Information disclosure in Mozilla Firefox and Firefox ESR stems from a site isolation flaw in the Networking component, letting a malicious web page bypass cross-origin process/security boundaries and access data belonging to other sites. The issue was reported by Mozilla and fixed in Firefox 153 and Firefox ESR 140.13; no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.15% (5th percentile).
Cross-origin information disclosure in Mozilla Firefox and Firefox ESR stems from a site isolation weakness in the Networking: HTTP component (CWE-346, origin validation error), letting a malicious web page bypass origin boundaries to read data belonging to another site. It affects Firefox before version 153 and Firefox ESR before 140.13 and is addressed in Mozilla advisories MFSA2026-68 and MFSA2026-70. There is no public exploit identified at time of analysis, and the EPSS score is low (0.15%, 5th percentile), indicating no observed weaponization despite the vendor's 9.8 CVSS rating.
Memory corruption in Mozilla Firefox's JavaScript WebAssembly engine, stemming from an integer overflow (CWE-190), can be triggered by attacker-controlled web content and was patched in Firefox 153 and Firefox ESR 140.13. Reported by Mozilla and tracked as EUVD-2026-46202/MFSA2026-68 & MFSA2026-70, the flaw carries a 9.8 CVSS rating implying potential remote code execution, though no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.15% (5th percentile).
Memory corruption in Mozilla Firefox's WebAssembly (JavaScript) engine allows remote attackers to trigger a buffer overflow through incorrect boundary condition handling, potentially leading to arbitrary code execution in the browser content process. The flaw carries a critical CVSS 9.8 and affects Firefox prior to version 153 and Firefox ESR prior to 140.13; it is fixed in those releases per Mozilla advisories MFSA2026-68 and MFSA2026-70. There is no public exploit identified at time of analysis, and the low EPSS score (0.15%) suggests exploitation in the wild has not yet been observed.
Memory-safety corruption in Mozilla Firefox stems from a JIT miscompilation in the JavaScript engine's WebAssembly component, fixed in Firefox 153 and Firefox ESR 140.13. An attacker who lures a victim to a malicious page can supply crafted WebAssembly that the Just-In-Time compiler translates incorrectly, corrupting engine state to disclose memory or achieve code execution in the content process. There is no public exploit identified at time of analysis and the EPSS score is very low (0.15%, 5th percentile), so no active exploitation is indicated despite the 9.8 rating.
Protection-mechanism bypass in Mozilla Firefox's DOM Service Workers component allows remote web content to circumvent a browser security mitigation, weakening defenses that normally contain untrusted script. The flaw affects Firefox versions prior to 153 and was reported and patched by Mozilla (MFSA2026-68). No public exploit has been identified at time of analysis, and EPSS estimates exploitation probability at only 0.15% (5th percentile), indicating no observed weaponization despite the high nominal CVSS score.
Memory-safety defects in Mozilla Firefox 152 and the Firefox ESR 115.37 and 140.12 release trains can corrupt process memory, and Mozilla states some showed evidence of memory corruption that could be leveraged to run arbitrary code. The flaws were resolved in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.14%, 4th percentile), consistent with a batch of internally-found bugs rather than an actively exploited zero-day.
Access-control mitigation bypass in the DOM Service Workers component of Mozilla Firefox before version 153 allows remote content to circumvent a browser security mitigation, undermining protections intended to isolate web origins. Mozilla self-reported the flaw (MFSA2026-68/71) and shipped a fix in Firefox 153; there is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile). The NVD-assigned CVSS of 9.8 (full CIA impact, no user interaction) is notably higher than typical for a browser mitigation bypass, which warrants scrutiny.
Memory-safety compromise in Mozilla's NSS (Network Security Services) cryptographic library allows remote attackers to trigger an integer overflow that leads to out-of-bounds memory access, remediated in Firefox 153 (advisory MFSA2026-68). The flaw stems from incorrect boundary conditions during size calculations in NSS Libraries code, and because NSS handles TLS/certificate and cryptographic parsing, malicious network-supplied data can reach the vulnerable path without user authentication. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile), indicating no observed weaponization despite the critical CVSS score.
Sandbox escape in Mozilla Firefox's DOM: Networking component allows a remote attacker to break out of the content-process security boundary, fixed in Firefox 153. Rated CVSS 9.8, it maps to CWE-693 (Protection Mechanism Failure) and is tagged as an information-disclosure issue by Mozilla, meaning a compromised or malicious web page could bypass the browser's isolation to reach host resources. No public exploit identified at time of analysis, and the EPSS score is low (0.14%, 4th percentile), indicating no observed exploitation activity yet.
Memory-corrupting type confusion in Firefox's JavaScript JIT engine allows a remote attacker to serve a malicious web page that triggers a JIT miscompilation, corrupting memory to disclose sensitive data or achieve code execution in the content process; Mozilla fixed it in Firefox 153. No public exploit is identified at time of analysis, and the EPSS score is low (0.13%, 3rd percentile), indicating no observed weaponization yet despite the critical 9.8 CVSS rating.
Memory corruption via integer overflow in Mozilla Firefox's ImageLib graphics component allows remote attackers to potentially achieve code execution by serving a maliciously crafted image, with the flaw resolved in Firefox 153. The CVSS 9.8 rating reflects unauthenticated network reach with high impact to confidentiality, integrity, and availability, though no public exploit has been identified and the EPSS probability of 0.13% (3rd percentile) indicates no observed exploitation activity to date. It is not listed in CISA KEV and there is no public exploit identified at time of analysis.
SQL injection in Turkhotspot 5651 Loglama versions 5.1.2 through 5.1.2 (fixed in 5.1.3) allows remote attackers to inject arbitrary SQL commands, per TR-CERT advisory TR-26-0584. The product is a Turkish Law 5651 network-access logging/hotspot compliance appliance, and successful exploitation exposes the backing database that stores legally mandated user-activity logs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated account takeover in the Easy Form Builder by WhiteStudio WordPress plugin (versions up to and including 4.0.11) lets remote attackers reset any user's password - including administrators - and gain full site control. The plugin's password recovery flow reuses a publicly scrapeable session identifier ('sid') as the reset token and exposes an unauthenticated nonce-refresh endpoint that hands valid REST nonces to any visitor, collapsing the entire reset gate. Rated CVSS 9.8; no public exploit has been identified at time of analysis, but the attack path is fully described and trivial to reconstruct.
Privilege escalation and cross-product compromise in Oracle Application Object Library (the core AOL/FND framework of Oracle E-Business Suite versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read and modify all AOL-accessible data and, because of a scope change, significantly impact other Oracle EBS products beyond AOL itself. Rated CVSS 3.1 9.6 (Critical) with confidentiality and integrity impact but no availability effect, it is remotely exploitable over HTTPS with low attack complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege/authorization bypass in Oracle WebCenter Portal (Fusion Middleware, Runtime Tools component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, authenticated network attacker read and modify all portal-accessible data over HTTP. The scope-changing flaw (CVSS 3.1 base 9.6) can significantly impact additional products beyond the portal itself and is tagged as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV; disclosed via the Oracle Critical Patch Update of July 2026.
Privilege-escalating data compromise in Oracle SOA Suite (Oracle Fusion Middleware) lets a low-privileged, remote attacker with HTTP access abuse the Integration Business Insight component to read, create, modify, or delete all data accessible to SOA Suite. Rated CVSS 3.1 9.6 (Critical) with a scope change that can significantly impact other products beyond SOA Suite itself. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass and data compromise in Oracle Coherence (Oracle Fusion Middleware Core component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 allows a low-privileged, network-adjacent attacker to read, create, delete or modify all Coherence-accessible data over HTTP. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond Coherence itself, yielding a CVSS 3.1 score of 9.6. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a high-priority patch item.
Cross-context web attack against Oracle Banking Trade Finance Process Management (OBTFPM) 14.6.0 through 14.8.0 lets an unauthenticated network attacker who lures an authenticated user into interacting with crafted content act in the victim's session, reading, creating, deleting or modifying all OBTFPM-accessible data and causing a partial denial of service. Oracle rates it CVSS 3.1 9.6 with a scope change (S:C), meaning impact can spill into other connected products beyond OBTFPM itself. No public exploit is identified at time of analysis and it is not in CISA KEV; the Critical rating is driven by the scope change plus full confidentiality/integrity impact rather than by observed exploitation.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete, and modify all HRMS-accessible data over HTTP. The scope-change (S:C) rating means a successful attack can pivot beyond HRMS to significantly impact other Oracle EBS products, yielding a CVSS 3.1 base score of 9.6. No public exploit identified at time of analysis; the fix is delivered in Oracle's July 2026 Critical Patch Update.
Sandbox escape in Google Chrome for Android prior to 150.0.7871.182 stems from a use-after-free in the GPU component, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Chromium rates the severity High; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. As a second-stage primitive it is typically chained with a separate renderer bug to achieve full device compromise on Android.
Authorization bypass in Gitea before 1.27.0 lets a public-only Personal Access Token read internal content owned by Limited-visibility users and organizations, exceeding the reach the scope is meant to grant. The Repository and Package scope categories only test repo.IsPrivate / Owner.Visibility.IsPrivate(), which return false for VisibleTypeLimited, so an authenticated attacker with a public-only PAT can fetch READMEs, repo content, packages from all 24 registries, and even perform full git-upload-pack clones of instance-internal projects. A vendor-verified end-to-end Docker PoC exists (publicly available exploit code exists); it is not in CISA KEV and EPSS is low at 0.17% (6th percentile). This is the residual gap left after CVE-2026-25714 / PR #37118 fixed the sibling User/Org/ActivityPub cases.
An out-of-bounds read and write in ANGLE within Google Chrome on Android allows a remote attacker to potentially escape the browser sandbox via a crafted HTML page. The flaw is patched in Chrome 150.0.7871.182. No public exploit or active exploitation has been reported; EPSS estimates a low 0.16% probability of exploitation.
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through asset filter parameters on the Analysis REST endpoint, breaking out of command argument handling to run arbitrary commands as a low-privileged OS user. The CVSS 4.0 base score of 9.4 reflects high confidentiality, integrity, and availability impact plus a scope change to subsequent systems, though exploitation requires low-level authenticated access (PR:L). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Remote unauthenticated compromise of Oracle PeopleSoft Enterprise FIN Expenses 9.2 (Expenses component) allows attackers with only HTTP network access to read, create, delete or modify all Expenses-accessible data and to cause a partial denial of service. Rated CVSS 3.1 9.4 and flagged by Oracle as easily exploitable, meaning no authentication or user interaction is required. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low-complexity unauthenticated profile makes it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Unauthenticated remote compromise of Oracle Agile Engineering Data Management 6.2.1 (Install component) lets attackers with only HTTP network access modify or destroy critical PLM data, read a subset of accessible data, and trigger a complete denial of service. Oracle rates it CVSS 9.4 and describes it as easily exploitable, but it is not in CISA KEV and no public exploit has been identified. The combination of no authentication requirement with high integrity and availability impact makes it a serious exposure for any network-reachable deployment.
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-admin user to read sensitive information from the underlying appliance database. Because any low-privileged authenticated account can trigger it over the network, the flaw effectively collapses the product's internal privilege boundaries and exposes vulnerability, asset, and configuration data held by the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor (Tenable) has released a fixed version.
Unauthorized critical-data access and partial denial of service in Oracle Product Lifecycle Analytics 3.6.1 (Supply Chain suite, Installation Issues component) allows a remote, unauthenticated attacker over HTTP to fully read all data the application can access and partially disrupt service. The flaw carries a scope change, so successful attacks may significantly impact adjacent Oracle products beyond the analytics component itself. Rated CVSS 3.1 9.3 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Scope-changing information disclosure and data tampering in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets an unauthenticated network attacker who lures a victim into a single interaction read or alter all data the product can access. Rated CVSS 3.1 9.3 (C:H/I:H, scope change), the flaw is dangerous because compromise can spill into other integrated Oracle Fusion Middleware products, though availability is unaffected. No public exploit identified at time of analysis and it is not on CISA KEV, so exploitation is currently theoretical but the criticality warrants prompt patching.
Unauthorized data compromise in Oracle Coherence (Oracle Fusion Middleware Core component) lets an unauthenticated network attacker read and modify all Coherence-accessible data and impact additional products through a scope change, provided a legitimate user is tricked into a required interaction. It affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, carries an Oracle CVSS 3.1 base score of 9.3, and has no public exploit identified at time of analysis. Fixes ship in the Oracle July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle PeopleSoft Enterprise SCM eProcurement 9.2 (Manage Requisition Status component) lets a remote, unauthenticated attacker read all module-accessible data and perform limited updates over HTTP, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 9.3 (Critical) and tagged as an authentication bypass, the flaw is easily exploitable without user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker read and tamper with all Content Server data and pivot into other connected products. Exploitation is network-based over HTTP and requires luring a victim to trigger the attack (UI:R), with a resulting CVSS 3.1 score of 9.3 driven by a scope change and High confidentiality/integrity impact. No public exploit identified at time of analysis; this entry is disclosed via Oracle's July 2026 Critical Patch Update and is not listed in CISA KEV.
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure direct object reference (IDOR) and elevate to a system administrator, ultimately executing commands as the root user on the underlying host. The flaw affects Serv-U file transfer server deployments, with a reduced impact on Windows installations, and carries a CVSS 9.1 rating driven by a scope change from application admin to OS-level root. There is no public exploit identified at time of analysis and no CISA KEV listing, but SolarWinds self-reported and shipped a fix in the Serv-U 2026-3 release.
Full compromise of Oracle Coherence (Fusion Middleware Core component) is possible by an unauthenticated attacker who holds a local logon on the host where Coherence runs, per Oracle's July 2026 Critical Patch Update. The flaw scores CVSS 9.3 because a successful attack yields complete confidentiality, integrity, and availability loss and, via a scope change, can significantly impact additional products beyond Coherence itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable.'
Sandbox escape in the Chromecast component of Google Chrome before 150.0.7871.182 lets a local attacker corrupt memory through an integer overflow (CWE-190) triggered by crafted network traffic, potentially breaking out of the renderer sandbox to gain broader access on the host. Google rated the Chromium severity High, and the CVSS score is 9.3 driven by the scope change from a sandbox escape. There is no public exploit identified at time of analysis, EPSS exploitation probability is very low (0.10%), and CISA SSVC marks exploitation as none.
Path-traversal to remote code execution in Home Assistant Core before 2026.6.0 lets an authenticated user who can supply a backup archive overwrite arbitrary files on the host. The backup-restore routine trusts a tar SYMTYPE (symlink) entry whose linkname is an absolute path outside the extraction directory, then writes a following regular-file entry through that unvalidated symlink; because the official Docker image runs the process as root, an attacker can drop code into auto-imported Python paths (e.g. site-packages/sitecustomize.py) and gain code execution. Reported by VulnCheck with a vendor patch available (2026.6.0); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting in the Ninja Forms WordPress plugin (versions 3.10.4 through 3.14.9) lets unauthenticated visitors persist script payloads through the Repeatable Fieldset feature that later execute in an administrator's browser when they review form submissions. Because it requires no authentication and fires inside a privileged admin session, a successful hit can lead to admin-account takeover, malicious plugin installation, and full site compromise. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a vendor patch is available; the CVSS 4.0 base score is 9.3 (Critical).
Remote code execution in Grav CMS 2.0.4 (fixed in 2.0.7) lets an authenticated user holding the admin.pages or api.pages.write permission plant a malicious Class::method callable directive in page frontmatter, which Blueprint::dynamicData() feeds unfiltered into call_user_func_array(). The injected command then executes as the web-server user for any subsequent visitor to the page, including unauthenticated ones. Reported by VulnCheck (CWE-94, CVSS 4.0 base 9.3); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side request forgery in Weaviate's Verba (GoldenVerba) RAG application version 2.1.3 lets unauthenticated remote attackers coerce the server into issuing arbitrary outbound HTTP GET requests. The flaw stems from a same-origin middleware bypass: any Origin header prefixed with a single quote defeats the localhost origin check, after which attacker-supplied host and port values passed to the /api/connect endpoint are fetched by the server. No public exploit code exists, but a detailed VulnCheck advisory and a third-party technical write-up document the exact bypass; there is no CISA KEV listing and EPSS was not provided.
Server-side request forgery in Verba (Weaviate's open-source RAG application) version 2.1.3 lets unauthenticated attackers coerce the backend into issuing arbitrary HTTP GET requests to attacker-chosen URLs. By connecting to the unauthenticated /ws/import_files WebSocket endpoint and supplying a malicious URL in the HTMLReader configuration, an attacker can reach internal-only services such as co-located databases or cloud instance metadata endpoints to harvest credentials. No public exploit code has been identified at time of analysis, though a detailed technical disclosure exists; the CVSS 4.0 base score is 9.2 (Critical).
Server-side request forgery in Keep (keephq/keep) as of commit 91c75e0 lets unauthenticated attackers coerce the backend into issuing arbitrary outbound HTTP requests by POSTing a crafted host value to an unprotected providers healthcheck endpoint. Because the endpoint requires no authentication, a remote attacker can pivot into internal services and cloud metadata endpoints (e.g. 169.254.169.254) to steal cloud credentials and map internal networks. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a corresponding GitHub issue is public; the CVSS 4.0 base score is 9.2 (Critical).
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct object reference that lets an authenticated domain administrator reference objects outside their intended authorization boundary to run code on the host. The flaw carries a 9.1 CVSS due to network reach, scope change, and full confidentiality/integrity/availability impact, though the practical bar is high because domain administrator access is a prerequisite, and impact is reduced on Windows deployments. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct object reference (CWE-639) that an authenticated domain administrator with read/write access to the home directory can abuse to execute code as root on the underlying host. The CVSS 3.1 score of 9.1 reflects a scope change from application-admin context to full OS compromise, with the impact explicitly noted as lower on Windows deployments. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so this is a high-severity but authentication-gated flaw rather than a mass-exploitable unauthenticated bug.
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code remotely, executing as root on Unix/Linux deployments while impact is reduced on Windows. The flaw stems from an access-control weakness (CWE-284) and is corroborated by a vendor 'Authentication Bypass' tag, carrying a CVSS 9.1 (scope-changed) rating. No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than confirmed.
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object reference (IDOR) that lets an authenticated group administrator manipulate object references beyond their authority. The flaw carries a CVSS 9.1 rating because a scope change allows a lower-tier admin to fully compromise the underlying host on Linux/Unix, though impact is reduced on Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the high privilege prerequisite (group admin) is realistic in multi-tenant MFT environments.
Unauthenticated data compromise and denial of service in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) lets a remote attacker send crafted HTTP requests to read all data accessible to the service and to crash or hang it completely. Rated CVSS 3.1 9.1 (Critical) with high confidentiality and availability impact and no integrity impact; disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, but the combination of network reachability, no authentication, and low complexity makes it an urgent patch priority.
Unauthenticated remote compromise of Oracle Net Services affects Oracle Database Server versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2, letting a network attacker reaching the database listener over Oracle Net (typically TCP 1521) read all data accessible to the component and hang or repeatedly crash it for a complete denial of service. Rated CVSS 3.1 9.1 with high confidentiality and availability impact and no integrity impact, it requires no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network-facing nature make it a high remediation priority.
Full takeover of Oracle PeopleSoft Enterprise HCM Global Payroll Switzerland 9.2 is possible via network-facing HTTP by an attacker who already holds high application privileges, per Oracle's July 2026 Critical Patch Update. Because the flaw carries a scope change, successful attacks can reach beyond the Global Payroll Switzerland component into additional PeopleSoft products, yielding full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the low attack complexity (CVSS 9.1) makes it a priority patch for organizations running this payroll module.
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other users' accounts through an insecure direct object reference (CWE-639), where user-controlled identifiers are not properly authorization-checked. Any valid low-effort authenticated session can be leveraged to reach objects belonging to other accounts, with the vendor noting reduced impact on Windows deployments (implying greater exposure on non-Windows/Linux installs). No public exploit has been identified at time of analysis; the issue was reported by SolarWinds and is fixed in the Serv-U 2026-3 release.
Data tampering and denial of service in Oracle Hospitality Simphony (POS component) versions 19.8-19.8.5, 19.9-19.9.3 and 19.10 allow a remote unauthenticated attacker to compromise the point-of-sale platform over HTTP. Successful attacks can create, delete or modify all Simphony-accessible critical data and can hang or repeatedly crash the service for a complete denial of service. Rated CVSS 3.1 9.1 with no confidentiality impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.