Confidentiality breach in Apple's operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) allows remote unauthenticated attackers to access high-sensitivity information through improper access control checks. Despite the vendor description indicating denial-of-service impact, the CVSS vector reveals a severe confidentiality compromise (C:H) with network-accessible attack surface requiring no authentication. Apple has patched all affected platforms in coordinated security updates released across six operating systems. EPSS score of 0.02% suggests low observed exploitation probability, and no public exploit code has been identified at time of analysis.
Kernel memory layout disclosure in Apple iOS, iPadOS, macOS, tvOS, and watchOS allows a malicious application to read sensitive log data that exposes kernel address information, enabling KASLR bypass. The flaw stems from insufficient redaction of kernel pointers written to system logs (CWE-532) and was reported and patched by Apple across its operating system families. No public exploit identified at time of analysis and EPSS probability is very low (0.02%), but the issue is typically chained with memory-corruption bugs to achieve reliable kernel exploitation.
Weak XOR obfuscation in Meari IoT SDK's libmrplayer.so library enables remote unauthenticated attackers to decrypt baby monitor image snapshots from CloudEdge 5.5.0, Arenti 1.8.1, and white-label apps (versions ≤1.8.x). The '.jpgx3' file format applies reversible XOR encryption only to the first 1024 bytes using a predictable key derivation model, exposing confidential video surveillance imagery. EPSS data unavailable; no CISA KEV listing or public exploit code confirmed, though proof-of-concept research published by runZero demonstrates practical decryption. CVSS 7.5 reflects HIGH confidentiality impact with network-accessible attack surface requiring no authentication.
Denial of service in Docling's METS GBS backend (through version 2.61.0) allows remote attackers to exhaust CPU and memory by submitting a malicious .tar.gz archive containing an XML bomb. The backend parses embedded XML with etree.fromstring() while entity resolution remains enabled, so recursively nested entity definitions expand exponentially during parsing and stall or crash the host processing the document. EPSS is very low (0.02%) and there is no public exploit code or KEV listing, but a vendor-published Notion write-up describes the flaw in detail.
Local privilege escalation in Apple macOS (all versions prior to Tahoe 26.5) allows a malicious or compromised application to gain root privileges by abusing an information-leakage weakness that Apple addressed through additional validation. Reported internally by Apple with no public exploit identified at time of analysis; EPSS is negligible (0.02%) and the flaw is not on the CISA KEV list. A vendor-released patch is available in macOS Tahoe 26.5.
High confidentiality information disclosure across Apple's ecosystem (iOS, iPadOS, macOS, visionOS) allows remote unauthenticated attackers to extract sensitive data by delivering a maliciously crafted file. The vulnerability affects all current Apple operating systems and was fixed in March 2026 security updates (iOS/iPadOS 18.7.9/26.5, macOS 14.8.7/26.5, visionOS 26.5). Despite CVSS 7.5 HIGH rating and network attack vector requiring no privileges, EPSS exploitation probability is very low at 0.02% (5th percentile), suggesting minimal real-world risk. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis.
Apps on iOS and iPadOS can bypass App Privacy Report logging due to insufficient entitlement checks, allowing malicious applications to conceal their privacy-invasive activities from users. Fixed in iOS/iPadOS 18.7.9 and 26.4. The CVSS vector (AV:N/AC:L/PR:N/UI:N) appears inconsistent with the actual attack requirements, as exploitation requires a malicious app already installed on the device, not remote network access. Despite the 7.5 CVSS score, EPSS exploitation probability is very low (0.02%, 5th percentile), no active exploitation is confirmed, and no public exploit code identified at time of analysis.
Memory corruption in Safari's WebKit engine across all Apple platforms allows remote attackers to trigger information disclosure via maliciously crafted web content delivered through network-accessible attack vectors requiring no authentication or user interaction. Despite the vendor description focusing on crash scenarios, the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact with no availability impact, suggesting potential memory disclosure rather than denial of service. Patched in iOS/iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. EPSS score of 0.02% (5th percentile) suggests low probability of mass exploitation despite network-accessible attack vector.
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously crafted input, causing denial of service through system termination. Affects iOS/iPadOS versions prior to 18.7.9, macOS Sequoia prior to 15.7.7, macOS Sonoma prior to 14.8.7, and macOS Tahoe prior to 26.5. Apple has released patches for all affected platforms. Despite the network attack vector and lack of authentication requirements (CVSS AV:N/PR:N), EPSS exploitation probability is very low at 0.02% (5th percentile), and no public exploits or active exploitation have been identified. Not listed in CISA KEV, suggesting limited real-world targeting.
Memory corruption in WebKit across Apple platforms (iOS, iPadOS, macOS, tvOS, visionOS) allows remote attackers to access sensitive information via malicious web content. CVSS vector indicates network-based exploitation requiring no user interaction or authentication (AV:N/AC:L/PR:N/UI:N), contradicting the description's 'process crash' outcome with the High Confidentiality impact rating. EPSS score of 0.02% (5th percentile) suggests low real-world exploitation probability. Vendor patches available for all affected platforms (version 26.5). SSVC framework rates this as automatable with partial technical impact but no observed exploitation.
Buffer overflow in Apple's image processing framework across iOS, iPadOS, macOS, tvOS, and watchOS allows remote attackers to cause denial of service through process memory corruption. Despite the CVSS 7.5 (High) rating and network attack vector, the vulnerability is rated low priority with only 2% EPSS exploitation probability (5th percentile), indicating minimal real-world threat activity. Apple has released patches in version 26.5 across all affected platforms. No active exploitation or public proof-of-concept has been identified at time of analysis.
WebKit memory corruption vulnerability allows remote attackers to trigger denial-of-service process crashes across Apple's entire operating system ecosystem (iOS, iPadOS, macOS, tvOS, watchOS) when processing maliciously crafted web content. Despite a CVSS score of 7.5 suggesting high confidentiality impact, the vendor description indicates only process crash (availability impact), representing a scoring discrepancy that requires clarification. No active exploitation confirmed (not in CISA KEV), EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability, and vendor patches released across all affected platforms in version 26.5.
Out-of-bounds read in Apple operating systems allows remote unauthenticated denial-of-service via malicious application. Apple has patched this vulnerability across all affected platforms (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) in version 26.5 releases. Despite CVSS 7.5 HIGH rating, exploitation probability remains low (EPSS 2%, 5th percentile) with no public exploit code identified and no CISA KEV listing. The vulnerability is impact-limited to availability (denial-of-service) with no confidentiality or integrity compromise, though tags indicate potential information disclosure concerns that warrant verification against vendor advisories.
Apple Mail on iOS, iPadOS, and macOS bypasses Lockdown Mode protections when replying to emails, allowing remote image loading that should be blocked. This information disclosure affects all supported Apple OS versions (iOS/iPadOS 18.x, macOS Sequoia 15.x, Sonoma 14.x, and Tahoe 26.x) prior to security updates released in early 2026. The vulnerability undermines a critical privacy protection for high-risk users, enabling email tracking and potential IP address disclosure despite Lockdown Mode activation. EPSS score of 0.02% suggests minimal automated exploitation likelihood, no public exploit or CISA KEV listing identified, though the attack complexity is rated low (CVSS AC:L).
Use-after-free in WebKit across Apple's entire operating system ecosystem enables remote information disclosure via malicious web content. Affects iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS versions prior to 26.5. The vulnerability allows network-based unauthenticated attackers to access high-value confidential information through crafted web pages, though the CVE description anomalously mentions process crash (availability impact) while the CVSS vector indicates confidentiality impact only. No public exploit identified at time of analysis. EPSS score of 0.02% (5th percentile) suggests low likelihood of imminent widespread exploitation despite the broad platform impact and network attack vector.
Malicious applications on iOS 26.5, iPadOS 26.5, and visionOS 26.5 can access sensitive user data due to inconsistent user interface state management. The vulnerability stems from UI state handling flaws (CWE-451) that allow apps to bypass expected data access controls. Apple has released patches in iOS/iPadOS 26.5 and visionOS 26.5. Despite a CVSS score of 7.5 (High), the EPSS score of 0.02% (5th percentile) indicates minimal observed exploitation probability in the wild. No public exploit code or CISA KEV listing identified at time of analysis, suggesting this is primarily a platform-hardening fix rather than an actively targeted vulnerability.
Lock screen bypass in iOS and iPadOS versions prior to 26.5 allows unauthorized access to restricted content without authentication. Apple's security advisory HT227110 confirms the privacy issue affected lock screen content filtering mechanisms. Despite CVSS 7.5 scoring suggesting network exploitation, the vulnerability requires physical access to a locked device, creating a significant disparity between theoretical severity and practical attack surface. EPSS probability of 0.02% (5th percentile) indicates minimal observed exploitation attempts, and no CISA KEV listing or public exploit code exists at time of analysis.
Information disclosure in Apple WebKit allows remote attackers to extract sensitive user data by serving maliciously crafted web content to Safari or in-app browsers across iOS, iPadOS, macOS, and visionOS. Fixed in iOS/iPadOS 18.7.9, iOS/iPadOS 26.5, macOS Tahoe 26.5, and visionOS 26.5. Despite high CVSS 7.5, EPSS score of 0.02% (5th percentile) indicates minimal observed exploitation attempts in the wild. No CISA KEV listing and no public exploit code identified at time of analysis. Apple characterizes this as an access restriction flaw (CWE-200), suggesting the vulnerability bypasses same-origin policy or other browser security boundaries to leak data cross-domain.
macOS Gatekeeper can be bypassed using specially crafted disk images, allowing unauthenticated remote attackers to execute untrusted code without security warnings across iOS, iPadOS, and all supported macOS versions. Apple has released patches addressing this authentication bypass in macOS Tahoe 26.5, Sequoia 15.7.7, Sonoma 14.8.7, iOS 18.7.9, and iPadOS 18.7.9. Despite the CVSS 7.5 HIGH rating, EPSS probability remains very low at 0.02% (5th percentile), suggesting limited immediate exploitation risk, though the attack requires no special conditions and could be delivered via common distribution channels like email or web downloads.
Denial of service in Docling through version 2.61.0 lets remote attackers crash or exhaust resources on any system that parses a document via the JATS XML backend. The backend calls etree.parse() without disabling entity resolution, so a maliciously crafted JATS/XML file containing nested entity definitions (a 'billion laughs' XML bomb) triggers exponential entity expansion and consumes all available CPU/memory. No public exploit identified at time of analysis; EPSS is very low (0.02%) and SSVC records no observed exploitation, so this is a high-CVSS availability issue rather than an actively exploited threat.
Remote denial of service in Apple WebKit (iOS/iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5) allows unauthenticated network attackers to crash browser processes via maliciously crafted web content exploiting a memory handling flaw. CVSS 7.5 (High) reflects network-based attack with no authentication required, though impact is limited to availability (process crash). EPSS score of 0.02% (4th percentile) indicates very low observed exploitation probability. SSVC assessment confirms no active exploitation, but marks it as automatable, suggesting potential for future weaponization in drive-by attacks. Apple has released patches across all affected platforms.
Buffer overflow in macOS kernel allows local applications to terminate the system or write to kernel memory, affecting macOS Sequoia 15.x, Sonoma 14.x, and Tahoe 26.x. Apple has released security updates patching this vulnerability. Despite the CVSS vector indicating network-based attack (AV:N), the description specifies 'an app may be able to' which confirms local application context, indicating a vector/description inconsistency. EPSS score of 0.02% (4th percentile) suggests low probability of mass exploitation, and no active exploitation or public POC identified at time of analysis.
Malicious applications on macOS Sequoia, Sonoma, and Tahoe can bypass user consent prompts to access the Contacts database through a race condition in symbolic link handling. Apple has patched this privacy control bypass in macOS Sequoia 15.7.7, Sonoma 14.8.7, and Tahoe 26.5. Despite a network-based CVSS vector scoring 7.5 (High), the actual attack requires local application execution, indicating likely miscategorization in the metric. EPSS exploitation probability is very low (0.02%, 4th percentile) with no active exploitation or public POC identified at time of analysis.
Local privilege escalation in macOS allows malicious applications to modify protected filesystem areas despite system integrity protections, enabling persistent compromise of system security. Affects macOS Sequoia (prior to 15.7.7), Sonoma (prior to 14.8.7), and Tahoe (prior to 26.5). Apple fixed the vulnerability by removing the exploitable code component. Despite the CVSS vector indicating a network-based denial-of-service, the description clearly states the actual impact is unauthorized filesystem modification by local applications, suggesting a CVSS scoring inconsistency. EPSS exploitation probability is very low (0.02%, 4th percentile) with no public exploit code or CISA KEV listing identified.
Information disclosure in macOS allows malicious applications to read unprotected user data through a path handling vulnerability. Affects macOS Sequoia (prior to 15.7.7), Sonoma (prior to 14.8.7), and Tahoe (prior to 26.5). The CVSS vector (AV:N/AC:L/PR:N/UI:N) appears misaligned with the vendor description indicating local app-based exploitation, requiring verification. Despite high CVSS 7.5, EPSS of 0.02% (4th percentile) suggests minimal observed exploitation activity. No public exploit code or CISA KEV listing identified at time of analysis.
Memory corruption in Apple macOS image processing allows a remote attacker to corrupt process memory by delivering a maliciously crafted image to an affected system, potentially leading to sensitive information disclosure. The flaw affects macOS Sequoia before 15.7.7, macOS Sonoma before 14.8.7, and macOS Tahoe before 26.5, and was fixed by Apple with improved memory handling. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.02%, 4th percentile), and it is not listed in CISA KEV.
Remote unauthenticated attackers can crash Node.js applications running the OpenTelemetry Prometheus exporter by sending a single malformed HTTP request to the metrics endpoint (default port 9464). The vulnerability exists in @opentelemetry/exporter-prometheus versions prior to 0.217.0, where missing error handling around URL parsing causes an uncaught TypeError when processing invalid URIs, terminating the entire Node.js process. The metrics endpoint binds to 0.0.0.0 by default and requires no authentication, making exploitation trivial for any network-accessible attacker. Publicly available exploit code exists (one-line netcat command demonstrated in vendor advisory). No active exploitation confirmed at time of analysis, though the attack complexity is minimal (CVSS AC:L) and the impact severe for production observability infrastructure.
macOS Tahoe allows applications to access protected user data due to insufficient permission enforcement on system APIs. The vulnerability affects all macOS versions prior to 26.5 and is tagged as an authentication bypass, indicating apps can circumvent permission prompts or system restrictions to read sensitive data without user consent. While not yet actively exploited (EPSS 0.01%, no CISA KEV listing), the CVSS vector (AV:N/AC:L/PR:N/UI:N) appears inconsistent with the local application context described, suggesting potential network-accessible component or misclassified attack vector requiring vendor clarification.
Insufficient permission enforcement in macOS Tahoe prior to 26.5 allows applications to bypass access controls and read protected user data without proper authorization. Apple addressed the vulnerability through hardened permission checks in version 26.5. EPSS probability indicates minimal observed exploitation activity (0.01%, 3rd percentile), and no public exploit code or CISA KEV listing exists at time of analysis, suggesting exploitation requires application-specific development effort rather than readily available tooling.
Local File Inclusion in the Yii2 PHP framework (all versions before 2.0.55) allows remote attackers to read arbitrary local files by supplying a request parameter named `_file_` that collides with an internal variable in `View::renderPhpFile()` and `ErrorHandler::renderFile()`. Because the render routine runs `extract($_params_, EXTR_OVERWRITE)` before `require $_file_`, an attacker-controlled `_file_` key overwrites the path of the file to be included, yielding arbitrary file read and, if a PHP file is includable, potential code execution. No public exploit identified at time of analysis; EPSS is very low (0.05%, 14th percentile) and CISA SSVC records no observed exploitation, though the technical impact is rated total.
Unsafe Python pickle deserialization in pgAdmin 4 FileBackedSessionManager allows authenticated local users with session-directory write access to execute arbitrary code as the pgAdmin process. The vulnerability arises from deserializing session files before validating their HMAC signature, enabling payload injection through crafted pickle objects. Attackers require both valid authentication and filesystem write permission to the sessions directory-achievable through misconfiguration or chaining with a separate path-traversal vulnerability. EPSS exploitation probability and KEV status not provided; no public exploit code identified at time of analysis. PostgreSQL maintainers confirmed the flaw and patched it in version 9.15 by implementing pre-deserialization HMAC validation.
Command injection in D-Link DCS-932L v2.18.01 allows remote unauthenticated attackers to execute arbitrary system commands via the LightSensorControl parameter in the /bin/alphapd binary. CVSS 7.3 indicates network-accessible exploitation with low complexity requiring no authentication or user interaction, though EPSS score of 0.15% (35th percentile) suggests low observed exploitation probability. No CISA KEV listing or confirmed active exploitation. Publicly documented vulnerability details exist on GitHub, increasing risk of future exploitation attempts against this end-of-life IoT camera model.
Stored cross-site scripting in Outline collaborative documentation (versions 0.84.0 through 1.6.1) lets an authenticated user inject a mention in the comment section whose href attribute is never validated, so dangerous protocols such as javascript: survive rendering and execute in a viewing user's browser. When a victim interacts with the malicious mention, attacker-controlled script runs in their session, enabling account-context actions and data theft; publicly available exploit code exists but there is no evidence of active exploitation and EPSS probability is negligible (0.04%). The issue is resolved in Outline 1.7.0.
Brute-force protection bypass in Vaultwarden (the Rust Bitwarden-compatible server) before 1.35.4 lets unauthenticated remote attackers guess passwords without rate-limiting when email 2FA is enabled on the instance. The /api/two-factor/send-email-login endpoint (send_email_login in email.rs) is not covered by login rate-limiting yet still validates the username/password pair, turning it into a credential-validity oracle. The flaw affects all accounts on an instance that has email 2FA enabled — even users who never configured email 2FA themselves. Publicly available exploit code exists (SSVC 'poc'); EPSS is very low at 0.04% and it is not in CISA KEV, so no confirmed active exploitation.
SQL injection in MuuCMF T6 v1.9.4.20260115 lets an unauthenticated remote attacker inject arbitrary SQL through the keyword parameter of the /index/controller/Search.php endpoint, exposing the full database and enabling forged administrative access. Because the underlying database and application run with sufficient privileges, the flaw can be escalated to write malicious files to disk and potentially achieve remote code execution. Publicly available exploit code exists (write-up by thinhneee), but the flaw is not on CISA KEV and EPSS is very low at 0.03% (10th percentile).
Reflected XSS in docuForm Managed Print Services 11.11c enables authenticated attackers to execute malicious JavaScript in victim browsers via crafted links. The dfm-menu_orderopt.php component fails to sanitize input parameters, allowing session hijacking and account takeover when low-privilege users click attacker-controlled URLs. EPSS data unavailable; no CISA KEV listing indicates exploitation remains opportunistic rather than widespread. Public exploit code exists via GitHub Gist, lowering barrier to attack.
Reflected cross-site scripting in Mercury Managed Print Services docuForm v11.11c allows authenticated attackers with low privileges to execute arbitrary JavaScript in victim browsers via the acc-menu_pricess.php component. Public proof-of-concept exploit code exists on GitHub (ZeroBreach-GmbH). EPSS data not available, not listed in CISA KEV. Attack requires user interaction (phishing/social engineering to click malicious link), limiting automated exploitation but enabling credential theft and session hijacking for authenticated users.
Reflected cross-site scripting in Mercury docuForm (Managed Print Services) v11.11c enables authenticated attackers to execute arbitrary JavaScript in victim browsers when users click malicious links. The vulnerability exists in dfm-menu_markeralerts.php due to unfiltered variable handling. CVSS 7.3 (High) reflects network-accessible attack requiring low-privilege authentication and user interaction. No public exploit confirmed, but proof-of-concept code published by ZeroBreach GmbH demonstrates feasibility. EPSS data unavailable; not in CISA KEV, indicating no confirmed widespread exploitation at time of analysis.
Reflected cross-site scripting in Mercury docuForm v11.11c allows authenticated attackers to execute arbitrary JavaScript in victim browsers via crafted payloads to dfm-menu_alerts.php. Attack requires low complexity and user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R). Public proof-of-concept exists on GitHub (ZeroBreach-GmbH gist), but no CISA KEV listing indicates targeted or low-volume exploitation. EPSS data not available, but the authentication requirement and user interaction dependency reduce attack surface compared to stored XSS.
Remote denial-of-service and limited information disclosure in dnsmasq's extract_addresses() function allows attackers controlling or able to inject DNS responses to crash the daemon by sending a malformed DNS record whose declared rdlen pushes extract_name() past the record boundary, triggering a heap out-of-bounds read. The flaw affects dnsmasq 2.93 and downstream packages from Red Hat, SUSE, Ubuntu, and Pi-hole FTL. No public exploit identified at time of analysis, EPSS exploitation probability is 0.03% (9th percentile), and CISA SSVC rates exploitation as 'none' with only partial technical impact.
Heap buffer overflow in dnsmasq's extract_name() function allows remote attackers to write out-of-bounds on the heap, enabling DNS cache poisoning that redirects lookups to attacker-controlled IP addresses or causes denial of service. The flaw stems from a bigname namebuffer sized for wire-form domain names (MAXDNAME) instead of the larger escaped internal representation (MAXDNAME*2 + 1). EPSS is low (0.03%, 9th percentile) with no public exploit identified at time of analysis, but multiple major distributions (Red Hat, SUSE, Ubuntu) have shipped patches reflecting widespread downstream exposure.
Account-lockout bypass in WSO2 Identity Server (6.0.0, 6.1.0, 7.0.0, 7.1.0) and the Carbon MagicLink Authenticator Module allows accounts that have been administratively or automatically locked to still authenticate through the Magic Link and Passkey (FIDO2) flows, because those paths do not validate account state. An attacker in possession of a valid magic link or passkey for a locked account can reach the application and its sensitive data despite the lock, and the lockout control intended to stop further login attempts is rendered ineffective. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%), and the flaw is not in CISA KEV.
Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds write in Apple's file parsing component across iOS, iPadOS, and macOS enables remote code execution or denial of service via maliciously crafted files with no user interaction required. Exploitation probability is extremely low (EPSS 0.02%, 6th percentile) with no public exploit identified at time of analysis, despite the critical CVSS 7.3 score and network-based attack vector. Vendor patches available for all affected platforms (iOS/iPadOS 18.7.9, 26.5; macOS Sonoma 14.8.7, Sequoia 15.7.7, Tahoe 26.5). The CVSS vector indicating AV:N/PR:N/UI:N suggests automatic exploitation without user interaction, which contradicts the description's 'parsing a file' language - verify whether this requires user action to open/download the file or if background processes parse untrusted files automatically.
Arbitrary code execution in the flash-attention project's training script (up to commit e724e2588cbe754beb97cf7c011b5e7e34119e62) allows an attacker to run Python code by supplying a malicious Hydra configuration. The script registers Python's eval() as a Hydra resolver named 'eval', so any config value using the ${eval:...} syntax is executed when a victim launches training with that configuration. No public exploit has been identified and EPSS probability is very low (0.02%), but SSVC rates the flaw as automatable with partial technical impact.
Arbitrary code execution in CosyVoice's gRPC server (through commit 6e01309e) occurs because the speech-synthesis model is loaded via torch.load() without weights_only=True, deserializing untrusted pickle data. Any operator who starts the gRPC server against an attacker-supplied model directory executes embedded Python code during initialization. No public exploit has been identified and it is not in CISA KEV; EPSS is negligible at 0.02% (5th percentile), consistent with a file-delivery attack rather than mass remote exploitation.
Remote code execution in QuickJS-NG 0.12.1 allows unauthenticated network attackers to execute arbitrary code through the js_mapped_arguments_mark function. The vulnerability enables attackers to achieve code injection with low confidentiality, integrity, and availability impact via network-accessible JavaScript engine exploitation. EPSS score of 0.02% (5th percentile) indicates very low predicted exploitation probability, and no active exploitation has been publicly reported at time of analysis.
Arbitrary code execution in the Dao-AILab flash-attention training framework (all revisions up to and including commit e724e2588cbe754beb97cf7c011b5e7e34119e62) arises because its checkpoint-loading paths call PyTorch's torch.load() without weights_only=True, permitting pickle-based deserialization of attacker-controlled objects. Any user who warmstarts or evaluates a model from an untrusted checkpoint file triggers code execution on their host. No public exploit is identified at time of analysis, EPSS is negligible (0.02%), and SSVC records exploitation as 'none' - this is a latent supply-chain/ML-artifact risk rather than an actively exploited one.
Arbitrary code execution in CosyVoice (FunAudioLLM's open-source multilingual text-to-speech toolkit) arises because its average_model.py utility calls PyTorch's torch.load() on epoch_*.pt checkpoint files without weights_only=True, allowing pickle-based deserialization of attacker-controlled objects. Any user who runs the model-averaging tool against a directory containing a malicious checkpoint executes attacker code on their machine. There is no public exploit identified at time of analysis and EPSS is very low (0.02%), but the CWE-502 pattern is trivially weaponizable and SSVC marks it automatable.
Arbitrary code execution in CosyVoice (FunAudioLLM's multilingual text-to-speech toolkit) through commit 6e01309 allows an attacker to run code on a victim's machine via a malicious PyTorch .pt file. The vulnerability lives in the make_parquet_list.py data-preparation tool, which calls torch.load() without weights_only=True, so any .pt file it ingests can carry a malicious pickle payload that executes when the victim processes an attacker-supplied data directory. Reported by MITRE with a low EPSS (0.02%, 5th percentile) and no public exploit identified at time of analysis; this is a poisoned-input/supply-chain style flaw rather than a remotely reachable network service.