The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations. CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile
A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user. CVSSv3.1 9.9 (CRITICAL) · EPSS 76th percentile
A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers. CVSSv3.1 8.8 (HIGH) · EPSS 28th percentile
Netartmedia PHP Real Estate Agency 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the features[] parameter. Attackers can send POST requests to index.php with crafted SQL payloads in the features[] parameter to extract sensitive database information or manipulate database queries. CVSSv3.1 8.2 (HIGH)
SpecterOps published a comprehensive red-team tradecraft guide on exploiting compromised Tailscale authentication keys (Trusted Keys and Auth Keys) discovered in CI/CD pipelines. The post details how to provision nodes, enumerate Tailnets, abuse subnet routers and exit nodes for lateral movement, and leverage Tailscale SSH for passwordless access to internal systems and cloud resources.
An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains vers CVSSv3.1 9.9 (CRITICAL) · EPSS 41th percentile
A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication. CVSSv3.1 9.1 (CRITICAL) · EPSS 56th percentile
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. CVSSv3.1 9.9 (CRITICAL) · EPSS 53th percentile
A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository. CVSSv3.1 8.8 (HIGH) · EPSS 9th percentile
SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication. CVSSv3.1 9.8 (CRITICAL)
SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication. CVSSv3.1 9.8 (CRITICAL)
A vulnerability was found in Tenda W3 1.0.0.3(2204). Affected by this issue is the function formSetCfm of the file /goform/setcfm of the component HTTP Handler. The manipulation of the argument funcpara1 results in stack-based buffer overflow. The attack can only be performed from the local network. The exploit has been made public and could be used. CVSSv3.1 8.8 (HIGH) · EPSS 39th percentile
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2, Safari 17.2, iOS 16.7.15 and iPadOS 16.7.15, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption. CVSSv3.1 8.8 (HIGH)
Quarkslab published a detailed firmware reverse-engineering writeup on a JieLi AC6958 smartwatch, documenting weeks of work to decrypt proprietary firmware sections, reverse-engineer the custom Pi32v2 CPU instruction set, and improve Ghidra support for the architecture. The researchers recovered an LFSR-based stream cipher key (0x170f), decrypted FAT filesystem partitions, and significantly extended the Pi32v2 processor module in Ghidra to enable full disassembly and decompilation of the watch's main application.
An issue pertaining to CWE-259: Use of Hard-coded Password was discovered in oslabs-beta ThermaKube master. CVSSv3.1 9.8 (CRITICAL) · EPSS 18th percentile
An issue pertaining to CWE-89: Improper Neutralization of Special Elements used in an SQL Command was discovered in benkeen generatedata 4.0.14. CVSSv3.1 9.8 (CRITICAL) · EPSS 20th percentile
Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a computable URL. CVSSv3.1 9.9 (CRITICAL) · EPSS 31th percentile
FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious files by sending ZIP archives through the ft2.php endpoint. Attackers can upload ZIP files containing PHP shells, use the unzip functionality to extract them into accessible directories, and execute arbitrary commands through the extracted PHP files. CVSSv3.1 9.8 (CRITICAL)
A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device. This vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful CVSSv3.1 8.8 (HIGH) · EPSS 4th percentile
A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the prompt. A successful exploit could allow the attacker to elevat CVSSv3.1 8.8 (HIGH) · EPSS 7th percentile
An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authenti CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile
An issue in Lantronix EDS3000PS v.3.1.0.0R2 allows an attacker to execute arbitrary code and obtain sensitive information via the ltrx_evo component CVSSv3.1 9.8 (CRITICAL) · EPSS 39th percentile
An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges. CVSSv3.1 9.8 (CRITICAL) · EPSS 34th percentile
An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username. CVSSv3.1 9.1 (CRITICAL) · EPSS 30th percentile
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authantication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges. CVSSv3.1 9.8 (CRITICAL) · EPSS 37th percentile