In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. CVSSv3.1 8.4 (HIGH) · EPSS 1th percentile
In multiple functions of FaceEnroll.kt, there is a possible privilege escalation due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. CVSSv3.1 8.4 (HIGH)
AzureHound v2.10.0 released with support for federated identity credentials enumeration and minor bug fixes. This update extends Azure AD reconnaissance capabilities to include federated identity attack surface.
A remote authentication bypass vulnerability exists in HPE AutoPass License Server (APLS). CVSSv3.1 9.8 (CRITICAL) · EPSS 58th percentile
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization. If an attacker can modify the fac_Config.dot value, arbitrary commands may be executed in the context of the web server process. CVSSv3.1 9.8 (CRITICAL) · EPSS 97th percentile
openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database. CVSSv3.1 8.8 (HIGH) · EPSS 58th percentile
openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allo CVSSv3.1 8.8 (HIGH) · EPSS 63th percentile
kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using `filepath.Join(dest, cleanedName)` without enforcing that the final path stays within `dest`. A tar entry like `../outside.txt` escapes the extraction root and writes files outside the destination directory. In environments with registry authentication, this can be chained w CVSSv3.1 8.2 (HIGH)
A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use('/secret', auth)). When Fastify router normalization options are enabled (such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related trailing-slash behavior), crafted request paths may bypass middleware checks while still being routed to protected handlers. CVSSv3.1 9.1 (CRITICAL) · EPSS 23th percentile
A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled. This issue affects nest.Js: 11.1.13. CVSSv3.1 9.8 (CRITICAL)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Signum Technology Promotion and Training Inc. Windesk.Fm allows SQL Injection. This issue affects windesk.Fm: before v2.3.4. NOTE: The vendor patched the vulnerability after the CVE was published. CVSSv3.1 9.8 (CRITICAL) · EPSS 4th percentile
PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other ve CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows SQL Injection. This issue affects E-Commerce Platform: through 27022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 9.8 (CRITICAL) · EPSS 4th percentile
A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise This issue affects Frick Controls Quantum HD version 10.22 and prior. CVSSv3.1 9.8 (CRITICAL) · EPSS 14th percentile
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field when accessing the get setup route. CVSSv3.1 8.0 (HIGH) · EPSS 52th percentile
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update action to achieve remote code execution. CVSSv3.1 8.0 (HIGH) · EPSS 52th percentile
OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the root_api_key configuration is omitted. Attackers can send requests to protected endpoints without authentication headers to access administrative functions including account management, resource operations, and system configuration. CVSSv3.1 9.8 (CRITICAL)
Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publish a crafted message (api_id=1002) containing arbitrary Python, which the robot writes to disk under /unitree/etc/programming/ and binds to a physical controller keybinding. When CVSSv3.1 8.0 (HIGH) · EPSS 23th percentile
Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fragment, then appends subsequent fragments using memcpy() without verifying that sufficient capacity remains. An adjacent BLE client can send unauthenticated fragments whose combined size exceeds the allocated buffer, causing a heap ov CVSSv3.1 8.1 (HIGH) · EPSS 5th percentile
Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user. CVSSv3.1 8.2 (HIGH) · EPSS 4th percentile
Bishop Fox released CloudFox GCP, an offensive security enumeration tool for Google Cloud Platform that maps IAM permissions, identifies service account risks, detects storage misconfigurations, and surfaces privilege escalation and lateral movement paths across GCP organization hierarchies. The tool includes 64 modules organized across identity, storage, compute, networking, and attack path analysis categories, with planned integration to FoxMapper for advanced privilege escalation graph analysis.
Project Zero researcher provides a comprehensive historical analysis of the GetProcessHandleFromHwnd Windows API across Vista through Windows 11 24H2, documenting how it evolved from a hook-based implementation to a kernel function and the security implications of each version. The post details a critical vulnerability (CVE-2023-41772) in Windows 10 and pre-24H2 Windows 11 that allowed bypassing protected process isolation via UIPI checks, and demonstrates a practical attack chain to hijack Protected TCB processes like WerFaultSecure.exe. Microsoft's fixes in 24H2 introduce feature flags to enforce UIPI permanently and restrict the API to UI Access-enabled callers, though workarounds exist for systems with UIPI disabled.
c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map<String,Map<String,String>>`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDat CVSSv3.1 8.0 (HIGH)
Hexacorn documents Windows 11 shim database enhancements including newly tracked process names (SdbMergeTestEntry_Added_Exe_Item.exe variants) and plugin directory structures (%windir%\apppatch\AcPluginDlls\) with test DLLs present across multiple architectures. The research identifies potential persistence and code injection vectors through underdocumented shim plugin mechanisms in apphelp.dll, pcasvc.dll, and appraiser.dll.
Cisco SD-WAN vulnerabilities CVE-2026-20127 and CVE-2022-20775 are under active exploitation targeting federal networks, with CISA issuing an emergency directive. CVE-2026-20127 permits unauthenticated remote attackers to bypass authentication and gain admin access; CVE-2022-20775 enables authenticated local privilege escalation. Sophos has released IPS signatures for detection.