Local access to sensitive user data in macOS allows a malicious app to bypass sandbox restrictions and read protected files or information. This issue affects all macOS versions prior to Tahoe 26.6, requires user interaction to run the malicious app (e.g., via social engineering or masquerading as legitimate software), and has no public exploit or active exploitation reported at this time.
Information disclosure in macOS allows a local app to access sensitive user data. The issue affects macOS Sonoma before 14.8.8 and macOS Sequoia before 15.7.8, where missing privacy controls could be abused by a malicious application. With a CVSS score of 5.5 and EPSS at 0.14%, no public exploit or active exploitation has been observed; Apple has released patches.
Unexpected Safari crash via use-after-free when processing maliciously crafted web content affects Safari 26.6 and earlier on all Apple platforms. This denial-of-service condition requires user interaction to open a malicious webpage; no public exploit identified and EPSS probability is low (0.14%).
Denial of service in macOS Tahoe fixed by removing vulnerable code. A local attacker with low privileges can cause a denial-of-service condition. No active exploitation or public exploit known, and the low EPSS score (0.14%) indicates limited real-world risk.
Information disclosure in iOS and iPadOS versions before 26.6 allows a locally installed malicious application to access sensitive user data without proper authorization. Apple addressed the flaw in iOS 26.6 and iPadOS 26.6 with improved state management; no active exploitation or public proof-of-concept has been identified. The EPSS exploitation probability is low (0.14%), consistent with the local attack vector and required user interaction.
Information disclosure in macOS Screen Sharing allows a local attacker with low privileges to read the legacy VNC password. This issue affects macOS versions prior to 15.7.8 and 14.8.8, and could enable unauthorized remote access if VNC is enabled. No active exploitation or public exploit code has been identified.
An integer overflow in GIMP's file-sgi plugin, triggered by a crafted RLE-compressed SGI image, causes denial of service by crashing the plugin. The vulnerability affects GIMP versions with the file-sgi plugin and requires a user to open a malicious image file. No public exploit or active exploitation is known at this time; the issue is being tracked by GNOME and Red Hat.
Heap-based buffer overflow in HDF5 through 2.1.1 enables attackers to crash applications and potentially corrupt data by providing a crafted HDF5 file. The flaw lies in the shared‑message list‑index deserializer (SOHM), allowing out‑of‑bounds heap reads and writes when a num_messages field exceeds the declared list_max. No active exploitation has been reported, but the issue is publicly documented and a proof‑of‑concept may exist in the linked issue.
Server-side request forgery in Kimi Code's FetchURL tool allows attackers who can influence a FetchURL call (e.g., via prompt injection) to bypass hostname and IP denylists by using crafted public hostnames that resolve to internal addresses or via HTTP redirects, exposing internal network services. No public exploit or active exploitation identified at the time of analysis.
Improper authorization in Papra allows authenticated users to delete or rename tags belonging to other organizations. The vulnerability affects Papra versions before 26.5.0, where tag mutation endpoints fail to scope database operations to the organization in the URL. An attacker with low privileges and membership in any organization can modify or remove tags of a different organization by knowing the target tag's identifier.
Authorization bypass in JFrog Artifactory enables authenticated users with limited repository access to modify internal metadata under specific conditions, leading to integrity and availability impact. No exploitation or public proof-of-concept has been identified at this time, and EPSS data is unavailable, but the high integrity impact warrants a prompt patching response.
Broken access control in YayPricing ≤ 3.5.6 allows authenticated subscribers to modify pricing data or cause service disruption. The vulnerability, rated medium severity (CVSS 5.4), stems from missing authorization checks in an endpoint that should be restricted to higher-privilege roles. No public exploit code or active exploitation is known at the time of analysis.
Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX WordPress plugin versions up to 2.3.5 allows remote attackers to
Unauthenticated broken access control in the Gillion WordPress theme (versions ≤ 4.13) allows remote attackers to modify certain data without authentication, with no confidentiality or availability impact. The vulnerability, tracked as CVE-2026-66477, has a CVSS score of 5.3 (Low integrity). No known public exploit or active exploitation exists at this time.
Information disclosure in Exclusive Addons Elementor versions up to 2.8.0 allows unauthenticated remote attackers to access sensitive data. The vulnerability is classified as CWE-497 exposure of sensitive information. No public exploit code or active exploitation has been reported at time of analysis.
An unauthenticated broken access control vulnerability in Event Tickets through version 5.29.0.1 allows remote attackers to modify event ticket data without authentication. The vulnerability affects installations of the WordPress plugin where default configurations are in place, permitting unauthorized integrity impact. No active exploitation or public exploit code has been reported at the time of this analysis.
Sensitive data exposure in MapPress Maps for WordPress <= 2.97.6 allows unauthenticated remote attackers to access potentially sensitive information through a vulnerable plugin endpoint. The flaw, assigned CWE-497, permits disclosure of internal data such as configuration details or API keys without any user interaction, facilitating further attacks. No public exploit or active exploitation has been reported at the time of analysis, but the low attack complexity elevates its practical risk.
Denial-of-service in the Mercusys MB115-4G router's web interface allows unauthenticated attackers to crash the administration service by sending a crafted request to the /cgi/login endpoint. A stack buffer overflow in the http_gdpr_decrypt function corrupts memory and halts the httpd process, leaving the device operational but unmanageable through the web UI. A vendor patch is available; no public exploit or active exploitation has been identified.
Hardcoded credentials in TP-Link router firmware allow attackers with physical access to gain unauthorized access to privileged functions, potentially leading to full device compromise. Affected models include TL-WR845N v4, TL-WR850N v3, Archer C20 v6, and Archer MR200 v5. No evidence of active exploitation or public exploit code exists at this time, and the physical access requirement limits remote exploitation risk.
Denial of service in HDF5 caused by a NULL pointer dereference when processing a crafted HDF5 file with an invalid variable-length datatype attribute. The vulnerability affects all versions of HDF5 and can be triggered by a user opening a malicious file, leading to application crash. Publicly available exploit code exists per CVSS metric.
Reflected cross-site scripting (XSS) in the Phoca Commander extension for Joomla (versions 5.0.0 through 6.1.1) allows remote attackers to inject arbitrary JavaScript into a victim's browser via a crafted URL that reflects unvalidated input. Exploitation requires the victim to click a malicious link (UI:R), and while no authentication is needed to deliver the payload, the impact is limited to the victim's session context, yielding Low confidentiality and integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is low at 0.32% (24th percentile), indicating a moderate-to-low priority issue.
Integer overflow in the print_string_ptr() function of the cJSON library on 32-bit platforms causes a heap buffer overflow when processing crafted JSON strings with approximately 858,993,460 control characters. Applications using cJSON_PrintBuffered() with a pre-allocated buffer are vulnerable, potentially leading to remote code execution, information disclosure, or denial of service. No public exploit or active exploitation has been identified at the time of analysis.
Stored cross-site scripting in Ekushey CRM through version 5.0 allows authenticated client users to inject arbitrary HTML and JavaScript via the Ticket Title field on the Create New Ticket page. The payload executes in the browser of any staff or administrator
Stored cross-site scripting in Ekushey Project Manager CRM through version 5.0 allows authenticated client users to inject arbitrary HTML and JavaScript via the client Name field on the Edit Profile page, which is not sanitized. When staff or administrators view the Manage Clients or Manage Client Projects pages, the malicious scripts execute in their browser sessions. A proof-of-concept exploit is publicly available, though no active exploitation has been confirmed in CISA KEV.
Out-of-bounds heap write in Erlang OTP's binary_to_term/1 function causes virtual machine crash via a maliciously crafted Erlang external term format (ETF) binary. The vulnerability, triggered by a signed/unsigned conversion error in LARGE_TUPLE_EXT decoding, affects OTP 25.0 through 27.3.4.14, 28.5.0.3, and 29.0.3. No authentication is required, and exploitation leads to denial of service; no public exploit code has been identified at time of analysis.
Hardcoded credential in Ericsson Packet Core Controller (PCC) versions before 1.38 allows an attacker with cluster access to read alarm and alert information
A local denial-of-service vulnerability in macOS versions before Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a malicious app to cause unexpected system termination due to a memory handling flaw. Exploitation requires a low-privilege user to run a crafted application, and no active exploitation is known at this time.
Broken access control in Visual Composer Website Builder plugin for WordPress allows authenticated attackers with low privileges (e.g., subscriber) to modify site content by bypassing authorization checks on restricted endpoints. No public exploit has been identified, and the SSVC decision framework indicates no current exploitation, making this a low-priority issue despite a CVSS 5.0 score.
An open redirect vulnerability in Milk admin through version 0.9.8 allows an authenticated attacker with high privileges to craft a request that redirects users to arbitrary external URLs, enabling phishing or credential theft. Public exploit code exists on GitHub, but the vulnerability is not actively exploited per CISA SSVC and has a low EPSS probability of 0.30%. The CVSS vector indicates high privileges and no user interaction required, which is unusual for open redirects and may indicate a server-side forced redirect.
Arbitrary file deletion vulnerability in Easy Digital Downloads plugin for WordPress versions 3.6.9 and earlier allows authenticated administrators to delete arbitrary files on the server via a path traversal attack. The vulnerability leads to high availability impact (file deletion) but requires high privileges, limiting exploitability to admin users. No public exploit or active exploitation has been identified at the time of analysis.
Server-side request forgery (SSRF) in the Feedzy WordPress plugin version 5.2.4 and below allows authenticated contributors to craft malicious RSS feed URLs, leading to unauthorized requests to internal or external resources. This could disclose limited internal service information or allow low-integrity modifications, but exploitation requires high attack complexity and contributor-level access. No active exploitation or public proof-of-concept has been identified at the time of analysis.
Directory traversal in Ericsson Packet Core Controller (PCC) Configuration Management allows authenticated attackers with high privileges to alter directory permissions, causing denial of service to legitimate users. The vulnerability affects PCC versions prior to 1.39 and requires adjacent network access. No public exploit or active exploitation (KEV) has been reported, and the CVSS 4.0 medium score (4.8) reflects the limited impact and prerequisites.
Path traversal vulnerability in Erlang OTP's stdlib zip module allows attackers to write files outside the intended extraction directory by exploiting flawed validation of relative paths in zip archives. Affected are OTP versions 27.1 before 27.3.4.15, 28.5.0.4, and 29.0.4. Successful exploitation requires user interaction (extracting a crafted zip) and has limited impact on integrity and availability; no active exploitation has been reported.
Information disclosure vulnerability in Ericsson Packet Core Controller (PCC) versions before 1.39 permits an attacker with high privileges on an adjacent network to enumerate system users through the configuration management interface. No evidence of active exploitation or public exploit code has been identified at this time, and the CVSS score of 4.8 (Medium) reflects the requirement for elevated privileges and adjacent access.
XML External Entity processing in proCertum SmartSign allows server-side request forgery (SSRF) and local file disclosure via crafted signature files. The vulnerability is triggered when a victim merely previews a malicious file in the file selection window, before clicking Open. patched in version 9.4.3.90. No active exploitation or public exploit code identified.
Information disclosure in macOS and tvOS due to a race condition allows a malicious local app to read sensitive user data without authorization. Affected versions include macOS prior to Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6, and tvOS prior to 26.6. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation probability.
Sensitive information disclosure vulnerability in macOS via a race condition allows a local malicious application to access user data. Apple fixed the issue in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public proof-of-concept is known.
iOS and iPadOS versions before 26.6 allow a malicious app to modify protected file system areas via a race condition. The vulnerability, tracked as CVE-2026-43811, requires local user interaction and has no known public exploit or active exploitation, with EPSS indicating very low real-world likelihood.
Physical access to a locked Apple device running vulnerable iOS or macOS allows an attacker to view sensitive user information due to an out-of-bounds read. The flaw is fixed in iOS 26.6, iPadOS 26.6, and multiple macOS versions. No public exploit or active exploitation has been reported.
Information disclosure in macOS allows an attacker with physical access to a locked device to view sensitive user information. Affected versions include macOS Sonoma below 14.8.8, macOS Sequoia below 15.7.8, and macOS Tahoe below 26.6. No public exploit or active exploitation has been identified, and EPSS probability is very low at 0.16%, reflecting the physical access requirement.
Physical access to an iPhone or iPad running vulnerable iOS/iPadOS versions allows an attacker to access sensitive user data during the iPhone Mirroring feature due to improper state management. This issue is fixed in iOS 26.6 and iPadOS 26.6. No known exploitation in the wild; EPSS score is low (0.15%, percentile 5%).
Denial of service in Zephyr's Synopsys DesignWare I2C driver (slave mode) enables an I2C master on the same physical bus to cause permanent failure of the write_requested() callback due to a missing START_DET interrupt enable. This halts all subsequent write transactions and desynchronizes higher-layer framing until device reset. No public exploit identified; patch available from vendor.
We are tasked with synthesizing data about CVE-2026-57916 into a comprehensive analysis. We must follow all rules strictly. First, gather data from the input: - CVE ID: CVE-2026-57916 - Description: proCertum SmartSign opens Certificate Practice Statement (CPS) URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a local executable file or any URL, sign a document with it, and send it to the victim. When the victim opens the document in the application, the specified file will be executed (or webpage will be opened). This issue was fixed in version 9.4.3.90. - CVSS Score: 4.6 - CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N - CWE: CWE-73 External Control of File Name or Path - Reported by: CERT-PL - CPE: cpe:2.3:a:asseco:procertum_smartsign:*:*:*:*:*:*:*:* - Tags: Information Disclosure, Procertum Smartsign (likely a typo, should be proCertum SmartSign) - References: - cert.pl/posts/2026/07/CVE-2026-57916 - pomoc.certum.pl/pl/oprogramowanie/procertum-smartsign/ Now, we have to synthesize. Note: There is no KEV status, no EPSS, no POC mention. So we'll use standard phrases. Let's construct each field. product_name: "proCertum SmartSign" - the specific product. Use 1-3 words. summary: Need to start with impact verb and product. "proCertum SmartSign allows arbitrary file execution via CPS URI due to missing schema validation." Possible summary: "proCertum SmartSign before 9.4.3.90 fails to validate the schema of Certificate Practice Statement (CPS) URIs, allowing a document recipient to be tricked into executing a local executable or opening a malicious webpage when viewing a specially crafted signed document. No authentication required; user interaction is needed to open the document." The attack vector is local? CVSS says AV:L, meaning local, but description suggests sending document to victim, so the execution occurs when victim opens it. The CVSS 4.0 has UI:A (Active), meaning
Denial of service in Mattermost 10.11.x through 11.8.x allows authenticated users with file-upload permission to degrade file-upload performance for all users by exploiting unbounded resource consumption during server-side document extraction. Attackers can repeatedly upload small documents that are expensive to extract, saturating the extraction worker pool and causing service degradation. No active exploitation or public exploit code is reported, but the low attack complexity and minimal privileges make this an accessible DoS vector.
Disclosure of plaintext credential secrets in Devolutions Server allows authenticated low-privileged users to access PAM password history entries via crafted API requests. Affected versions are 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier, with vendor patches released (DEVO-2026-0026). No active exploitation or public exploit code has been identified at time of analysis.
Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier contain an improper access control flaw in the NetBox synchronizer that allows an authenticated user with view-only permissions to retrieve a stored API token. No active exploitation or public exploit code has been reported; EPSS indicates a 0.13% probability of exploitation, making mass targeting unlikely. The vulnerability is rated Medium severity with a CVSS base score of 4.3.
Cross-Site Request Forgery in the HT Script WordPress plugin allows an attacker to trick an authenticated administrator into performing unintentional actions, such as modifying the header/footer code that may include injecting malicious scripts. Versions 1.1.8 and earlier are affected. No public exploit or active exploitation has been identified at this time.
Cross-site request forgery in WP Google Review Slider versions up to 18.4 allows unauthenticated attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings or injecting content. The vulnerability is rated medium severity (CVSS 4.3) because it requires user interaction and has only a low integrity impact. No active exploitation or public exploit code has been identified at this time.
Double free in HDF5 library allows a local attacker to cause a denial of service via a crafted file with an oversized chunk size. Processing the file with h5repack triggers an application abort, with no confidentiality or integrity impact. No active exploitation or public exploit code has been confirmed.