Denial of service in Schreibfaul1 ESP32-audioI2S version 3.4.5 allows unauthenticated network attackers to crash the audio service by exploiting a buffer overflow in the MP3Decoder::decode() function. Missing validation on untrusted mainDataBegin and nSlots values from incoming MP3 streams leads to memory corruption and service unavailability. No active exploitation or public exploit code has been identified at time of analysis.
Shell command injection in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) permits a remote attacker holding high-privilege credentials to execute arbitrary operating system commands on the underlying server. The CVSS 7.2 High score reflects full confidentiality, integrity, and availability impact, substantially gated by the PR:H authentication requirement. No public exploit has been identified at time of analysis, and both EPSS (1.04%, 60th percentile) and CISA SSVC (Exploitation: none) align on low current exploitation activity; a vendor patch is confirmed available.
Prototype pollution in the @instana/core Node.js tracer, part of IBM Observability with Instana Agent builds 1.0.303 to 1.0.320, allows a local attacker to inject arbitrary properties into JavaScript object prototypes. This can lead to information disclosure and high integrity impact. No public exploit or active exploitation reported; vendor patch is available.
Information disclosure in the Xen hypervisor's DM_OP (device model operation) hypercall handling allows a device model caller to leak uninitialized hypervisor stack memory because certain operations do not verify that the required number of buffers was supplied before reading them. Affected Xen builds process DM_OP requests using structures that may remain uninitialized ('stack rubble'), disclosing low-value memory contents (CWE-665) with limited integrity and availability side effects. No public exploit has been identified at time of analysis; SSVC records exploitation status as none, EPSS is low (0.26%, 18th percentile), and it is not on CISA KEV.
Arbitrary file deletion in the Better Messages WordPress plugin allows authenticated administrators to delete arbitrary server files by exploiting a path traversal flaw in the delete_sticker function. The vulnerability, present in versions up to 2.15.19, enables an attacker with admin access to craft a URL that bypasses directory restrictions via embedded ../ sequences, potentially leading to remote code execution when critical files such as wp-config.php are deleted. No active exploitation or public proof-of-concept has been reported at this time.
Arbitrary OS command execution is possible in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) through unquoted shell interpolation, allowing a remote attacker who has already obtained high-privilege authentication to run arbitrary commands on the underlying host. The CVSS vector (AV:N/AC:L/PR:H) confirms network reachability with low attack complexity once authenticated, resulting in full confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via the advisory at https://www.ibm.com/support/pages/node/7280530.
Local privilege escalation in ArkSigner Desktop Client versions 2.2.16.10 through 17062026 allows authenticated attackers to execute arbitrary code via search order hijacking. A low-privileged local user who can place a malicious DLL in a directory that the application searches before the legitimate one, or convince a victim to open a file from such a location, can achieve full system compromise. No public exploit or active exploitation has been reported, but the TR-CERT advisory confirms the vulnerability.
We are tasked to produce a comprehensive analysis JSON for CVE-2026-62432. We must synthesize all provided data: CVE description, CVSS, tags, SSVC, references, etc. The output must be plain-text strings per field, no arrays, no markdown. First, parse the input: - CVE ID: CVE-2026-62432 - Description: "The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer." - CVSS: 7.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) - Reported by: security@xen.org - Tags: Denial Of Service, Race Condition - SSVC: Exploitation: none, Automatable: yes, Technical Impact: partial - ENISA EUVD ID: EUVD-2026-49785 - References include xenbits advisory, NVD, oss-security. No listed KEV status, no POC mention, no explicit patch version. The patch data is missing (we need to check references? Not provided explicitly. We must infer from multiple sources. The description mentions xen and hypercall, so it's a Xen hypervisor vulnerability. We need to fill out each field. Let's systematically analyze. - product_name: From description, "EVTCHNOP_expand_array hypercall" implies Xen hypervisor. The vulnerability is in Xen's event channel mechanism. So product is "Xen Hypervisor". Could also say "Xen", but "Xen Hypervisor" is 2 words. According to rule "1-3 words ONLY", "Xen Hypervisor" fits. - summary: Must be 2-3 sentence plain-language synthesis. Not copy description. Start with impact verb and product. Example: "Race condition in Xen Hypervisor can lead to denial of service via NULL pointer dereference." But also mention what attacker can do. The CVSS suggests partial impacts in C/I/A, so maybe more than DoS? But tags say Denial Of Service, Race Condition, and description says dereferencing NULL pointer, so likely denial of service (sys
2-3 sentence plain-language summary ... Start with specific impact verb and product. e.g., 'Cross-origin sig
Stored cross-site scripting in StoreGrowth Sales Booster for WooCommerce allows unauthenticated attackers to inject web scripts via the 'message_popup' AJAX parameter. The vulnerability arises because the required nonce is exposed to all frontend visitors, completely bypassing the intended access control. Exploitation leads to arbitrary script execution in the browsers of any user who views an injected popup page, compromising session data and site integrity.
Denial of service via null dereference in Let's Chat 0.4.0 through 0.4.8 allows authenticated users to crash the server by sending a crafted request with a non-existent room ID. The vulnerability is remotely exploitable with no user interaction, and publicly available proof-of-concept code exists. No evidence of active exploitation or CISA KEV inclusion was identified at the time of analysis.
Cross-user information disclosure in IBM Langflow OSS 1.0.0-1.10.1 allows authenticated attackers to access private vector content and poison query results by reusing another user's FAISS namespace. This leads to high confidentiality impact and low integrity impact; the vulnerability has a CVSS 3.1 score of 7.1, and a vendor patch is available.
Arbitrary file write in @wakaru/cli versions 1.0.0 to 1.3.x allows attackers who can trick a user into running `wakaru --unpack` on a crafted bundle to write files outside the intended output directory. The flaw stems from incomplete sanitization of bundle-controlled filenames containing overlapping path traversal sequences like `....//`, which after sanitization become `../`. Successful exploitation can lead to code execution if an overwritten file is executed later.
Denial of service in Quick.CMS allows an authenticated administrator to delete the primary language by sending a direct HTTP request to the language-deletion API endpoint, bypassing the UI restriction, which renders the application unusable. The vendor deems a fix unnecessary due to very low exploitation likelihood, but chaining with a separate Cross-Site Request Forgery vulnerability (CVE-2026-1468) enables an unauthenticated remote attacker to craft a malicious link that, if visited by an authenticated admin, triggers the same DoS condition.