A NULL pointer dereference in audiofile 0.3.7, reached through the ModuleState::setup code path, lets unauthenticated attackers crash applications that use the library to parse attacker-supplied audio data, producing a denial of service with no confidentiality or integrity impact. The NVD CVSS of 7.5 is availability-only (A:H), but it assumes AV:N, whereas the assessed vector is AV:L - the real attack vector depends entirely on whether the embedding application exposes audiofile parsing to remote input or only to locally opened files. No CISA KEV entry exists and EPSS is low at 0.36% (30th percentile); a public PoC reference exists (GitHub issue #66) but is not verified as working exploit code, and the item is prioritized as this_week.
Outdated third-party UI dependencies in BLU-IC2 and BLU-IC4 firmware through 1.19.5 can expose the management web interface to remote, unauthenticated exploitation, primarily risking information disclosure with lower integrity and availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.41% (34th percentile). Real-world exposure is limited by reachability of the device UI, since these access-control appliances are often segmented onto internal or restricted networks.
Authenticated Gallagher Command Centre Server operators holding only limited site permissions can abuse the Morpho integration to make critical configuration changes to local Morpho biometric devices, effectively exceeding their authorized site scope. The flaw is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) because the scope change lets a low-privileged account act beyond its intended security boundary, but exploitation requires a valid operator account and a deployment that actually has the Morpho integration configured - Command Centre installations without Morpho hardware are not exposed. Only 0.34% EPSS and no CISA KEV entry indicate low observed exploitation activity, and no public exploit code has been identified at time of analysis; the main risk is insider or compromised-credential abuse in Morpho-enabled environments.
Server-side request forgery in Microsoft's cloud-hosted Azure Compute Gallery allows unauthenticated remote attackers to coerce the Azure Compute Resource Provider into issuing attacker-influenced requests, ultimately elevating privileges within the service. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), exploitation is network-reachable, low complexity, requires no authentication and no user interaction, and yields high confidentiality and integrity impact; the scope is unchanged. There is confirmed no public exploit code and no CISA KEV listing at time of analysis - no public exploit identified at time of analysis - and the EPSS score is modest at 0.77% (54th percentile), reflecting that the primary constraint is operational: the target is a Microsoft-operated multi-tenant service remediated centrally by Microsoft, not by customer patch deployment.
Authenticated, high-privileged remote attackers can inject operating system commands through diagnostics functionality in Arista EOS, potentially achieving full compromise of confidentiality, integrity, and availability. CVE-2025-6978 carries a CVSS base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and an EPSS score of 13.43% (96th percentile), indicating elevated exploitation likelihood; however, no public exploit code and no CISA KEV active exploitation have been identified at time of analysis. Our independent assessment considers this a moderate-to-elevated priority issue with partially conflicting signals, and the vendor has published Arista security advisory 0123.
Azure Event Grid, Microsoft's fully managed event-routing service, can be abused by unauthenticated remote attackers to elevate privileges with high impact across confidentiality, integrity, and availability, per the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - no credentials or user interaction are required and attack complexity is low. The root cause is improper access control (CWE-284) in the service's own authorization logic; because Event Grid is a multi-tenant cloud PaaS, any fix is applied centrally by Microsoft rather than by customers, which substantially narrows the real-world exposure window. No public exploit code has been identified at time of analysis and the EPSS score is low at 0.38% (30th percentile), so the 9.8 base score overstates near-term exploitation likelihood; an independent assessment confirms the primary limiting factor is the cloud-managed deployment model, and the exact starting trust level implied by 'elevate privileges' remains ambiguous in the available data.
Remote file inclusion in ArkSigner AcBakImzala versions before 5.1.4 allows unauthenticated attackers to coerce the PHP application into including attacker-controlled files, resulting in local file inclusion and potential remote code execution. The CVSS 9.8 score reflects network-reachable, no-authentication exploitation with full confidentiality, integrity, and availability impact, though no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
Authenticated remote command execution affects the Veeder-Root TLS4B Automatic Tank Gauge (ATG), whose SOAP-based web services handler exposes functionality that allows an attacker with valid credentials on that interface to run system-level commands on the device's underlying Linux operating system. Successful exploitation yields full shell access on the gauge and a foothold for lateral movement into the surrounding OT/fuel-management network. Per the CVSS vector the attack requires network reachability plus valid credentials (PR:L), not pre-auth access, and no user interaction; there is no CISA KEV listing and no public exploit code identified at time of analysis, while EPSS sits at 1.39% (71st percentile) - a moderate, not extreme, likelihood signal. Severity is nevertheless very high (CVSS 9.4 per the 4.0 vector; independent assessment scores CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) because a single compromised credential converts directly into host-level control of a safety- and business-critical tank monitoring device.
Unauthenticated file read, write, and deletion in AutomationDirect Productivity Suite 4.4.1.19 arises because the ProductivityService PLC simulator binds to an unrestricted IP address and does not require credentials or user interaction. Any network-reachable attacker can invoke file operations to read, write, or delete arbitrary files and folders under the service's permissions, although realistic exposure depends on whether the OT engineering workstation or simulator is reachable from untrusted segments. No public exploit was identified at time of analysis, and EPSS is low at 0.66% (51st percentile), but the potential impact is severe where the service is exposed.
Improper access control in Microsoft's Azure Notification Service lets an already-authorized, low-privileged principal bypass authorization boundaries and elevate privileges over the network, with full impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, HIGH). The exploit path requires only low privileges (PR:L), low complexity (AC:L), and no user interaction (UI:N), so any tenant or service principal with legitimate but limited access is a potential launching point; anonymous outsiders cannot exploit it. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, and the EPSS score of 0.55% (44th percentile) reflects low near-term exploitation likelihood. Because this is a Microsoft-hosted cloud service, the fix is applied server-side by Microsoft rather than requiring customer patching.
Authentication bypass in Arista's Captive Portal (CVE-2025-6979, documented as security advisory SA-0123) allows a remote, unauthenticated attacker to reach resources that the portal is supposed to protect, with high impact to confidentiality, integrity and availability (CVSS 8.8). Exposure is limited to environments where the captive portal feature is actually deployed - typically guest or onboarding access control on Arista wireless and edge infrastructure - and the assessed vector requires user interaction (UI:R), which rules out fully automated, drive-by mass exploitation but not targeted social-engineering attacks against guests. Risk is meaningful for organizations running guest portals, although EPSS is low (0.53%, roughly the 43rd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; treat this as a genuine high-severity issue requiring prompt patching rather than an emergency.
Local privilege escalation in MongoDB BI Connector ODBC driver versions 1.0.0 through 1.4.6 occurs when the Windows installer is used to place the driver in a custom installation path, because the installer applies overly permissive directory permissions that a low-privileged local user can leverage to elevate privileges. Affected systems are Windows hosts running the BI Connector ODBC driver with a non-default install location; default installations into standard protected directories are likely unaffected. Exploitation requires authenticated local access as a low-privileged user plus the custom-path precondition, and no public exploit code has been identified at time of analysis (EPSS 0.17%, 5th percentile, no CISA KEV listing).
Local privilege escalation in the MongoDB Atlas SQL ODBC driver on Windows (versions 1.0.0 through 2.0.0) allows an authenticated low-privileged attacker to gain elevated privileges by exploiting incorrect default permissions (CWE-276). The driver installation leaves files or directories writable by non-administrative users, enabling tampering with components that are later executed with higher privileges. No public exploit has been identified, and the EPSS score is low (0.13%, 2nd percentile), making this a credible but non-urgent local issue that requires a pre-existing foothold on the target system.
Relative path traversal (ZipSlip) in AutomationDirect Productivity Suite 4.4.1.19 can turn a tampered project file into arbitrary code execution when an engineer opens it, because malicious archive paths escape the intended extraction directory. Exploitation is conditional: an attacker must first modify or deliver a malicious project and then convince a user to open it in the affected software, making this a targeted OT engineering-workstation risk rather than an internet-facing service emergency. No KEV entry or public exploit was identified at time of analysis, and EPSS is low at 0.54% (44th percentile).
Local privilege escalation in I-O DATA NAS management applications, including NarSuS App and Clone for Windows, allows a local attacker who can write to the root of the system drive to plant a binary that a vulnerable unquoted service path executes with SYSTEM privileges. The issue is CWE-428 and is gated by a service restart, so practical exploitation requires an existing foothold and either prior administrative access or a misconfigured ACL granting write access to C:\. No public exploit identified at time of analysis, and the EPSS score is 0.20% (9th percentile), which supports a moderate rather than urgent priority.
Relative path traversal (CWE-23) in the ProductivityService PLC simulator component shipped with AutomationDirect Productivity Suite 4.4.1.19 lets unauthenticated remote attackers reach the simulator over the network and delete arbitrary files on the host, hitting integrity and availability with no confidentiality exposure. The assessed vector (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:H) confirms no credentials or user interaction are needed, but the CVSS 4.0 AT:P flag and the assessed precondition make clear that exploitation depends on the simulator actually running and being network-reachable - environments that do not launch or expose this development feature are not exposed. No public exploit code or active exploitation has been identified at time of analysis (EPSS 0.62%, ~48th percentile), so the residual risk is driven by exposure of the simulator rather than by observed attack activity.
Relative path traversal in AutomationDirect Productivity Suite 4.4.1.19 allows an unauthenticated remote attacker to write arbitrary files outside the intended directory by interacting with the ProductivityService PLC simulator, causing high availability impact and limited integrity impact while confidentiality is unaffected. Exploitation requires the simulator service to be running and network-reachable, and no public exploit code was identified at time of analysis; EPSS is 0.62% (48th percentile), so prioritization should focus on exposure of the simulator to untrusted networks.
Unauthenticated remote file read affects AutomationDirect Productivity Suite 4.4.1.19 through a relative path traversal in the ProductivityService PLC simulator, allowing an attacker who can reach the simulator to read arbitrary files on the host. Impact is limited to confidentiality-PLC logic modification and denial of service are not indicated-and exploitation depends on the simulator being running and network-exposed. No public exploit was identified at time of analysis, EPSS is 0.62% (49th percentile), and the overall signal is moderate rather than alarming.
Authentication bypass in HashiCorp Vault's AWS Auth method allows an attacker with valid AWS credentials to authenticate as a bound IAM principal when a role's bound_iam_principal_arn is identical across multiple AWS accounts or contains a wildcard. The flaw is configuration-gated: deployments using uniquely scoped, per-account, non-wildcard bindings are not exploitable, while successful exploitation can yield high confidentiality and integrity impact. It is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27; no public exploit identified at time of analysis, and EPSS is 0.49%.
Unauthenticated remote attackers can invoke the APIs of the OctoPrint-SpoolManager plugin, because the plugin's API blueprint declared is_blueprint_protected() as False (removing the API-key requirement) and failed to enforce permission checks on sensitive operations, allowing spool metadata, settings and other plugin data to be read or modified without any credentials. The affected releases are 1.7.7 and earlier on the stable branch and 1.8.0a2 and earlier on the testing branch; the vendor has released fixes in 1.7.8 and 1.8.0a3 respectively, and the vendor notes that impact is greatly reduced on OctoPrint 1.11.2 and newer, which is why the assessed CVSS vector carries AC:H despite PR:N. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; EPSS is modest at 0.45% (37th percentile), and real-world exposure is further limited because OctoPrint instances are typically bound to a LAN or placed behind an authenticating reverse proxy rather than exposed to the internet.
Cross-account IAM role impersonation in OpenBao's auth-aws plugin (versions up to and including 0.1.0) lets an authenticated attacker holding credentials for an IAM role in an untrusted AWS account authenticate to OpenBao by presenting a role name that collides with a trusted role in a different account, granting unauthorized access to secrets, data, and elevated privileges. The flaw is rooted in a client cache that is keyed only by AWS region and STS role and fails to incorporate the AWS Account ID, so a cached credential for one account is reused for another. Exploitation is environment-gated: it only affects multi-account AWS deployments where IAM role names are not globally unique, and a role-name collision must exist; EPSS is low (0.27%, 17th percentile) and no public exploit code has been identified at time of analysis.
Uninitialized pointer access in the NVIDIA Virtual GPU Manager lets a malicious guest VM running on a vGPU-enabled hypervisor host corrupt host-side memory, potentially achieving code execution in the hypervisor context, denial of service, privilege escalation, information disclosure, or data tampering. Per the CVSS vector (AV:L/PR:L/UI:N), exploitation requires an attacker to already control a guest with a vGPU assigned and to hold low privileges inside that guest; no network reachability or host-side user interaction is needed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and EPSS is low at 0.18% (7th percentile), so this is a moderate, non-urgent priority concentrated in multi-tenant GPU-virtualized deployments.
Privilege escalation in NVIDIA Project G-Assist (CVSS 7.8 HIGH) allows a low-privileged local attacker to elevate permissions on systems where the opt-in feature is installed and running, potentially leading to code execution, data tampering, denial of service, and information disclosure. The flaw is rooted in CWE-276 incorrect default permissions and requires an existing local account; it is not remotely exploitable. No public exploit identified at time of analysis; EPSS is low at 0.17% (5th percentile).
Reflected cross-site scripting in Proliz Software OBS (Student Affairs Information System) prior to V26.0401 allows remote attackers to execute arbitrary JavaScript in a victim's browser session after luring them to click a crafted link. The high CVSS of 7.6 reflects unauthenticated network exploitation with high confidentiality impact, though no public exploit identified at time of analysis and EPSS data was not provided. The flaw was reported by Turkey's national CERT (USOM), indicating regional relevance for Turkish higher-education institutions that use this Student Affairs platform.
Unauthenticated denial of service affects HashiCorp Vault and Vault Enterprise because JSON request payloads are processed before rate limiting is applied, a regression from the prior HCSEC-2025-24 fix. Network-reachable deployments running Vault Community Edition before 1.21.0 or Vault Enterprise before 1.16.27, 1.19.11, 1.20.5, and 1.21.0 can be made unavailable through resource exhaustion; no public exploit identified at time of analysis and EPSS is low at 0.53% (44th percentile).
Information disclosure in Arista Captive Portal allows remote, unauthenticated attackers to access sensitive data when the feature is enabled and network-reachable. The vulnerability has a CVSS score of 7.5 (HIGH) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating low attack complexity, no authentication or user interaction required, and high confidentiality impact with no integrity or availability impact. Affected are Arista devices with the Captive Portal feature enabled; exact versions are detailed in Arista Security Advisory 0123. No public exploit code is identified at time of analysis, and the EPSS score is 0.48% (40th percentile), suggesting a low likelihood of exploitation activity.
Remote denial-of-service in libsoup affects GNOME and WebKit-based applications that rely on the library for HTTP/2 client communication. A race in the asynchronous message-queue handling lets a queue item be freed twice when network operations are aborted at precise timing, producing a use-after-free that crashes the consuming application. Red Hat reported the issue and has shipped errata fixes; there is no public exploit identified at time of analysis and the flaw is confined to availability impact (no code execution or data exposure indicated).
MinKNOW 24.11 and earlier (Oxford Nanopore Technologies) writes authentication tokens into a world-readable file under the host's system temporary directory (/tmp), so any local user or application on the sequencer host can read the token. Where remote access is enabled on the instrument - either because an operator turned it on for legitimate workflows or because separate malware with elevated privileges enabled it - the leaked token permits unauthorized remote connections and creation of developer tokens with arbitrary expiration dates, yielding persistent access that bypasses normal authentication. The issue has no public exploit identified at time of analysis, carries a low EPSS of 0.16% (4th percentile), and depends on stacked prerequisites (a local read of the token plus remote access being switched on), making it a conditional post-compromise persistence and lateral-movement amplifier rather than an unauthenticated remote entry point.
AutomationDirect Productivity Suite v4.4.1.19 permits local attackers with access to the software or an encrypted project file to decrypt that project by correctly answering only one forgotten-password recovery question, bypassing the intended project-password protection (CWE-640). Exploitation requires local access and successful knowledge or guessing of the recovery answer, with no user-interaction requirement; EPSS is low at 0.14% (3rd percentile), and no public exploit or CISA KEV entry was identified at time of analysis.
Pre-authentication remote code execution in Kottster development mode (versions 3.2.0 through 3.3.1) allows an attacker who can reach a locally running dev instance to reinitialize the application, mint a new root JWT, and execute arbitrary system commands via the installPackagesForDataSource action. Production deployments are never affected, and exploitation requires the development server to be exposed to untrusted networks. No public exploit has been identified at time of analysis, and the vendor released a patch in version 3.3.2.
Reaching or remotely setting the January 19, 2038 32-bit Unix epoch boundary on a Veeder-Root TLS4B automatic tank gauge (ATG) causes the system clock to wrap to December 13, 1901, which breaks authentication and disables core functions such as login, history viewing, and leak-detection termination. An attacker with authenticated low-privilege access to the device's network-reachable time-configuration function can deliberately force this state to lock out administrators and stall operational timers; the same failure also occurs spontaneously when real-world time reaches 2038, so the practical limiting factor is reachability of and authentication to the time-setting interface rather than a special exploit condition. Impact is bounded to high availability loss and minor integrity effects (corrupted logs) with no confidentiality exposure and no scope change; CISA's ICS advisory ICSA-25-296-03 tracks the issue, EPSS is low at 0.45% (37th percentile), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Authenticated users of TESI Gandia Integra Total 4.4.2236.1 can abuse a path traversal flaw in the comprimir.php export function to force the server to build and return a ZIP archive containing files from outside the intended directory, including parent-directory paths reached with sequences such as ..\..\... Exploitation requires only a valid, low-privileged session and network access to the web interface (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so the impact is limited to confidentiality - there is no file write, modification, or denial-of-service capability - which makes this a moderate-priority rather than critical issue. No public exploit code and no CISA KEV listing were identified at time of analysis, and EPSS is low at 0.38 percent (29th percentile), although the vendor/NVD CVSS 4.0 score of 7.1 reflects the high confidentiality impact.
Denial of service in Vilar VS-IPC1002 IP cameras (confirmed on firmware 1.1.0.18) allows an unauthenticated attacker located on the same local network segment to render the device completely unresponsive by sending a single crafted request to the /cgi-bin/action CGI endpoint; recovery requires a manual power cycle or restart. No credentials or user interaction are needed, and the CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:H) confirms the adjacent-network prerequisite and high availability impact, while the CVSS 3.1 assessment (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms no confidentiality or integrity loss. Exploitation is bounded to the LAN and there is no public exploit code identified at time of analysis, no CISA KEV listing, and a low EPSS score of 0.23% (13th percentile); the vendor did not respond to CERT.PL, so no vendor-released patch is identified at time of analysis. This is a genuine but geographically-contained availability threat, not a widespread emergency.
Unauthenticated remote attackers can make the Liferay Portal ComboServlet merge an unbounded number and size of files named in the URL query string, producing very large HTTP responses that degrade portal availability across Liferay Portal 7.4.0 through 7.4.3.111, older unsupported releases, and Liferay DXP 2023.Q4.0-2023.Q4.2, 2023.Q3.1-2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35. The assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, 5.3) confirms an availability-only, partial impact with no confidentiality or integrity loss, and no authentication, user interaction or non-default configuration is required beyond the ComboServlet being network-reachable. Risk is moderate rather than urgent: EPSS is 0.55% (45th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis.
Username enumeration in Tibbo AggreGate Network Manager before 6.40.05 lets an unauthenticated remote attacker distinguish valid accounts from invalid ones because the login endpoint returns different failure responses depending on whether the supplied username exists. The flaw does not grant access on its own; its value is as a reconnaissance step that feeds targeted brute-force or credential-stuffing against confirmed accounts, so real-world risk depends on weak or reused passwords. There is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score is low (0.53%, roughly the 43rd percentile), consistent with a genuine but low-priority information-disclosure issue rather than a high-impact one.
Liferay Portal 7.4.0 through 7.4.3.109 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, and 7.3 GA through update 35 can expose their OpenAPI YAML specification when access restrictions are not properly enforced in certain circumstances. Unauthenticated remote attackers can retrieve the API description document through a crafted URL, gaining reconnaissance-level information but not write access, data modification, or code execution. No public exploit or CISA KEV confirmation is identified in the provided data, and EPSS is low at 0.40% (33rd percentile).
Tibbo AggreGate Network Manager versions below 6.40.05 expose Java system properties, server path details, and version information to unauthenticated remote attackers through the /cwmp/happyaxis.jsp diagnostic endpoint, requiring no credentials or user interaction (CVSS 4.0 6.9, CVSS 3.1 C:L). The EPSS score is 0.37% (29th percentile) and no public exploit identified at time of analysis; this CWE-497 information disclosure is reconnaissance-only and does not by itself grant access, modify data, or disrupt service, though internet-exposed instances remain the highest risk.
Email enumeration in the Frontier Airlines website allows unauthenticated remote attackers to determine whether a given email address is associated with a Frontier account. This information disclosure (CWE-204) has a low confidentiality impact and no public exploit identified at time of analysis; the CVSS 4.0 base score is 6.9, but the real-world risk is low-to-moderate because exploitation is confined to the hosted service and value depends on chaining harvested addresses into phishing or credential stuffing.
Local privilege escalation in AutomationDirect Productivity Suite 4.4.1.19 is a moderate-risk flaw that allows an authenticated low-privileged user with access to the engineering workstation to change their own role assignment and obtain full project control, primarily threatening project integrity and availability. The assigned CVSS is 6.9, and the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, confirming the attack requires local access and a pre-existing low-privileged account, with no user interaction and no confidentiality impact; there is no remote unauthenticated path. EPSS is low at 0.15% (4th percentile), and the provided intelligence contains no CISA KEV confirmation or public exploit code, so no public exploit was identified at time of analysis.
A local denial-of-service condition affects Oxford Nanopore Technologies' MinKNOW sequencing control software at version 24.11 and earlier, where the startup routine writes the local authentication token to a temporary file inside a directory that is readable and writable by all users on the host before relocating it to its final location. An attacker holding a low-privileged local account or running an unprivileged local process can call flock() on that temporary file to block MinKNOW from finishing token generation, leaving the instrument without a valid local token so that it cannot execute sequencing commands; the result is an availability-only outage (no confidentiality or integrity impact, no code execution). There is no public exploit identified at time of analysis, and EPSS is very low at 0.16% (4th percentile), so this is best treated as a low-priority, locally-scoped nuisance/availability bug rather than a broadly exploitable threat.
Cleartext storage of a signing key in the Gallagher Command Centre Server's Morpho biometric integration allows an authenticated, high-privilege administrator with access to the Command Centre Server itself to export that key while it is in use, enabling the deployment of a compromised or counterfeit Morpho device on the affected site. The vulnerability is local (AV:L) and requires PR:H privileges, effectively restricting exploitation to trusted administrators or an attacker who already holds an administrative foothold on the server, and it only applies where the Morpho integration is actually configured and active. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and the EPSS score is low at roughly 0.10% (1st percentile); Gallagher has issued fixed maintenance releases for supported branches 9.20, 9.10, and 9.00, while 8.90 and earlier have no fix identified.
A memory leak exists in FontForge 20230101 within the DlgCreate8 dialog routine in gdraw/gaskdlg.c, where a formatted message buffer is allocated but never released when the function takes its error-return path. The realistic exposure is a local user opening or processing attacker-supplied input in the GUI and repeatedly reaching that error path, producing cumulative heap growth that can degrade or crash the editor; the assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) rates impact as availability-only and low, well below the NVD base score of 6.5. No public exploit code has been identified at time of analysis, EPSS is 0.26% (18th percentile), and there is no CISA KEV listing; an upstream fix exists as a pull request that adds the missing free().
CRLF injection in KeeneticOS before version 4.3 enables full device takeover by exploiting the /auth API endpoint to inject crafted HTTP headers that create additional administrator-level user accounts. The attack requires social engineering the device owner into visiting a malicious page, after which the injected CRLF sequences manipulate the API response to silently add a full-permission user the attacker controls. No public exploit has been identified at time of analysis, though a detailed writeup is publicly available on GitHub, which significantly lowers the barrier to weaponization.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions up to and including 5.4.5) lets authenticated users with Contributor-level access or higher inject arbitrary JavaScript through the 'percentage' parameter of the Progress Bar content element. The injected script persists in page content and executes in the browser of any admin or visitor who later loads the affected page, potentially leading to session abuse or content tampering in the site's context. Exploitation requires a valid contributor account and a victim viewing the page; there is no confirmed actively exploited status (not in CISA KEV) and no public exploit code identified at time of analysis, with EPSS at 0.23% (13th percentile) indicating low predicted exploitation likelihood. This is a legitimate but low-priority finding.
Privilege escalation to container root in Red Hat Container-native Virtualization (CNV) images allows an attacker with command execution inside an affected container and membership in the root group (GID 0) to gain full UID 0 privileges within that container. The flaw originates during image build time, where /etc/passwd is incorrectly created with group-writable permissions (CWE-276), enabling root-group members to inject arbitrary user entries - including those with UID 0. No public exploit code has been identified at time of analysis, and Red Hat has released remediation via multiple enhancement advisories. Exploitation probability appears low given the high CVSS complexity and privilege requirements.
Unauthenticated remote attackers can delete arbitrary directories on engineering workstations running AutomationDirect Productivity Suite 4.4.1.19 by sending relative path traversal sequences to the bundled ProductivityService PLC simulator, provided that service is running and reachable over the network. The flaw is a medium-severity CWE-23 path traversal with integrity-only impact (no code execution, no data disclosure), reported by CISA ICS-CERT as ICSA-25-296-01 and scored 6.3 under CVSS 4.0; our independent assessment rates it comparably under CVSS 3.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L) because the attack requirement (AT:P) that the simulator be active and exposed substantially limits real-world reach. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS is low at 0.51% (42nd percentile), consistent with the typical OT deployment where such engineering software sits on segmented or firewalled networks rather than direct internet exposure.
AutomationDirect Productivity Suite 4.4.1.19 contains a relative path traversal (CWE-23) in its ProductivityService PLC simulator that lets an unauthenticated remote attacker create arbitrary directories on the target host. Exposure is limited to systems where the simulator service is active and reachable over the network, so segmented engineering workstations are largely insulated. Impact is integrity-only - no code execution, data disclosure, or denial of service - with low EPSS (0.51%) and no public exploit or CISA KEV entry identified at time of analysis.
Reflected cross-site scripting in Mingsoft MCMS v6.0.1 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL containing a malicious payload. The CVSS scope change (S:C) indicates impact extends beyond the web application itself into the victim's browser trust context, enabling session hijacking or credential theft. No public exploit identified at time of analysis beyond the referenced GitHub gist, and EPSS of 0.22% (13th percentile) signals very low current exploitation interest.
Stored cross-site scripting on the KeeneticOS 'Wireless ISP' page enables a physically proximate attacker to compromise a Keenetic router by injecting a malicious payload-likely via a crafted nearby wireless network name (SSID)-that executes in an authenticated administrator's browser session. Successful exploitation allows the attacker to create additional users with full administrative permissions, resulting in complete device takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS probability stands at 0.03%, indicating limited current exploitation activity.
Prototype pollution in the merge() helper of the Rollbar.js browser/Node logging SDK lets attacker-supplied data corrupt Object.prototype when a consuming application passes untrusted values into rollbar.configure(). Only npm/rollbar releases before 2.26.5 and the 3.0.0-alpha1 through 3.0.0-beta4 pre-releases are affected; per the CVSS vector the attack is network-reachable and requires no authentication or user interaction (PR:N/UI:N), though exploitation is conditional on the host application forwarding attacker-controllable input to configure(), which is why complexity is rated High (AC:H). Impact is limited to integrity (I:H) with no confidentiality or availability effect, EPSS is low at 0.39% (31st percentile), and no public exploit code or active exploitation has been identified at time of analysis.