Broad data compromise in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.62 allows a low-privileged, network-adjacent attacker to reach any data the platform can access. The flaw sits in the Security component and is characterized by improper access control (CWE-284, tagged as Authentication Bypass), letting an authenticated-but-unprivileged user read, create, delete, or modify critical data across the deployment. There is no public exploit identified at time of analysis, EPSS risk is very low (0.03%), and it is not on CISA KEV.
Password reset poisoning in LinkAce (self-hosted link archive by Kovah) before 2.5.4 allows a remote attacker to hijack accounts by injecting a malicious host into reset URLs. Because the app trusts the X-Forwarded-Host header when building password reset links, an attacker who triggers a reset for a victim can cause the emailed link to point to an attacker-controlled domain; if the victim clicks it, the valid reset token leaks to the attacker, enabling full account takeover. No public exploit identified at time of analysis, and EPSS is very low (0.03%), consistent with SSVC exploitation status of 'none'.
CSS injection in FreeScout mailbox signatures enables CSRF token exfiltration and privilege escalation from authenticated agents to administrators. The vulnerability exists in FreeScout versions prior to 1.8.213 where incomplete input sanitization fails to strip <style> tags from mailbox signature fields. Attackers with mailbox configuration access leverage CSS attribute selectors to steal CSRF tokens from viewing users, then perform arbitrary state-changing actions including admin account creation. EPSS data not available; no confirmed active exploitation (CISA KEV absent). Vendor patch released in version 1.8.213 with complete fix addressing previous incomplete remediation (GHSA-jqjf-f566-485j).
OS command injection in GitHub Enterprise Server (all releases prior to 3.21) lets an authenticated Management Console administrator run arbitrary shell commands on the underlying appliance by embedding shell metacharacters in proxy configuration fields such as http_proxy. The flaw was reported through the GitHub Bug Bounty program and there is no public exploit identified at time of analysis; EPSS is negligible (0.01%, 3rd percentile) and CISA SSVC rates exploitation as none. Because it requires high-privilege console access, it is primarily a privilege-boundary escape from Management Console admin to full OS-level control rather than a remotely reachable pre-auth issue.
Command injection in Tenda W30E router firmware V16.01.0.21 allows unauthenticated remote attackers to execute arbitrary system commands via the 'hostName' parameter in the diagnostic ping function. Attack requires only network access to the router's web interface with no authentication or user interaction. Proof-of-concept exploit code is publicly available (SSVC exploitation status: POC). EPSS data not available, but SSVC framework marks this as automatable with partial technical impact, making it suitable for mass scanning campaigns targeting exposed Tenda routers.
Full compromise of Oracle Application Development Framework (ADF Faces component) is possible by an authenticated low-privileged user with local logon access to the host where ADF executes, affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. The improper access control weakness (CWE-284) yields complete confidentiality, integrity, and availability loss ("takeover") with a CVSS 3.1 base score of 7.8. No public exploit identified at time of analysis; the EPSS probability is negligible at 0.01% (2nd percentile) and CISA SSVC records exploitation as none.
Local privilege escalation in Honor AiAssistant (all versions) allows authenticated users with low privileges to gain full system control (high impact on confidentiality, integrity, and availability) through authentication bypass. Vendor advisory confirmed by Honor with CVSS 7.8. No active exploitation confirmed; EPSS data not yet available as this is a recently disclosed 2026 CVE.
Buffer overflow in Firefox WebRTC networking component allows local attackers to execute arbitrary code with high impact to confidentiality, integrity, and availability. Affects Firefox versions prior to 150 and Firefox ESR prior to 140.10. No public exploit identified at time of analysis. CVSS 7.8 reflects high severity but requires local access and user interaction, limiting remote attack surface. Mozilla has released patches in Firefox 150 and Firefox ESR 140.10.
Sandbox escape in Claude Code versions prior to 2.1.64 enables arbitrary file writes outside the workspace by exploiting symlink handling between sandboxed and unsandboxed processes, potentially leading to code execution. The vulnerability requires prompt injection to trigger malicious sandboxed code execution, creating an exploitable chain where neither component can independently breach the sandbox but their interaction does. EPSS score of 0.08% (23rd percentile) suggests limited real-world exploitation likelihood, and CISA SSVC indicates no known exploitation with non-automatable attack requirements. Version 2.1.64 patches this issue, auto-deployed to standard installations.
Cross-origin data exfiltration in Glances web server allows remote unauthenticated attackers to read sensitive system information (CPU, memory, processes, network stats) through the REST API endpoint /api/4/* via malicious websites exploiting permissive CORS policy. Affects all versions prior to 4.5.4. EPSS score of 0.06% (18th percentile) suggests low widespread exploitation probability despite proof-of-concept availability, though the network-accessible, unauthenticated attack vector (AV:N/PR:N) combined with high confidentiality impact (VC:H) makes this a priority for internet-exposed instances.
Credential leakage in Tekton Pipelines git resolver allows authenticated users to exfiltrate system-configured Git API tokens (GitHub PAT, GitLab tokens) by directing the resolver to attacker-controlled endpoints. Affects versions 1.0.0 through 1.10.0 when users omit the token parameter in TaskRun or PipelineRun configurations. CVSS 7.7 with scope change reflects cross-tenant credential theft potential in multi-tenant Kubernetes environments. No active exploitation confirmed (not in CISA KEV), but exploitation is straightforward for authenticated cluster users with TaskRun/PipelineRun creation privileges.
Server-side request forgery in WWBN AVideo 29.0 and earlier lets an authenticated upload-capable user bypass the isSSRFSafeURL() same-domain shortcircuit by supplying the site's own public hostname with a non-standard port, causing the server to fetch arbitrary internal ports and save the response to a web-accessible cache path for full exfiltration. The flaw carries a CVSS 7.7 (scope-changing confidentiality impact) and publicly available exploit code exists via the GitHub Security Advisory, though it is not listed in CISA KEV and EPSS probability is negligible (0.03%, 8th percentile).
Authorization bypass in NVIDIA KAI Scheduler allows authenticated network attackers to access protected API endpoints and disclose sensitive information across security boundaries. The vulnerability (CWE-306: Missing Authentication for Critical Function) enables low-privileged authenticated users to read high-value data outside their intended scope (CVSS scope changed to 'C', high confidentiality impact). NVIDIA has published advisory 5818 with remediation guidance. No evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis.
Privilege escalation in FreeScout versions prior to 1.8.214 allows low-privileged agents to hijack hidden customer email addresses across mailbox boundaries, disclosing confidential customer names, profile URLs, and reassigning conversations from restricted mailboxes to attacker-controlled customer records. The vulnerability enables authenticated agents to bypass mailbox isolation controls and access data they should not see. CVSS score of 7.6 (High) reflects network-exploitable access with high integrity impact; EPSS and KEV data not provided in intelligence sources.
Privilege-based compromise of the Oracle Applications DBA product (ADPatch component) within Oracle E-Business Suite 12.2.3 through 12.2.15 allows an already high-privileged attacker with HTTP network access to fully take over the Applications DBA and, via a scope change, significantly impact additional products. Exploitation is rated difficult and requires human interaction from a victim other than the attacker. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%, 10th percentile), and it is not in CISA KEV, indicating low real-world exploitation pressure despite the high CVSS score.
Weak password policy enforcement in Quantum Networks router QN-I-470 version 6.1.1.B1 enables adjacent network attackers to gain unauthorized administrative access through password brute-force attacks. CVSS 7.6 reflects adjacent network requirement (AV:A) and high complexity (AC:H), limiting exploitation to attackers already on the local network segment. No active exploitation confirmed (not in CISA KEV), but authentication bypass via brute-force is a well-understood attack primitive requiring only network proximity and time.
Remote denial of service in Coturn TURN/STUN server allows unauthenticated attackers to crash ARM64 deployments with a single malformed UDP packet. The vulnerability triggers a fatal SIGBUS signal via misaligned memory access during STUN attribute parsing, requiring no authentication or special configuration. All ARM64 installations of Coturn prior to 4.10.0 are vulnerable to instant process termination. EPSS exploitation probability is not yet available as this is a newly disclosed CVE, but the attack complexity is low (AC:L) and requires no privileges (PR:N), making exploitation trivial once awareness spreads in attacker communities.
Use-after-free memory corruption (CWE-416) in Mozilla Firefox 149 and ESR 115.34/140.9, plus the shared Gecko engine in Thunderbird 149 and Thunderbird ESR 140.9, can lead to arbitrary code execution within the browser process when a victim renders attacker-controlled web content. This is a rolled-up batch of memory-safety bugs reported by Mozilla's own developers; Mozilla states some showed evidence of memory corruption presumed exploitable for code execution. There is no public exploit identified at time of analysis, the bug is not in CISA KEV, and EPSS is very low (0.06%, 17th percentile), consistent with the CVSS 7.5 rating being held down by high attack complexity (AC:H) and required user interaction (UI:R).
Remote attackers can crash Mozilla Firefox by triggering a use-after-free in the JavaScript Engine, exploiting freed memory during JS execution to cause denial of service. Affects all unpatched Firefox versions below 150, ESR 115.35, and ESR 140.10. CVSS 7.5 (High) reflects network-accessible exploitation with no authentication required, though SSVC assessment indicates non-automatable exploitation with partial technical impact. No public exploit code or active exploitation (KEV) confirmed at time of analysis, and ENISA tracking suggests European-focused monitoring.
High-severity denial-of-service condition in Mozilla Firefox DOM processing allows remote attackers to crash the browser via network-delivered content without authentication or user interaction. Fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10. CVSS 7.5 reflects network attack vector with low complexity (AV:N/AC:L/PR:N/UI:N) but impact limited to availability (A:H). EPSS data not provided. Not listed in CISA KEV, indicating no confirmed active exploitation. SSVC framework rates exploitation as 'none' and technical impact as 'partial', suggesting lower real-world priority despite high CVSS score.
Account takeover in GitHub Enterprise Server (all versions prior to 3.21) is possible through an OAuth redirect URI validation bypass caused by a flawed regular expression (CWE-185). An attacker who knows a first-party OAuth application's registered callback URL can craft a malicious authorization link that leaks the victim's OAuth authorization code to an attacker-controlled domain, granting access to the victim's account with the scopes of that application. Reported via the GitHub Bug Bounty program; there is no public exploit identified at time of analysis, EPSS is very low (0.05%), and CISA SSVC records exploitation status as none.
Unlimited credential brute-forcing against blueprintUE Self-Hosted Edition login form allows remote attackers to enumerate valid accounts and compromise credentials through dictionary attacks, credential stuffing, or exhaustive guessing. The login handler (versions prior to 4.2.0) implements zero rate limiting, no progressive delays, no account lockouts, and no CAPTCHA challenges, enabling attackers to submit authentication attempts at full network speed. While a strong password policy is enforced (10+ characters, mixed case, digit, special), this does not prevent attacks using breached credential databases or targeted guessing against predictable passwords. EPSS exploitation probability data not available; no public exploit code or active exploitation confirmed at time of analysis.
Multiple memory corruption bugs in Firefox ESR 140.9, Firefox 149, Thunderbird ESR 140.9, and Thunderbird 149 could enable remote code execution against users visiting malicious websites. Mozilla has fixed these memory safety vulnerabilities in Firefox 150 and Firefox ESR 140.10, with vendor advisories (MFSA2026-30, MFSA2026-32, MFSA2026-33, MFSA2026-34) confirming patches are available. EPSS score of 0.05% (14th percentile) indicates low observed exploitation probability, and no public exploit identified at time of analysis, though SSVC framework assesses total technical impact if successfully weaponized.
Memory corruption in Firefox's Widget: Cocoa component on macOS enables remote denial of service through use-after-free exploitation. Mozilla patched this in Firefox 150 and Firefox ESR 140.10 after internal discovery. The CVSS vector indicates network-accessible exploitation requiring no authentication or user interaction, though SSVC assessment classifies technical impact as partial and exploitation as non-automatable. No public exploit identified at time of analysis, with SSVC indicating no evidence of active exploitation.
High-severity denial-of-service in Firefox WebRTC component allows remote unauthenticated attackers to crash the browser via network-based use-after-free memory corruption. Affects Firefox versions prior to 150 and Firefox ESR prior to 140.10. Vendor-released patches available (Firefox 150, Firefox ESR 140.10). CVSS 7.5 reflects high availability impact with low attack complexity and no privileges required. No public exploit identified at time of analysis, though SSVC framework classifies technical impact as partial and exploitation as none, suggesting limited real-world activity despite the theoretical ease of exploitation indicated by CVSS.
Signal K Server versions before 2.25.0 allow remote unauthenticated attackers to crash the server via Regular Expression Denial of Service (ReDoS) in WebSocket subscription handling. By injecting unescaped regex metacharacters into the context parameter, attackers trigger catastrophic backtracking that consumes 100% CPU and renders the server completely unresponsive to all API and socket requests. This creates a complete denial of service for marine navigation systems relying on Signal K Server as their central data hub. While EPSS score is low (0.04%, 13th percentile), the trivial exploitation complexity (AV:N/AC:L/PR:N/UI:N) and complete availability impact make this a priority for boat operators running vulnerable versions. No public exploit identified at time of analysis, but the GitHub security advisory provides clear technical details. Vendor-released patch available in version 2.25.0.
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over the VirtualBox Remote Desktop Protocol (VRDP/RDP) service trigger a hang or repeatable crash, producing a complete availability loss of the virtualization host process. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%, 12th percentile), so while the flaw is network-reachable and unauthenticated, real-world exploitation pressure currently appears minimal. Note that the supplied 'Authentication Bypass' tag conflicts with the availability-only CVSS vector - the confirmed impact is DoS, not auth bypass.
Denial-of-service in Oracle Identity Manager Connector (Core component) version 12.2.1.4.0 lets a remote, unauthenticated attacker send network traffic over TCP to hang or repeatedly crash the service, producing a complete availability outage (CVSS 3.1 7.5). Oracle disclosed this in the April 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and EPSS is very low (0.04%). Confidentiality and integrity are unaffected - the impact is purely availability (CWE-400, resource exhaustion).
Denial of service in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated, network-based attacker to cause a hang or repeatable crash (complete availability loss) of the affected runtime. The flaw is described by Oracle as easily exploitable via multiple protocols against any application that feeds attacker-controlled data to the vulnerable networking APIs (e.g., an exposed web service). There is no public exploit identified at time of analysis; EPSS is very low (0.04%, 12th percentile) and CISA SSVC lists exploitation status as none, so this is a patch-in-cycle availability issue rather than an active threat.
Remote attackers can crash Nest.js applications (versions prior to 11.1.19) by sending approximately 47 KB of fragmented JSON messages within a single TCP frame, triggering a call stack overflow. The handleData() function's recursive processing of small valid JSON messages causes stack exhaustion before maxBufferSize limits are enforced, resulting in RangeError and denial of service. No authentication required (CVSS AV:N/PR:N). Vendor patch released in version 11.1.19. EPSS data not available; no confirmed active exploitation (not in CISA KEV).
Denial-of-service in Firefox versions prior to 150 allows remote attackers to crash the browser via malformed audio/video content during playback. The vulnerability requires no authentication and minimal attack complexity (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), enabling attackers to render the browser unresponsive or terminated through crafted media files. Mozilla has released Firefox 150 to address this issue. EPSS data not available; no evidence of active exploitation (not in CISA KEV), though SSVC assessment notes the vulnerability is not currently being exploited and is classified as non-automatable with partial technical impact.
Denial-of-service in Firefox's Audio/Video playback component allows remote attackers to crash the browser via network-based exploitation requiring no authentication or user interaction. Mozilla patched the vulnerability in Firefox 150. CVSS 7.5 (High) reflects high availability impact, but SSVC assessment marks it as partial technical impact with no confirmed exploitation, indicating lower real-world priority than critical RCE vulnerabilities. No public exploit code or CISA KEV listing identified.
Integer overflow in Firefox's WebGPU graphics component enables remote denial-of-service attacks against default browser configurations. Attackers can trigger high availability impact via network-accessible exploitation without authentication or user interaction. Mozilla patched this in Firefox 150, with SSVC framework rating it automatable with partial technical impact despite CVSS 7.5 severity. No active exploitation confirmed and EPSS data not provided for risk quantification.
Use-after-free in Firefox's WebAssembly JavaScript engine enables remote denial-of-service attacks against users running unpatched versions below Firefox 150. The vulnerability allows network-based attackers to crash the browser without authentication or user interaction by triggering memory corruption in WebAssembly processing. Mozilla patched this in Firefox 150 (MFSA2026-30). EPSS data not available, not listed in CISA KEV, and SSVC framework rates exploitation as 'none' with non-automatable, partial technical impact-suggesting lower real-world risk despite CVSS 7.5 severity.
Memory corruption in Firefox 149 and Thunderbird 149 enables remote code execution when users interact with malicious web content. Mozilla patched 55 distinct memory safety bugs in Firefox 150, some demonstrating memory corruption that could be weaponized for arbitrary code execution. While no public exploit is confirmed, the CVSS score of 7.5 reflects high complexity requiring user interaction, with SSVC assessment indicating total technical impact despite no current automation or active exploitation.
Information disclosure in Mozilla Firefox NSS Library component allows remote unauthenticated attackers to extract high-value confidential data via network-accessible boundary condition errors. Affects Firefox versions prior to 150, ESR 115.x prior to 115.35, and ESR 140.x prior to 140.10. SSVC framework classifies as automatable with partial technical impact. No public exploit identified at time of analysis, though SSVC automation rating and CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector indicate straightforward exploitation potential once vulnerability details are published.
Uninitialized memory in Firefox's Canvas2D graphics component allows remote attackers to disclose sensitive information from browser memory without authentication. Affects Firefox versions prior to 150, ESR prior to 115.35, and ESR prior to 140.10. The vulnerability carries a CVSS score of 7.5 with network-based exploitation requiring low complexity and no user interaction. SSVC framework indicates no confirmed exploitation and non-automatable attack, but EPSS data not available to assess real-world exploitation probability. Mozilla has released patches across all affected product lines.
Local file disclosure via XML External Entity (XXE) injection affects the lxml Python library (versions < 6.1.0) when applications parse untrusted XML using iterparse() or ETCompatXMLParser(), whose default configuration left resolve_entities=True. An unauthenticated remote attacker who can submit crafted XML to such an endpoint can read arbitrary local files readable by the process. There is no public exploit identified at time of analysis and EPSS risk is very low (0.03%), but exploitation is trivial (CVSS 7.5, AV:N/AC:L/PR:N/UI:N) wherever these two specific parsers are used.
Remote information disclosure in Mozilla Network Security Services (NSS) library allows unauthenticated attackers to extract high-sensitivity data via network requests with no user interaction. Affects Firefox versions prior to 150 and Firefox ESR prior to 140.10. The vulnerability stems from incorrect boundary condition handling (CWE-754) in NSS cryptographic libraries. Vendor-released patches available in Firefox 150 and Firefox ESR 140.10. SSVC framework classifies as automatable with partial technical impact, though no public exploit identified at time of analysis.
Unauthenticated information disclosure in Oracle Financial Services Transaction Filtering 8.1.2.8.0 (User Interface component) allows a remote attacker with only network/HTTP access to read all data accessible to the application. Oracle rates it CVSS 7.5 (confidentiality-only), and community tagging labels it an authentication bypass; there is no public exploit identified at time of analysis, with EPSS at a low 0.03% (9th percentile) and SSVC exploitation status 'none'.
Unauthorized data access in Oracle Database Server's Java VM component allows a remote, unauthenticated attacker to compromise the Java VM over Oracle Net (default port 1521) and read all data accessible to it, affecting versions 19.3-19.30 and 21.3-21.21. The flaw is rated CVSS 7.5 with confidentiality-only impact and is easily exploitable per Oracle, though EPSS is very low (0.03%, 9th percentile) and no public exploit identified at time of analysis. It is addressed in the Oracle Critical Patch Update of April 2026.
Unauthorized data disclosure in Oracle Financial Services Customer Screening 8.1.2.8.0 (User Interface component) allows a remote, unauthenticated attacker with only HTTP network access to read all data accessible to the application. The flaw is an authorization/access-control weakness (CWE-285) that yields high confidentiality impact without any integrity or availability effect. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.03%, 9th percentile), indicating no observed exploitation activity.
Unauthorized data access in Oracle Financial Services Analytical Applications Infrastructure (OFSAA) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 lets a remote, unauthenticated attacker read critical data over HTTP with no user interaction. The flaw stems from improper access control (CWE-284) in the Platform component and is tagged as an authentication bypass, though impact is limited to confidentiality (no data modification or denial of service). No public exploit has been identified at time of analysis and EPSS exploitation probability is very low (0.03%).
Unauthenticated information disclosure in Oracle WebLogic Server (Fusion Middleware, Web Services component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows a remote attacker with only HTTP network access to read critical data, potentially gaining access to all data accessible to the server. The flaw is rated CVSS 7.5 with confidentiality-only impact and is classified under CWE-200 (Information Exposure). Publicly available exploit code exists per the CISA SSVC assessment, but the vulnerability is not on the CISA KEV list and EPSS exploitation probability is very low (0.03%).
Unauthorized information disclosure in Oracle HCM Common Architecture (Knowledge Integration component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a remote, unauthenticated attacker read critical HCM data over HTTP without any user interaction. Oracle rates this 7.5 (confidentiality-only impact) and addressed it in the April 2026 Critical Patch Update. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%), but SSVC flags the attack as automatable.
Unauthorized data disclosure in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition arises from a flaw in the JAXP (Java API for XML Processing) component, allowing an unauthenticated remote attacker to read critical or all accessible data across affected JDK 8, 11, 17, 21, 25, and 26 builds. The confidentiality-only issue (CVSS 7.5, C:H/I:N/A:N) is easily exploitable over multiple network protocols, including via web services that pass attacker-supplied data into JAXP APIs, and also affects sandboxed Java Web Start/applet deployments running untrusted code. There is no public exploit identified at time of analysis and EPSS is very low (0.03%, 9th percentile), consistent with the SSVC exploitation status of 'none'.
Unauthorized data disclosure in Oracle Financial Services Analytical Applications Infrastructure (OFSAA) 8.0.7.9, 8.0.8.7, and 8.1.2.5 allows a remote, unauthenticated attacker to reach protected data over HTTP against the Platform component. Successful exploitation yields read access to critical or all OFSAA-accessible data with no integrity or availability impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%, 9th percentile), consistent with CISA SSVC scoring exploitation as 'none.'
Unauthenticated remote attackers can obtain sensitive information from Firefox's IP Protection component prior to version 150 via network-accessible requests with low attack complexity. The vulnerability leaks confidential data (CVSS:C=High) without requiring user interaction or special privileges, affecting all Firefox installations below version 150. Mozilla has released a vendor-confirmed patch in Firefox 150. No active exploitation (CISA KEV) or public exploit code identified at time of analysis, though CVSS vector indicates trivial exploitation conditions (AV:N/AC:L/PR:N/UI:N).
Denial of service in Go's x/image/webp library allows remote attackers to crash 32-bit applications by sending specially crafted WEBP images with invalid large size values, triggering runtime panic. Vendor patch released (version 0.39.0) with low EPSS score (0.02%) indicating minimal observed exploitation activity. Despite network vector and no authentication requirements (CVSS AV:N/PR:N), exploitation is platform-specific to 32-bit architectures only.
A mitigation bypass in Firefox for Android allows remote attackers to achieve high-impact integrity violations without authentication or user interaction. Fixed in Firefox 150, this CWE-200 information disclosure flaw enables attackers to circumvent existing security controls via network-based vectors. Despite a CVSS base score of 7.5 (High), real-world exploitation risk appears limited: EPSS probability is only 0.02% (5th percentile), no public exploit code has been identified, and CISA SSVC framework rates it as non-exploited with partial technical impact, though automatable.