata services (e.g., 169.254.169.254) and internal RFC1918 ranges. No fixed release beyond 0.9.0 is identified in the available data, so upgrade to a patched version once published and treat the create-source API as untrusted input until then.

Nuclei, the open-source template-based vulnerability scanner from ProjectDiscovery, caches the result of template code-signature verification keyed only on a file's modification time, with no content checksum involved. An attacker with local write access to the templates directory can replace a previously verified template with unsigned malicious content and restore the original modification timestamp, causing the cached 'verified' state to be reused for the tampered file. When a user then runs a scan using that template, Nuclei executes it, giving the attacker arbitrary operating-system command execution with the privileges of the user running the scanner. All users running Nuclei versions prior to 3.11.1 are affected. No public proof-of-concept is known, the issue is not listed in CISA KEV, and there is no confirmed exploitation to date.

Do: Upgrade to Nuclei 3.11.1 or later, which adds content checksums to the signature verification cache. Restrict write permissions on the templates directory, and audit it for templates whose contents do not match their signature or whose modification timestamps appear artificially preserved (e.g., via timestamp-restoring copies or touch). Users who cannot upgrade immediately should re-download templates from the official repository before running scans.

Covenant through version 0.6 registers its CovenantHub SignalR hub without an Authorize attribute, so any unauthenticated caller who can reach the Covenant web interface can invoke CreateHttpListener and receive a signed JWT token. With that token, the attacker authenticates as an operator against the full Covenant API and can access grunts (implants), captured credentials, binaries, tasking events, and the operator roster. Any team running Covenant 0.6 or earlier is affected, especially where the Covenant web/API port is reachable beyond localhost. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is currently known, although the flaw requires no authentication or user interaction and is trivially reachable where the interface is exposed.

Do: Restrict access to the Covenant web/API and SignalR ports to trusted management networks or a VPN, and apply an upstream fix adding the Authorize attribute to CovenantHub as soon as a patched release is available. Organizations that ran Covenant on internet-reachable hosts should assume operator API compromise: rotate the JWT signing key and any credentials stored in the Covenant database, and audit API logs for unauthenticated hub connections or unknown operator activity.

Shuffle through version 2.2.1 contains a cross-tenant privilege escalation flaw (CWE-639, authorization bypass via user-controlled key) in its HandleApiGeneration endpoint. An attacker who holds administrator privileges in one organization can supply arbitrary user IDs belonging to non-administrator users in different organizations; the endpoint fails to verify that the targeted user belongs to the caller's tenant and generates valid API keys for those accounts. This effectively lets a tenant admin reset and read other users' API keys, enabling account takeover across tenant boundaries on a shared instance. Any Shuffle deployment at version 2.2.1 or earlier that hosts multiple organizations is affected; exploitation requires network access to the instance and an organization-admin account. No exploitation has been reported: the flaw is not in CISA KEV and no public proof-of-concept is known.

Do: Upgrade Shuffle to the newest available release and monitor the vendor for a patched version above 2.2.1, since all versions through 2.2.1 are vulnerable. In the interim, keep Shuffle instances off the public internet, minimize the number of organization-admin accounts, and review logs of the HandleApiGeneration endpoint for API-key generation requests referencing user IDs outside the admin's own organization.

IRIS, an open-source incident-response case-management platform, fails through version 2.4.29 to enforce case-level authorization on the comment-listing endpoints for notes, tasks, IOCs, assets, and evidence items (CWE-639, broken object-level authorization). An authenticated user who has legitimate access to any single case can iterate over sequential object identifiers and retrieve comment threads from cases they are not authorized to see, on the same instance. The impact is confidentiality-only (high), but the data exposed can include sensitive investigation details from other clients' or other teams' cases, and the attack requires only a low-privileged account via the network with no user interaction (CVSS 4.0 score 7.1, high). All deployments of IRIS up to and including 2.4.29 are affected, which in practice means self-hosted instances operated by CERTs, CSIRTs, and security teams. No exploitation in the wild, KEV listing, or public proof-of-concept is currently known.

Do: Upgrade to the latest IRIS release (anything beyond 2.4.29, i.e., the first patched build once published) as the primary fix, since no vendor-side mitigation short of patching is described. In the meantime, restrict case membership to vetted staff, limit API access to trusted accounts, and review access logs for authenticated users requesting comment endpoints across many sequential object IDs, which would indicate enumeration. Note that no fix version is confirmed in the available data, so verify the vendor's advisory for the patched release.

Scirius through 3.8.0 contains an arbitrary file write flaw (CWE-22) in its PCAP filestore upload endpoint. An authenticated attacker holding only the default User role can embed path traversal sequences in an uploaded document's _id field, causing the server to escape the intended storage directory. The attacker-controlled JSON content is then written with a .json extension to arbitrary filesystem locations, and the write occurs with root privileges, giving the attacker high integrity and availability impact on the host (CVSS 4.0: 7.2 High, network-vector, low privileges required). Any organization running Scirius 3.8.0 or earlier, typically deployed to manage Suricata rulesets in SELKS or Stamus NSM environments, is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and no exploitation has been reported to date.

Do: Upgrade Scirius to a release newer than 3.8.0 as soon as a patched version is available from Stamus Networks. Until then, restrict User-role accounts in the Scirius UI to trusted operators, keep the console off the public internet, and audit the filesystem for unexpected .json files outside the PCAP filestore directory (especially in cron, systemd, or application config paths) to detect potential abuse.

A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smf_n4_handle_session_report_request of the file src/smf/n4-handler.c of the component PFCP Session Report Request Handler. The manipulation leads to reachable assertion. The attack may be initiated remotely. The identifier of the patch is e5f0c06d0f2d9613b003daa1cfa3ba8a4bd157e9. It is suggested to install a patch to address this issue.

A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the file pdf-stream.c of the component PDF Xref Loading. Executing a manipulation can lead to null pointer dereference. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e. Applying a patch is advised to resolve this issue.

A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted element is an unknown function of the file /admins/assessments/databank/btn_functions.php?action=add. Performing a manipulation of the argument difficulty_id results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and the templates insert these values into raw JavaScript contexts.

Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly revoked, and deactivating a user did not revoke that user's outstanding tokens. As a result, a deactivated user retained full access to /ccm/api/1.0/* for the remaining lifetime of any token already issued to them. The same gap applied to accounts that had been deleted or locked pending a forced password reset. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Myq Larson for reporting.

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.video.video_backend to pynvvideocodec, and MediaConnector.fetch_video forwards that choice to VideoMediaIO even when startup configuration selected a software decoder. The engine's _reserve_mm_ipc_gpu_memory logic budgets decoder memory only from static configuration, so the request-selected VIDEO_LOADER_REGISTRY backend can create a CUDA context, decoder surfaces, and decoded-frame allocations that were not removed from the engine's KV-cache budget. An attacker able to submit video requests to a video-capable GPU deployment with PyNvVideoCodec installed can exhaust shared GPU memory, causing request failures, worker crashes, or denial of service. The first release containing the fix is version 0.28.0.

Sogou Input Method, one of China's most widely used keyboard input tools (owned by Tencent), contains a remote code execution flaw in its biz_helper.exe component in versions before 16.3.0.3498. Based on reporting, the flaw is a 'one-click' RCE: an attacker crafts a malicious link that, when clicked by the victim, triggers the vulnerable component to execute attacker-controlled code. Successful exploitation gives the attacker arbitrary code execution in the context of the component, and has been used in the wild to deploy a backdoor tracked as GRAYRABBIT. All users running Sogou Input Method prior to 16.3.0.3498 are potentially affected, with attacks attributed to China-linked threat actors. Exploitation is confirmed in the wild and a public proof-of-concept is available, though the CVE is not yet in CISA KEV and has no CVSS score.

Do: Update Sogou Input Method to version 16.3.0.3498 or later immediately, prioritizing endpoints used by at-risk users given confirmed in-the-wild exploitation. Investigate hosts for signs of GRAYRABBIT backdoor activity and unusual biz_helper.exe behavior or child process spawns, and warn users against clicking unsolicited links. Since no CVSS score or KEV listing exists yet, treat this as a critical RCE based on active exploitation and the public proof-of-concept on GitHub.

SIMAC MyPHR 1.1 is vulnerable to an insecure direct object reference (IDOR, CWE-639) because the employee update endpoint does not validate server-side that the authenticated user owns the record being modified. Any authenticated user can send a PUT request to that endpoint with an arbitrary employee identifier and a password value they control, allowing them to change other employees' passwords and take over their accounts. The same flaw also permits enumeration of employee records and retrieval of sensitive personally identifiable information, including private pay bulletins. Organizations running SIMAC MyPHR 1.1 with multiple employee accounts are affected, with a low barrier to exploitation (network-accessible, low privileges, no user interaction per the 8.7 CVSS 4.0 score). No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time.

Do: Contact the vendor for a patched release or an official fix, since no fixed version is stated in the available data. As an interim measure, audit application logs for PUT requests to the employee update endpoint referencing employee IDs other than the requester's own, and reset credentials for any accounts whose passwords may have been changed unexpectedly. Ensure employee accounts use strong, unique passwords to limit the impact of account takeover until server-side ownership validation is fixed.

Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries() permission check applied by the normal dashboard and CSV Export flow. An unauthenticated visitor who knew or discovered an Express entity identifier could enumerate that entity's entry search results, disclosing attribute values intended to be restricted to privileged users. For Express entities that do not support entry-specific permissions (i.e., supportsEntrySpecificPermissions() returns false), per-entry permission filtering is additionally disabled via EntryList::ignorePermissions(). The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Daniel Powell for reporting.

ContiNew Admin through 4.1.0 contains an authorization bypass (CWE-639) in its personal message delete endpoint: the server fails to verify that the requesting user owns the targeted message rows. An authenticated low-privileged user can supply arbitrary message identifiers in the IdsReq parameter to delete any other user's messages and announcements, and to purge all recipients' read receipts in a single request. The impact is a loss of message integrity (high integrity per the CVSS 4.0 score of 7.1) rather than confidentiality or availability. Any deployment of ContiNew Admin up to and including 4.1.0 that exposes the messaging module to ordinary authenticated accounts is affected. No public proof-of-concept is known, the issue is not listed in CISA KEV, and no exploitation has been reported.

Do: Upgrade to a ContiNew Admin release newer than 4.1.0 once the vendor publishes a patched build, as no fixed version is confirmed in the current data. As an interim mitigation, restrict the message-delete endpoint to administrative roles and enforce server-side ownership validation of message IDs. Audit application logs for delete requests where the IdsReq identifiers reference messages owned by other users.

TDuck survey form through version 5.3 contains a server-side request forgery and broken-access-control flaw (CWE-918) in its WebhookConfigController, which neither validates the webhook URL supplied nor verifies that the requesting user owns the target form. An authenticated attacker with a low-privilege account can attach a webhook pointing to an arbitrary external or internal address to another user's form. When victims then submit that form, their submission data is pushed to the attacker-controlled URL, enabling data exfiltration, and the server can be made to send requests to internal network addresses. Any organization running a TDuck deployment at version 5.3 or earlier, particularly multi-user deployments, is affected. No public proof-of-concept, CISA KEV listing, or confirmed exploitation has been reported as of this analysis.

Do: Upgrade TDuck to a patched release as soon as the vendor publishes one (no fixed version is specified in the available data), and in the meantime restrict which authenticated roles can create or modify webhooks. Audit existing webhook configurations for entries on forms you did not create, apply egress filtering so the TDuck server cannot reach unexpected internal or external hosts, and remove or disable the webhook feature for untrusted users until the ownership check is fixed.

Guns, an open-source Java admin/management platform, is affected by an improper access control flaw (CWE-862) in its SysNoticeController, where the requiredPermission flag defaults to false and is never overridden by any action method. Any user who can authenticate to the application — even without any role assigned — can therefore invoke the notice endpoints to create, edit, delete, publish, and retract system-wide notices directed at arbitrary users and departments. An attacker gains integrity-level control over the internal notice/messaging system, which could be abused to push fake announcements to an entire organization (e.g., for internal phishing) or to silently remove or alter legitimate communications, though CVSS indicates no confidentiality impact. All deployments running Guns version 8.3.5 or earlier are affected. No public proof-of-concept is known, the issue is not in CISA KEV, and exploitation has not been observed in the wild.

Do: Upgrade Guns to a release newer than 8.3.5 as soon as a patched version is published, since no fix is confirmed in the current data. In the interim, restrict network access to the Guns admin console to trusted users/networks, review accounts able to authenticate without assigned roles, and audit the notice records/logs (sys_notice) for unauthorized creations, edits, deletions, publishes, or retractions. Administrators who build from source should consider enforcing an explicit permission check on the SysNoticeController endpoints.

The Guns administration platform through version 8.3.5 contains a missing-authorization flaw (CWE-862) in SysUserController: the /sysUser/detail and /sysUser/page endpoints lack the requiredPermission configuration, so the platform's permission interceptor skips RBAC validation entirely for these routes. Any remote attacker holding any valid login token — regardless of assigned role — can call these endpoints and retrieve account names, real names, email addresses, phone numbers, last login IPs, and role assignments for every user in the system. This effectively discloses the full user directory of the console, which is valuable for phishing, social engineering, and reconnaissance toward privilege escalation. All deployments of Guns up to and including 8.3.5 are affected, with risk concentrated in systems exposed beyond the local network. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is currently known.

Do: Upgrade Guns to the latest release beyond 8.3.5 as soon as a patched version is available, since the fixed version is not specified in current disclosures. As an interim mitigation, restrict or block access to /sysUser/detail and /sysUser/page at the gateway/WAF for non-administrator roles, or add the missing requiredPermission annotations on those endpoints. Review access logs for calls to these endpoints by low-privilege accounts to detect prior abuse.

A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. The affected element is an unknown function of the file /index.php. Such manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the function index of the file UserController.java of the component top.upstudy.crm.controller.UserController. The manipulation results in missing authorization. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects the function top.upstudy.crm.utils.LoginUserUtil.releaseUserIdFromCookie. The manipulation leads to improper authentication. The attack can be initiated remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame of the file src/utils/rmt_ws.c of the component WebSocket Handler. Executing a manipulation of the argument payload_size can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.26 is able to mitigate this issue. This patch is called 37bccbb30cf53a0e1a084cea9a1ce422b3ddfe12. Upgrading the affected component is recommended.

The Ruijie RG-EW3000GX Wi-Fi router running firmware EW_3.0(1)B11P380 contains an OS command injection flaw (CWE-77/CWE-78) in the user_list_note module, which handles the file /etc/rg_config/admin. A remote attacker who already holds administrative privileges manipulates the 'Name' argument, causing injected commands to be executed on the router's operating system; the CVSS 4.0 vector (PR:H) confirms admin-level access is required, so this is not an unauthenticated bug. Successful exploitation yields full command execution on the device, with confidentiality, integrity and availability impacts rated high for both the router and subsequent (downstream) systems, effectively letting an attacker take over the gateway and pivot into the network behind it. Only the RG-EW3000GX on build EW_3.0(1)B11P380 is confirmed affected; other firmware builds or EW-series models are not ruled out but are not documented in the advisory. The advisory states the exploit has been made public and could be used, though no standalone PoC is catalogued in this listing and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog.

Do: Upgrade the RG-EW3000GX to a firmware release newer than EW_3.0(1)B11P380 as soon as Ruijie publishes a fix (no fixed version is named in the advisory); until then, disable WAN-side/remote administration and restrict the management interface to trusted LAN clients or management allowlists. Rotate administrative credentials and audit the admin/user list configuration (the user_list_note module and /etc/rg_config/admin data) for unauthorized accounts, since that is the component under attack. Because exploitation requires admin-level privileges, exposed management ports combined with weak or reused passwords are the main risk multipliers — prioritize internet-reachable devices.

n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Controller/Users.php) did not perform a permission check before creating an account. As a result, any valid OAuth token carrying the users:add scope, including a client_credentials token with no associated user context, could create active, validated user accounts, bypassing email verification and administrator approval. Under default registration settings the created accounts could then edit page content, providing a path to stored cross-site scripting and further compromise. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating page-backed summary content. As a result, an authenticated user holding edit-board-contents permission on a single board instance could submit the identifier of an item belonging to a different board instance and receive summary fields, including the page title and description, of an underlying page the same user was otherwise forbidden to view. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Pakung for reporting.

Dell Repository Manager (DRM) versions prior to 3.5.2 ship with incorrect default permissions (CWE-276) on files or components of the application, leaving them writable or usable by accounts that should not have that level of access. A low-privileged attacker who already has some form of remote access to the system running DRM could leverage these misconfigured permissions to elevate privileges, a path reflected in the high-severity CVSS score of 8.5 with network attack vector, high attack complexity, and a changed scope indicating impact beyond the vulnerable component itself. Successful exploitation could yield high confidentiality, integrity, and availability impact on the host and potentially related resources. Organizations are affected if they run affected DRM versions, typically on administrator workstations or management servers used to build and host Dell update repositories. Exploitation status: this flaw is not listed in CISA's KEV catalog, no public proof-of-concept is known, and there are no reports of in-the-wild exploitation.

Do: Upgrade to Dell Repository Manager 3.5.2 or later, which corrects the default permissions. In the meantime, restrict network and local access to hosts running DRM to trusted administrative users, and audit permissions on DRM installation directories, services, and scheduled tasks for overly permissive settings. Since exploitation requires a low-privileged foothold with remote access, prioritize patching hosts reachable from broader networks or shared user environments.

Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote execution.

SSH.NET, a widely used Secure Shell library for .NET, is vulnerable to command injection (CWE-78) in its ScpClient, which places caller-supplied remote paths directly into the scp command executed on the server. When an application passes an attacker-controlled remote path to a shell-based SSH server, shell metacharacters not neutralized by the active IRemotePathTransformation (including the default DoubleQuote transformation) are interpreted by the remote shell, allowing an authenticated attacker to execute arbitrary commands with the privileges of the SSH user. Exploitation requires valid low-privilege SSH credentials, a shell-based server, and a path crafted for that shell's parsing rules, so attack complexity is high; non-shell servers and applications using SftpClient (which avoids the remote shell entirely) are not affected. Any application built on SSH.NET prior to 2026.0.0 that uses ScpClient with attacker-influenced remote paths is affected. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not on CISA's KEV list.

Do: Upgrade to SSH.NET 2026.0.0. Where an immediate upgrade is not possible, switch from ScpClient to SftpClient (which avoids the remote shell entirely) or use RemotePathTransformation.ShellQuote for POSIX shell servers, and audit code for attacker-controlled remote paths passed to ScpClient.

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim's network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2.

oras-go, a Go library for managing OCI artifacts, contains a path traversal flaw (CWE-22, CWE-59) in its content/file.Store code: when extracting OCI layers annotated with io.deis.oras.content.unpack=true, symlink targets are validated only lexically and writeFile follows a terminal symlink when opening a regular file, allowing a crafted archive to escape the store working directory even when AllowPathTraversalOnWrite is false. Attackers trigger it by getting a user, developer, or CI pipeline to pull an attacker-controlled artifact through the vulnerable extraction path. The result is creation or overwrite of any file writable by the pulling process, which can lead to code execution via overwriting scripts, configuration, or other executable content. Any application, CLI, or service that embeds oras-go prior to version 2.6.2 and unpacks artifacts from untrusted or compromised registries is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known.

Do: Upgrade oras-go to version 2.6.2 and rebuild any tooling that embeds it; check dependency manifests for github.com/opencontainers/oras-go to identify affected builds. Until patched, avoid pulling or unpacking OCI artifacts from untrusted registries, and on systems where such pulls run, audit for unexpected file creation or modification by the pulling process.

Concrete CMS before 9.5.4 failed to sanitize XML and XSLT files submitted through a public Form Block file-upload question, validating uploads by file extension only and storing them as publicly accessible files served inline from the site's own origin. An unauthenticated visitor could upload an XML document containing an xml-stylesheet processing instruction that referenced an attacker-supplied, same-origin XSLT stylesheet; when a victim opened the stored XML directly, the browser applied the stylesheet and executed attacker-controlled JavaScript in the Concrete CMS origin, resulting in stored cross-site scripting. If the victim was an authenticated administrator, the script could act with that administrator's session, and the reporter demonstrated creation of a new user in the Administrators group. Any Concrete CMS deployment running a version before 9.5.4 that exposes a public form with a file-upload question is affected. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not listed in CISA KEV.

Do: Upgrade to Concrete CMS 9.5.4 or later. As interim mitigation, remove or restrict file-upload questions in public Form Blocks so XML/XSLT files cannot be uploaded, or serve uploads with attachment disposition and nosniff headers. Review the file manager for unexpected .xml/.xslt uploads and audit the Administrators group for unauthorized users.

Concrete CMS versions below 9.5.4 fail to validate the user timezone value (uTimezone) on write and render it without output encoding on the Dashboard user management page, since Date::getTimezoneDisplayName() passes through any non-IANA value unchanged, enabling stored cross-site scripting. An attacker stores a script payload in the timezone field, and it executes in an administrator's browser when the admin views that user in the Dashboard, running in the admin session. With admin-level script execution, the attacker can read CSRF tokens, create administrator accounts, or change site settings. All versions below 9.5.4 are affected if the concrete.misc.user_timezones setting is enabled (off by default); in 9.5.3 the field is reachable by unauthenticated visitors when public registration is enabled, while in versions below 9.5.3 it is reachable by any authenticated user through the account profile editor. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not listed in CISA's KEV.

Do: Upgrade to Concrete CMS 9.5.4 or later. As interim mitigation, disable concrete.misc.user_timezones (and public registration if you rely on the 9.5.3 path), and audit existing user records for suspicious timezone values plus the Dashboard for unexpectedly created administrator accounts or changed site settings.

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to 6.6.16 and 7.1.7, the shared SQL layer validates the field key of an orderBy clause but does not validate its direction value before AbstractSqlPlatform.getOrderByExpression concatenates it into an ORDER BY clause. Applications that bind attacker-controlled request data to the direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject() can permit a raw SQL fragment that performs blind or boolean extraction of data available to the database account. The BaseMySqlPlatform and MsSqlPlatform fallthrough paths have the same behavior, affecting SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, and Oracle drivers, while MongoDB is not affected. This issue is fixed in versions 6.6.16 and 7.1.7.

CVE-2026-76420 is an improper authorization flaw (CWE-285) in the internal configuration of the Apache JServ Protocol (AJP) connector in Cisco Secure FMC Software, caused by incorrect initialization of the connector's encryption parameters at boot time. An unauthenticated remote attacker can trigger it by sending crafted packets to the AJP connector, but only while the valid sftunnel connection between the FMC and its managed Cisco Secure FTD devices is down — allowing the attacker to impersonate a peer device. A successful exploit yields command execution as root and full control of the FMC REST APIs, giving complete compromise of the management center and, by extension, the firewall policies it pushes. Any organization running Cisco Secure FMC paired with Secure FTD devices is affected during a tunnel outage; no exploitation in the wild, public PoC, or KEV listing is currently known.

Do: Upgrade Cisco Secure FMC to the fixed release per Cisco's advisory (fixed versions not listed in this data). Until patched, keep the FMC–FTD sftunnel connection healthy and restore any tunnel outages immediately, restrict access to the FMC management interface (including the AJP port, typically TCP 8009) to trusted management networks, and alert on FTD disconnect/tunnel-down events as elevated-risk windows.

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.

Dell Update Package Framework versions prior to 26.07.03 fail to verify a return value before proceeding (CWE-252, Unchecked Return Value), a flaw that a low-privileged local attacker can leverage to gain elevated privileges on the host. The attack requires local access to the machine and user interaction (per the CVSS UI:R metric), consistent with inducing a privileged update process to continue past a failed operation. Because the CVSS scope is changed with high confidentiality, integrity, and availability impact, a successful exploit can compromise resources beyond the vulnerable component's security context. Any Dell client system or administrator workstation running the framework below the fixed version is affected. No public proof-of-concept and no known in-the-wild exploitation have been reported, and the issue is not on the CISA KEV catalog.

Do: Update Dell Update Package Framework to version 26.07.03 or later, obtainable through Dell Command | Update, Dell Update, or the Dell support site, and verify the installed version in the Windows apps list or via the Dell utility. Because exploitation requires local access, prioritize patching shared or multi-user endpoints and remind users not to run untrusted local code while unpatched.

Dell Update Package Framework versions prior to 26.07.03 contain an OS command injection flaw (CWE-78) in which special elements are improperly neutralized before being passed to the operating system. A local, low-privileged attacker can trigger the vulnerability, and the CVSS vector (UI:R) indicates user interaction is required to exploit it. Successful exploitation executes arbitrary OS commands in the context of the update framework, elevating the attacker's privileges with high impact on confidentiality, integrity, and availability. Any Dell client system running the affected framework — typically deployed as part of Dell's client update tooling on consumer and commercial PCs — is affected. No public proof of concept is known and the flaw is not in CISA KEV, so exploitation is not currently observed.

Do: Upgrade Dell Update Package Framework to version 26.07.03 or later, available via Dell's support site or Dell Command | Update / Dell Update channels. Because exploitation requires local low-privileged access and user interaction, prioritize patching shared, multi-user, and kiosk-style endpoints, and verify the installed framework version on managed Dell clients.

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts directly assigns unsanitized field names and allows a __proto__.pollutedKey path to modify Object.prototype. Successful exploitation requires an application to expose attacker-controlled event fields to fieldsToJson and may cause denial of service or application logic corruption. This vulnerability is fixed in 2.145.0.

node-opcua, the most widely used open-source OPC UA implementation for Node.js, contains a resource-exhaustion flaw (CWE-400) in which every failed reconnection leaves a TCP socket stranded in FIN-WAIT-2 state, leaking file descriptors and memory until the process or container is killed by the OOM killer. No attacker interaction is required: with the default keepSessionAlive: true setting, a server clock skewed beyond the server's timestamp tolerance (e.g., an industrial PLC roughly 50 minutes ahead of the client) makes the keepalive manager misread the resulting BadInvalidTimestamp fault as a network outage and force a full transport reconnect every keepAliveInterval, while the failed HEL/ACK handshake path calls socket.end() instead of socket.destroy(), so sockets the PLC never closes accumulate indefinitely. At the commonly used 3-second keepAliveInterval this is about 20 leaked sockets per minute (~1,200 per hour), so an attacker who controls or spoofs a skewed, non-responsive OPC UA endpoint — or simple clock misconfiguration — can crash the Node.js client application, gateway, or SCADA data bridge (CVSS 3.1 7.0 High, availability-focused). Any node-opcua client deployment carries the flawed code (confirmed on 2.169.0, the latest release as of April 2026), but only installations communicating with clock-skewed or non-responding servers actually leak; no public proof-of-concept or in-the-wild exploitation is known.

Do: No fixed version is named in the advisory, so watch node-opcua releases beyond 2.169.0 and upgrade as soon as a patch lands; in the interim, either disable keepSessionAlive or lengthen keepAliveInterval, and enforce NTP time synchronization (or raise the server's accepted timestamp tolerance) so client request timestamps stay within the server's window. Monitor FIN-WAIT-2 socket counts on client hosts and apply container file-descriptor/memory limits so any leak surfaces as a bounded, restartable failure rather than a silent OOM crash.

Stanza, Stanford NLP's Python library for tokenization, NER, and parsing, contains a zip path traversal flaw in stanza.resources.common.unzip (stanza/resources/common.py), which passes downloaded model and resource archives directly to zipfile.ZipFile.extractall without validating member paths. The vulnerable extraction path is reachable through the commonly used stanza.download and stanza.install_corenlp functions, so a malicious archive containing parent-directory traversal entries can write files outside the intended model directory. An attacker who can supply or tamper with the archive (for example via a compromised mirror, proxy, or man-in-the-middle download) gains arbitrary file writes with the privileges of the Stanza process, potentially achieving code execution by overwriting shell configuration, SSH authorized_keys, Python packages, or executable scripts. Anyone running Stanza prior to version 1.14.0 is affected. No public proof-of-concept or confirmed exploitation is known, and the flaw is not listed in CISA's KEV catalog.

Do: Upgrade Stanza to version 1.14.0 or later, which validates archive member paths before extraction. Until upgraded, avoid running stanza.download or stanza.install_corenlp from untrusted networks, proxies, or unofficial model mirrors, and review model directories plus shell startup files, ~/.ssh/authorized_keys, site-packages, and scripts for unexpected modifications on hosts where untrusted downloads occurred.

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolution, while the symlink and installed-metadata paths described by the advisory skip that validation. A package can ship an in-package binary symlink that resolves outside its installation directory, or attacker-influenced vendor/composer/installed.json metadata can provide an escaping binary path during a reinstall or regeneration of missing vendor/bin entries. The installed-metadata path is reachable only when the vendor directory was not populated by the same validated install run, such as when it is restored from an untrusted cache, copied from an earlier build stage, carried over from an older Composer run, or writable by a lower-trust build step. Composer can follow the path, change the external target's permissions to make it world-readable and executable, and create a runnable vendor/bin proxy to that external file. The issue does not directly read or transmit data and does not by itself provide remote code execution. This issue is fixed in versions 2.2.30 and 2.10.3.

vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling path for /v1/chat/completions calls AudioMediaIO.load_bytes or AudioMediaIO.load_file without passing VLLM_MAX_AUDIO_DECODE_DURATION_S to the shared audio decoder. An unauthenticated client can therefore submit a small compressed audio input that expands into a very large float32 PCM allocation, bypassing the duration guard already used by /v1/audio/transcriptions and causing an out-of-memory worker crash. Inline data URLs reach this path without being bounded by VLLM_AUDIO_FETCH_TIMEOUT. The issue affects deployments serving an audio-capable model, and authentication changes only the deployment-specific reachability. This issue is fixed in version 0.24.0.

sequoia-openpgp, a widely used Rust implementation of OpenPGP, incorrectly infers key capabilities for older certificates that lack a key flags subpacket, creating a discrepancy between the key flags a verifier assumes and what the certificate actually declares. An attacker who controls such a legacy-style certificate can leverage this confusion to bypass the back-signature check, which normally proves that a primary key authorized a signing subkey. As a result, an attacker can bind an arbitrary subkey to their own certificate and produce signatures that verifiers accept as legitimate, compromising the cryptographic integrity of signature verification. Any software or service that uses sequoia-openpgp to verify attacker-supplied OpenPGP certificates and signatures is affected, including downstream tooling such as RPM package signature verification in RPM-based Linux distributions. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

Do: Track the Sequoia PGP security advisory (CVE-2026-42784) and upgrade sequoia-openpgp to the patched release as soon as one is published; RPM-based distribution users should apply package-manager security updates as vendors ship rebuilt components. Until patched, exercise caution when verifying certificates that lack a key flags subpacket, and treat subkey-binding and back-signature validation results from unpatched sequoia-openpgp versions as untrusted. Audit your dependency tree (cargo) to determine whether sequoia-openpgp is present in verification-critical paths.

CVE-2026-20331 tracks multiple internally discovered vulnerabilities in Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software, all classified as failures of protection mechanisms (CWE-693) and addressed through a software hardening release. Cisco has not published detailed technical specifics, but the CVSS 3.1 vector indicates an attacker needs only adjacent network access, with no privileges or user interaction, and that impact crosses security boundaries (scope changed) with high confidentiality and integrity effects plus low availability impact. This is consistent with a bypass of security controls on a firewall/VPN platform, where successful exploitation could let an attacker defeat protections the appliance is meant to enforce. Any organization running affected ASA, FTD, or FMC software is in scope, and FMC operators should note that the management center can propagate exposure across large fleets of managed FTD devices. As of now there is no known exploitation, no public proof of concept, and the issue is not on the CISA KEV list.

Do: Consult Cisco's advisory for the hardening release and upgrade ASA, FTD, and FMC to the fixed releases it specifies for your software train, since the bundle covers multiple internally found issues. In the interim, limit adjacent-network reachability to device management interfaces and review VPN and management-plane access controls. Because the flaws were found internally and details are sparse, monitor Cisco PSIRT for updated indicators and remediation guidance.

Cisco Identity Services Engine (ISE) contains an insecure deserialization flaw (CWE-502) in its web-based management interface, caused by unsafe handling of a user-supplied Java byte stream. An attacker who already holds at least low-privileged administrative credentials can send a crafted serialized Java object to the management interface to trigger the flaw. Successful exploitation yields arbitrary code execution on the underlying operating system and privilege escalation to root; in single-node deployments it can also render the ISE node unavailable, blocking network access for endpoints that have not yet authenticated. All Cisco ISE deployments whose management interface is reachable by an attacker with administrative credentials are affected, though specific version ranges were not provided in the source data. As of now the flaw is not listed in CISA's KEV catalog and no public proof-of-concept is known.

Do: Upgrade affected ISE nodes to the fixed release identified in Cisco's advisory. Until patched, restrict access to the ISE web management interface to trusted administrative networks and audit which accounts hold low-privileged administrative credentials. Operators of single-node deployments should prioritize patching since exploitation would cause a full denial of network access for unauthenticated endpoints.

Cisco ISE and ISE-PIC contain a command injection vulnerability (CWE-78) in their REST API, caused by improper validation of user-supplied input. An authenticated, remote attacker who already holds valid administrative credentials can send crafted commands to the web-based management interface to trigger the flaw. Successful exploitation allows arbitrary code execution on the underlying operating system with elevation to root privileges. In single-node deployments, exploitation can also render the ISE node unavailable, denying network access to endpoints that have not yet authenticated. As of the latest data, the flaw is not listed in CISA's KEV catalog and no public proof-of-concept is known.

Do: Upgrade ISE and ISE-PIC to the fixed releases identified in the Cisco Security Advisory (version numbers not provided in available data). Until patched, restrict access to the management and REST API interfaces to trusted admin networks, audit and rotate privileged administrative credentials (since valid admin creds are required for exploitation), and enable MFA for ISE administrators. Organizations running single-node deployments should prioritize patching and maintain backups, as exploitation could take the sole node offline and block new endpoint authentication.