Use-after-free vulnerability in Foxit PDF Editor and PDF Reader allows local attackers to crash the application by manipulating document page lifecycle events, causing internal component states to desynchronize and subsequent operations to reference invalidated memory objects. Attack requires user interaction to open a malicious PDF file and does not enable information disclosure or code execution; impact is denial of service with CVSS 5.5 (medium severity). No public exploit code or active exploitation confirmed at time of analysis.
Authorization bypass in Ribblr Crochet & Knitting iOS version 2.5 allows authenticated users to access resources belonging to other users by manipulating user-controlled object identifiers, a class of flaw defined by CWE-639 (IDOR). The vulnerability is network-exploitable with low privilege and no user interaction required, but is constrained to confidentiality impact only - no integrity or availability exposure. No active exploitation has been confirmed (CISA KEV absent), and the EPSS score of 0.04% at the 11th percentile reflects minimal real-world exploitation probability at time of analysis.
Authorization bypass in SendPortal's workspace invitation handler allows authenticated low-privilege users to delete workspace invitations they do not own by manipulating the invitation identifier in the destroy endpoint. Versions 3.0.0 and 3.0.1 are confirmed affected per EUVD-2026-25896. The vendor has not responded to responsible disclosure; no patch is available, no public exploit code exists, and no active exploitation has been confirmed (not in CISA KEV), making this a low-urgency finding with limited blast radius.
Module import confusion in pip before version 26.1 allows a maliciously crafted wheel package to execute arbitrary code within pip's own process by exploiting the sequencing of pip's self-update check relative to wheel installation. Because pip deferred well-known module imports for startup performance and triggered the self-update check after wheels were installed, a freshly installed malicious module could shadow a legitimate import targeted by the self-update routine. No public exploit code is identified at time of analysis, EPSS sits at the 2nd percentile, and SSVC confirms no exploitation, though the CWE-829 root cause carries inherent supply-chain risk.
Elevation of Privileges in Dell Alienware Command Center (AWCC) versions prior to 6.13.8.0 allows a local low-privileged attacker to operate beyond their intended permission level due to a CWE-272 Least Privilege Violation. The CVSS vector (AV:L/AC:H/PR:L) confirms this is a local attack requiring an existing low-privileged foothold and elevated complexity conditions, with primary impact on system integrity (I:H). No public exploit or active exploitation has been identified at time of analysis; SSVC rates exploitation as 'none' and technical impact as 'partial', consistent with the moderate 5.3 base score.
Cypher injection in LogonTracer prior to v2.0.0 allows remote attackers to alter database contents by submitting specially crafted Windows event log data. The vulnerability requires user interaction to load the malicious log data but results in integrity compromise of the underlying database due to improper input sanitization in Cypher query construction.
uriparser before 1.0.1 suffers a numeric truncation vulnerability in text range comparison that causes denial of service when processing URIs with gigabyte-scale lengths. The flaw occurs because internal range comparisons truncate large numeric values, allowing maliciously crafted oversized URIs to bypass length validation and trigger memory exhaustion or processing failures. Local attackers can exploit this via specially constructed input, though practical exploitation requires an application to accept and process URIs of exceptional size.
Spring Boot's Elasticsearch auto-configuration omits hostname verification when an SSL bundle is used, opening TLS connections to the Elasticsearch server to man-in-the-middle interception by an attacker on the adjacent network. Affected versions are 4.0.0 through 4.0.5; only deployments explicitly configured with an SSL bundle are exposed. No active exploitation is confirmed (absent from CISA KEV, EPSS 0.01% at the 3rd percentile), and VMware has released a fix in version 4.0.6.
Improper certificate validation in Apache Storm Prometheus Reporter versions 2.6.3 to 2.8.6 allows man-in-the-middle attacks across all TLS connections in the Storm daemon when the skip_tls_validation configuration option is enabled. Enabling this setting for Prometheus PushGateway connections inadvertently downgrades the JVM-wide SSL context, causing all subsequent HTTPS communications (ZooKeeper, Thrift, Netty, UI) to trust arbitrary certificates without validation, enabling interception of cluster state, topology submissions, and administrative credentials. No public exploit code identified at time of analysis, and EPSS scoring of 0.01% reflects the requirement for explicit administrator misconfiguration to trigger the vulnerability.
Stored cross-site scripting in Pimcore v12.3.3 allows authenticated editors to persistently inject malicious HTML/JavaScript into the Document embed editable component, with the payload executing in victim browsers whenever the published page is rendered. Exploitation requires a low-privilege authenticated account and active user interaction from a victim, materially limiting the attack surface relative to a fully unauthenticated XSS. No public exploit has been identified at time of analysis and EPSS sits at 0.00% (0th percentile), indicating negligible observed exploitation activity.
Denial-of-service in the Mercury MIPC252W IP camera's RTSP service allows an authenticated attacker to crash streaming sessions by repeatedly issuing SETUP requests for the same media track within a single RTSP session, forcing the server to reset the connection and rendering the camera's video stream unavailable. The vulnerability affects firmware version 1.0.5 Build 230306 Rel.79931n specifically. Proof-of-concept code is publicly available on GitHub per SSVC data, though no active exploitation has been confirmed in CISA KEV.
Path traversal in the Blocks module of Daylight Studio FuelCMS v1.5.2 enables authenticated low-privileged users to read arbitrary server-side files outside the web root by injecting directory traversal sequences into the module's path parameter. A public proof-of-concept is confirmed via SSVC exploitation status and the pentest-tools advisory (PTT-2025-031), though no active exploitation appears in CISA KEV. With an EPSS of 0.06% (19th percentile) and a read-only, non-automatable attack profile, this represents a real but low-urgency confidentiality risk - file disclosure rather than code execution.
Open redirect in DevPush v0.3.2's Google OAuth endpoint allows unauthenticated remote attackers to redirect victims to attacker-controlled sites by supplying a crafted URL to the /api/google/authorize endpoint. The attack requires user interaction (UI:R per CVSS), limiting practical exploitation to phishing scenarios where victims must click a malicious link. No active exploitation is identified (EPSS 0.01%, 1st percentile; SSVC exploitation: none), though a public disclosure gist exists suggesting exploit mechanics are documented.