Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible attacker to write arbitrary files and directories to restricted locations on a vulnerable system by sending a specially crafted file. Exploitation is constrained by limited attacker control over the write destination, and SSVC assessment rates exploitation as 'none' with non-automatable impact, consistent with the low EPSS of 0.08%. A publicly available proof-of-concept exists on GitHub Gist, but no confirmed active exploitation appears in CISA KEV; patched runtime versions are available for all affected .NET branches.
Cross-origin source code exposure in webpack-dev-server up to 5.2.3 allows attackers controlling a malicious website to steal bundled application source code when a developer runs the dev server over non-trustworthy HTTP origins. The vulnerability exploits the omission of Sec-Fetch-Mode and Sec-Fetch-Site headers on non-HTTPS connections, enabling script injection and cross-origin code exfiltration. Chromium-based browsers Chrome 142+ are exempt due to local network access restrictions. CVSS 5.3 (AC:H due to user requirement to visit attacker site; High confidentiality impact). Fix: upgrade to webpack-dev-server 5.2.4 or later.
A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V11.0), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions >= V7.80 < V11.0), SIPROTEC 5. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PowerSYSTEM Center 2020 (versions 5.11.x through 5.28.x) by SUBNET Solutions exposes a REST API device endpoint that fails to enforce operational role-based permissions, allowing any low-privilege authenticated user to retrieve device information that should be restricted to higher-permission roles. Reported through ICS-CERT advisory ICSA-26-132-02, this is an OT/ICS supervisory control product for power distribution environments, where unauthorized access to device-level data may carry operational sensitivity well beyond what a standard CVSS score conveys. No public exploit code exists and exploitation probability is near-zero (EPSS 0.01%), with SSVC assessing exploitation status as none and the attack requiring both network adjacency and a valid user credential.
Authenticated remote attackers can read arbitrary files from the operating system filesystem with root privileges on affected RUGGEDCOM ROX devices due to improper input validation in the JSON-RPC web server interface. All versions of ROX MX5000, MX5000RE, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, and RX5000 below V2.17.1 are affected. No public exploit code has been identified at time of analysis.
Information disclosure in Microsoft Power Automate for Desktop (all versions from 1.0.0.0 up to but not including 2.67) enables an authenticated, low-privileged attacker operating over the network to access sensitive data they are not authorized to view. The flaw, rooted in CWE-200 improper exposure of sensitive information, carries a CVSS 6.5 score reflecting high confidentiality impact with no integrity or availability consequence. No active exploitation has been confirmed - EPSS stands at 0.11% and CISA KEV listing is absent - but patch availability from Microsoft makes remediation straightforward.
Local privilege escalation in Azure Monitor Agent Metrics Extension (versions below 1.42.0) allows an authenticated low-privileged local attacker to elevate privileges by exploiting an untrusted search path condition (CWE-426). The agent process resolves executable or library paths from an attacker-controllable location, enabling substitution of malicious code that executes in a higher-privileged security context (S:C). No public exploit code has been identified at time of analysis, and EPSS stands at 0.05% (17th percentile), indicating minimal observed exploitation pressure.
Cross-site scripting in Microsoft Visual Studio Code (all versions prior to 1.119.1) allows a local attacker to inject malicious scripts into VS Code's webview rendering engine, bypassing security feature protections with high confidentiality impact across component boundaries. The CVSS Scope:Changed metric (S:C) combined with C:H indicates the injected payload can escape the webview sandbox and exfiltrate data accessible to the broader VS Code/Electron process, such as environment variables, authentication tokens, or workspace file contents. No public exploit code has been identified and EPSS sits at 0.04% (13th percentile), indicating low current exploitation pressure despite the meaningful confidentiality impact.
CRLF injection in SUBNET Solutions' PowerSYSTEM Center email notification service enables adjacent-network, low-privilege attackers to manipulate SMTP protocol sequences during SMTPS communication. All three major release lines are affected: 2020 (≤5.28.x), 2024 (6.0.x-6.1.x), and 2026 (7.0.x), as confirmed by CISA ICS-CERT advisory ICSA-26-132-02. No public exploit or active exploitation has been identified; EPSS is 0.01% and SSVC classifies exploitation as none, placing this firmly in a low-urgency remediation tier for most organizations.
Reflected XSS in SillyTavern's CORS proxy middleware (all versions prior to 1.18.0) allows unauthenticated network attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL that triggers the server's unescaped HTTP 500 error response. The server concatenates the raw attacker-controlled URL parameter directly into the response body at src/middleware/corsProxy.js:40 without HTML encoding, enabling token theft and session manipulation against any user who loads a crafted proxy link. No active exploitation has been confirmed (not in CISA KEV) and EPSS is 0.05% (15th percentile), indicating low real-world exploitation activity; a vendor patch is available in version 1.18.0.
Denial of service in Intel Quick Assist Technology (QAT) software drivers for Windows before version 2.6 can be triggered by a low-privileged local user through improper input validation at the Ring 3 (user application) boundary. An authenticated but unprivileged local attacker can cause high availability impact to the affected system with low complexity, also producing minor confidentiality and integrity side effects. No public exploit code has been identified at time of analysis, and SSVC assessment classifies exploitation as none with non-automatable attack surface.
Improper input validation in Intel Quick Assist Technology (QAT) software drivers for Windows prior to version 1.13 allows a local authenticated user to trigger a denial of service condition. The flaw resides in the Ring 3 (user-space application) layer of the driver stack, meaning an unprivileged but authenticated local adversary can cause high availability impact - potentially crashing the driver or the system - with minor confidentiality and integrity side effects. No public exploit code has been identified at time of analysis, EPSS sits at 0.02% (6th percentile), and CISA SSVC classifies exploitation as none and the attack as non-automatable, indicating negligible current threat activity.
Buffer overflow in Intel QAT (Quick Assist Technology) software drivers for Windows before version 1.13 allows an authenticated local user to trigger a denial of service condition via the Ring 3 user-application interface. The flaw (CWE-120) resides in the user-space driver layer and does not require special internal knowledge or user interaction to exploit, though local authenticated access is a hard prerequisite. No active exploitation has been identified (not in CISA KEV), and EPSS remains at the 3rd percentile, placing real-world risk firmly in the low-to-medium range despite a moderate CVSS 4.0 score of 6.9.
Null pointer dereference in Intel QAT (Quick Assist Technology) software drivers for Windows before version 1.13 permits a low-privileged authenticated local user to crash the driver's Ring 3 user-mode component, causing a denial of service with high availability impact and minor confidentiality exposure. No active exploitation is confirmed - the vulnerability is absent from CISA KEV, EPSS sits at 0.01% (3rd percentile), and SSVC classifies exploitation status as none. Real-world risk is constrained to environments with Intel QAT explicitly deployed, which is typical of data-center and high-performance computing workloads rather than general enterprise endpoints.
Denial of service in Intel Neural Processing Unit (NPU) firmware drivers (Ring 1: Device Drivers) allows a low-privileged local user to crash or impair NPU availability through an improper conditions check (CWE-754). Affected are systems running Intel NPU Drivers as identified under Intel Security Advisory INTEL-SA-01424. No public exploit or active exploitation has been identified; EPSS is 0.01% (3rd percentile) and CISA SSVC rates exploitation as none - making this a low-urgency patching item despite the driver-level impact.
Server-Side Request Forgery in SillyTavern's optional CORS proxy middleware allows unauthenticated remote attackers to pivot through the server and reach internal network resources, cloud metadata endpoints, or RFC1918 services. All versions up to and including 1.17.0 (npm package pkg:npm/sillytavern) are affected via the `GET /proxy/:url(*)` endpoint, where `corsProxyMiddleware` in `src/middleware/corsProxy.js:31` forwards attacker-controlled URLs directly to `fetch()` without destination allowlisting or private-range blocking. No public exploit has been identified at time of analysis, and the EPSS score of 0.01% (2nd percentile) reflects negligible observed exploitation activity; however, publicly hosted instances without network-level controls present meaningful exposure to internal service probing.
Transient execution information disclosure in Intel processors allows unprivileged guest VM code to leak sensitive data from co-resident workloads by exploiting shared microarchitectural predictor state during VMX non-root operation. Confidentiality impact is rated high at both the vulnerable-system and subsequent-system level, indicating potential cross-VM or host-to-guest data leakage consistent with Spectre-class side-channel behavior. No public exploit has been identified at time of analysis, EPSS sits at the 3rd percentile, and CISA SSVC rates exploitation as none - but the cross-boundary confidentiality impact makes this relevant to any multi-tenant virtualized environment running affected Intel silicon.
Improper buffer restrictions in Intel's Display Virtualization for Windows OS driver software (Ring 2 device driver layer) allow a locally authenticated low-privileged user to trigger a denial of service condition affecting system availability. The flaw, tracked as CWE-119, resides in the driver's memory boundary enforcement and can be exploited without special internal knowledge or user interaction. No active exploitation has been identified (EPSS 0.01%, 3rd percentile; SSVC exploitation status: none), and the impact is limited to availability - confidentiality and integrity are unaffected.
Use-after-free in the Linux kernel ice driver for Intel Ethernet 800 series adapters before version 2.3.14 enables a local authenticated attacker with low privileges to trigger a kernel-level denial of service. The flaw resides in Ring 0 (kernel space), meaning heap corruption in the driver can cause kernel panics or system hangs with high availability impact to both the vulnerable system and subsequent dependent systems. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.01% (3rd percentile) reflects negligible near-term weaponization probability.
Null pointer dereference in Intel Quick Assist Technology (QAT) software drivers for Windows before version 2.6.0 enables denial of service by local authenticated users operating within Ring 3 (user-space). The flaw requires low complexity and no user interaction, allowing a low-privileged local adversary to crash the affected driver component, producing availability loss with no confidentiality or integrity impact. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.01% (3rd percentile), indicating negligible real-world exploitation activity at time of analysis.
Divide-by-zero in Intel Quick Assist Technology (QAT) software drivers for Windows before version 1.13 allows a low-privileged authenticated local user to cause a denial of service. The flaw resides in the Ring 3 (user application) layer of the driver stack, meaning no kernel-level access or elevated privileges are required to trigger the crash. No active exploitation has been identified - EPSS is 0.01% at the 3rd percentile, the vulnerability is absent from the CISA KEV catalog, and SSVC rates exploitation as 'none' with automatable set to 'no.'
Man-in-the-middle attackers positioned between OX Dovecot Pro and clients can forge SCRAM TLS channel binding via specially crafted base64 exchanges, allowing eavesdropping on encrypted communications. The attack requires network-level access and knowledge of channel binding mechanics but yields complete confidentiality compromise. No public exploit code is known, and patched versions are available from Open-Xchange.
Windows Secure Boot bypass across Windows 10 version 1809 through Windows 11 version 26H1 and multiple Windows Server editions allows an authorized local administrator to circumvent boot-time integrity protections by exploiting a non-updateable boot chain component. A successful attacker can subvert the UEFI Secure Boot trust chain to load unsigned or malicious code at the pre-OS stage, enabling persistent bootkit or rootkit implantation that survives OS reinstallation. No public exploit code has been identified and CISA SSVC reports no active exploitation, though the SSVC technical impact rating of 'total' correctly reflects full defeat of the boot integrity boundary.
Privilege escalation via double free in the Windows Rich Text Edit Control (RichEdit) affects an exceptionally broad range of Microsoft platforms, spanning Windows 10 versions 1607 through 22H2, all current Windows 11 branches through 26H1, and Windows Server 2012 through Server 2025. A low-privileged local attacker who can induce user interaction with crafted RTF content can corrupt heap memory to achieve full compromise of confidentiality, integrity, and availability - consistent with the SSVC 'total technical impact' rating. No public exploit code exists and no active exploitation has been identified (not in CISA KEV), and the EPSS score of 0.05% at the 16th percentile reflects a minimal current exploitation signal; however, the sheer scale of the affected Windows install base keeps this relevant for enterprise patch cadence. A notable discrepancy exists: the CVE tags classify this as 'Information Disclosure,' which conflicts with Microsoft's own description of local privilege elevation - the CVSS C:H/I:H/A:H impact metrics and SSVC total-impact rating support the privilege escalation characterization, suggesting the tag is erroneous.
Double free vulnerability in Windows Rich Text Edit component allows local authenticated attackers to escalate privileges on Windows 10 and Windows 11 systems through a specially crafted interaction. The flaw requires local access with standard user privileges and user interaction, but enables full system compromise including code execution and privilege elevation. Microsoft has released a vendor patch to address this issue.
OS command injection in Fortinet FortiAP and FortiAP-W2 access points allows authenticated administrators to execute arbitrary code or commands via specially crafted CLI commands. Affected versions span FortiAP 6.4 through 7.6.2 and FortiAP-W2 7.0 through 7.4.4. The vulnerability requires high-privilege administrative access and does not require user interaction, making it exploitable by rogue administrators or accounts with compromised credentials. No public exploit code or active exploitation has been identified at time of analysis.
OS command injection in Fortinet FortiAP, FortiAP-U, and FortiAP-W2 allows authenticated privileged attackers to execute arbitrary code via maliciously crafted CLI requests. Affected versions span FortiAP 6.4 through 7.6.2, FortiAP-U 6.2 through 7.0.5, and FortiAP-W2 7.0 through 7.4.4. The vulnerability requires high-privilege administrative access and local CLI interaction, limiting exposure to trusted insider threats or compromised management interfaces. CVSS 6.1 reflects the high impact (code execution with full system privileges) constrained by authentication and local access requirements.
Privilege escalation in Axis OS via path traversal in ACAP configuration files allows high-privileged local attackers to achieve code execution with elevated permissions. The vulnerability requires the device to be configured for unsigned ACAP application installation and the attacker to socially engineer a user into installing a malicious ACAP application. CVSS 6.7 reflects high confidentiality, integrity, and availability impact, but exploitation is constrained by high-privilege requirement and user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Axis OS allows privilege escalation via improper input validation during ACAP application installation when unsigned applications are permitted, enabling authenticated attackers with high privileges to gain elevated system access. The vulnerability requires explicit administrative configuration allowing unsigned ACAP installations and victim interaction to install a malicious application. No public exploit code or active exploitation has been confirmed at time of analysis.
Local privilege escalation in Dell PowerScale InsightIQ versions 5.0.0 through 6.2.0 allows high-privileged attackers to execute code with unnecessary elevated privileges, potentially escalating to full system compromise. The vulnerability requires existing local access and high privilege level on the affected system; no public exploit has been identified at time of analysis.
OS command injection in SAP NetWeaver Application Server for ABAP and ABAP Platform allows authenticated administrators to execute arbitrary shell commands on the server while bypassing audit logging. The vulnerability affects integrity and availability but not confidentiality, and requires high-privilege administrative access over the network with no user interaction. CVSS 6.5 reflects the high-privilege requirement despite severe impact potential.
Arbitrary shortcode execution in the Advanced Custom Fields: Extended WordPress plugin (all versions through 0.9.2.3) enables unauthenticated remote attackers to invoke any shortcode registered in a WordPress installation by submitting crafted input to exposed front-end forms. The flaw exists in two code paths - the form front-end renderer and the email action handler - both of which pass user-controlled values directly to WordPress's do_shortcode() function without validation or allowlisting. No active exploitation has been identified (SSVC: Exploitation none, not in CISA KEV), and EPSS sits at 0.09% (25th percentile), though the attack is flagged as automatable, raising the potential for opportunistic scanning at scale.
Null pointer dereference in Windows Storport Miniport Driver allows remote attackers to trigger denial of service over a network with user interaction. The vulnerability affects Windows Server 2025 and exists in the storage port driver architecture, requiring the attacker to send a specially crafted network request that causes the driver to dereference a null pointer, resulting in service interruption or system instability. No public exploit code or active exploitation has been confirmed.
mem0 1.0.0 server exposes an unauthenticated memory deletion API endpoint (DELETE /memories) that allows remote attackers to delete arbitrary user memory records by specifying user identifiers in query parameters, resulting in unauthorized data loss and denial of service. No authentication or authorization validation is performed before processing deletion requests, enabling any network-accessible attacker to target any user's data without credentials.
Windows TCP/IP stack allows a low-privilege network-authenticated attacker to bypass a security feature by exploiting an alternate path or channel (CWE-288), resulting in a high-integrity impact without requiring user interaction. Affected scope spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2012 through Server 2025, making the exposure footprint extremely broad. No public exploit code exists and no active exploitation is confirmed at time of analysis; EPSS at 0.06% (18th percentile) and SSVC classification of 'exploitation: none, automatable: no' indicate low near-term weaponization risk despite the wide attack surface.
Unauthenticated deletion of arbitrary memory records in mem0 1.0.0 allows remote attackers to remove any database entry without credentials, causing unauthorized data loss and potential denial of service. The DELETE /memories/{memory_id} endpoint completely lacks authentication and authorization controls, exposing all memory records to deletion by any network-accessible attacker. No public exploit code has been identified, but the vulnerability is trivial to exploit given the straightforward API design.
UI spoofing in Microsoft Edge for Android (versions below 148.0.3967.55) allows a remote, unauthenticated attacker with high attack complexity to misrepresent critical browser security information to victims over a network, potentially deceiving users about the true origin or security state of web content. The flaw stems from CWE-451, where the browser fails to correctly display security-critical UI elements such as address bar content or trust indicators, enabling phishing or credential theft scenarios. No public exploit code has been identified, EPSS probability sits at 0.05%, and CISA SSVC rates exploitation status as none - placing this as a moderate-priority patch rather than an urgent emergency.
Microsoft Teams for Android exposes internal files or directories to unauthorized local parties via CWE-552 (Files or Directories Accessible to External Parties), enabling a local attacker to perform identity spoofing. Affected versions span all releases of Teams for Android below 1.0.0.2026092103. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, though the SSVC framework rates the technical impact as total, suggesting that successfully accessed data could fully compromise the Teams session or identity context on the device.
Local file disclosure in Microsoft Word exposes sensitive files and directories to external parties when a victim opens a specially crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise across version ranges confirmed by NVD CPE data. No public exploit code has been identified and CISA SSVC rates exploitation as none with only partial technical impact; a vendor-released patch is available via the Microsoft Security Response Center.
Path traversal in the Visual Studio Code Live Preview extension (versions 0.4.0 through 0.4.18) enables a local attacker to read arbitrary files outside the intended workspace directory by exploiting insufficient path validation in the extension's embedded HTTP server. The flaw (CWE-23) can expose sensitive local files such as credentials or private keys to any party who can supply a crafted file to a developer and have them trigger the preview feature. No public exploit code exists and the vulnerability is absent from CISA KEV; Microsoft has released a fix in version 0.4.19.
SQL injection in shelf.nu's /assets route exposes cross-organizational database contents to any authenticated user regardless of role, affecting versions 1.12 through 1.20.0. The injection point is the sortBy query parameter's direction component, where unsanitized input is passed directly into Prisma.raw() SQL construction. A PoC is confirmed by regression tests in the fix commit (GHSA-69xv-wmgg-3qp3); no CISA KEV listing exists and EPSS sits at 0.04%, indicating limited observed exploitation activity at time of analysis.
mem0 1.0.0 server allows unauthenticated remote attackers to trigger memory reset and table re-creation via unprotected DELETE /memories endpoint, causing schema disruption, data loss, and denial of service. The vulnerability exploits missing authentication and authorization controls on a database management operation accessible over the network without credentials.
Incorrect boundary conditions in Firefox's JavaScript JIT compiler expose network-reachable memory corruption in all Firefox versions prior to 150.0.3, yielding partial confidentiality and integrity impact per CVSS C:L/I:L. The flaw is classified under CWE-119 (buffer bounds violation) and carries a CVSS 6.5 Medium score with an AV:N/AC:L/PR:N/UI:N vector - though the UI:N designation warrants scrutiny for a browser-based JIT flaw (see confidence notes). SSVC assesses technical impact as partial with no confirmed exploitation, and EPSS places exploitation probability at 0.03% (8th percentile), indicating low real-world exploitation pressure despite the network-reachable vector. No public exploit identified at time of analysis.
Time-based blind SQL injection in the Eight Day Week Print Workflow WordPress plugin (versions up to 1.2.6) via the 'title' parameter in the pp-get-articles AJAX action allows authenticated attackers with Subscriber-level access to extract sensitive database information. The vulnerability stems from insufficient escaping and lack of prepared statement usage, enabling attackers to append arbitrary SQL queries to extract confidential data with high confidentiality impact.
OpenClaude MCP's OAuth callback handler in Node.js can be shut down via CSRF attack by sending a request with any `error` query parameter, bypassing state validation entirely without knowledge of the CSRF token. The vulnerability allows unauthenticated remote attackers to terminate a user's active authentication session and force server shutdown due to a logic flaw where the `error` parameter check precedes and disables the state validation check. Vendor-released patch version 0.5.1 available.
Brute-force password attacks against the web management interface of Zyxel WRE6505 v2 firmware V1.00(ABDV.3)C0 succeed due to improper rate-limiting on authentication attempts, allowing adjacent LAN attackers to bypass authentication and gain administrative access without requiring valid credentials. The vulnerability affects a legacy wireless range extender model marked as end-of-life by Zyxel, with CVSS 6.5 reflecting high confidentiality impact but local network scope.
Credential leakage in LWP::UserAgent before 6.83 (Perl) exposes Authorization and Proxy-Authorization headers to attacker-controlled redirect targets across cross-origin 3xx redirects. The library's redirect handler stripped only Host and Cookie on follow-up requests, leaving credential headers intact even when the redirect crossed a scheme, host, or port boundary. Authenticated Perl HTTP clients - including server-side applications, crawlers, API integrators, and automation tooling - are affected whenever caller-supplied credentials are passed to a UserAgent instance that can be redirected. No public exploit has been independently confirmed beyond the proof-of-concept submitted with the vulnerability report, and CISA KEV does not list this CVE; however, the exploitation pattern is straightforward and mirrors a well-documented class of credential-leakage flaws in HTTP client libraries.
Remote authenticated attackers can exploit an exposed dangerous method on the Core Server of Ivanti Endpoint Manager versions before 2024 SU6 to leak access credentials. The vulnerability requires valid authentication credentials to exploit and does not allow code execution or system modification, but compromises confidentiality by exposing sensitive authentication material that could facilitate lateral movement or account takeover.
Stored cross-site scripting in Shortcodely WordPress plugin versions up to 1.0.1 allows authenticated contributors and above to inject arbitrary JavaScript into pages via the 'widget_area' parameter, with scripts executing whenever users access affected pages. The vulnerability stems from insufficient input sanitization and output escaping, affecting all installations with vulnerable plugin versions active. CVSS 6.4 reflects the cross-site scope and information disclosure potential, though exploitation requires authenticated contributor-level access.
Stored Cross-Site Scripting in BJ Lazy Load plugin for WordPress versions up to 1.0.9 allows authenticated attackers with Contributor-level access to inject arbitrary web scripts via regex-based HTML attribute manipulation in the `filter_images()` function. The vulnerability exploits improper handling of HTML attribute boundaries during `src` attribute replacement, enabling attackers to promote malicious content from class attribute values into executable DOM attributes. When victims access injected pages, the injected scripts execute in their browsers with the privileges of the compromised site.