An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile CVSSv3.1 8.1 (HIGH)
SUDO_KILLER is a privilege escalation enumeration and exploitation framework targeting sudo misconfigurations and CVE-based weaknesses on Unix-like systems. The tool identifies dangerous sudo rules, GTFOBINS abuse paths, vulnerable sudo versions, and environment variable exploits, then provides manual exploitation guidance and helper scripts for credential harvesting, user impersonation, and TTY injection attacks.
Trail of Bits identifies six recurring vulnerability patterns in ERC-4337 smart account implementations: incorrect access control on execute functions, incomplete signature validation of gas fields, dangerous state modification during validation, ERC-1271 replay attacks across accounts/chains, unsafe reliance on postOp reverts for fee recovery, and initialization race conditions in ERC-7702 delegated accounts. The post provides vulnerable and patched code examples for each pattern.
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. A low-privileged staff user can inject arbitrary SQL queries via crafted requests to this parameter, allowing execution of unintended SQL statements and exposure of sensitive database information. Successful exploitation may lead to full CVSSv3.1 8.8 (HIGH) · EPSS 16th percentile
Authentication bypass issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to bypass authentication and change the device configuration. CVSSv3.1 9.8 (CRITICAL) · EPSS 32th percentile
Use of hard-coded credentials issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to obtain administrative access. CVSSv3.1 9.8 (CRITICAL) · EPSS 20th percentile
netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 value for SUPERUSER_API_TOKEN). In practice on the public Internet, almost all users changed the password but only about 90% changed the token. Having a default token value was intentional and was valuable for the main intended use case of the netbox-docker product (isolated development networks). Some users engaged in CVSSv3.1 9.0 (CRITICAL) · EPSS 17th percentile
MiCode FileExplorer contains an authentication bypass vulnerability in the embedded SwiFTP FTP server component that allows network attackers to log in without valid credentials. Attackers can send arbitrary username and password combinations to the PASS command handler, which unconditionally grants access and allows listing, reading, writing, and deleting files exposed by the FTP server. The MiCode/Explorer open source project has reached end-of-life status. CVSSv3.1 9.8 (CRITICAL) · EPSS 30th percentile
A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behavior. CVSSv3.1 8.8 (HIGH) · EPSS 43th percentile
A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable resetting the admin password. CVSSv3.1 9.8 (CRITICAL) · EPSS 51th percentile
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vvulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the c CVSSv3.1 8.1 (HIGH) · EPSS 37th percentile
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the co CVSSv3.1 8.0 (HIGH) · EPSS 23th percentile
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the con CVSSv3.1 8.7 (HIGH) · EPSS 38th percentile
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the co CVSSv3.1 8.1 (HIGH) · EPSS 32th percentile
Sophos X-Ops documented three evolving ClickFix campaigns targeting macOS users with the MacSync infostealer between November 2025 and February 2026. The campaigns shifted from impersonating OpenAI/ChatGPT download sites to leveraging legitimate ChatGPT shared conversations and Apple domain spoofing, with the latest variant employing multistage shell-based loaders, dynamic AppleScript payloads, and binary patching (including Ledger Live app hijacking for seed phrase theft) instead of native MachO binaries. Threat actors tracked campaign efficacy via stats.php endpoints reporting thousands of successful command-copy interactions to Telegram bots, with active infection clusters across Belgium, India, and the Americas.
Illustrator versions 29.8.4, 30.1 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. CVSSv3.1 8.6 (HIGH) · EPSS 6th percentile
Quarkslab details a complete exploitation of CVE-2022-0995, an out-of-bounds write in the Linux kernel's watch_queue_set_filter() function affecting kernel 5.17+. The writeup demonstrates the PageJack technique—a modern heap exploitation method introduced at Black Hat USA 2024—to convert a constrained OOB write into a use-after-free on kernel pages, ultimately achieving privilege escalation by corrupting struct file objects.
Improper Authorization vulnerability in nerves-hub nerves_hub_web allows cross-organization device control via device bulk actions and device update API. Missing authorization checks in the device bulk actions and device update API endpoints allow authenticated users to target devices belonging to other organizations and perform actions outside of their privilege level. An attacker can select devices outside of their organization by manipulating device identifiers and perfo CVSSv3.1 8.8 (HIGH) · EPSS 4th percentile
Tenda G1V3.1si V16.01.7.8 Firmware V16.01.7.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root. CVSSv3.1 8.4 (HIGH)
Tenda i24V3.0si V3.0.0.5 Firmware V3.0.0.5 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root. CVSSv3.1 8.4 (HIGH)
`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability. CVSSv3.1 9.8 (CRITICAL)
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, an unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL by supplying two custom HTTP headers without an `Authorization` header. No authentication is required. The vulnerability exists in the HTTP middleware and dependency injection laye CVSSv3.1 8.2 (HIGH)
Memory safety bugs present in Firefox 148.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 148.0.2. CVSSv3.1 8.8 (HIGH)
Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android. This vulnerability was fixed in Firefox 148.0.2. CVSSv3.1 8.8 (HIGH)
Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in application/x-www-form-urlencoded data (e.g., action=do&sql=<query_here>&reload_driver=0) to execute arbitrary SQL commands and potentially achieve remote code execution. CVSSv3.1 9.8 (CRITICAL) · EPSS 39th percentile