Use-after-free memory corruption in Google Chrome for desktop before version 150.0.7871.128 lets a remote attacker corrupt heap memory and potentially execute arbitrary code or disclose sensitive information after the victim interacts with attacker-controlled web content. The flaw was fixed in the Stable channel update and reported downstream by the Ubuntu security team; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 7.8 CVSS reflects full confidentiality, integrity, and availability impact once a user is lured to malicious content.
Arbitrary file read in FileBrowser Quantum (gtsteffaniak/filebrowser) before 1.4.3-beta lets any authenticated user, regardless of role or permissions, exfiltrate sensitive host files via the GET /api/media/subtitles endpoint. The endpoint's `path` and `name` query parameters are used in filesystem operations without sanitization, yielding two independent path-traversal vectors that escape the storage root to read files such as /etc/passwd, SSH keys, database credentials, and JWT signing keys. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is confirmed in commit f3f4bbe and released in 1.4.3-beta.
Broken access control in NextCRM 0.12.1 lets a low-privileged authenticated user with a valid MCP Bearer API token (`nxtc__...`) read, modify, and delete campaigns belonging to other users. Because multiple MCP campaign handlers query and mutate objects by ID alone while ignoring the authenticated user ID, an attacker can enumerate all campaigns, alter templates and steps, and trigger or pause delivery across tenant boundaries. No public exploit identified at time of analysis; the issue is fixed in version 0.12.2.
Arbitrary file disclosure in dataCycle-CORE (versions up to and including 25.07.3) allows an unauthenticated remote attacker to read arbitrary .md files outside the intended docs/static directories. The documentation and static markdown renderer passes attacker-controlled path segments only through the Rails HTML sanitizer, which does not strip directory-traversal sequences, enabling path traversal to the application or engine root. No public exploit identified at time of analysis; the flaw is remotely reachable with no authentication and low complexity (CVSS 7.5). Patched in version 26.06.08.
Broken authentication in FreeScout (a PHP/Laravel self-hosted help desk and shared inbox) prior to version 1.8.221 lets an unauthenticated remote attacker download arbitrary attachments whose token_type is set to 1 (TOKEN_TYPE_LEGACY). The download route bypasses token verification for these legacy attachments, and because file paths are deterministic, any attachment created by an older FreeScout instance can be retrieved without a valid token or session. There is no public exploit identified at time of analysis, but the upstream commit disclosing the exact flawed conditional is public.
Arbitrary file write in Apache MINA SSHD's sshd-scp component lets a malicious SCP sender place files outside the intended download directory because filenames in SCP 'C' (file) and 'D' (directory) commands are not validated for path separators. Any application acting as an SCP receiver - either an SSHD server accepting uploads or an SCP client fetching from a server - using unsupported versions <2.0.0 or the sshd-scp module in >=2.0.0 is affected, allowing an attacker to overwrite or plant files in attacker-chosen locations. Reported by Apache; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in libcupsfilters and cups-filters (the OpenPrinting image-filtering stack bundled with Red Hat Enterprise Linux 7 through 10) allows an unauthenticated attacker to abort the CUPS image filter by submitting a specially crafted PNG print job. The PNG reader instantiates a libpng decoder without registering an error-recovery handler, so a malformed image triggers libpng's default fatal-error path and terminates the filter process, killing the in-flight print job. No public exploit identified at time of analysis; this is a print-job availability issue, not a code-execution or data-exposure flaw.
Remote code execution in Chamilo LMS 1.11.40 and earlier allows any user enrolled in a course to run arbitrary PHP through the main/inc/ajax/lang.ajax.php endpoint, which is guarded only by api_protect_course_script(true) and is therefore reachable by students, teachers, and DRH (HR) roles rather than administrators. The root cause is an improper-authorization defect (CWE-285) that exposes a dangerous language-editing endpoint to low-privilege course members. No public exploit code is identified at time of analysis and it is not listed in CISA KEV, but a vendor security advisory (GHSA-4hwq-pv7c-3928) has been published.
Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any authenticated low-privileged user reach server-side rendered admin content via the /remote_render endpoint, which renders arbitrary partials and helper-backed views without enforcing controller-specific authorization. On a test instance a Standard user retrieved the PostgreSQL admin dashboard statistics even though direct access to /admin redirected the user away, confirming an information-disclosure impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is fixed in 26.06.08.
Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any remote, unauthenticated caller download a DataLink text attachment directly by supplying its DataLink UUID, bypassing expiration checks and the access controls enforced by the normal show flow. Because the file-serving route is public and dataCycle's mailer embeds the direct file URL, any leaked, forwarded, logged, or stale email link permanently exposes the attachment. No public exploit identified at time of analysis and it is not listed in CISA KEV, but SSVC rates the flaw automatable with partial technical impact.
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g. the database editor role) plant futures, functions, or closures inside record fields that later execute in the security context of whoever reads or writes the record. When a root owner or namespace admin touches the poisoned field, the attacker's logic runs with elevated permissions, enabling creation of a root owner and full server takeover. There is no public exploit identified at time of analysis, no KEV listing, and no EPSS score supplied, so risk assessment rests on the vendor advisory and CVSS 4.0 signals rather than observed exploitation.
Denial of service in the Net::DNS Perl library (versions through 1.55) lets a remote attacker crash any application that parses untrusted DNS messages by sending a crafted response with a deeply nested chain of compression pointers. Net::DNS::DomainName::decode recurses once per pointer with no depth cap, so a chain of ~8191 (UDP/14-bit) to ~32767 (TCP/16-bit) two-byte pointers exhausts Perl's C stack and triggers SIGSEGV. EPSS is low (0.20%, 10th percentile) and there is no public exploit identified at time of analysis, though CPANSec/oss-security disclosure provides enough detail to reconstruct a trigger.
Server-side request forgery in FlareSolverr before 3.4.7 lets a remote attacker abuse the /v1 API endpoint to make the server issue attacker-controlled requests and read sensitive responses. Because FlareSolverr is typically deployed as an unauthenticated internal proxy for the *arr media stack, an attacker who can reach the API can pivot into internal networks and cloud metadata services. No CISA KEV listing and no confirmed weaponized exploit, though a public technical vulnerability report describing the flaw exists.
Timing side-channel in the Crypt::Password Perl module (versions through 0.28) allows attackers to incrementally guess a stored password hash because check_password compares values with Perl's short-circuiting eq operator instead of a constant-time comparison. The flaw is classic CWE-208 (Observable Timing Discrepancy); it carries a CVSS 7.5 but a very low EPSS (0.14%, 4th percentile) and no public exploit identified at time of analysis, and SSVC records exploitation status as none. A vendor patch is available.
Account takeover via unthrottled online password guessing affects dataCycle-CORE (versions up to and including 25.07.3), the data management engine that stores and distributes centralized data. Because Devise's :lockable module is enabled but both lock and unlock strategies are explicitly disabled - and no request throttling exists anywhere in the Rails stack - attackers can attempt unlimited credential guesses against both /users/sign_in and the CSRF-free /api/v4/auth/login JSON endpoint, obtaining a session cookie or JWT on success. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the CSRF-free API path makes automated credential-stuffing and brute-force campaigns straightforward against any valid account.
Open redirect and token-theft in dataCycle-CORE (all versions up to and including 25.07.3) lets a low-privileged authenticated API user inject attacker-controlled `forwardToUrl` and `redirectUrl` parameters into password-reset and confirmation email flows, which lack host allowlisting. Because a live reset/confirmation token can be appended to an attacker-controlled destination, and users are redirected off-site after completing a reset, an attacker can capture tokens, hijack confirmations, and stage convincing phishing from a trusted-domain email. No public exploit or CISA KEV listing exists at time of analysis; the issue is fixed in 26.06.08.
Local privilege escalation to root in the QEMU Guest Agent (qga) affects Red Hat Enterprise Linux 6 through 10, RHEL for NVIDIA 26, and OpenShift Container Platform 4, where a local unprivileged guest user abuses the guest-ssh-add-authorized-keys command handler through symlink manipulation to seize ownership of arbitrary root-owned files. Two attack variants exist - a deterministic directory-symlink bypass and a TOCTOU file-symlink race - both requiring an external management layer such as libvirt to invoke the code path. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.3 rating and clean path to full root access make it a meaningful local escalation risk in multi-tenant virtualization estates.
Command-restriction bypass in Apache MINA SSHD (server-side) lets a user who authenticates with an OpenSSH user certificate carrying a force-command directive execute arbitrary commands instead of the single restricted command the certificate authority intended. The server accepts and honors such certificates but silently ignores the force-command and verify-required options, breaking the security model that certificate issuers rely on to constrain principals. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is confirmed and fixed by the Apache Software Foundation in versions 2.19.0 and 3.0.0-M5.
Local privilege escalation in Bizerba BRAIN2 before version 3.09 stems from the setup routine invoking LogPathConfig.exe, which misapplies an overly broad ACL granting the Windows 'Everyone' group full control over the entire %ProgramData% directory rather than the intended %ProgramData%\Bizerba\BRAIN2\ subtree. Any local user can therefore read, modify, or plant files that other applications and services trust, enabling tampering and potential escalation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the flaw is fixed in 3.09, though the optional, soon-to-be-deprecated Bizerba ScriptService component reintroduces the misconfiguration.
Local privilege escalation in Bizerba _connect.BRAIN before version 5.06 stems from its setup routine invoking LogPathConfig.exe, which strips the existing ACL on %ProgramData% and grants the built-in Everyone group full control instead of scoping permissions to the Bizerba subfolders. Any local low-privileged user can then modify files under %ProgramData% that privileged components read or execute, enabling escalation to higher privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is resolved in 5.06, which no longer runs the tool.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire server process with a single crafted query. Submitting a flat operator chain of tens of thousands of terms (e.g. RETURN 1 + 1 + 1 + ...) builds an unbounded expression tree that overflows the thread stack when later walked recursively, aborting the process and denying service to every namespace and database on the instance. No public exploit identified at time of analysis; impact is availability-only with an EPSS-independent CVSS 4.0 score of 7.1.
Path traversal in Apache MINA SSHD's sshd-git component lets an authenticated remote user on Windows-hosted git servers escape the configured server-side root directory and reach git repositories elsewhere on the filesystem. It is an incomplete-fix regression of CVE-2026-48827: the path validation added in 2.18.0 and 3.0.0-M4 was only partly effective on Windows path semantics. No public exploit identified at time of analysis; not listed in CISA KEV, and no EPSS score was provided.
Memory disclosure and ASLR bypass in ProFTPD's mod_sftp SCP handler affects all releases before 1.3.9c and 1.3.10rc3, letting an authenticated low-privilege user leak server process memory into an uploaded file. By sending a crafted SCP size record of UINT64_MAX, an attacker triggers a signed integer overflow (CWE-190) that produces a ~4 GB overread, exposing libc, libcrypto, and PIE pointers. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the disclosed pointers are sufficient to defeat ASLR and make co-resident memory-corruption bugs reliably exploitable.
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT permissions by traversing graph edges or REFERENCES TO back-references, reading full documents from tables defined with PERMISSIONS FOR select NONE. The root cause is that GraphEdgeScan and ReferenceScan fetched records directly from storage without evaluating the target table's permission expression. No public exploit identified at time of analysis and not listed in CISA KEV; impact is confidentiality-only and bounded to the caller's current database, but any table reachable through a chain of edges from a readable starting point is exposed.
Broken authorization in SurrealDB before 3.1.4 allows record-scoped (authenticated) users to read array elements that field-level SELECT permissions are supposed to hide. When permissions are evaluated against array fields using the `field.*` wildcard, denied elements are leaked back to the caller instead of being filtered out, because the engine mishandles element indexing during permission filtering (CWE-863). No public exploit has been identified at time of analysis and it is not in CISA KEV, but the flaw is a straightforward authorization bypass reachable by any user with record scope access.
Denial of service in SurrealDB before 3.1.0 lets an authenticated user with query-execution privileges crash the server with a single WebSocket message. The type/kind parser fails to enforce the configured recursion depth limit when parsing deeply nested type annotations (e.g. array<option<array<option<...>>>>), driving uncontrolled recursion that exhausts server memory and terminates the process. No public exploit identified at time of analysis and not listed in CISA KEV, but the flaw is trivially triggerable and is an incomplete fix of a previously patched bug class (GHSA-6r8p-hpg7-825g).
Denial of service in SurrealDB before 3.1.0 allows an authenticated user holding only 'select' permission on a table to indefinitely block all CREATE, UPDATE, and DELETE operations on that table for every other user - including root. By registering a LIVE query whose WHERE clause deterministically throws an evaluation error (e.g. calling a typed SurrealQL function with a wrong-typed argument), the resulting error propagates into the write path and rolls back the triggering modification. No public exploit identified at time of analysis, but the technique is fully documented in the vendor's GHSA advisory.
Broken authorization in SurrealDB before 3.1.0 lets any authenticated principal - including low-privilege Record and Scope users - read the full contents of every table in their current database, bypassing PERMISSIONS FOR SELECT WHERE controls. The flaw stems from the engine evaluating user-supplied WHERE (and SET/MERGE/CONTENT/PATCH) expressions against complete record data before running the table-level SELECT permission check, so side-effecting expressions exfiltrate data the caller should never see. No public exploit identified at time of analysis, and the issue is not in CISA KEV, but the GHSA advisory documents multiple practical exfiltration primitives (scripting functions, THROW, and timing side channels).
Cross-agent authorization bypass in AgenticMail's @agenticmail/api (prior to 0.9.64) lets any low-privileged authenticated agent read and hijack tasks belonging to other agents. By calling GET /api/agenticmail/tasks/pending?assignee=<victim>, an attacker enumerates a target agent's pending/claimed tasks - including task IDs and sensitive payloads - then reuses those IDs against the /tasks/:id/claim, /result, /complete, and /fail endpoints, which never verify the caller is the assignee. Fixed in 0.9.64; no public exploit identified at time of analysis, though the GitHub advisory (GHSA-hjwc-26pj-v3pm) includes a working local reproduction, and no EPSS or KEV signal is present in the input.
Payment validation bypass in Frappe LMS 2.51.0 and earlier lets an authenticated user enroll in paid courses for free by supplying an unrelated batch that was never linked to the target course, granting access to premium content without completing payment. The flaw is an authorization/business-logic weakness (CWE-288) fixed in version 2.52.0, which now verifies the batch belongs to the course before enrollment. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Improper privilege enforcement in NextCRM 0.12.1 lets any authenticated low-privileged user create, modify, archive, or soft-delete entries in the organization-wide product catalog by calling MCP product tools at /api/mcp/mcp with a self-generated Bearer token. While the standard application server restricts these write operations to manager and admin roles, the MCP interface omits the role checks entirely, giving a vertical privilege escalation over shared business data. No public exploit identified at time of analysis; the issue is fixed in version 0.12.3.
Unauthenticated loopback API access and path traversal in WhatsApp MCP Server (whatsapp-mcp) prior to v0.2.1 allow any same-user local process - including sibling MCP servers and IDE extensions - to send WhatsApp messages from the paired account and exfiltrate arbitrary user-readable files (SSH private keys, browser session data, dotfiles) as WhatsApp document attachments. The whatsapp-bridge HTTP service on 127.0.0.1:8080 requires no authentication and validates no Host header, enabling a DNS rebinding attack whereby a malicious webpage visited by the user can trigger identical file exfiltration remotely without any credentials. No public exploit identified at time of analysis; vendor-released patch v0.2.1 is available.
SQL injection in syslog-ng versions before 4.12 (also fixed in Premium Edition 8.2 and Store Box 7.8) allows an attacker who controls an untrusted log source to inject SQL through log data processed by the afsql SQL destination driver, because afsql_dd_run_query omits a required sanitization call. Exploitation only affects deployments that have manually configured the SQL driver, and there is no public exploit identified at time of analysis and no CISA KEV listing. The rated impact centers on integrity of the backing database and availability of the logging pipeline (CVSS 7.1).
Cross-tenant data tampering in NextCRM (open-source CRM) before version 0.12.0 lets any authenticated user - including low-privilege 'member' accounts - modify CRM contacts and targets owned by other users or organizations. The contact and target update endpoints trust a client-supplied resource identifier without checking ownership, so an attacker who is a legitimate tenant on the instance can overwrite records outside their scope. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
Arbitrary recursive file deletion in Network-AI (npm package `network-ai`) before v5.12.2 allows a local attacker who can write into an environment's backup directory to delete any path the process user can access. `EnvironmentManager.pruneBackups()` trusts the `path` field of an attacker-controllable `_manifest.json` and feeds it straight into `rmSync(..., { recursive: true, force: true })`, so a poisoned manifest such as `"path": "/"` gets deleted when `network-ai env backup prune` runs. Publicly available exploit code exists (a working PoC ships in the GHSA advisory); there is no public exploit identified as actively exploited and it is not in CISA KEV.
Heap buffer overflow in libvips' tiffload operation (versions ≤ 8.18.1) lets an attacker who supplies a crafted TIFF image trigger memory corruption during decode. The flaw stems from libvips incorrectly determining the channel/component count of a JPEG- or JPEG2000-encoded tile embedded in a TIFF, so the pixel buffer is sized from the TIFF photometric metadata while more components are written from the codec. No public exploit has been identified at time of analysis; the issue is fixed in 8.18.2.