EHG2408 series switch developed by Atop Technologies has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to control the program's execution flow and execute arbitrary code. CVSSv3.1 9.8 (CRITICAL) · EPSS 48th percentile
Trend Micro researchers demonstrated two novel attack vectors against AI systems at [un]prompted 2026: (1) exploiting AI-driven KYC pipelines by embedding malicious instructions in documents to trick AI agents into reading/writing across customer records, and (2) FENRIR, an automated vulnerability discovery system that has identified 60+ published CVEs and 100+ pre-disclosure vulnerabilities in AI/MCP ecosystems. The research frames documents as executable attack surfaces when AI agents can read and invoke tools, fundamentally shifting the threat model for document-processing pipelines.
A comprehensive curated repository of Linux kernel exploitation research, techniques, and tools maintained by Andrey Konovalov. The collection spans 15+ years of kernel pwning primitives including heap feng shui, use-after-free exploitation, KASLR bypasses, control-flow hijacking, and defense evasion methods, with bimonthly updates covering both academic papers and practical CTF/real-world exploits.
GitHub Security Lab released an open-source AI-powered framework (seclab-taskflows) that uses LLM-based agents to audit codebases for web security vulnerabilities. The framework employs a multi-stage threat modeling and auditing approach to minimize hallucinations and false positives, and has discovered 80+ vulnerabilities including authorization bypasses and privilege escalations in real open-source projects. The taskflows are publicly available and can be run on any repository with a GitHub Copilot license.
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5. CVSSv3.1 9.8 (CRITICAL)
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the call_user_func_array function (and its wrappe CVSSv3.1 8.1 (HIGH)
Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete adm CVSSv3.1 8.8 (HIGH) · EPSS 38th percentile
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructu CVSSv3.1 9.4 (CRITICAL)
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructu CVSSv3.1 9.4 (CRITICAL) · EPSS 53th percentile
PlayJoom 0.10.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the catid parameter. Attackers can send GET requests to index.php with option=com_playjoom&view=genre&catid=[SQL] to extract sensitive database information including usernames, databases, and version details. CVSSv3.1 8.2 (HIGH) · EPSS 14th percentile
ServerZilla 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the email parameter. Attackers can send POST requests to reset.php with malicious email values containing SQL operators to bypass authentication and extract sensitive database information. CVSSv3.1 8.2 (HIGH) · EPSS 19th percentile
EdTv 2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to the admin/edit_source endpoint with crafted SQL UNION statements to extract database information including schema names, user credentials, and version details. CVSSv3.1 8.2 (HIGH) · EPSS 19th percentile
BitZoom 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the rollno and username parameters in forgot.php and login.php. Attackers can submit crafted POST requests with SQL UNION statements to extract database schema information and table contents from the application database. CVSSv3.1 8.2 (HIGH)
ADAR is a comprehensive Active Directory reconnaissance and attack tool for authorized penetration testing, implementing 20+ enumeration techniques across four tiers: unauthenticated (DNS, LDAP anon, Kerberos AS-REQ, SMB null, LLMNR/passive), low-auth (LDAP referral, OXID, SAMR, RID cycling), credential-required (LDAP auth, AS-REP Roasting, Kerberoasting, SYSVOL/GPP parsing), and specialized (ADCS ESC detection, Azure AD enumeration, OWA timing side-channel, printer spooler). The tool supports stealth profiles, pass-the-hash, and multiple output formats (JSON, HTML, CSV).
Sekoia analysis documents a recurring intrusion pattern where attackers gain initial access through shadow IT infrastructure—unmanaged edge devices, orphaned cloud storage, unmonitored SaaS tenants, exposed developer credentials, and domain lifecycle abuse—that exists outside SOC visibility boundaries. The research synthesizes five documented attack chains (ransomware via unpatched VPN appliances, cloud storage repurposing, OAuth persistence, leaked CI/CD credentials, and domain takeover) to demonstrate that the visibility gap between external attacker reconnaissance and internal SOC telemetry is the primary exploitation vector.
An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions. CVSSv3.1 8.1 (HIGH) · EPSS 4th percentile
Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7. CVSSv3.1 9.8 (CRITICAL)
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructu CVSSv3.1 9.4 (CRITICAL)
Elastic Security Labs published a detailed technical writeup of a Use-After-Free vulnerability in Windows Desktop Window Manager (DWM) that enables privilege escalation from low-privileged user to SYSTEM. The research demonstrates how LLMs (Claude Opus 4.5/4.6) can dramatically accelerate patch diffing and exploit development, reducing the time from vulnerability discovery to functional exploit from 3 weeks to hours. The exploit chains a novel GetRECT heap spray technique with CFG-bypassing gadgets (__fnINSTRING + CStdAsyncStubBuffer2_Disconnect) to achieve arbitrary code execution.
OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to bypass DM and room allowlists. An attacker can change their Nextcloud display name to match an allowlisted user ID and gain unauthorized access to restricted conversations. CVSSv3.1 9.8 (CRITICAL)
OpenClaw versions prior to 2026.2.14 contain an arbitrary file read vulnerability in the exec-approvals allowlist validation that checks pre-expansion argv tokens but executes using real shell expansion. Attackers with authorization or through prompt-injection attacks can exploit safe binaries like head, tail, or grep with glob patterns or environment variables to disclose files readable by the gateway or node process when host execution is enabled in allowlist mode. CVSSv3.1 8.4 (HIGH)
Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover. Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a reset link with a token. This token remains valid indefinitely until used. There is no time-based expiration enforced. If a user's historical emails are exposed through a data breach (e. CVSSv3.1 9.8 (CRITICAL)
An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files. An authenticated user can upload a crafted web.config file by sending a crafted POST request to /ASDKAPI/api/v8.6/item/addfile, which is processed by the ASP.NET runtime. The uploaded configuration file alters the execution context of the upload directory, enabling compilation and execution of attacker-control CVSSv3.1 8.8 (HIGH) · EPSS 62th percentile
A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover via spoofing the HTTP Host header. CVSSv3.1 9.3 (CRITICAL) · EPSS 2th percentile
OpenCode Systems OC Messaging / USSD Gateway OC Release 6.32.2 contains a broken access control vulnerability in the web-based control panel allowing authenticated low-privileged attackers to gain to access to arbitrary SMS messages via a crafted company or tenant identifier parameter. CVSSv3.1 8.1 (HIGH) · EPSS 11th percentile