In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the array pointer. These run from netlink_recvmsg() without the nfnl mutex and without an RCU read-side critical section. A concurrent ip_set_create() can grow the array: it publishes the new array, calls synchronize_net() and then kvfree()s the old one. Since the dump paths read the array outside any RCU reader, synchronize_net() does not wait for them and the old array can be freed while they still index into it, causing a use-after-free. The dumped set itself stays pinned via set->ref_netlink, so only the array load needs protecting. Take rcu_read_lock() around it, matching ip_set_get_byname() and __ip_set_put_byindex(). BUG: KASAN: slab-use-after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) Read of size 8 at addr ffff88800b5c4018 by task exploit/150 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) netlink_dump (net/netlink/af_netlink.c:2325) netlink_recvmsg (net/netlink/af_netlink.c:1976) sock_recvmsg (net/socket.c:1159) __sys_recvfrom (net/socket.c:2315) ... Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI KASAN: maybe wild-memory-access in range [0x02d6...d0-0x02d6...d7] RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698) Kernel panic - not syncing: Fatal exception
Use-after-free memory corruption in Google Chrome for desktop before version 150.0.7871.128 lets a remote attacker corrupt heap memory and potentially execute arbitrary code or disclose sensitive information after the victim interacts with attacker-controlled web content. The flaw was fixed in the Stable channel update and reported downstream by the Ubuntu security team; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 7.8 CVSS reflects full confidentiality, integrity, and availability impact once a user is lured to malicious content.
Arbitrary file read in FileBrowser Quantum (gtsteffaniak/filebrowser) before 1.4.3-beta lets any authenticated user, regardless of role or permissions, exfiltrate sensitive host files via the GET /api/media/subtitles endpoint. The endpoint's `path` and `name` query parameters are used in filesystem operations without sanitization, yielding two independent path-traversal vectors that escape the storage root to read files such as /etc/passwd, SSH keys, database credentials, and JWT signing keys. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is confirmed in commit f3f4bbe and released in 1.4.3-beta.
Broken access control in NextCRM 0.12.1 lets a low-privileged authenticated user with a valid MCP Bearer API token (`nxtc__...`) read, modify, and delete campaigns belonging to other users. Because multiple MCP campaign handlers query and mutate objects by ID alone while ignoring the authenticated user ID, an attacker can enumerate all campaigns, alter templates and steps, and trigger or pause delivery across tenant boundaries. No public exploit identified at time of analysis; the issue is fixed in version 0.12.2.
Arbitrary file disclosure in dataCycle-CORE (versions up to and including 25.07.3) allows an unauthenticated remote attacker to read arbitrary .md files outside the intended docs/static directories. The documentation and static markdown renderer passes attacker-controlled path segments only through the Rails HTML sanitizer, which does not strip directory-traversal sequences, enabling path traversal to the application or engine root. No public exploit identified at time of analysis; the flaw is remotely reachable with no authentication and low complexity (CVSS 7.5). Patched in version 26.06.08.
Broken authentication in FreeScout (a PHP/Laravel self-hosted help desk and shared inbox) prior to version 1.8.221 lets an unauthenticated remote attacker download arbitrary attachments whose token_type is set to 1 (TOKEN_TYPE_LEGACY). The download route bypasses token verification for these legacy attachments, and because file paths are deterministic, any attachment created by an older FreeScout instance can be retrieved without a valid token or session. There is no public exploit identified at time of analysis, but the upstream commit disclosing the exact flawed conditional is public.
Arbitrary file write in Apache MINA SSHD's sshd-scp component lets a malicious SCP sender place files outside the intended download directory because filenames in SCP 'C' (file) and 'D' (directory) commands are not validated for path separators. Any application acting as an SCP receiver - either an SSHD server accepting uploads or an SCP client fetching from a server - using unsupported versions <2.0.0 or the sshd-scp module in >=2.0.0 is affected, allowing an attacker to overwrite or plant files in attacker-chosen locations. Reported by Apache; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in libcupsfilters and cups-filters (the OpenPrinting image-filtering stack bundled with Red Hat Enterprise Linux 7 through 10) allows an unauthenticated attacker to abort the CUPS image filter by submitting a specially crafted PNG print job. The PNG reader instantiates a libpng decoder without registering an error-recovery handler, so a malformed image triggers libpng's default fatal-error path and terminates the filter process, killing the in-flight print job. No public exploit identified at time of analysis; this is a print-job availability issue, not a code-execution or data-exposure flaw.
Remote code execution in Chamilo LMS 1.11.40 and earlier allows any user enrolled in a course to run arbitrary PHP through the main/inc/ajax/lang.ajax.php endpoint, which is guarded only by api_protect_course_script(true) and is therefore reachable by students, teachers, and DRH (HR) roles rather than administrators. The root cause is an improper-authorization defect (CWE-285) that exposes a dangerous language-editing endpoint to low-privilege course members. No public exploit code is identified at time of analysis and it is not listed in CISA KEV, but a vendor security advisory (GHSA-4hwq-pv7c-3928) has been published.
Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any authenticated low-privileged user reach server-side rendered admin content via the /remote_render endpoint, which renders arbitrary partials and helper-backed views without enforcing controller-specific authorization. On a test instance a Standard user retrieved the PostgreSQL admin dashboard statistics even though direct access to /admin redirected the user away, confirming an information-disclosure impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is fixed in 26.06.08.
Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any remote, unauthenticated caller download a DataLink text attachment directly by supplying its DataLink UUID, bypassing expiration checks and the access controls enforced by the normal show flow. Because the file-serving route is public and dataCycle's mailer embeds the direct file URL, any leaked, forwarded, logged, or stale email link permanently exposes the attachment. No public exploit identified at time of analysis and it is not listed in CISA KEV, but SSVC rates the flaw automatable with partial technical impact.
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g. the database editor role) plant futures, functions, or closures inside record fields that later execute in the security context of whoever reads or writes the record. When a root owner or namespace admin touches the poisoned field, the attacker's logic runs with elevated permissions, enabling creation of a root owner and full server takeover. There is no public exploit identified at time of analysis, no KEV listing, and no EPSS score supplied, so risk assessment rests on the vendor advisory and CVSS 4.0 signals rather than observed exploitation.
Denial of service in the Net::DNS Perl library (versions through 1.55) lets a remote attacker crash any application that parses untrusted DNS messages by sending a crafted response with a deeply nested chain of compression pointers. Net::DNS::DomainName::decode recurses once per pointer with no depth cap, so a chain of ~8191 (UDP/14-bit) to ~32767 (TCP/16-bit) two-byte pointers exhausts Perl's C stack and triggers SIGSEGV. EPSS is low (0.20%, 10th percentile) and there is no public exploit identified at time of analysis, though CPANSec/oss-security disclosure provides enough detail to reconstruct a trigger.
Server-side request forgery in FlareSolverr before 3.4.7 lets a remote attacker abuse the /v1 API endpoint to make the server issue attacker-controlled requests and read sensitive responses. Because FlareSolverr is typically deployed as an unauthenticated internal proxy for the *arr media stack, an attacker who can reach the API can pivot into internal networks and cloud metadata services. No CISA KEV listing and no confirmed weaponized exploit, though a public technical vulnerability report describing the flaw exists.
Timing side-channel in the Crypt::Password Perl module (versions through 0.28) allows attackers to incrementally guess a stored password hash because check_password compares values with Perl's short-circuiting eq operator instead of a constant-time comparison. The flaw is classic CWE-208 (Observable Timing Discrepancy); it carries a CVSS 7.5 but a very low EPSS (0.14%, 4th percentile) and no public exploit identified at time of analysis, and SSVC records exploitation status as none. A vendor patch is available.
Account takeover via unthrottled online password guessing affects dataCycle-CORE (versions up to and including 25.07.3), the data management engine that stores and distributes centralized data. Because Devise's :lockable module is enabled but both lock and unlock strategies are explicitly disabled - and no request throttling exists anywhere in the Rails stack - attackers can attempt unlimited credential guesses against both /users/sign_in and the CSRF-free /api/v4/auth/login JSON endpoint, obtaining a session cookie or JWT on success. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the CSRF-free API path makes automated credential-stuffing and brute-force campaigns straightforward against any valid account.
Open redirect and token-theft in dataCycle-CORE (all versions up to and including 25.07.3) lets a low-privileged authenticated API user inject attacker-controlled `forwardToUrl` and `redirectUrl` parameters into password-reset and confirmation email flows, which lack host allowlisting. Because a live reset/confirmation token can be appended to an attacker-controlled destination, and users are redirected off-site after completing a reset, an attacker can capture tokens, hijack confirmations, and stage convincing phishing from a trusted-domain email. No public exploit or CISA KEV listing exists at time of analysis; the issue is fixed in 26.06.08.
Local privilege escalation to root in the QEMU Guest Agent (qga) affects Red Hat Enterprise Linux 6 through 10, RHEL for NVIDIA 26, and OpenShift Container Platform 4, where a local unprivileged guest user abuses the guest-ssh-add-authorized-keys command handler through symlink manipulation to seize ownership of arbitrary root-owned files. Two attack variants exist - a deterministic directory-symlink bypass and a TOCTOU file-symlink race - both requiring an external management layer such as libvirt to invoke the code path. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.3 rating and clean path to full root access make it a meaningful local escalation risk in multi-tenant virtualization estates.
Command-restriction bypass in Apache MINA SSHD (server-side) lets a user who authenticates with an OpenSSH user certificate carrying a force-command directive execute arbitrary commands instead of the single restricted command the certificate authority intended. The server accepts and honors such certificates but silently ignores the force-command and verify-required options, breaking the security model that certificate issuers rely on to constrain principals. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is confirmed and fixed by the Apache Software Foundation in versions 2.19.0 and 3.0.0-M5.
Local privilege escalation in Bizerba BRAIN2 before version 3.09 stems from the setup routine invoking LogPathConfig.exe, which misapplies an overly broad ACL granting the Windows 'Everyone' group full control over the entire %ProgramData% directory rather than the intended %ProgramData%\Bizerba\BRAIN2\ subtree. Any local user can therefore read, modify, or plant files that other applications and services trust, enabling tampering and potential escalation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the flaw is fixed in 3.09, though the optional, soon-to-be-deprecated Bizerba ScriptService component reintroduces the misconfiguration.
Local privilege escalation in Bizerba _connect.BRAIN before version 5.06 stems from its setup routine invoking LogPathConfig.exe, which strips the existing ACL on %ProgramData% and grants the built-in Everyone group full control instead of scoping permissions to the Bizerba subfolders. Any local low-privileged user can then modify files under %ProgramData% that privileged components read or execute, enabling escalation to higher privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is resolved in 5.06, which no longer runs the tool.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire server process with a single crafted query. Submitting a flat operator chain of tens of thousands of terms (e.g. RETURN 1 + 1 + 1 + ...) builds an unbounded expression tree that overflows the thread stack when later walked recursively, aborting the process and denying service to every namespace and database on the instance. No public exploit identified at time of analysis; impact is availability-only with an EPSS-independent CVSS 4.0 score of 7.1.
Path traversal in Apache MINA SSHD's sshd-git component lets an authenticated remote user on Windows-hosted git servers escape the configured server-side root directory and reach git repositories elsewhere on the filesystem. It is an incomplete-fix regression of CVE-2026-48827: the path validation added in 2.18.0 and 3.0.0-M4 was only partly effective on Windows path semantics. No public exploit identified at time of analysis; not listed in CISA KEV, and no EPSS score was provided.
Memory disclosure and ASLR bypass in ProFTPD's mod_sftp SCP handler affects all releases before 1.3.9c and 1.3.10rc3, letting an authenticated low-privilege user leak server process memory into an uploaded file. By sending a crafted SCP size record of UINT64_MAX, an attacker triggers a signed integer overflow (CWE-190) that produces a ~4 GB overread, exposing libc, libcrypto, and PIE pointers. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the disclosed pointers are sufficient to defeat ASLR and make co-resident memory-corruption bugs reliably exploitable.
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT permissions by traversing graph edges or REFERENCES TO back-references, reading full documents from tables defined with PERMISSIONS FOR select NONE. The root cause is that GraphEdgeScan and ReferenceScan fetched records directly from storage without evaluating the target table's permission expression. No public exploit identified at time of analysis and not listed in CISA KEV; impact is confidentiality-only and bounded to the caller's current database, but any table reachable through a chain of edges from a readable starting point is exposed.
Broken authorization in SurrealDB before 3.1.4 allows record-scoped (authenticated) users to read array elements that field-level SELECT permissions are supposed to hide. When permissions are evaluated against array fields using the `field.*` wildcard, denied elements are leaked back to the caller instead of being filtered out, because the engine mishandles element indexing during permission filtering (CWE-863). No public exploit has been identified at time of analysis and it is not in CISA KEV, but the flaw is a straightforward authorization bypass reachable by any user with record scope access.
Denial of service in SurrealDB before 3.1.0 lets an authenticated user with query-execution privileges crash the server with a single WebSocket message. The type/kind parser fails to enforce the configured recursion depth limit when parsing deeply nested type annotations (e.g. array<option<array<option<...>>>>), driving uncontrolled recursion that exhausts server memory and terminates the process. No public exploit identified at time of analysis and not listed in CISA KEV, but the flaw is trivially triggerable and is an incomplete fix of a previously patched bug class (GHSA-6r8p-hpg7-825g).
Denial of service in SurrealDB before 3.1.0 allows an authenticated user holding only 'select' permission on a table to indefinitely block all CREATE, UPDATE, and DELETE operations on that table for every other user - including root. By registering a LIVE query whose WHERE clause deterministically throws an evaluation error (e.g. calling a typed SurrealQL function with a wrong-typed argument), the resulting error propagates into the write path and rolls back the triggering modification. No public exploit identified at time of analysis, but the technique is fully documented in the vendor's GHSA advisory.
Broken authorization in SurrealDB before 3.1.0 lets any authenticated principal - including low-privilege Record and Scope users - read the full contents of every table in their current database, bypassing PERMISSIONS FOR SELECT WHERE controls. The flaw stems from the engine evaluating user-supplied WHERE (and SET/MERGE/CONTENT/PATCH) expressions against complete record data before running the table-level SELECT permission check, so side-effecting expressions exfiltrate data the caller should never see. No public exploit identified at time of analysis, and the issue is not in CISA KEV, but the GHSA advisory documents multiple practical exfiltration primitives (scripting functions, THROW, and timing side channels).
Cross-agent authorization bypass in AgenticMail's @agenticmail/api (prior to 0.9.64) lets any low-privileged authenticated agent read and hijack tasks belonging to other agents. By calling GET /api/agenticmail/tasks/pending?assignee=<victim>, an attacker enumerates a target agent's pending/claimed tasks - including task IDs and sensitive payloads - then reuses those IDs against the /tasks/:id/claim, /result, /complete, and /fail endpoints, which never verify the caller is the assignee. Fixed in 0.9.64; no public exploit identified at time of analysis, though the GitHub advisory (GHSA-hjwc-26pj-v3pm) includes a working local reproduction, and no EPSS or KEV signal is present in the input.
Payment validation bypass in Frappe LMS 2.51.0 and earlier lets an authenticated user enroll in paid courses for free by supplying an unrelated batch that was never linked to the target course, granting access to premium content without completing payment. The flaw is an authorization/business-logic weakness (CWE-288) fixed in version 2.52.0, which now verifies the batch belongs to the course before enrollment. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Improper privilege enforcement in NextCRM 0.12.1 lets any authenticated low-privileged user create, modify, archive, or soft-delete entries in the organization-wide product catalog by calling MCP product tools at /api/mcp/mcp with a self-generated Bearer token. While the standard application server restricts these write operations to manager and admin roles, the MCP interface omits the role checks entirely, giving a vertical privilege escalation over shared business data. No public exploit identified at time of analysis; the issue is fixed in version 0.12.3.
Unauthenticated loopback API access and path traversal in WhatsApp MCP Server (whatsapp-mcp) prior to v0.2.1 allow any same-user local process - including sibling MCP servers and IDE extensions - to send WhatsApp messages from the paired account and exfiltrate arbitrary user-readable files (SSH private keys, browser session data, dotfiles) as WhatsApp document attachments. The whatsapp-bridge HTTP service on 127.0.0.1:8080 requires no authentication and validates no Host header, enabling a DNS rebinding attack whereby a malicious webpage visited by the user can trigger identical file exfiltration remotely without any credentials. No public exploit identified at time of analysis; vendor-released patch v0.2.1 is available.
SQL injection in syslog-ng versions before 4.12 (also fixed in Premium Edition 8.2 and Store Box 7.8) allows an attacker who controls an untrusted log source to inject SQL through log data processed by the afsql SQL destination driver, because afsql_dd_run_query omits a required sanitization call. Exploitation only affects deployments that have manually configured the SQL driver, and there is no public exploit identified at time of analysis and no CISA KEV listing. The rated impact centers on integrity of the backing database and availability of the logging pipeline (CVSS 7.1).
Cross-tenant data tampering in NextCRM (open-source CRM) before version 0.12.0 lets any authenticated user - including low-privilege 'member' accounts - modify CRM contacts and targets owned by other users or organizations. The contact and target update endpoints trust a client-supplied resource identifier without checking ownership, so an attacker who is a legitimate tenant on the instance can overwrite records outside their scope. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
Arbitrary recursive file deletion in Network-AI (npm package `network-ai`) before v5.12.2 allows a local attacker who can write into an environment's backup directory to delete any path the process user can access. `EnvironmentManager.pruneBackups()` trusts the `path` field of an attacker-controllable `_manifest.json` and feeds it straight into `rmSync(..., { recursive: true, force: true })`, so a poisoned manifest such as `"path": "/"` gets deleted when `network-ai env backup prune` runs. Publicly available exploit code exists (a working PoC ships in the GHSA advisory); there is no public exploit identified as actively exploited and it is not in CISA KEV.
Heap buffer overflow in libvips' tiffload operation (versions ≤ 8.18.1) lets an attacker who supplies a crafted TIFF image trigger memory corruption during decode. The flaw stems from libvips incorrectly determining the channel/component count of a JPEG- or JPEG2000-encoded tile embedded in a TIFF, so the pixel buffer is sized from the TIFF photometric metadata while more components are written from the codec. No public exploit has been identified at time of analysis; the issue is fixed in 8.18.2.
Remote code execution affects safishamsi GRAPHIFY versions 0.3.2 through 0.4.29 via a DNS rebinding attack targeting its URL-fetching subsystem. The functions validate_url, safe_fetch, _build_opener, _fetch_html, and _download_binary are exploitable when a maliciously controlled hostname performs DNS rebinding to bypass the URL validation layer, allowing an attacker to pivot into internal network resources and ultimately achieve code execution. A public proof-of-concept repository exists; no KEV listing is present at time of analysis, though the PoC lowers the bar for exploitation.
Stored cross-site scripting in maalfer Pentestify before 1.1.0 allows an authenticated attacker to inject arbitrary JavaScript that executes in the browser of every user who views an affected report. The payload is stored in a finding's images array or a report's client_logo array and interpolated directly into HTML img src attributes by the client-side rendering functions renderPreview, renderEditor, and renderAuditData in js/app.js without HTML escaping. No public exploit has been identified and this vulnerability is not listed in CISA KEV; however, the stored nature means a single injection persists and fires for all future viewers of the affected report until the application is patched.
Denial of service in SurrealDB's SurrealML header parser allows an authenticated Owner-role user to crash the entire server process by uploading a malformed .surml file to the /ml/import endpoint. Non-numeric input-dimensions or other invalid header fields trigger unchecked Rust unwrap() calls, causing a process-aborting panic that denies service to all databases hosted on the affected instance simultaneously. No public exploit code has been identified at time of analysis; vendor-released patch is available in SurrealDB 3.2.0.
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to run arbitrary Groovy scripts through scripted REST and SQL connectors, escaping the intended sandbox and executing code on the host. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1, and is rooted in improper isolation (CWE-653) of the scripting engine. Although the published CVSS is 9.8, the vendor description states an authenticated privileged administrator is required, and there is no public exploit identified at time of analysis.
Unauthenticated namespace and database creation in SurrealDB before 3.1.0 exposes any network-reachable instance to unauthorized catalog manipulation. The RPC use method and SurrealQL executor's USE NS/USE DB handling silently creates namespaces and databases that don't yet exist without verifying whether the caller holds DEFINE NAMESPACE or DEFINE DATABASE authority, making a completely unauthenticated guest session sufficient to pollute or exhaust the catalog. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects limited impact - data within existing namespaces cannot be read or modified - but the storage exhaustion vector and the ability to resurrect deliberately dropped namespaces via stale tokens represent meaningful operational risk for multi-tenant or publicly exposed deployments.
Information disclosure in the Quix Page Builder Pro Joomla extension exposes raw exception data to unauthenticated remote attackers via AJAX handler responses. The affected component fails to sanitize or suppress server-side exception output before returning it to the client, potentially leaking internal application state, file paths, database structure, or configuration details depending on what triggers the exception. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network-accessible attack vector lowers the barrier for reconnaissance abuse.
Pre-authentication memory amplification in SurrealDB before 3.1.0 allows unauthenticated network attackers to exhaust server memory by streaming oversized WebSocket frames to the /sql endpoint, which fails to enforce the operator-configured SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit before buffering incoming bytes. The /sql WebSocket upgrade handler accepts anonymous connections and accumulates up to 16 MiB per frame and 64 MiB per reassembled message in per-connection read buffers - the full WebSocket library default - before the authentication check (check_anon) can reject the payload, meaning memory cost is incurred regardless of whether the caller holds any SurrealQL permissions. No public exploit has been identified at time of analysis, but the unauthenticated network-accessible attack surface requires no special prerequisites beyond network connectivity and sustained bandwidth.
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbitrary Groovy code on the server by importing and starting a malicious BPMN process definition through the REST API. Because Flowable's Groovy scriptTasks execute with no sandbox in affected 3.0.x, 4.0.x, and 4.1.x releases, script code embedded in the process runs directly with the privileges of the Syncope core JVM. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path once an entitled admin account is reached makes it a strong candidate for post-compromise abuse and insider misuse.
Groovy sandbox escape in Apache Syncope's Implementations feature lets an administrator holding Implementation entitlements author a malicious Groovy class that runs untrusted code outside the intended security sandbox, effectively achieving arbitrary code execution on the identity-management server. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the published CVSS of 9.8 overstates real-world exposure because the flaw requires a privileged administrator account.
Policy signing key bypass in ClearanceKit prior to 5.0.10 permits any root process on macOS to forge valid signatures over arbitrary policy database content, granting full control over ClearanceKit's per-process file-system access enforcement plane. The root cause is a silent ACL failure specific to the macOS legacy System Keychain: ECDSA key items persisted via SecItemAdd silently lose their kSecAttrAccess restriction, leaving the signing key unrestricted to any root caller. No public exploit has been identified and no CISA KEV listing exists, but the integrity impact extends beyond the vulnerable component to the entire policy enforcement layer ClearanceKit provides.
ClearanceKit's on-disk SQLite policy store on macOS is vulnerable to a replay attack that allows a high-privileged local attacker to substitute a previously-captured, legitimately-signed policy snapshot, causing the opfilter component to enforce outdated or permissive per-process file-access policies on the next boot. All releases prior to version 5.0.10 are affected, with exploitation gated to specific windows: the opfilter-update period when the Endpoint Security filter is offline, offline-boot scenarios, or decrypted-backup restoration. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS data was not provided in available intelligence.
Denial of service in libvips 8.18.1 and earlier arises from the EXIF decoder's failure to validate Image File Directory (IFD) index values before passing them to libexif, enabling a crash via null pointer dereference when a crafted image with an out-of-range IFD tag group index is processed. All platforms running libvips through its EXIF parsing path are affected, including downstream consumers such as Node.js sharp and other language bindings that link against libvips. No public exploit has been identified and active exploitation is not confirmed, but the fix is publicly visible and the crash condition is straightforward to reproduce.
Integer overflow in libvips gifload on 32-bit platforms allows an attacker who can supply crafted GIF images to cause incorrect buffer sizing and crash the image-processing application. Affected are all libvips builds up to and including 8.18.0 compiled for 32-bit architectures, where multiplying GIF width by height as a native int can wrap past INT_MAX. No public exploit is identified at time of analysis; a vendor-released patch is available in libvips 8.18.1.