Vulnerabilities

The league/commonmark PHP Markdown parsing library (versions >= 1.5.0 and < 2.9.1) contains quadratic parsing complexity (CWE-407) in its SmartPunctExtension and AttributesExtension. The flaw is only triggered when one of these extensions is explicitly registered on a custom Environment — they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters — and an unauthenticated attacker who can submit Markdown to such a deployment can trigger it with small crafted documents (e.g., text alternating with unpaired quotes, runs of block-level attribute blocks, or repeated class attributes). The attacker gains a denial of service: disproportionate CPU consumption degrades or stalls the rendering process, with no confidentiality or integrity impact (CVSS 4.0 8.7 High, availability-only). Affected parties are PHP applications and services that use the library in the affected range and have either extension explicitly enabled while accepting untrusted Markdown. There is currently no known exploitation, no public proof-of-concept, no entry in CISA KEV, and a low EPSS score of 0.3%.

Do: Upgrade league/commonmark to 2.9.1 or later. If upgrading is not immediately possible, remove or unregister the SmartPunct and Attributes extensions from custom Environments, or rate-limit/CPU-limit rendering of untrusted Markdown. Audit composer dependency trees for versions >= 1.5.0 and < 2.9.1 and review Environment configuration for SmartPunctExtension or AttributesExtension usage.

HPE has disclosed multiple flaws in a daemon of ArubaOS-CX, the operating system running on Aruba's CX enterprise switches, where the service improperly processes malformed input (CWE-284, improper access control). An unauthenticated remote attacker can trigger the issue by sending specially crafted packets to the affected service, and successful exploitation yields remote code execution with elevated privileges on the switch. The 9.8 CVSS score reflects network-based attack vectors requiring no authentication, privileges, or user interaction, with high impact on confidentiality, integrity, and availability. Organizations running ArubaOS-CX switches are affected; the specific vulnerable and fixed firmware versions are not stated in the available data and must be taken from HPE's advisory. There is no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.5% chance of exploitation in the next 30 days, indicating no known exploitation at this time.

Do: Monitor HPE's security advisory for the list of affected AOS-CX releases and fixed firmware, then prioritize patching switches whose management services are reachable from untrusted networks. Until fixed builds are available, reduce exposure by placing switch management on an out-of-band management network or restricting the service with ACLs or firewall rules. Although no public PoC or in-the-wild exploitation is known, the unauthenticated nature and critical severity on core network infrastructure warrant prompt patching once firmware is published.

phpMyFAQ before 4.1.7 improperly restricts excessive authentication attempts (CWE-307): the two-factor authentication failure counter is scoped to the session and is reset every time the user successfully re-authenticates with their password. An attacker who already possesses a valid password can therefore bypass the five-attempt limit by repeatedly opening a fresh session and re-submitting the password before each TOTP guess, resetting the counter each time. This enables unbounded guessing of TOTP codes until one is accepted, defeating the second factor and giving the attacker full access to the protected account. Only phpMyFAQ deployments running versions prior to 4.1.7 with TOTP-based two-factor authentication enabled are affected, and the attack requires network access to the login endpoint plus valid user credentials (CVSS 4.0 9.1 Critical, vector AV:N/AC:H/AT:P). There is one public advisory/PoC reference (GHSA-f98m-hcjv-7rp9) but no confirmed in-the-wild exploitation: the flaw is not in CISA KEV and EPSS is 0.3% (26th percentile).

Do: Upgrade to phpMyFAQ 4.1.7 or later. Until patched, apply rate limiting or lockouts to the login/2FA endpoints at a reverse proxy or WAF, review 2FA failure logs for repeated failures from a single source, and prioritize accounts with potentially compromised passwords, since exploitation requires a valid password.