Out-of-bounds read in Apple operating systems allows malicious applications to crash the system or leak kernel memory across iOS/iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, and watchOS 26.5. The vulnerability requires local application execution but no user interaction, enabling information disclosure and denial-of-service attacks. Despite high CVSS 7.3 scoring, the EPSS probability is very low (0.02%, 5th percentile), indicating minimal observed exploitation activity. Vendor-released patches are available for all affected platforms.
Stored cross-site scripting in MantisBT (Composer package mantisbt/mantisbt, versions <= 2.28.1) allows any authenticated user to inject arbitrary HTML/JavaScript through the 'font_family' account preference, which is then rendered into the CSS/head of every MantisBT page. Because the account preference update accepted an arbitrary font string without validating it against the allowed font list, the payload persists and executes whenever the affected page context is loaded. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is very low (0.05%), but chained with the companion CSP-bypass advisory GHSA-9c3j-xm6v-j7j3 the flaw can escalate to full account takeover.
Broken access control in MantisBT's programmatic file APIs lets any authenticated REPORTER-level user (access level 25) download attachments from private bugnotes created by higher-privileged DEVELOPER, MANAGER, or ADMIN users, exposing internal logs, screenshots, and patches. The flaw affects the REST endpoint GET /api/rest/issues/{id}/files and the SOAP mc_issue_attachment_get endpoint, while the web UI is unaffected because it filters through bugnote_get_all_visible_bugnotes(). There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and the issue is not on CISA KEV.
Symbolic link path traversal in pgAdmin 4 File Manager allows authenticated users to write arbitrary files on the server filesystem. Attackers with valid credentials can plant symlinks in their storage directory pointing outside it, bypassing access controls to overwrite critical system files or application configurations with pgAdmin process privileges. The vulnerability combines CWE-61 (symlink following) with a time-of-check-time-of-use race condition. Affects all pgAdmin 4 versions before 9.15. No active exploitation confirmed (not in CISA KEV), but exploit is straightforward for authenticated attackers given the detailed fix description published by PostgreSQL project.
Server-Side Request Forgery in MLflow allows authenticated users to force the MLflow backend to send HTTP requests to arbitrary URLs, including internal services and cloud metadata endpoints (e.g., AWS EC2 metadata at 169.254.169.254). Affects MLflow versions prior to 3.9.0. The webhook creation endpoint accepts unvalidated user-controlled URLs that are later used in HTTP POST requests, enabling cloud credential theft, internal network reconnaissance, and data exfiltration. Vendor-released patch available in MLflow 3.9.0, confirmed by GitHub commit 64aa0ab. No active exploitation confirmed (not in CISA KEV), but publicly disclosed with detailed technical analysis from huntr.com.
Authenticated users in pgAdmin 4 before version 9.15 can read arbitrary server-side files or trigger server-side request forgery (SSRF) attacks via unvalidated LLM API configuration endpoints. The vulnerabilities exist in the chat and model-list endpoints where user-supplied api_key_file and api_url parameters are passed directly to LLM provider clients without sanitization, enabling attackers to exfiltrate sensitive files (database credentials, private keys) readable by the pgAdmin process or coerce internal requests to cloud metadata services and private infrastructure.
Insecure Direct Object Reference (IDOR) in Open WebUI allows authenticated users with read-only channel access to modify or delete any message in those channels, bypassing frontend ownership controls through direct API calls. The vulnerability affects the channels feature in Open WebUI versions ≤0.6.18, exploiting missing message ownership validation in backend FastAPI endpoints despite correct frontend access control implementation. Publicly available exploit code exists with detailed proof-of-concept demonstrating privilege escalation from read to write/delete permissions. Vendor-released patch available in version 0.6.19.
Memory-corruption in Apple's operating-system file-processing components (iOS/iPadOS before 18.7.9, macOS Sequoia before 15.7.7, macOS Tahoe before 26.5) lets a remote attacker cause a denial-of-service crash or leak fragments of process memory when a victim opens a maliciously crafted file. Rated CVSS 7.1, it is unauthenticated but requires user interaction to open the file. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and it is not on CISA KEV.
Denial of service in the barebox bootloader (all versions up to and including 2026.04.0) lets an attacker on the same broadcast domain crash the device by sending a crafted DHCP Offer or ACK packet that omits the 0xff end marker, triggering an out-of-bounds read in the dhcp_message_type() option parser. Exploitation is unauthenticated but requires adjacent network access, and impact is limited to availability (a crash) rather than code execution or data theft. No public exploit is identified at time of analysis and the EPSS probability is negligible (0.01%, 1st percentile).
User equipment (UE) downlink traffic can be redirected to attacker-controlled radios in Ella Core (5G AMF software) versions prior to 1.10.0. A malicious radio with a valid NG Setup connection can forge PDUSessionResourceSetupResponse messages using arbitrary AMF-UE-NGAP-IDs, causing Ella Core to create GTP tunnels that misdirect victim UE downlink packets to the attacker's radio. This enables traffic interception and denial of service against targeted UEs. The vulnerability stems from missing validation that NGAP messages arrive on the correct SCTP association for the UE context. No public exploit identified at time of analysis, and EPSS data not available. Vendor-released patch: version 1.10.0.
Commit and tag signature confusion in go-git (the pure-Go implementation of Git) lets a crafted Git object carry a signature that validates while its effective metadata differs from what was actually signed. Because go-git parses ambiguous or malformed object headers differently from canonical Git, and because its signing/verification path operates over a reconstructed representation rather than the raw object bytes, an attacker with contributor access can create commits whose displayed author/committer/metadata diverges from the signed payload - undermining downstream trust decisions (the issue was originally surfaced through sigstore/gitsign). Affected releases are go-git v5 before 5.19.0 and v6 alpha builds 6.0.0-alpha.1 through 6.0.0-alpha.2. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was provided in the source data.