SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication. CVSSv3.1 9.8 (CRITICAL)
A vulnerability was found in Tenda W3 1.0.0.3(2204). Affected by this issue is the function formSetCfm of the file /goform/setcfm of the component HTTP Handler. The manipulation of the argument funcpara1 results in stack-based buffer overflow. The attack can only be performed from the local network. The exploit has been made public and could be used. CVSSv3.1 8.8 (HIGH) · EPSS 39th percentile
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2, Safari 17.2, iOS 16.7.15 and iPadOS 16.7.15, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption. CVSSv3.1 8.8 (HIGH)
Quarkslab published a detailed firmware reverse-engineering writeup on a JieLi AC6958 smartwatch, documenting weeks of work to decrypt proprietary firmware sections, reverse-engineer the custom Pi32v2 CPU instruction set, and improve Ghidra support for the architecture. The researchers recovered an LFSR-based stream cipher key (0x170f), decrypted FAT filesystem partitions, and significantly extended the Pi32v2 processor module in Ghidra to enable full disassembly and decompilation of the watch's main application.
An issue pertaining to CWE-259: Use of Hard-coded Password was discovered in oslabs-beta ThermaKube master. CVSSv3.1 9.8 (CRITICAL) · EPSS 18th percentile
An issue pertaining to CWE-89: Improper Neutralization of Special Elements used in an SQL Command was discovered in benkeen generatedata 4.0.14. CVSSv3.1 9.8 (CRITICAL) · EPSS 20th percentile
Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a computable URL. CVSSv3.1 9.9 (CRITICAL) · EPSS 31th percentile
FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious files by sending ZIP archives through the ft2.php endpoint. Attackers can upload ZIP files containing PHP shells, use the unzip functionality to extract them into accessible directories, and execute arbitrary commands through the extracted PHP files. CVSSv3.1 9.8 (CRITICAL)
A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device. This vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful CVSSv3.1 8.8 (HIGH) · EPSS 4th percentile
A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the prompt. A successful exploit could allow the attacker to elevat CVSSv3.1 8.8 (HIGH) · EPSS 7th percentile
An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authenti CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile
An issue in Lantronix EDS3000PS v.3.1.0.0R2 allows an attacker to execute arbitrary code and obtain sensitive information via the ltrx_evo component CVSSv3.1 9.8 (CRITICAL) · EPSS 39th percentile
An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges. CVSSv3.1 9.8 (CRITICAL) · EPSS 34th percentile
An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username. CVSSv3.1 9.1 (CRITICAL) · EPSS 30th percentile
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authantication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges. CVSSv3.1 9.8 (CRITICAL) · EPSS 37th percentile
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "tunnel" parameter when killing a tunnel connection. Injected commands are executed with root privileges. CVSSv3.1 8.8 (HIGH) · EPSS 30th percentile
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitization in the file name parameter, an authenticated attacker can inject arbitrary OS commands that are executed with root privileges. CVSSv3.1 8.8 (HIGH) · EPSS 30th percentile
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such as server keys, users, and known hosts. Commands are executed with root privileges. CVSSv3.1 9.8 (CRITICAL) · EPSS 34th percentile
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges. CVSSv3.1 8.8 (HIGH) · EPSS 38th percentile
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in their Workflow submission. This works even when the controller is configured with templateReferencing: Strict, which is specifically documented as a mechanism to restrict users to admin CVSSv3.1 8.1 (HIGH)
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11. CVSSv3.1 9.8 (CRITICAL)
SpecterOps researcher Max Andreacchi disclosed architectural details of Anthropic's Claude multi-agent system through social engineering and sycophancy exploitation. By leveraging Claude's tendency to agree with and mirror user statements, the researcher extracted information about a dual-Claude architecture, inter-instance communication mechanisms (window.claude.complete), JavaScript REPL sandboxing, and identified collaboration potential between isolated Claude instances that could exceed individual capabilities.
External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via network access. CVSSv3.1 9.6 (CRITICAL) · EPSS 24th percentile
An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile CVSSv3.1 8.1 (HIGH)
SUDO_KILLER is a privilege escalation enumeration and exploitation framework targeting sudo misconfigurations and CVE-based weaknesses on Unix-like systems. The tool identifies dangerous sudo rules, GTFOBINS abuse paths, vulnerable sudo versions, and environment variable exploits, then provides manual exploitation guidance and helper scripts for credential harvesting, user impersonation, and TTY injection attacks.