Improper input validation in the NETGEAR WAX333 Wi-Fi 6 access point permits an already-authenticated, high-privilege user on the adjacent network to bypass authorization controls and make unauthorized changes to device configuration settings. Affected firmware versions are all WAX333 releases below V2.8.0.100, per EUVD-2026-44331 and the July 2026 NETGEAR advisory. No public exploit has been identified and all available signals - EPSS at 0.19%, SSVC exploitation status of none, and a CVSS 4.3 medium score - consistently indicate low real-world urgency.
Buffer over-read in Fortinet FortiOS and FortiProxy exposes sensitive memory contents to authenticated network attackers across multiple product lines including FortiPAM and FortiSwitchManager. The flaw, rooted in CWE-126 (buffer over-read), allows low-privileged remote users to read beyond allocated buffer boundaries, resulting in partial information disclosure with no integrity or availability impact. No active exploitation confirmed in CISA KEV, but the CVSS temporal vector includes E:P indicating proof-of-concept exploit code exists, and an official fix is available per RL:O.
Information disclosure in Mozilla Firefox via CWE-763 (Release of Invalid Pointer or Reference) allows network-based attackers to read limited memory contents from affected browser instances. All Firefox versions prior to 152.0.6 are affected. Publicly available exploit code exists, though Mozilla reports no confirmed attacks in the wild; user interaction is required to trigger the flaw, moderately reducing real-world exposure.
Insecure Direct Object Reference in the Academy LMS WordPress plugin (all versions through 3.8.0) allows authenticated attackers with Subscriber-level access to read, overwrite, or delete the private lesson notes of any user - including administrators - and to falsify lesson-completion records for arbitrary accounts. Three AJAX handlers (save_lesson_note, get_lesson_note, complete_lesson_video) perform no ownership validation on a user-controlled key, making cross-user data manipulation trivially achievable by any registered site user. No public exploit identified at time of analysis, but the attack surface is fully described via Wordfence's public threat-intelligence entry and source-level code references.
Improper authorization in Apache Kylin's REST API job endpoints allows authenticated users to retrieve job metadata from projects they are not authorized to access. The `JobController.getJobList` and `JobController.getJobDetail` endpoints lack project-scoped permission verification, meaning any authenticated user can query build job information across project boundaries within a shared Kylin deployment. Apache Kylin versions 4 through 5.0.3 are affected; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in SAP S/4HANA's Draft Operation component allows authenticated restricted users to read entity data beyond their authorized scope due to missing authorization checks. The flaw, classified under CWE-862, is exploitable over the network without elevated privileges, resulting in low confidentiality impact with no effect on integrity or availability. No public exploit code or active exploitation has been identified at time of analysis, keeping real-world risk bounded despite the network-accessible attack vector.
Missing authorization in SAP S/4HANA's Create Single Payment function exposes restricted entity set keys to authenticated but low-privileged users. The flaw (CWE-862) allows a restricted user to query specific payment-related entity sets beyond their intended access scope, resulting in low-impact confidentiality leakage with no effect on data integrity or system availability. No public exploit code exists and this vulnerability is not listed in CISA KEV; EPSS data was not provided, but the CVSS 4.3 medium score and limited impact scope suggest low exploitation urgency.
Script injection in SAP CRM WebClient UI is enabled by absent Content Security Policy (CSP) directives for certain restrictive headers, allowing an authenticated low-privileged attacker to inject malicious JavaScript that executes in a victim user's browser session. The CVSS vector (PR:L/UI:R/S:C) confirms this requires both an authenticated attacker and victim interaction, with a cross-scope impact consistent with browser-context script execution. No public exploit code or CISA KEV active exploitation listing has been identified at time of analysis, and impact is bounded to low integrity with no confidentiality or availability consequence.
Out-of-bounds bit clear operations in a Matroska container format parser allow processing of maliciously crafted media files containing negative ReadOrder field values to corrupt memory. The vulnerability arises when a negative integer ReadOrder value is used without adequate sign checking, causing bit-clear write operations to target memory locations outside the intended buffer boundary. Affected deployments include software in the Ubuntu ecosystem that parses Matroska (.mkv/.webm) files; no public exploit has been identified at time of analysis and CISA KEV status is not confirmed.
Out-of-bounds read and write conditions exist in the `wrap_lines_measure` function, as tracked under GHSA-pjjp-65r7-ppgm and reported by Ubuntu. Memory corruption of this class - simultaneous OOB read and write - typically enables attackers to leak sensitive memory contents and corrupt heap or stack state, potentially leading to arbitrary code execution or process crash depending on exploitability conditions. No CVSS vector, EPSS score, KEV status, or POC availability data was supplied, so severity and real-world risk cannot be quantified with confidence at this time.