What needs attention now.

Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints

• Rapid7 Metasploit Framework
• Authentication bypass

OAuth2 SSRF vulnerability in SAP Cloud SDK for Python

• SAP_SE SAP Cloud
• Server-side request forgery (SSRF)

Broken Access Control in SAP NetWeaver Visual Composer

• SAP_SE SAP NetWeaver Visual Composer
• CWE-749

Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)

• SAP_SE SAP Manufacturing Integration and Intelligence (Configuration Service)
• Broken access control

Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)

• SAP_SE SAP S/4HANA (Manage Substitution/Validation Rules)
• Code injection

An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.

• Code injection

Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606…

• Path traversal

DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.

• Information disclosure

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component

• Privilege escalation

Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module.

• Command injection

reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/re…

• Command injection

An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.

• Authentication bypass

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter.

• Broken access control

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.

• Broken access control

IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI

• i
• Code injection

DataStage on Cloud Pak for Data Path Traversal

• IBM DataStage on Cloud Pak for Data
• Path traversal

DataStage on Cloud Pak for Data Information Disclosure

• IBM DataStage on Cloud Pak for Data
• Information disclosure

DataStage on Cloud Pak for Data Path Traversal

• IBM DataStage on Cloud Pak for Data
• Path traversal

phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint

• thorsten phpMyFAQ
• SQL injection

Qexo initialization endpoint can reset setup state and expose stored credentials

• Qexo
• Information disclosure

Maximo AI Service Code Injection

• IBM Maximo AI Service
• Code injection

sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace

• Th0rgal sandboxed.sh
• CWE-1188

Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder

• zofe rapyd-admin
• Hard-coded credentials

GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py

• RVC-Boss GPT-SoVITS
• Command injection

easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function

• karuppiah7890 easy-pdf-merge
• Command injection

Netherman Portal del Hermano Account Takeover via Password Reset Oracle

• NetHerman Portal del Hermano (portaldelhermano.es)
• Authentication bypass
• CWE-640

Netcore NR268 DDNS DDNSset.cgi execvp argument injection

• Netcore NR268
• Other injection
• Command injection

Apache Allura: Oauth1 Replay Attack

• Apache Software Foundation Apache Allura
• Authentication bypass

Apache Allura: REST API Mass Assignment

• Apache Software Foundation Apache Allura
• Broken access control

Apache Allura: OAuth1 missing callback validation

• Apache Software Foundation Apache Allura
• Open redirect

NetEase Cloud Music TLS Certificate Validation Bypass

• NetEase Cloud Music for Windows
• Weak cryptography or TLS

NetEase Cloud Music RCE via os.navigateExternal IPC

• NetEase Cloud Music for Windows
• CWE-749

Missing authentication in HAProxy Data Plane API EE and others

• HAProxy Data Plane API EE
• HAProxy Data Plane API CE
• Authentication bypass

IBM Db2 Mirror for i Privilege Escalation

• IBM Db2 Mirror for i
• CWE-264

Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)

• Privasys ra-tls-clients
• CWE-346

Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations

• Red Hat build of Quarkus 3.27.6.redhat
• Red Hat build of Quarkus 3.33.4.redhat
• Broken access control

Edimax BR-6208AC formWlanMP command injection

• Edimax BR-6208AC
• Other injection
• Command injection

Edimax BR-6208AC formAutoFWupgrade command injection

• Edimax BR-6208AC
• Other injection
• Command injection

Edimax BR-6208AC formWlanMP buffer overflow

• Edimax BR-6208AC
• Memory corruption

OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table

• Turboderp-org ExLlamaV3
• Memory corruption
• CWE-20

Edimax BR-6208AC formWlSiteSurvey buffer overflow

• Edimax BR-6208AC
• Memory corruption

Netcore NR268 CGI Execution user_ok improper authentication

• Netcore NR268
• Authentication bypass

ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie

• zitadel
• CWE-441

ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion

• zitadel
• Authentication bypass

LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header

• librenms
• Other injection

Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass

• getgrav grav-plugin-login-oauth
• Hard-coded credentials

Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder

• unclecode crawl4ai
• Server-side request forgery (SSRF)

Improper privilege management in Progress MarkLogic Server backup and restore operations

• Progress Software Corporation MarkLogic Server
• Privilege escalation

Improper privilege management in Progress MarkLogic Server xdmp:eval-in

• Progress Software Corporation MarkLogic Server
• Privilege escalation

Improper privilege management in Progress MarkLogic Server Management API

• Progress Software Corporation MarkLogic Server
• Privilege escalation

Improper privilege management in Progress MarkLogic Server forest operations

• Progress Software Corporation MarkLogic Server
• Privilege escalation

Insufficient isolation of user-supplied code in Progress MarkLogic Server

• Progress Software Corporation MarkLogic Server
• CWE-346

SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates

• sbabic swupdate
• Weak cryptography or TLS

Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout

• thirty bees
• Broken access control

Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API

• Square Squash
• Insecure deserialization

@neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields

• @neo4j/graphql
• Authentication bypass

AnyDesk: AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code…

• AnyDesk
• CWE-130

Linksys E1700 setLinksysIpv6 os command injection

• Linksys E1700
• Command injection

Linksys E1700 setDMZ os command injection

• Linksys E1700
• Command injection

Linksys E1700 Static Route addStaticRoute os command injection

• Linksys E1700
• Command injection