Wazuh managers before 4.10.2 contain an out-of-bounds read in the Windows Event Channel decoder (DecodeWinevt) that is reachable by a compromised or maliciously enrolled agent sending a crafted winevt message. The over-read is triggered while parsing the message, but the leaked memory is only exposed when the manager runs with the non-default analysisd.debug=2 setting because the faulty access is evaluated in an mdebug2 diagnostic call; publicly available exploit code exists, with no CISA KEV confirmation of active exploitation. Consistent with the assessed CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L), impact is limited: a privileged/trusted agent position is required, attack complexity is high, and only limited confidentiality and availability effects are expected.
LiteLLM installations can expose stored API_KEY credentials through the health endpoint to authenticated users, with exploitation requiring a valid low-privileged account and some victim interaction. The issue is a low-severity information disclosure (CVSS 3.5) that can leak sensitive credentials but does not directly affect integrity or availability. No public exploit code was identified at time of analysis, and active exploitation is not confirmed.
An unprotected alternate MQTT authorization channel in the Dyson cloud backend allows a former owner of a Dyson device (for example a Pure Hot+Cool purifier/heater) to retain control after ownership is transferred, provided the device is not factory-wiped and the previously sniffed AWS credentials-AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN-together with the device serial number remain valid. Exploitation is heavily constrained: the attacker must have legitimately held the device with full privileges, capture the AWS credentials, and complete an ownership-transfer sequence to the victim; the resulting impact is limited to setting the room temperature within the safe operating range (up to 37 Celsius), with no code execution and no sensitive data disclosure. No public exploit code or confirmed active exploitation is known, and EPSS places the probability of exploitation within 30 days at roughly 0.38% (29th percentile); Dyson states it can no longer replicate the behavior, which dates to its 2022 firmware generation.