barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section loading logic fails to validate that PointerToRawData plus copied size remains within the PE file buffer. An attacker can supply a malicious EFI PE binary via TFTP, USB, SD card, or network boot to trigger heap buffer overflow or out-of-bounds read from heap memory, potentially achieving code execution in bootloader context.
Remote code execution in GitHub Copilot CLI versions prior to 1.0.43 allows attackers to execute arbitrary commands via malicious bare git repositories embedded in project directories. When the CLI agent performs routine git operations, git's automatic bare repository discovery triggers execution of commands specified in config keys like core.fsmonitor. Attackers can deliver the malicious repository through pull requests, compromised dependencies, or pre-existing cloned repositories. No public exploit identified at time of analysis, though the attack technique leverages well-documented git behavior. The vendor-released patch (version 1.0.43) sets safe.bareRepository=explicit to block automatic bare repository discovery.
Server-side request forgery (SSRF) in Open edX Platform allows authenticated Enterprise Admin users to force the application server to make HTTP requests to arbitrary internal network resources, cloud metadata endpoints (AWS 169.254.169.254), or external attacker-controlled hosts via the sync_provider_data SAML configuration endpoint. The unvalidated metadata_url parameter is passed directly to requests.get() without IP filtering or URL scheme enforcement, enabling internal network reconnaissance, credential theft from cloud metadata services, and potential lateral movement. Fixed in commits 6fda1f120ff and 70a56246dd9. EPSS data not available; no confirmed active exploitation at time of analysis.
Arbitrary code execution in OpenClaw via CWD-based setup-api.js injection allows local attackers to run malicious JavaScript when users execute OpenClaw commands from attacker-controlled directories. Affects all OpenClaw versions before 2026.4.23. Vendor-released patch available in version 2026.4.23. Exploitation requires user interaction (running OpenClaw commands from a malicious repository) but no authentication. CVSS 7.8 reflects local attack vector with user interaction requirement, mitigating remote exploitation risk.
Heap-based buffer overflow in dnsmasq's DHCPv6 implementation enables local attackers to execute arbitrary code with root privileges. Affects dnsmasq 2.93 (and potentially earlier 2.92 branch based on NixOS patching activity). CERT/CC issued VU#471747, and upstream published CVE-specific advisory at thekelleys.org.uk/dnsmasq/CVE/. NixOS patch activity (PR #519082, #519093) indicates real-world remediation effort. No CISA KEV listing or public POC identified at time of analysis, suggesting limited active exploitation despite high CVSS 8.4 score.
Authenticated low-privilege users in Open WebUI (pip package versions prior to 0.6.19) can access, delete, and restore other users' memory data through inconsistent authorization controls in the memories API. The /api/v1/memories/query endpoint allows any authenticated user to query all memories across the system regardless of ownership, while the DELETE and update endpoints enable unauthorized manipulation of other users' memory objects. A publicly available exploit code exists with three detailed proof-of-concept demonstrations published in the GitHub security advisory GHSA-hmjq-crxp-7rjw. The vulnerability carries a CVSS score of 8.3 with High confidentiality and integrity impact, exploitable remotely with low attack complexity requiring only low-privilege authentication (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).
{% include %} and {% render %} Liquid tags. The built-in FileSystemLoader and CachingFileSystemLoader failed to reject absolute paths, escaping the configured search path; no public exploit identified at time of analysis but the vendor advisory (GHSA-8p4x-wr7x-3788) publicly documents the bypass mechanism.
jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.
Prototype pollution in @rvf/set-get allows remote attackers to modify Object.prototype on Node.js servers processing form data via Remix or React Router applications. The setPath function fails to block dangerous property keys (__proto__, constructor, prototype) when flattening form submissions, enabling unauthenticated attackers to inject arbitrary properties into all JavaScript objects across the server process with a single malformed HTTP request. Working proof-of-concept code is publicly available demonstrating property injection via field names like '__proto__[polluted]'. The vulnerability affects default configurations with no special setup required - any endpoint using parseFormData or createValidator is exploitable. CVSS 8.2 High severity driven by network attack vector (AV:N), low complexity (AC:L), and no authentication requirement (PR:N), with high integrity impact from the ability to alter application logic process-wide.
Sensitive authentication headers (Authorization, Cookie, Proxy-Authorization) leak to unintended domains when urllib3's low-level ProxyManager API follows cross-origin redirects. Applications using ProxyManager.connection_from_url().urlopen() with assert_same_host=False on urllib3 versions 1.23 through 2.6.x inadvertently forward credentials across origins, potentially exposing user sessions or API tokens to third-party servers. Vendor-released patch available in urllib3 2.7.0.
Server-side request forgery (SSRF) in GuardDog 1.0.0 through 2.9.0 allows remote attackers to exfiltrate GitHub personal access tokens and probe internal networks via malicious repository URLs. The vulnerability stems from blind string replacement in ProjectScanner.scan_remote() that fails to validate hostnames before appending authentication credentials. No vendor-released patch identified at time of analysis. Publicly available exploit code exists via GitHub advisory reproduction steps. CVSS 8.2 (High) with network vector and no authentication required.
Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() uses Array.some() to validate requested OAuth scopes, causing the function to accept the entire scope array if any single scope is valid. An attacker can smuggle the wildcard * scope by requesting scope=read *, escalating a read-only OAuth token to full unrestricted API access including write, delete, and admin operations. This vulnerability is fixed in 1.7.0.
Authentication bypass in JetBrains TeamCity allows remote unauthenticated attackers to gain unauthorized access to server APIs. Despite the CVE description stating 'authenticated users could expose server API,' the CVSS vector (PR:N) confirms no authentication is required for exploitation, enabling direct unauthorized API access with high confidentiality impact and limited integrity impact. JetBrains has released patches in versions 2026.1 and 2025.11.5. EPSS and KEV status not available at time of analysis.
Remote code execution in automagik-genie 2.5.27 MCP Server occurs when processing transcripts from attacker-controlled external FORGE_BASE_URL endpoints. Exploitation chains command injection in the readTranscriptFromCommit function's view_task parameter to execute arbitrary system commands on the server. A proof-of-concept exploit exists, though active exploitation has not been confirmed by CISA KEV at time of analysis.
Remote code execution and denial of service in Neat VNC library version <0.9.6 allows unauthenticated network attackers to overflow a 1024-byte stack buffer during RSA-AES security handshake. An attacker sends a crafted VNC security type 5 or 129 message with an oversized client RSA public key, triggering a stack buffer overflow in rsa_aes_send_challenge() when the server encrypts its challenge response. CVSS 8.1 (High) with network attack vector, low complexity, and no authentication required. No public exploit identified at time of analysis, though the vulnerability is trivial to trigger based on the patch diff showing a simple size validation check addition.
Path traversal in Open WebUI's file upload mechanism allows authenticated attackers to write and subsequently delete arbitrary files on the server filesystem. Discovered by Taylor Pennington of KoreLogic, this vulnerability affects the /ollama/models/upload API endpoint where unsanitized filename parameters enable directory traversal using dot-segments. The vulnerability requires low-privilege authentication (PR:L) and has straightforward exploitation (AC:L), confirmed by a published GitHub security advisory (GHSA-j3fw-wc48-29g3) with working proof-of-concept code. Vendor-released patch available in version 0.6.10. No evidence of active exploitation (not in CISA KEV) at time of analysis.
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden allows an unconfirmed organization owner to purge the entire organization vault. The organization invite flow uses a two-step process: accepting an invite transitions membership from Invited to Accepted, and a separate confirmation by an existing owner upgrades it to Confirmed. The POST /api/ciphers/purge endpoint uses plain Headers and only checks that the membership type is Owner without verifying that the membership status is Confirmed. An authenticated user who has been invited as an organization owner and has accepted the invite and has not yet been confirmed can call this endpoint to hard-delete all ciphers and attachments in the organization, causing immediate organization-wide data loss. This vulnerability is fixed in 1.35.5.
Content Security Policy bypass in Apple's WebKit-based platforms (iOS, iPadOS, macOS Tahoe, tvOS, visionOS, watchOS) allows maliciously crafted web content to evade CSP enforcement, undermining a core browser defense against XSS and data exfiltration. Apple addressed the input validation flaw across its product line in coordinated June 2026 updates. No public exploit is identified at time of analysis and EPSS is very low (0.03%), but the cross-platform reach and high CIA impact via user interaction make patching a priority.
Authorization bypass in Next.js 15.4.0-15.5.15 and 16.0.0-16.2.4 allows authenticated attackers to access protected dynamic routes by manipulating query parameters to alter route parameter values seen by the application while keeping the URL path unchanged, bypassing middleware authorization checks. Vendor-released patches available in versions 15.5.16 and 16.2.5. No active exploitation confirmed (not in CISA KEV), but publicly disclosed vulnerability with high CVSS 8.1 (network attack, low complexity, high confidentiality and integrity impact).
Broken object-level authorization in HireFlow v1.2 exposes all candidate profiles and interview notes to any authenticated user via direct object reference. Attackers with valid low-privilege credentials can enumerate integer IDs in /candidate/<id> and /interview/<id> endpoints to access the entire database, enabling full horizontal privilege escalation and complete data breach. No vendor patch identified at time of analysis. EPSS data not available; no evidence of active exploitation (not in CISA KEV).
Cross-Site Request Forgery (CSRF) in HireFlow v1.2 allows remote attackers to perform unauthorized actions on behalf of authenticated users without token validation on any state-changing endpoint. An attacker can craft malicious web pages to silently change victim passwords, delete candidate records, inject feedback, or schedule interviews when visited by an authenticated user. The absence of SESSION_COOKIE_SAMESITE configuration removes browser-level CSRF defenses. Publicly available exploit code exists (SSVC exploitation status: POC), though EPSS score of 0.02% (4th percentile) suggests limited widespread targeting. CVSS 8.1 reflects high confidentiality and integrity impact requiring only user interaction (UI:R), making this a realistic threat in phishing scenarios despite no active exploitation confirmed at time of analysis.
Remote code execution in Cockpit's system logs UI allows authenticated users to inject shell metacharacters into unsanitized URL parameters, executing arbitrary commands on RHEL 7/8/9/10 hosts. Attack requires low-complexity exploitation by a logged-in user who can craft malicious links targeting the logs interface. No public exploit identified at time of analysis, though the vulnerable code section is publicly accessible on GitHub. EPSS data not available; CVSS 8.0 reflects high impact across confidentiality, integrity, and availability if user interaction occurs.
Zen Browser's auto-update mechanism delivered unsigned code to all users due to deliberately removed MAR signature verification inherited from Firefox. The browser shipped with Mozilla's updater binary stripped of all cryptographic verification code and served update packages containing zero cryptographic signatures. Compromise of the update server or GitHub Actions pipeline allowed arbitrary code execution on all Zen installations without cryptographic chain-of-trust protection. Version 1.19.9b restores MAR signing with RSA-4096 keys and certificate verification in the updater binary.
Missing authorization in Dell Automation Platform before 2.0.0.0 allows authenticated remote attackers to elevate privileges to high-integrity access. The vulnerability requires low-level authentication and user interaction but enables complete compromise of confidentiality, integrity, and availability. CVSS 8.0 (High) reflects the significant impact despite the authentication prerequisite. No active exploitation (CISA KEV) or public exploit code identified at time of analysis, though Dell has released patches per DSA-2026-193.
libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas import functionality allows an attacker to cause a controlled heap out-of-bounds write (heap overflow) by supplying a crafted file in the "caca" format. Depending on the build configuration and memory allocator, this may lead to memory corruption or remote code execution. This is the same vulnerability as CVE-2021-3410 but the fix at that time was not fully correct. Commit fb77acff9ba6bb01d53940da34fb10f20b156a23 fixes this vulnerability.
Local privilege escalation in Apple macOS (Sequoia, Sonoma, and Tahoe branches) allows a malicious application to gain root privileges by exploiting a path validation flaw in directory path handling. The issue, tracked as CVE-2026-28915 and reported by Apple itself, has no public exploit identified at time of analysis and a very low EPSS score (0.02%), but the total technical impact (root) makes it a meaningful endpoint hardening priority.
Privilege escalation in Apple operating systems allows local authenticated applications to gain root privileges through an authorization flaw in state management. Affects multiple macOS versions (Sonoma, Sequoia, Tahoe) and iOS/iPadOS versions prior to patched releases. Apple has issued coordinated security updates across all affected platforms (iOS 18.7.9/26.5, iPadOS 18.7.9/26.5, macOS Sonoma 14.8.7, Sequoia 15.7.7, Tahoe 26.5). EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation despite high CVSS 7.8, with no public exploit identified at time of analysis and no CISA KEV listing. The local attack vector requiring authenticated privileges substantially reduces immediate risk compared to network-based vulnerabilities.
Local privilege escalation in macOS Sequoia, Sonoma, and Tahoe allows applications to gain root privileges through a state handling flaw in the operating system. Apple patched this consistency issue in macOS Sequoia 15.7.7, Sonoma 14.8.7, and Tahoe 26.5. Despite the high CVSS score (7.8), EPSS indicates only 0.02% exploitation probability (4th percentile), no public exploit code identified at time of analysis, and no CISA KEV listing, suggesting this is not yet widely exploited but represents a significant risk in multi-user or untrusted application environments.
Local privilege escalation in Wellbia XIGNCODE3 anti-cheat driver (xhunter1.sys) allows any low-privileged user process to obtain a PROCESS_ALL_ACCESS handle to arbitrary processes by sending the IRP_MJ_REITS command to the kernel driver. Because XIGNCODE3 is bundled with many online games and runs with kernel privileges, a local attacker on an affected gaming system can hijack high-integrity processes including LSASS. Publicly available exploit code exists in the form of a detailed write-up, though EPSS exploitation probability remains very low at 0.02%.
Local privilege escalation in macOS allows authenticated users with low-level access to gain root privileges through a permissions enforcement flaw. Affects macOS Tahoe (pre-26.4), Sequoia (pre-15.7.7), and Sonoma (pre-14.8.7). Apple has released patches for all affected versions. Despite CVSS 7.8, EPSS score of 0.01% indicates minimal observed exploitation activity. No public exploit code identified at time of analysis, though the local attack vector and low complexity suggest post-compromise utility rather than initial access vector.
Compromised AI models running with access to OpenClaw's gateway tool can persist malicious configuration changes affecting command execution, network endpoints, credentials, and security policies by exploiting an incomplete denylist that failed to protect newly added config paths. The vulnerability allows model-driven writes to sensitive config subtrees (command execution safeguards, proxy/TLS settings, telemetry hooks, operator policies) that survive restart, enabling persistent control beyond the intended model-to-operator trust boundary. Patch available in OpenClaw 2026.4.23 with fail-closed allowlist enforcement. No public exploit or active exploitation confirmed, but CVSS 8.8 (AV:N/AC:L/PR:L) indicates authenticated remote attackers with low-privilege model access can achieve full config compromise.
Authentication bypass in Crabbox coordinator allows privilege escalation to full admin access. Attackers holding valid low-privilege user tokens can inject an admin claim into the token payload, sign it with HMAC-SHA256, and authenticate to admin-restricted coordinator endpoints. This grants unauthorized access to lease visibility across all users, pool state management, and forced release operations. Patch available in version 0.9.0 with upstream commit confirmed. No active exploitation (CISA KEV) or public POC identified at time of analysis, but CVSS 8.8 reflects network-accessible attack with low complexity once initial authentication is obtained.
Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.7.0, the subscriptions.create API endpoint in server/routes/api/subscriptions/subscriptions.ts exhibits a broken authorization pattern. When both collectionId and documentId are supplied in the request, the route handler authorizes ONLY the collection branch (line 125 if (collectionId)), while the downstream subscriptionCreator command at server/commands/subscriptionCreator.ts writes the subscription against the documentId (which was never validated). The result is a subscription record pinning the attacker's user to a victim document the attacker has no read access to, on any team in the instance. The schema (server/routes/api/subscriptions/schema.ts) only enforces "at least one of collectionId/documentId" via .refine() - it does NOT enforce mutual exclusivity, so passing both is a valid, schema-conforming request. This vulnerability is fixed in 1.7.1.
Server-Side Request Forgery in Budibase self-hosted instances allows authenticated Global Builder users to bypass SSRF protections via trivial substring manipulation in plugin URL uploads. The vulnerability exploits a flawed validation check that accepts any URL containing '.tar.gz' anywhere in the string, enabling requests to internal cloud metadata services (AWS IMDS at 169.254.169.254), CouchDB, Redis, and private network ranges when chained with the BLACKLIST_IPS bypass (CVE-2026-45060) or via HTTP redirect chains. CVSS 7.7 (High) with Changed Scope indicates cross-boundary impact from application to infrastructure layer. Vendor-released patch available in version 3.35.10 per GitHub security advisory GHSA-xh5j-727m-w6gg. EPSS data not available; no CISA KEV listing at time of analysis. Publicly available exploit code exists in researcher's GitHub repository with Docker-based proof-of-concept.
Authenticated low-privilege users can subscribe to global wildcard topics in Meari IoT Cloud MQTT Broker (EMQX 4.x), receiving telemetry from devices they do not own. While publish restrictions are enforced, subscribe authorization lacks per-device scope controls, enabling cross-tenant data exposure in multi-tenant IoT deployments. Publicly available exploit code exists (GitHub repository confirmed by runZero advisory). EPSS and KEV status not available, but CVE assigned in 2026 suggests recent disclosure with active researcher attention.
Sensitive credentials and personal data leak through production error logs in Valtimo's web module via LoggingRestClientCustomizer. The component intercepts all outgoing Spring RestClient HTTP calls and includes full request/response bodies and headers in HttpClientErrorException messages logged at ERROR level, exposing JWT tokens, API keys, OAuth tokens, session cookies, and personal data (BSN numbers, case details) to anyone with log access or Valtimo admin role. Vendor-released patches available for both affected release lines (12.33.0 and 13.26.0). No public exploit identified at time of analysis, but exploitation requires only privileged access to logs rather than technical exploitation of a code vulnerability.
Remote unauthenticated attackers can crash dnsmasq DNS servers via crafted packets exploiting DNSSEC validation logic. The vulnerability affects dnsmasq 2.93 with CVSS 7.5 (high severity). Upstream fix is available in version 2.92rel2 per NixOS packaging commits, though official vendor release status requires confirmation. No public exploit identified at time of analysis, with CERT/CC tracking (VU#471747) suggesting coordinated disclosure.
Type confusion vulnerability in Apple's operating systems allows remote unauthenticated attackers to trigger denial of service across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Apple has released patches addressing the issue in iOS/iPadOS 18.7.9 and 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. The CVSS vector indicates network-accessible exploitation with low complexity and no privileges required, though EPSS score of 0.13% (32nd percentile) suggests relatively low likelihood of widespread exploitation. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Buffer overflow in Apple operating systems allows remote attackers to trigger application denial of service without authentication. Affects iOS/iPadOS, macOS (Sequoia, Sonoma, Tahoe), tvOS, visionOS, and watchOS across multiple versions. Vendor-released patches available for all affected platforms. No public exploit identified at time of analysis, with EPSS score of 0.12% (30th percentile) indicating low probability of widespread exploitation attempts. CVSS 7.5 reflects network-accessible unauthenticated attack causing high availability impact but limited to app termination rather than system-wide denial of service.
Remote attackers can crash Apple devices or corrupt kernel memory without authentication via a use-after-free vulnerability affecting iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Apple has released patches across eight separate security bulletins (HT127110-127120) fixing this memory management flaw in all supported OS versions. EPSS score of 0.10% (28th percentile) suggests low exploitation probability despite the network-accessible attack vector and lack of authentication requirements. No active exploitation or public POC identified at time of analysis.
Remote attackers can instantly crash bird-lg-go frontends by sending unbounded JSON payloads to the unauthenticated /api or /telegram endpoints. The application's JSON decoder allocates memory without size limits, allowing multi-gigabyte payloads to trigger out-of-memory fatalities that force the Linux OOM Killer to terminate the daemon. Patch available in commit 0ff87024 (v1.4.5) implements a 100KB request body limit. No public exploit identified at time of analysis. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) reflects easy remote exploitation requiring no authentication, though impact is limited to availability disruption.
Using *show_inline=1* parameter and a valid *file_show_inline_token* CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment. Cross-site scripting - 26647b2e68ba30b9d7987d4e03d7a16416684bc2 None Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.
A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4. A remote attacker may be able to cause a denial-of-service.
docuFORM Managed Print Service Client 11.11c is vulnerable to a directory traversal allowing attackers to read arbitrary files via crafted url.
Buffer overflow in macOS allows remote unauthenticated attackers to cause system crashes and denial of service without user interaction. Affects macOS Sequoia versions prior to 15.7.7 and macOS Tahoe versions prior to 26.5. Apple has released patches addressing the vulnerability through improved bounds checking. Despite network-based attack vector and low complexity (CVSS 7.5), EPSS score of 0.05% (15th percentile) indicates minimal observed exploitation activity, and CISA SSVC framework confirms no active exploitation detected. Automatable attack path suggests potential for scanning-based campaigns if exploited.
{ "nick": "alice", "tagline": "hi", "internal": { "ssn": "111-11-1111", "token": "tok_abcdef", "admin": true } }
Unauthenticated access to motion detection snapshots in Meari IoT Cloud allows remote attackers to retrieve security camera alert images stored on Alibaba OSS without authentication, signed URLs, or expiry enforcement. The vulnerability exposes IoT camera surveillance footage through predictable direct object references with confirmed proof-of-concept code publicly available. With CVSS 7.5 (High) and no authentication required (PR:N), this poses significant privacy risk to Meari camera deployments, though no active exploitation is confirmed via CISA KEV at time of analysis.
Remote unauthenticated attackers can read arbitrary files from MLflow server filesystems in versions 3.9.0 and earlier. By submitting a CreateModelVersion request with the tag 'mlflow.prompt.is_prompt' and an arbitrary local filesystem path as the source, attackers bypass validation logic. The get_model_version_artifact_handler() function later serves files from that path without checking prompt status, enabling full confidentiality breach. Fixed in version 3.10.0 per commit 6e801f4 which blocks file:// URIs and absolute paths for prompt sources. CVSS 7.5 (High) reflects network attack vector with no authentication or user interaction required.
Connection exhaustion denial of service affects Next.js applications using the Partial Prerendering feature with Cache Components. Remote unauthenticated attackers can send crafted POST requests containing the internal-only 'Next-Resume' header to server actions, triggering a request-body handling deadlock that holds connections open indefinitely, consuming file descriptors and server capacity until legitimate users cannot connect. Vendor-released patches are available in Next.js v15.5.16 and v16.2.5, which strip the internal header from untrusted external requests.
Content Security Policy bypass in Apple WebKit allows remote attackers to access sensitive information via maliciously crafted web content. Affects all major Apple platforms (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) prior to their respective 26.5 releases (iOS/iPadOS also fixed in 18.7.9). Vendor-released patches available across all platforms. EPSS score of 0.03% (10th percentile) indicates low observed exploitation probability despite network-accessible attack vector requiring no authentication or user interaction. No public exploit code or CISA KEV listing identified at time of analysis.