Windows File Explorer on affected Microsoft Windows 10, Windows 11, and Windows Server platforms exposes sensitive information to locally authenticated low-privilege users without authorization. The CWE-200 root cause indicates inadequate access restrictions within the File Explorer shell component, enabling a user to read data beyond their authorization boundary. No public exploit exists and SSVC confirms no observed exploitation activity, but the broad Windows deployment footprint and high confidentiality impact (C:H) make this relevant for shared-access environments, terminal servers, and organizations with insider-threat concerns.
Windows File Explorer on virtually all supported Microsoft Windows desktop and server editions leaks sensitive information to locally authenticated low-privileged users, classified under CWE-200. The flaw allows a local attacker holding only a standard account to access data that should be restricted to higher-privileged processes - with no user interaction required (UI:N) and low attack complexity (AC:L). Despite the high confidentiality impact in the CVSS vector, EPSS sits at just 0.36% (28th percentile) and SSVC confirms exploitation as 'none' and the attack as not automatable, placing this firmly in the category of a patch-cycle priority rather than an emergency response. No public exploit has been identified at time of analysis.
Windows Media on multiple Windows client and server editions exposes sensitive information to authenticated local users, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Affected builds span Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025, representing a broad footprint of Microsoft's supported OS ecosystem. No active exploitation has been identified at time of analysis - the vulnerability is absent from CISA KEV, EPSS sits at 0.36% (28th percentile), and SSVC assesses exploitation status as none - making this a patch-and-monitor priority rather than an emergency response.
Memory parsing across Microsoft Office and SharePoint Server products is susceptible to a CWE-125 out-of-bounds read that, when triggered by opening a specially crafted Office document, produces local information disclosure or application availability loss. The affected surface is broad - spanning Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024 on both Windows and macOS, and SharePoint Enterprise Server 2016, 2019, and Subscription Edition - but real-world exploitation pressure is low: EPSS sits at 0.36% (28th percentile), CISA SSVC rates exploitation as none and the attack as non-automatable, and no public exploit has been identified at time of analysis. Vendor-released patches are available for all affected product lines.
Out-of-bounds read in Microsoft Excel and related Office products exposes adjacent process memory to local information disclosure when a user opens a specially crafted spreadsheet file. The flaw spans a broad set of Microsoft Office versions across Windows and macOS - including Excel 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office Online Server - with vendor-released patches now available for all affected builds. No active exploitation has been confirmed by CISA KEV, and EPSS places exploitation probability at 0.35% (27th percentile), consistent with SSVC's assessment of no current exploitation and non-automatable delivery.
Microsoft Graphics Component on Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 leaks sensitive information to locally authenticated standard users. Exploitation requires existing local access with at least user-level privileges (PR:L, AV:L), after which the attacker can extract sensitive data through the Graphics Component without any user interaction. No active exploitation has been confirmed - SSVC categorizes exploitation as 'none,' CISA KEV listing is absent, and EPSS of 0.35% (27th percentile) reflects low near-term exploitation probability.
Local information disclosure in Windows Universal Plug and Play (upnp.dll) exposes sensitive memory contents to authorized low-privilege users across a wide range of Windows 10, Windows 11, and Windows Server releases. The flaw stems from use of an uninitialized resource (CWE-908), meaning the UPnP service reads from memory that has not been properly initialized before use, potentially leaking stale heap or stack contents. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.
Out-of-bounds memory read in the Windows Desktop Window Manager (DWM) Core Library enables a locally authenticated, low-privileged user to disclose sensitive memory contents across a wide range of Windows client and server versions. The flaw is reachable by any standard user account without administrative rights, making it relevant in multi-user, shared workstation, and terminal services environments. No active exploitation is confirmed - CISA SSVC rates exploitation as 'none', EPSS sits at 0.31% (22nd percentile), and no KEV listing exists - but the broad affected surface spanning Windows 10 through Windows 11 and Server 2025 warrants timely patching.
Out-of-bounds read in the Windows Cloud Files Mini Filter Driver (cldflt.sys) exposes kernel memory contents to local attackers with standard user privileges. Affected across Windows 10 (1809 through 22H2), Windows 11 (24H2 through 26H1), and Windows Server 2019 through 2025, the vulnerability allows an authorized local account to read beyond allocated buffer boundaries in the driver that underpins cloud sync features such as OneDrive Files On-Demand. No public exploit identified at time of analysis; EPSS is 0.31% (22nd percentile) and SSVC rates exploitation as none, making this a moderate patch priority rather than an emergency response.
Buffer over-read in the Windows NTFS kernel driver exposes adjacent memory contents to a local attacker holding a standard user account across a broad range of Windows 10, 11, and Server releases. Exploitation is constrained to AV:L/PR:L, meaning an attacker must already have interactive or programmatic local access before triggering the CWE-126 condition - making this a post-compromise reconnaissance primitive rather than an initial-access vector. EPSS stands at 0.31% (22nd percentile) and SSVC confirms no known exploitation activity, placing this at low operational urgency despite the High confidentiality impact rating.
Integer underflow in the Windows Kernel enables a locally authenticated attacker to disclose sensitive kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server platforms. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms that any low-privilege local user can trigger the flaw without special configuration or user interaction, yielding high confidentiality impact with no integrity or availability consequences. Microsoft has released a patch via the July 2026 Security Update Guide; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Uninitialized memory disclosure in the Windows SMB implementation enables a locally authenticated, low-privileged attacker to read sensitive contents from uninitialized kernel or heap buffers, achieving high confidentiality impact within the affected system. The vulnerability spans Windows 10 (from version 1607 through 22H2), Windows 11 (versions 24H2 through 26H1), and Windows Server 2012 through 2025 across both full and Server Core installation types. No public exploit code has been identified and CISA SSVC assesses exploitation status as none, placing this firmly in the patch-and-monitor category rather than emergency response.
Windows File Explorer across a broad range of Windows 10, Windows 11, and Windows Server releases contains a use-of-uninitialized-resource flaw (CWE-908) that allows a low-privileged local attacker to read stale memory contents and disclose potentially sensitive information. The vulnerability is locally constrained (AV:L, PR:L) with no integrity or availability impact, and SSVC signals no known exploitation and no automatable attack path. EPSS at 0.31% (22nd percentile) and the absence of a CISA KEV entry collectively indicate low near-term exploitation likelihood despite the wide deployment footprint of the affected OS.
Information disclosure via uninitialized memory in the Windows SMB driver stack affects a broad range of Windows 10, Windows 11, and Windows Server versions. A locally authenticated, low-privileged attacker can trigger a code path that reads from uninitialized memory within the SMB subsystem, potentially leaking sensitive kernel or heap memory contents. No public exploit code or active exploitation has been identified at the time of analysis; Microsoft has released a patch via MSRC.
Out-of-bounds read in the Windows TCP/IP stack exposes kernel or process memory to locally authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases spanning from Server 2012 through Server 2025. The CWE-125 root cause allows an authorized local attacker with standard user credentials to read memory regions outside allocated buffer boundaries in the TCP/IP component, yielding high-confidentiality-impact information disclosure with no integrity or availability consequence. No public exploit code exists and no active exploitation has been identified (EPSS: 0.31%, 22nd percentile; SSVC exploitation status: none), placing this in a lower-priority remediation tier despite its exceptionally broad product footprint.
Local information disclosure in the Windows Container Isolation FS Filter Driver (unionfs.sys) on Windows 11 version 26H1 allows an authorized low-privileged user to read memory outside intended bounds and disclose sensitive kernel or process data. The flaw was reported by Microsoft, a vendor patch is available, and there is no public exploit identified at time of analysis. CVSS 7.1 (AV:L) reflects local access with low privileges but high confidentiality impact.
Windows Print Spooler Components on multiple Windows 10, 11, and Server editions contain a buffer over-read flaw (CWE-126) that allows a locally authenticated attacker with low privileges to disclose sensitive memory contents. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires local access and a standard user account, limiting the attack surface to insiders or already-compromised endpoints. No public exploit or active exploitation has been identified at time of analysis, and EPSS at 0.30% (22nd percentile) alongside SSVC exploitation status of 'none' together indicate low near-term exploitation probability.
Type confusion in the Windows Composite Image File System (CimFS) kernel driver enables local, low-privileged authenticated users to disclose protected memory contents on widely-deployed Windows 10, Windows 11, and Windows Server platforms. The flaw (CWE-843) causes the driver to access a kernel resource via an incompatible type, resulting in unintended memory reads with high confidentiality impact. No public exploit or active exploitation has been confirmed - SSVC lists exploitation as 'none,' EPSS stands at 0.29% (21st percentile), and the vulnerability is absent from the CISA KEV catalog - placing real-world risk in the lower-medium tier despite the C:H CVSS sub-score.
Out-of-bounds read in the Windows Kernel (CWE-125) enables a locally authenticated attacker with standard user privileges to bypass a kernel security feature and read kernel memory contents. Confirmed by Microsoft (MSRC) across Windows 10, Windows 11, and Windows Server 2012 through 2025 editions, with patches available for all affected builds. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.29% (20th percentile) and SSVC exploitation status of 'none' together signal low current exploitation activity, though the kernel memory disclosure primitive is a classic KASLR-defeat building block in chained exploits.
Local tampering in Windows DNS via improper access control (CWE-284) allows a low-privilege authenticated local user to manipulate DNS configuration or records across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) confirms exploitation requires only a valid local account with no elevated privileges, yielding high integrity impact with minimal availability disruption and no direct confidentiality exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 'Authentication Bypass' advisory tag suggests DNS tampering may enable downstream bypass of authentication mechanisms dependent on DNS resolution, potentially amplifying the effective impact beyond the raw CVSS score.
Link-following vulnerability in Windows upnp.dll (Universal Plug and Play) enables a locally authenticated attacker with standard user privileges to read files outside intended access boundaries by planting symbolic links or junction points that the service resolves without proper validation. Affected scope spans Windows 10 (versions 1607-22H2), Windows 11 (versions 24H2-26H1), and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis; EPSS of 0.27% (19th percentile) and CISA SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.
Windows Kernel security feature bypass across Windows 10, 11, and Server 2012 through 2025 allows a local authenticated attacker to circumvent kernel-enforced access controls, resulting in high-confidence disclosure of sensitive information (C:H). Rooted in CWE-284 (Improper Access Control), the flaw enables a privilege-constrained local user to read protected data beyond their authorization boundary. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.25% (16th percentile) and SSVC assigns exploitation status 'none,' consistently characterizing this as a standard patch-cycle priority rather than an emergency response item.
Out-of-bounds read in Adobe Media Encoder exposes sensitive process memory when a victim opens a specially crafted media file, enabling an attacker to obtain confidential runtime data. Affected branches are 25.x through 25.6.5 and 26.x through 26.2.2; patched releases 25.6.6 and 26.3 are available per Adobe APSB26-72. No active exploitation has been identified - EPSS sits at 0.24% (15th percentile) and SSVC rates exploitation as none - making this a moderate-priority patch for environments where Media Encoder handles untrusted media content.
Windows Boot Loader across Windows 10, Windows 11, and Windows Server 2012 through 2025 omits a required cryptographic integrity step (CWE-325), enabling a locally authenticated attacker to bypass boot-time security features. The CVSS vector (AV:L/PR:L) confirms exploitation requires an existing local foothold - remote unauthenticated attacks are not possible. No active exploitation is recorded (SSVC: none, EPSS 0.23%), but SSVC rates technical impact as total, reflecting that a successful boot-level security bypass can undermine the entire trusted boot chain and enable persistent pre-OS compromise.
Security feature bypass via improper privilege management (CWE-269) in Microsoft Windows DNS grants a locally authenticated attacker the ability to circumvent an unspecified security control, resulting in high integrity impact on affected Windows 11 and Windows Server 2025 systems. Affected platforms include Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 in both full and Server Core configurations. No active exploitation has been confirmed by CISA KEV, EPSS probability is very low at 0.22% (13th percentile), and SSVC rates exploitation status as none - indicating this is a patched local-only issue without known active abuse.
Path traversal (CWE-22) in Fortinet FortiOS, FortiProxy, and FortiPAM enables a highly-privileged, physically-present attacker to execute unauthorized code or commands by escaping restricted directory boundaries. The vendor-supplied CVSS vector (AV:P/PR:H) constrains exploitation to scenarios requiring both physical device access and high-level credentials, making opportunistic or remote mass exploitation implausible. A proof-of-concept exists per the CVSS temporal indicator (E:P), and Fortinet has released an official fix per PSIRT advisory FG-IR-26-151; this vulnerability is not currently listed in the CISA KEV catalog.
Windows Key Guard on multiple Windows 10, Windows 11, and Windows Server editions exposes a cryptographic security bypass to locally authenticated low-privilege users due to CWE-1240 (Use of a Cryptographic Primitive with a Risky Implementation), allowing protected key material to be accessed in violation of the Key Guard security boundary. Affected builds span Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025, representing a broad swath of Microsoft's current supported OS surface. No public exploit identified at time of analysis; EPSS sits at 0.21% (11th percentile) and SSVC classifies exploitation status as none with no automation potential, indicating low near-term exploitation probability despite the ubiquitous footprint.
Cleartext transmission of sensitive information in the Windows Ancillary Function Driver for WinSock (afd.sys) enables a locally authenticated, low-privilege attacker to intercept or read sensitive data that the driver handles without adequate protection. Affected platforms span Windows 10 (multiple versions), Windows 11, and Windows Server 2012 through 2025 as confirmed by EUVD version data and Microsoft CPE strings. No public exploit has been identified at time of analysis, EPSS is extremely low at 0.21% (11th percentile), and CISA SSVC classifies this as no active exploitation with non-automatable attack paths, positioning this as a low-urgency but meaningful local disclosure risk.
Out-of-bounds read in Adobe Audition exposes sensitive process memory when a victim opens a specially crafted media or project file. Affected branches span Audition 26.x through 26.0 and 25.x through 25.6.4, with Adobe releasing corrective patches at 26.3 and 25.6.6 respectively per APSB26-71. No public exploit has been identified and EPSS sits at 0.20% (10th percentile), indicating minimal current exploitation likelihood; SSVC likewise classifies exploitation as none and the attack as non-automatable.
Arbitrary file system read in Adobe's Content Credentials ecosystem (C2PA Rust SDK, JS SDK, and c2patool CLI) allows an attacker who crafts a malicious C2PA-signed file to access files and directories outside the intended scope when a victim opens that file. The root cause is improper input validation (CWE-20), likely path traversal in manifest or asset reference parsing. No public exploit code exists at time of analysis, EPSS is 0.15% (5th percentile), and CISA SSVC rates exploitation as none - real-world risk is currently contained but the confidentiality impact is rated High given successful arbitrary file read.
NULL pointer dereference in Zephyr RTOS's syscall verifier allows an unprivileged user-mode thread to crash the kernel across the userspace security boundary. The z_vrfy_k_thread_name_copy() verification handler in kernel/thread.c incorrectly guards against the caller-supplied thread pointer being NULL rather than the ko pointer returned by k_object_find(), so any non-NULL but unregistered address bypasses the check and triggers a supervisor-mode NULL dereference that halts or reboots the system. Affecting Zephyr v2.0.0 through v4.4.0 when built with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled, no public exploit code and no CISA KEV listing have been identified at time of analysis, but the one-syscall reproducibility makes this straightforward to trigger in qualifying builds.
Missing authorization on the `/api/v1/users/` backend user endpoint in xianyu-auto-reply allows remote unauthenticated attackers to access or manipulate user account data without any credentials. The flaw (CWE-862) affects all commits up to dcb445ad97816ad65299a7580ee0c8c8f929da84 in this FastAPI-based Python backend for automating Xianyu marketplace replies. A public exploit exists (CVSS 4.0 E:P), though no active exploitation is confirmed in CISA KEV; the vendor-issued patch commit is the recommended remediation given the project's rolling release model.
Untrusted pointer dereference (CWE-822) in Microsoft Excel allows a local attacker to disclose sensitive memory contents when a victim opens a specially crafted workbook. The flaw affects a broad swath of Microsoft Office product lines - from Excel 2016 through Office LTSC 2024 and their Mac counterparts - as confirmed by CPE enumeration. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as none and technical impact as partial, placing this in the moderate real-world priority tier despite the C:H CVSS rating.
SQL injection in SAP S/4HANA Project Management (PPM-PRO) allows a high-privileged authenticated attacker to execute crafted database queries, exposing backend database contents. The vulnerability is reachable over the network but requires both high attack complexity and high privilege level, significantly constraining the realistic attacker pool. No public exploit or active exploitation has been identified at time of analysis, and the CVSS base score of 5.5 reflects these mitigating factors despite the potential for database exposure.
Stored XSS in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Commerce Webhooks Plugin enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, executing in victims' browsers upon page load. Affected versions span Adobe Commerce through 2.4.9/p-series, Magento Open Source through 2.4.9, B2B through 1.5.3, and Webhooks Plugin through 1.20.0. The CVSS scope change (S:C) indicates the injected script can operate beyond the originating application's security context, raising the practical impact when higher-privileged users such as store administrators visit the compromised page. No public exploit has been identified at time of analysis and CISA has not listed this in KEV.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who visits the affected page. All three deployment variants are affected - AEM 6.5 (≤6.5.24), AEM 6.5 LTS (≤SP1), and AEM as a Cloud Service (≤2026.5.0) - with patches released under Adobe advisory APSB26-74. No public exploit code or active exploitation has been identified; EPSS sits at 0.29% (21st percentile) and SSVC confirms exploitation status as none, placing this in a patch-on-schedule rather than emergency-response posture.
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of any users who view the affected content - including administrators. Affected deployments span AEM as a Cloud Service through 2026.5.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP1. No public exploit identified at time of analysis; EPSS stands at 0.29% (21st percentile) and SSVC confirms no active exploitation, placing this in the medium-priority tier despite the scope-changed CVSS scoring.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute malicious JavaScript within a victim's browser by manipulating DOM-writable sinks in the AEM interface. Affected deployments span AEM as a Cloud Service (≤2026.5.0), AEM 6.5 LTS (≤SP1), and AEM 6.5 (≤6.5.24). No active exploitation has been identified - EPSS sits at 0.27% (19th percentile), CISA SSVC assigns exploitation status of 'none' and automatable 'no', and the vulnerability is absent from the CISA KEV catalog, collectively indicating low current threat momentum despite the scope-change component.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DOM sources and execute arbitrary JavaScript within an authenticated victim's browser session. All three supported deployment tracks are affected: AEM as a Cloud Service (≤2026.5.0), AEM 6.5 LTS (≤SP1), and AEM 6.5 on-premises (≤6.5.24). No public exploit has been identified and SSVC classifies exploitation status as none, but patches are available across all affected tracks per Adobe advisory APSB26-74.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject and execute arbitrary JavaScript within an authenticated victim's browser by delivering a crafted URL that manipulates the client-side DOM environment. All three AEM product tracks are affected: Cloud Service through 2026.5.0, the classic 6.5 series through 6.5.24, and 6.5 LTS through SP1. The CVSS scope change (S:C) reflects that execution escapes the vulnerable component into the victim's broader browser session, enabling session token theft or unauthorized AEM actions on the victim's behalf; however, no public exploit code has been identified at time of analysis and SSVC confirms no in-the-wild exploitation.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript within a victim's browser by delivering a crafted URL that manipulates client-side DOM sources, contingent on the victim clicking the link. All three AEM product lines are affected - AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP1, and AEM as a Cloud Service through the 2026.5.0 release - with vendor-confirmed patches now available per advisory APSB26-74. No public exploit code has been identified and EPSS sits at 0.27% (19th percentile), consistent with SSVC's assessment of no current exploitation and non-automatable attack delivery.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser by delivering a crafted URL that manipulates the client-side DOM environment. Affected deployments span AEM 6.5 (≤6.5.24), AEM 6.5 LTS (≤SP1), and AEM as a Cloud Service (≤2026.5.0) - three distinct product lines with broad enterprise reach. No active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.27% at the 19th percentile alongside an SSVC exploitation status of 'none' indicate low near-term threat activity, though patching remains warranted given the changed-scope impact.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within an authenticated victim's browser session by manipulating client-side DOM data flows. Three product lines are confirmed affected: AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP1), and AEM as a Cloud Service (through 2026.5.0), with patched releases available per Adobe APSB26-74. No public exploit has been identified at time of analysis; EPSS at 0.27% (19th percentile) and SSVC 'Exploitation: none' collectively indicate low current exploitation pressure, though the confirmed scope change (S:C) elevates potential browser-level impact beyond the AEM application boundary.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious JavaScript in a victim's authenticated browser session, affecting AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP1, and AEM as a Cloud Service through 2026.5.0. The changed-scope designation (S:C) in the CVSS 3.1 vector indicates that a successful exploit can affect resources beyond the originating AEM page context, enabling session hijacking or unauthorized content manipulation. No public exploit code or CISA KEV listing exists at time of analysis; EPSS is 0.27% (19th percentile), consistent with the SSVC assessment of no active exploitation and a non-automatable attack path.
Tenant scope isolation bypass in n8n-mcp's multi-tenant HTTP mode allows an authenticated tenant to read or delete default-scope workflow_versions backups that should be inaccessible to that tenant. Versions through 2.57.3 running with ENABLE_MULTI_TENANT=true are affected; the flaw stems from an inverted boolean guard that fails open when a tenant supplies only one of the two required credentials (URL or API key) rather than both. No public exploit code exists and CISA KEV does not list this CVE - EPSS at 0.26% and SSVC exploitation status 'none' confirm low real-world exploitation likelihood at time of analysis.
Authenticated command injection in NETGEAR RAXE450 and RAXE500 routers allows a logged-in, network-adjacent user to send specially crafted requests that bypass authorization controls and execute commands outside their permitted scope, enabling unauthorized configuration changes with material integrity impact. Both models running firmware below V1.2.14.114 are affected, and the CVSS 4.0 E:P modifier indicates proof-of-concept exploit code exists, though EPSS remains very low at 0.15% (5th percentile). No public exploit identified at time of analysis beyond the PoC signal, and CISA KEV does not list this CVE, consistent with the SSVC exploitation rating of none.
Firefox versions prior to 152.0.6 are exposed to a network-exploitable flaw requiring user interaction that yields limited confidentiality and integrity impact within the browser context. Publicly available exploit code exists, confirmed by Mozilla's own advisory language, though the vendor reports no known attacks in the wild at time of disclosure. The fix is confirmed in Firefox 152.0.6, referenced in Mozilla security advisory MFSA2026-67.
Unauthorized account self-registration in the FoodBook Lite WordPress plugin through version 1.5.6 allows unauthenticated remote attackers to create 'customer'-role accounts and obtain valid WordPress authentication cookies, even when the site administrator has explicitly disabled user registration. The flaw exists because the plugin's registration() function is registered on the publicly accessible wp_ajax_nopriv_registration_action AJAX hook and calls wp_insert_user() without performing nonce verification, capability checks, or consulting the users_can_register site option. No public exploit has been identified at time of analysis and no KEV listing exists; Wordfence reported the issue with a confirmed fix in version 1.5.7.
Process memory disclosure in Google Chrome's Media component on Windows (prior to 150.0.7871.125) enables an attacker who has already compromised the renderer process to read sensitive data from Chrome's memory via a crafted HTML page. This is a chained vulnerability - it is a second-stage exploit requiring a pre-compromised renderer, making it a useful component in multi-stage browser attack chains rather than a standalone threat. No public exploit identified at time of analysis, EPSS is 0.30% (22nd percentile), and SSVC exploitation status is 'none,' confirming no current active exploitation.
Eclipse Jetty fails to enforce RFC 9110/9112's requirement that the HTTP request authority (host and port) match the value in the Host header across all supported protocol versions - HTTP/1, HTTP/2, and HTTP/3. Unauthenticated network attackers can exploit this input validation gap to manipulate Host-header-derived URI constructions (particularly redirect targets on login pages), influence virtual host selection, corrupt reverse proxy routing decisions, and produce misleading access logs. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the attack surface is meaningful in any Jetty deployment that performs host-based routing or generates redirects from the Host header.