NULL pointer dereference in Zephyr RTOS's syscall verifier allows an unprivileged user-mode thread to crash the kernel across the userspace security boundary. The z_vrfy_k_thread_name_copy() verification handler in kernel/thread.c incorrectly guards against the caller-supplied thread pointer being NULL rather than the ko pointer returned by k_object_find(), so any non-NULL but unregistered address bypasses the check and triggers a supervisor-mode NULL dereference that halts or reboots the system. Affecting Zephyr v2.0.0 through v4.4.0 when built with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled, no public exploit code and no CISA KEV listing have been identified at time of analysis, but the one-syscall reproducibility makes this straightforward to trigger in qualifying builds.
Missing authorization on the `/api/v1/users/` backend user endpoint in xianyu-auto-reply allows remote unauthenticated attackers to access or manipulate user account data without any credentials. The flaw (CWE-862) affects all commits up to dcb445ad97816ad65299a7580ee0c8c8f929da84 in this FastAPI-based Python backend for automating Xianyu marketplace replies. A public exploit exists (CVSS 4.0 E:P), though no active exploitation is confirmed in CISA KEV; the vendor-issued patch commit is the recommended remediation given the project's rolling release model.
Untrusted pointer dereference (CWE-822) in Microsoft Excel allows a local attacker to disclose sensitive memory contents when a victim opens a specially crafted workbook. The flaw affects a broad swath of Microsoft Office product lines - from Excel 2016 through Office LTSC 2024 and their Mac counterparts - as confirmed by CPE enumeration. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as none and technical impact as partial, placing this in the moderate real-world priority tier despite the C:H CVSS rating.
SQL injection in SAP S/4HANA Project Management (PPM-PRO) allows a high-privileged authenticated attacker to execute crafted database queries, exposing backend database contents. The vulnerability is reachable over the network but requires both high attack complexity and high privilege level, significantly constraining the realistic attacker pool. No public exploit or active exploitation has been identified at time of analysis, and the CVSS base score of 5.5 reflects these mitigating factors despite the potential for database exposure.
Stored XSS in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Commerce Webhooks Plugin enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, executing in victims' browsers upon page load. Affected versions span Adobe Commerce through 2.4.9/p-series, Magento Open Source through 2.4.9, B2B through 1.5.3, and Webhooks Plugin through 1.20.0. The CVSS scope change (S:C) indicates the injected script can operate beyond the originating application's security context, raising the practical impact when higher-privileged users such as store administrators visit the compromised page. No public exploit has been identified at time of analysis and CISA has not listed this in KEV.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who visits the affected page. All three deployment variants are affected - AEM 6.5 (≤6.5.24), AEM 6.5 LTS (≤SP1), and AEM as a Cloud Service (≤2026.5.0) - with patches released under Adobe advisory APSB26-74. No public exploit code or active exploitation has been identified; EPSS sits at 0.29% (21st percentile) and SSVC confirms exploitation status as none, placing this in a patch-on-schedule rather than emergency-response posture.
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of any users who view the affected content - including administrators. Affected deployments span AEM as a Cloud Service through 2026.5.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP1. No public exploit identified at time of analysis; EPSS stands at 0.29% (21st percentile) and SSVC confirms no active exploitation, placing this in the medium-priority tier despite the scope-changed CVSS scoring.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute malicious JavaScript within a victim's browser by manipulating DOM-writable sinks in the AEM interface. Affected deployments span AEM as a Cloud Service (≤2026.5.0), AEM 6.5 LTS (≤SP1), and AEM 6.5 (≤6.5.24). No active exploitation has been identified - EPSS sits at 0.27% (19th percentile), CISA SSVC assigns exploitation status of 'none' and automatable 'no', and the vulnerability is absent from the CISA KEV catalog, collectively indicating low current threat momentum despite the scope-change component.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DOM sources and execute arbitrary JavaScript within an authenticated victim's browser session. All three supported deployment tracks are affected: AEM as a Cloud Service (≤2026.5.0), AEM 6.5 LTS (≤SP1), and AEM 6.5 on-premises (≤6.5.24). No public exploit has been identified and SSVC classifies exploitation status as none, but patches are available across all affected tracks per Adobe advisory APSB26-74.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject and execute arbitrary JavaScript within an authenticated victim's browser by delivering a crafted URL that manipulates the client-side DOM environment. All three AEM product tracks are affected: Cloud Service through 2026.5.0, the classic 6.5 series through 6.5.24, and 6.5 LTS through SP1. The CVSS scope change (S:C) reflects that execution escapes the vulnerable component into the victim's broader browser session, enabling session token theft or unauthorized AEM actions on the victim's behalf; however, no public exploit code has been identified at time of analysis and SSVC confirms no in-the-wild exploitation.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript within a victim's browser by delivering a crafted URL that manipulates client-side DOM sources, contingent on the victim clicking the link. All three AEM product lines are affected - AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP1, and AEM as a Cloud Service through the 2026.5.0 release - with vendor-confirmed patches now available per advisory APSB26-74. No public exploit code has been identified and EPSS sits at 0.27% (19th percentile), consistent with SSVC's assessment of no current exploitation and non-automatable attack delivery.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser by delivering a crafted URL that manipulates the client-side DOM environment. Affected deployments span AEM 6.5 (≤6.5.24), AEM 6.5 LTS (≤SP1), and AEM as a Cloud Service (≤2026.5.0) - three distinct product lines with broad enterprise reach. No active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.27% at the 19th percentile alongside an SSVC exploitation status of 'none' indicate low near-term threat activity, though patching remains warranted given the changed-scope impact.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within an authenticated victim's browser session by manipulating client-side DOM data flows. Three product lines are confirmed affected: AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP1), and AEM as a Cloud Service (through 2026.5.0), with patched releases available per Adobe APSB26-74. No public exploit has been identified at time of analysis; EPSS at 0.27% (19th percentile) and SSVC 'Exploitation: none' collectively indicate low current exploitation pressure, though the confirmed scope change (S:C) elevates potential browser-level impact beyond the AEM application boundary.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious JavaScript in a victim's authenticated browser session, affecting AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP1, and AEM as a Cloud Service through 2026.5.0. The changed-scope designation (S:C) in the CVSS 3.1 vector indicates that a successful exploit can affect resources beyond the originating AEM page context, enabling session hijacking or unauthorized content manipulation. No public exploit code or CISA KEV listing exists at time of analysis; EPSS is 0.27% (19th percentile), consistent with the SSVC assessment of no active exploitation and a non-automatable attack path.
Tenant scope isolation bypass in n8n-mcp's multi-tenant HTTP mode allows an authenticated tenant to read or delete default-scope workflow_versions backups that should be inaccessible to that tenant. Versions through 2.57.3 running with ENABLE_MULTI_TENANT=true are affected; the flaw stems from an inverted boolean guard that fails open when a tenant supplies only one of the two required credentials (URL or API key) rather than both. No public exploit code exists and CISA KEV does not list this CVE - EPSS at 0.26% and SSVC exploitation status 'none' confirm low real-world exploitation likelihood at time of analysis.
Authenticated command injection in NETGEAR RAXE450 and RAXE500 routers allows a logged-in, network-adjacent user to send specially crafted requests that bypass authorization controls and execute commands outside their permitted scope, enabling unauthorized configuration changes with material integrity impact. Both models running firmware below V1.2.14.114 are affected, and the CVSS 4.0 E:P modifier indicates proof-of-concept exploit code exists, though EPSS remains very low at 0.15% (5th percentile). No public exploit identified at time of analysis beyond the PoC signal, and CISA KEV does not list this CVE, consistent with the SSVC exploitation rating of none.
Firefox versions prior to 152.0.6 are exposed to a network-exploitable flaw requiring user interaction that yields limited confidentiality and integrity impact within the browser context. Publicly available exploit code exists, confirmed by Mozilla's own advisory language, though the vendor reports no known attacks in the wild at time of disclosure. The fix is confirmed in Firefox 152.0.6, referenced in Mozilla security advisory MFSA2026-67.
Unauthorized account self-registration in the FoodBook Lite WordPress plugin through version 1.5.6 allows unauthenticated remote attackers to create 'customer'-role accounts and obtain valid WordPress authentication cookies, even when the site administrator has explicitly disabled user registration. The flaw exists because the plugin's registration() function is registered on the publicly accessible wp_ajax_nopriv_registration_action AJAX hook and calls wp_insert_user() without performing nonce verification, capability checks, or consulting the users_can_register site option. No public exploit has been identified at time of analysis and no KEV listing exists; Wordfence reported the issue with a confirmed fix in version 1.5.7.
Process memory disclosure in Google Chrome's Media component on Windows (prior to 150.0.7871.125) enables an attacker who has already compromised the renderer process to read sensitive data from Chrome's memory via a crafted HTML page. This is a chained vulnerability - it is a second-stage exploit requiring a pre-compromised renderer, making it a useful component in multi-stage browser attack chains rather than a standalone threat. No public exploit identified at time of analysis, EPSS is 0.30% (22nd percentile), and SSVC exploitation status is 'none,' confirming no current active exploitation.
Eclipse Jetty fails to enforce RFC 9110/9112's requirement that the HTTP request authority (host and port) match the value in the Host header across all supported protocol versions - HTTP/1, HTTP/2, and HTTP/3. Unauthenticated network attackers can exploit this input validation gap to manipulate Host-header-derived URI constructions (particularly redirect targets on login pages), influence virtual host selection, corrupt reverse proxy routing decisions, and produce misleading access logs. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the attack surface is meaningful in any Jetty deployment that performs host-based routing or generates redirects from the Host header.
Eclipse Jetty mishandles HTTP URI path parameters containing semicolons combined with traversal sequences, delivering an unresolved path (e.g., `/public/../admin/secret.txt`) to downstream web applications instead of the canonicalized form (e.g., `/admin/secret.txt`). Web applications that delegate path-based authorization decisions to Jetty-provided paths are susceptible to confusion attacks where an attacker crafts a URI like `/public;/../admin/secret.txt` to receive a path that bypasses application-layer access controls. Jetty itself is shielded by its alias checker and will not serve restricted files directly; the integrity risk materializes only in applications that consume the unresolved path for routing or authorization logic. No public exploit code or CISA KEV listing is present at time of analysis.
Server-Side Request Forgery in Sonatype Nexus Repository 3 exposes internal network infrastructure to authenticated users holding the nexus:ssl-truststore:read permission, who can weaponize the SSL Certificate Retrieval endpoint to force the server to initiate outbound TCP connections to arbitrary hosts - including cloud metadata services, internal APIs, and otherwise firewalled systems. All versions from 3.0.0 up to (but not including) 3.94.0 are affected, and a vendor-released patch is available. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Path traversal in openSIS Classic 9.3 exposes arbitrary server files through the legacy messaging sent-mail attachment download endpoint, exploitable by any authenticated low-privilege user. The vulnerability allows crafted sequences such as directory traversal patterns to escape the intended attachment directory and retrieve sensitive server-side files. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, the low authentication bar and network accessibility make this a realistic internal threat.
Privilege escalation in Kimai time-tracking software (<=2.57.0) allows authenticated TEAMLEAD users to create and modify global export templates that are intended to be administrator-only resources. The web controller routes `createExportTemplate` and `editExportTemplate` in `ExportController` inherit only the class-level `create_export` permission - granted to ROLE_TEAMLEAD - while the API endpoints and UI correctly enforce the stricter `create_export_template` permission restricted to ROLE_ADMIN and ROLE_SUPER_ADMIN. Because ExportTemplate entities have no per-user or per-team scoping, a TEAMLEAD can silently alter organization-wide export configurations affecting all users including administrators. No public exploit is confirmed at time of analysis, though a private PoC was submitted to the vendor and subsequently removed.
Cross-scope billing rate manipulation in Kimai 2.56.0 allows authenticated users with edit access to any single project, customer, or activity to tamper with rate configurations belonging to entirely different organizational units they are not authorized to access. The root cause is missing parent-child consistency validation in three Web admin rate-editing endpoints, where the controller validates the authenticated user's access to the parent object but never verifies that the child rate record actually belongs to that same parent. A PoC was privately submitted and subsequently removed from the advisory before public disclosure; no public exploit code is circulating and no CISA KEV active-exploitation listing exists at time of analysis.
Improper authorization in Kimai's Team API endpoints allows an authenticated Teamlead to add users and activities to their team that fall outside their intended management scope, bypassing the access boundaries enforced by the frontend. Affected versions are Kimai <= 2.57.0 (composer package kimai/kimai). A proof-of-concept was reportedly created but withheld; no public exploit code is currently available and this vulnerability is not listed in CISA KEV. Once a Teamlead writes an out-of-scope team relation, downstream authorization logic may treat those relations as legitimate, silently expanding access to time entries, project visibility, and reporting for the affected users and activities.
Cross-site request forgery in Kimai's timesheet API allows an unauthenticated attacker to trigger unauthorized state changes against any logged-in victim by embedding malicious GET requests in attacker-controlled pages. Kimai versions up to and including 2.57.0 expose the `stop` and `restart` timesheet operations as HTTP GET routes, which browsers will follow automatically using the victim's active session cookie - no CSRF token is required. Impact is limited to timesheet data integrity and availability (corrupted time records, unauthorized entries, billing distortion), not system compromise; no public exploit is confirmed at time of analysis, and no active exploitation has been reported by CISA KEV.
Permission revocation bypass in Kimai's timesheet restart and duplicate workflows allows authenticated users to create new database-persisted time entries under projects they no longer have access to. Affecting Kimai up to and including version 2.57.0, the flaw exists because `TimesheetVoter.php` evaluates the `*_own_timesheet` ownership branch before team-based access checks, meaning a historical timesheet entry acts as a durable capability token that survives administrative revocation. No public exploit is available - a PoC was reportedly submitted to the project and then redacted - and this vulnerability is not listed in CISA KEV.
Improper object-level authorization in Kimai 2.56.0 allows any authenticated user holding the generic `create_activity` permission to inject Activity records into projects outside their authorized scope by directly invoking the preset-project creation routes with an arbitrary project ID. The controllers in `ActivityController.php` and `ProjectController.php` validate only the global capability (can the user create activities at all?) without performing a secondary check that the user also has edit rights on the specific target project. No public exploit exists at time of analysis, though a PoC was privately shared with the vendor and subsequently removed; the vendor has released a fix in version 2.57.0.
Privilege escalation in Checkmk's mk_sap_hana agent plugin allows a local unprivileged user to execute arbitrary commands as root by planting a process whose name mimics a SAP HANA instance. The plugin, when running as root under the RUNAS=agent configuration and lacking explicit database configuration, blindly reads the OS process list to derive SAP HANA instance identifiers and injects them unsanitized into a shell command executed with root privileges - a textbook CWE-78 OS command injection. No public exploit code or CISA KEV listing exists at time of analysis, but the attack prerequisites are achievable on any misconfigured Checkmk deployment that monitors SAP environments.
Server-Side Request Forgery in Sonatype Nexus Repository 3 allows any holder of the Capability Administration permission to redirect the server's outbound HTTP requests to arbitrary internal network addresses by supplying a crafted URL in the Webhook Global capability configuration, enabling probing of internal infrastructure. The vulnerability is patched in version 3.94.0 per Sonatype's release notes. No public exploit code exists and the vulnerability is not in CISA KEV, but risk escalates materially on instances where the anonymous role has been granted the Capability Administration permission, as this exposes the SSRF to unauthenticated actors without any configuration changes beyond that role assignment.
Privilege escalation in the TP-Link Archer VX1800v v1 HTTP authentication component allows an adjacent-network authenticated user with at least low-level account privileges to inject newline (CRLF) characters into internally constructed configuration data, ultimately elevating to full administrative access on the device. Affected firmware versions are those below v6092.0 Build 260521 RC.7927n; TP-Link has released a patched firmware. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.39% (32nd percentile), consistent with SSVC's 'Exploitation: none' finding.
Stored cross-site scripting in Hi.Events through v1.10.0-beta allows authenticated event organizers to inject arbitrary JavaScript into public event pages by embedding the raw </script> sequence in an event title, which the application's JSON.stringify() serialization fails to encode safely when placed in inline script contexts. The payload executes in the browser of every visitor to the affected event page - including unauthenticated attendees and authenticated administrators - enabling session hijacking and privilege escalation from a low-privileged creator account. No public exploit has been identified at time of analysis; a vendor-released patch is available in v1.11.0-beta.
Path traversal (Zip Slip) in Rclone's archive extract command allows crafted archives containing `../` or `..\ ` path components in entry names to write extracted files outside the user-selected destination prefix. All Rclone versions prior to 1.74.4 are affected; an attacker who can induce a user to run `rclone archive extract` against a malicious archive can create or overwrite sibling objects in the same bucket or parent path scope. No public exploit code has been identified and the vulnerability is not in CISA KEV; EPSS at 0.14% (4th percentile) reflects low real-world exploitation probability.
HTML injection in jadx-gui prior to version 1.5.6 enables a malicious APK to force arbitrary HTML rendering inside the Summary tab, allowing out-of-band network requests that disclose the analyst's IP address or interact with locally exposed services. The injection point is SummaryNode.java, which inserts attacker-controlled .so file path components from APK ZIP entries directly into an HTML panel without escaping. Publicly available exploit code exists per SSVC assessment, though the attack is non-automatable and constrained to interactive local use, consistent with the low CVSS score of 3.6 and an EPSS probability of just 0.14%.
SSRF protections in Sonatype Nexus Repository 3 are bypassed when proxy repository upstream servers return HTTP redirects, allowing those redirects to target internal network addresses or cloud metadata endpoints such as AWS IMDSv1. Any user with read access to an affected proxy repository - including anonymous users if anonymous access is enabled - can receive responses from internal infrastructure, potentially leaking cloud IAM credentials or other sensitive internal data. No public exploit or CISA KEV listing has been identified at time of analysis, but the condition relies on attacker-controlled or compromised upstream servers, making this a credible supply-chain-adjacent threat in enterprises relying on external upstream repositories.
Certificate validation bypass in NETGEAR XR1000 Gaming Router and Nighthawk models (MR70, MS70, RAXE500) allows an adjacent-network attacker to exploit improper OpenSSL certificate validation (CWE-599) and gain unauthorized remote control of the device. Exploitation requires adjacency to the target network and high attack complexity with specific preconditions (CVSS 4.0 AV:A/AC:H/AT:P), significantly constraining real-world risk despite full confidentiality and integrity impact on the vulnerable device. No public exploit identified at time of analysis; vendor-confirmed patches are available for all four affected models.
Cross-site scripting in Active Directory Federation Services (AD FS) on Windows Server 2012 through 2025 enables an authorized, high-privileged attacker to inject malicious scripts into AD FS web pages, producing spoofing effects against users who interact with the affected portal. The CVSS vector (PR:H, UI:R, S:C) confirms this is a post-compromise capability requiring admin-level access and victim interaction, not an unauthenticated initial access vector. No active exploitation is confirmed - SSVC rates exploitation as 'none', EPSS sits at 0.38% (30th percentile), and the vulnerability is absent from CISA KEV - placing this firmly in the low-urgency category despite network reachability of the AD FS web interface.
Out-of-bounds read in libsoup 3.6.6 exposes WebSocket clients to memory disclosure and crashes when connecting to malicious servers. The incomplete fix for CVE-2026-0716 (commit 6ff7ef0) placed the integer overflow guard exclusively inside the masked-frame branch, leaving the unmasked server-to-client frame path entirely unprotected - allowing a crafted payload length near UINT64_MAX to bypass the guard entirely. No public exploit code or active exploitation (CISA KEV) has been identified, but the CVSS AC:H rating reflects the non-trivial preconditions: a specific client configuration and attacker-controlled server are both required.
Link-following vulnerability in mosaxiv clawlet up to version 0.2.10 allows local low-privileged attackers to read, write, or modify files outside intended directories by supplying symlinks to the read_file, write_file, and edit_file functions in tools/fs_ops.go. All three file-operation primitives are affected, meaning the attack surface covers both read (information disclosure) and write/edit (integrity impact) paths. No patch is planned - the upstream GitHub issue was explicitly closed as 'not planned', leaving all deployments on affected versions permanently unpatched.
Integer overflow in the Windows Devices Human Interface (HID) subsystem enables a local, low-privileged attacker to disclose sensitive information on affected systems. The vulnerability spans Windows 10 (versions 1809 through 22H2), Windows 11 (versions 24H2 through 26H1), and Windows Server 2019 through 2025, representing a broad attack surface across Microsoft's supported OS portfolio. No public exploit code exists and CISA SSVC rates current exploitation as none, with an EPSS score of 0.30% (22nd percentile) confirming very low near-term exploitation probability.
Post-authentication command execution in NETGEAR Nighthawk RAX-series routers (RAX43, RAX45, RAX50, RAX54S, RAX54Sv2) permits an attacker already holding administrative credentials and adjacent network access to run unauthorized OS-level commands or code on the device. Rooted in CWE-20 (Improper Input Validation), the flaw bypasses authorization controls within the authenticated management session, yielding high integrity impact on the vulnerable system. No public exploit identified at time of analysis, though the CVSS 4.0 supplemental metric E:P indicates proof-of-concept code exists; a vendor-released patch is available from NETGEAR.
Tampering via a time-of-check time-of-use (TOCTOU) race condition in Windows Subsystem for Linux 2 (WSL2) enables a locally authorized, low-privileged attacker to manipulate file system or resource state between the moment a security check is performed and the moment the resource is actually used. Affected versions run below 2.7.10, and Microsoft has released a fix. No public exploit code has been identified and CISA has not added this to the KEV catalog, but the SSVC framework assesses technical impact as total if the race is won, making the integrity risk significant despite a medium CVSS score.
Reflected XSS in SAP NetWeaver Application Server ABAP's Business Server Pages (BSP) framework allows remote unauthenticated attackers to inject arbitrary JavaScript into HTTP responses when a victim user interacts with a crafted URL. Successful exploitation enables session token theft and execution of authenticated actions on behalf of the victim within the SAP web context. No public exploit code or CISA KEV listing is identified at time of analysis; CVSS AC:H indicates non-trivial conditions must align for successful delivery, moderating real-world risk despite the enterprise sensitivity of SAP environments.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) exposes kernel memory contents to an attacker who physically connects a crafted USB audio device to an unpatched system. Affected systems span Windows 10 (1809 through 22H2), Windows 11 (24H2 through 26H1), and Windows Server 2019/2022/2025, as confirmed by EUVD-2026-44284 and the MSRC advisory. No public exploit code has been identified at time of analysis, and EPSS at 0.42% (34th percentile) reflects low automated exploitation probability consistent with the mandatory physical access requirement.
Out-of-bounds read in usbaudio.sys (Windows USB Audio Class driver) exposes kernel memory contents to attackers with physical device access across Windows 10, Windows 11, and Windows Server 2012 through 2025. An attacker who can physically connect a crafted USB audio device causes the driver to read beyond an allocated buffer, potentially leaking sensitive kernel memory to the attacker. No public exploit exists and no active exploitation has been identified; SSVC rates this as non-automatable with partial technical impact, placing it firmly in the lower-urgency tier despite its wide platform coverage.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) enables physical attackers to disclose kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires plugging a crafted USB audio device into the target machine, making remote attack impossible by design. No public exploit exists and SSVC exploitation status is confirmed as none, though the High confidentiality impact rating reflects that kernel memory disclosure can expose sensitive in-memory data if triggered.
FortiOS across the 7.2, 7.4, and 7.6 release trains leaks portions of device runtime memory to authenticated remote attackers via a buffer over-read in redirect response handling. Exploitation requires valid credentials but no elevated privileges, and proof-of-concept code exists (CVSS temporal E:P). An official vendor fix is confirmed available (RL:O), though unpatched instances of FortiOS 7.2.x, 7.4.0-7.4.8, and 7.6.0-7.6.2 remain at risk of sensitive memory disclosure - a consequential exposure given that FortiOS processes session tokens, credentials, and cryptographic material at runtime.
HTTP Response Splitting in Fortinet FortiOS and FortiProxy captive portal authentication flows enables a man-in-the-middle attacker to inject arbitrary HTTP headers into intercepted authentication requests. Affected platforms span FortiOS 7.2-7.6.4 and FortiProxy 7.2-7.6.4. The CVSS temporal vector includes E:P, confirming proof-of-concept exploit code exists; however, no active exploitation has been confirmed via CISA KEV. The RL:O temporal indicator confirms an official remediation is available per vendor advisory FG-IR-26-153.
HTTP Response Splitting in Fortinet FortiOS and FortiProxy enables an attacker who holds a valid web filter override token to inject arbitrary HTTP headers into server responses by tricking a user into clicking a crafted link. Affected versions span FortiOS 7.2 through 7.6.4 and FortiProxy 7.2 through 7.6.4. No active exploitation has been confirmed by CISA KEV, though the CVSS temporal vector includes E:P, indicating partial proof-of-concept evidence exists. Real-world impact is constrained by the requirement to possess a valid web filter override token and to achieve user interaction.