Sandbox escape in Google Chrome's Network component before 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader access on the host via a crafted HTML page. Rated High by Chromium and scored CVSS 8.3, it is a second-stage bug that must be chained with an initial renderer exploit rather than exploited in isolation. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.29% (21st percentile).
Sandbox escape in Google Chrome's Navigation component (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, escalating a renderer-level foothold toward host-level code execution. Chromium rates the security severity High and the CVSS is 8.3; no public exploit identified at time of analysis, and the EPSS probability is low at 0.29% (21st percentile). This is the second-stage bug in a typical Chrome exploit chain rather than a standalone remote-code-execution primitive.
Insecure firmware-fallback in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000, SEC-3050, SEC-3100, SEC-3150, versions 1.0.0 up to 1.9.1) lets a remote unauthenticated attacker force the device to boot an alternate firmware partition that ships with an insecure configuration and default credentials, yielding SSH access as the unprivileged 'user-app' account and allowing charging to be interrupted. The issue was reported by CERT@VDE (VDE-2026-008 / EUVD-2026-51029) and carries a CVSS 4.0 base score of 8.3, driven by high availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sandbox escape in Google Chrome's Media component on Windows (versions before 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox through a crafted HTML page, exploiting a use-after-free (CWE-416). Rated High by Chromium and CVSS 8.3, it enables a scope-changing escalation from constrained renderer code to broader host access. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.21% (11th percentile).
Sandbox escape in Google Chrome's Android WebView allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page in versions prior to 151.0.7922.72. Rooted in a use-after-free (object lifecycle) flaw rated High by Chromium, this is a second-stage privilege-boundary bypass rather than a standalone entry point. No public exploit identified at time of analysis, and the EPSS score is low (0.21%, 11th percentile), consistent with a bug reported internally by the Chrome team and patched before evidence of exploitation.
Predictable shared-secret generation in Spring Tools for Eclipse (5.2.0 and earlier) weakens the authentication protecting Spring Boot DevTools remote-restart uploads to remotely deployed targets such as Docker containers or Cloud Foundry apps. Because the secret is derived from a non-cryptographic PRNG rather than a secure random source, an attacker able to reach the deployed application's DevTools remote endpoint may predict the secret, authenticate restart uploads, and push arbitrary code, yielding remote code execution (CVSS 8.3, scope-changed). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authenticated information disclosure in the LifterLMS WordPress plugin before 10.0.10 exposes internal post type titles - including coupon codes - to any subscriber-level user. The root cause is a missing capability check in a select2 query AJAX handler that only verifies login status, not whether the user holds an appropriate WordPress capability. A publicly available proof-of-concept exists (via WPScan), though EPSS sits at just 0.16% (5th percentile), indicating low broad exploitation likelihood; no active exploitation is confirmed by CISA KEV.
Unauthorized customer PII exposure in MotoPress Hotel Booking WordPress plugin before 6.0.4 allows any authenticated subscriber-level user to retrieve full personal details - name, email, phone number, and address - belonging to any customer booking in the system. The flaw stems from a missing capability check in an AJAX action handler, meaning the plugin never verifies whether the requesting user is authorized to view the target booking before returning its data. A publicly available exploit exists per WPScan, though EPSS at 0.16% (5th percentile) and absence from CISA KEV suggest exploitation remains opportunistic rather than widespread.
Easy Appointments WordPress plugin through version 3.12.26 exposes an appointment-listing REST endpoint to any authenticated user by gating it on a capability held by every WordPress user - including subscribers, the lowest authenticated role. Any user with a basic account can query this endpoint to enumerate all site bookings, extracting customer names, appointment schedules, and booking statuses belonging to other clients. A publicly available exploit is documented by WPScan; however, EPSS sits at 0.16% (5th percentile) and the vulnerability is not in CISA KEV, indicating limited observed mass exploitation at time of analysis.
Insecure direct object reference in the Easy Appointments WordPress plugin (all versions through 3.12.26) permits any authenticated subscriber-level user to retrieve personal information belonging to any appointment booking customer by iterating a customer identifier. The plugin fails to enforce ownership or capability checks before returning stored customer records, exposing PII across the entire customer base to the lowest-privileged WordPress role. No active exploitation is confirmed in CISA KEV, but a publicly available exploit exists via WPScan's disclosure, and EPSS sits at 0.15% - consistent with targeted rather than automated mass exploitation.
Insecure Direct Object Reference in the WP Travel WordPress plugin (all versions before 11.8.1) exposes customer booking records to any authenticated WordPress user. By supplying an arbitrary booking identifier to the customer account dashboard endpoint, a low-privileged attacker can retrieve another customer's full booking details, including billing address information. No special role is required beyond a basic site login; a publicly available proof-of-concept exists, though active exploitation has not been confirmed by CISA KEV.
Privilege escalation via dynamic client registration in malach-it's Boruta OAuth 2.0/OpenID Connect provider library (Elixir) lets an unauthenticated registrant create OIDC clients that carry administrative security attributes. Because Boruta.Openid.register_client/3 forwards caller-supplied parameters straight into the administrative client-creation changeset with no public/admin allowlist, a self-registering client can dictate its own supported grant types, authorized scopes, PKCE enforcement, public refresh/revocation behavior, token lifetimes, and signing settings on versions 2.3.0 through 2.3.6. There is no public exploit identified at time of analysis and it is not in CISA KEV, but a vendor-released patch (2.3.7) is available.
Cross-site request forgery in Softtr E-Commerce Pack (all versions through build 30072026) allows a remote attacker to force an authenticated user's browser into performing unintended state-changing actions, with high confidentiality and integrity impact per the CVSS vector. No public exploit identified at time of analysis, and the flaw is not on CISA KEV; however, exploitation only requires tricking a logged-in user into visiting a malicious page (UI:R). The vendor was contacted by TR-CERT but did not respond, so no fix is available.
Command injection in Eaton's Tripp Lite Series PADM firmware (versions 0 through 20) lets an authenticated administrator run arbitrary operating-system commands through a session-management interface that fails to properly validate input, escaping the intended restricted command environment. The flaw carries CVSS 8.3 (CWE-78) and is notable because the affected firmware line is end-of-life, meaning no security updates are being produced. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation currently requires an actor who already holds administrative credentials on the device.
Authentication bypass in FTC Software IT Services' FTC E-Commerce Management Panel before 1.0.2 lets remote unauthenticated attackers reach a critical function that is missing access controls (CWE-306), exposing sensitive data and permitting limited unauthorized modification. The CVSS 3.1 base score is 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N), reflecting easy network exploitation with high confidentiality impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Out-of-bounds write in PHP's BCMath bccomp() function allows attacker-controlled inputs to corrupt stack and heap memory in PHP 8.4.x before 8.4.24 and 8.5.x before 8.5.9, with high confidentiality, integrity, and availability impact per the vendor CVSS 4.0 score of 8.1. Exploitation requires an application to pass attacker-influenced values into bccomp() with the BCMath extension enabled; there is no public exploit identified at time of analysis (CVSS E:U, no KEV listing). Memory corruption of this class can lead to crashes and, potentially, arbitrary code execution within the PHP process.
SQL injection in the PHP interpreter's string-escaping routine affects PHP 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9, where backslashes in attacker-controlled parameters are improperly escaped, allowing malicious input to break out of quoted SQL string literals. Any web application relying on PHP's built-in escaping to sanitize user data before database queries can be subverted, enabling trivial injection. This is a CWE-89 flaw reported by the PHP project (advisory GHSA-7qpv-r5mr-78m4); no public exploit identified at time of analysis, and CVSS 4.0 rates it 8.1 with exploitation marked automatable.
Site isolation bypass in Google Chrome prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process read or tamper with data belonging to other origins by serving a crafted HTML page, defeating one of Chrome's core sandbox boundaries. Chromium rates the severity High and a fixed Stable-channel build has shipped; there is no public exploit identified at time of analysis and EPSS is low at 0.30% (23rd percentile). The flaw is an input-validation weakness (CWE-20) in the Passwords component that undermines the per-site process separation guarantee.
Cross-tenant vector document disclosure in IBM Langflow OSS 1.0.0 through 1.10.1 lets an authenticated low-privilege user read another user's private Chroma-backed documents by building a flow that reuses the victim's persist_directory and collection_name, returning exact victim content in the attacker's workflow output. The same shared-namespace flaw also lets the attacker write their own documents into the victim's collection, corrupting its integrity. No public exploit is identified at time of analysis and CISA SSVC rates exploitation as none, but the CVSS 8.1 rating reflects the combined high confidentiality and integrity impact.
Out-of-bounds memory read in Chrome's WebXR component allows remote attackers to disclose sensitive renderer process memory or crash the browser tab by luring a victim to a crafted HTML page. All Google Chrome releases prior to 151.0.7922.72 are affected across all platforms, with the vendor confirming a patch in the stable channel update. No public exploit identified at time of analysis, and an EPSS of 0.18% (8th percentile) indicates low near-term exploitation probability despite the high CVSS base score of 8.1.
Out-of-bounds memory read in the Dawn (WebGPU) component of Google Chrome before 151.0.7922.72 lets a remote attacker read memory outside intended bounds when a victim opens a crafted HTML page. Google's Chrome team reported it and a fixed Stable-channel build is available; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 7th percentile). Notably, Chromium internally rated the security severity 'Low' even though the NVD-style CVSS base score is 8.1, so real-world impact is likely narrower than the raw score implies.
Insecure Direct Object Reference (IDOR) in the foreUP customer REST API exposes records belonging to arbitrary users to any authenticated, low-privilege customer account. The endpoint returns user records based on a caller-supplied identifier without verifying that the requesting customer owns or is authorized to access the requested record. No active exploitation has been confirmed (not listed in CISA KEV), and EPSS places real-world exploitation probability at 0.13% - well below the 3rd percentile - though the high CVSS score of 8.1 reflects the potential confidentiality and integrity impact if an adversary with a valid account begins enumerating records.
Authentication bypass to root in Bosch BSH ELP (Electronic Platform) modules stems from a hardcoded, non-revocable SSH public key baked into the firmware's authorized_keys file for the root user. Any attacker holding the matching private key can SSH in and obtain full root-level control of the appliance over the network with no legitimate credentials. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the shared static-key design means a single leak of the private key would compromise every affected device at once.
Remote code execution in the Spring Tools IDE extensions (Spring Tools for Eclipse ≤5.2.0 and for VSCode/Cursor/Theia ≤2.2.0) occurs when a developer launches a Spring Boot application with the 'live information' mode enabled, which exposes an unprotected JMX endpoint that an adjacent-network attacker can abuse to execute arbitrary code on the developer's host. The flaw carries a CVSS 8.0 (High) rating and requires the developer to actively start the app in live mode (UI:R). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Network exposure of Docker container control ports in Spring Tools for Eclipse (versions 5.2.0 and earlier) occurs because the Boot Dashboard Docker integration binds these ports to 0.0.0.0 (all interfaces) instead of loopback. Any attacker on the same network segment as a developer running the integration can reach the container control interface without authentication, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the flaw is trivially triggered once a developer starts the affected feature.
Local privilege-relevant command injection in Performance Co-Pilot's (PCP) linux_sockets PMDA lets an authenticated user inject shell metacharacters through the network.persocket.filter metric, causing arbitrary commands to run as the PMDA user each time metrics refresh. Reported by Red Hat, it affects the pcp packages shipped across Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Authorization bypass in Tigera Calico, Calico Enterprise, and Calico Cloud allows network-adjacent attackers with no special RBAC to reach HTTP endpoints that Application Layer Policy was configured to restrict. Because Dikastes matched raw request paths without RFC 3986/7230 normalization, requests using path-traversal segments, percent-encoded or backslash separators, repeated slashes, or matrix parameters were authorized under a permitted Prefix rule while the downstream workload or fronting proxy normalized them to the restricted endpoint. A vendor fix exists (PRs 12531/12532/12533, advisory TTA-2026-005); no public exploit identified at time of analysis, and the affected Application Layer Policy feature is disabled by default.
Local OS-level privilege escalation in Google Chrome's Updater on macOS (versions prior to 151.0.7922.72) allows a local attacker who can plant a malicious file to exploit a race condition and elevate privileges on the host. Google rated the underlying Chromium bug Critical, though the CVSS base score is 7.8 (High) reflecting the local attack vector and required user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the Critical Chromium rating signals a high-quality, security-relevant defect.
Improper access control in the Easy Appointments WordPress plugin through version 3.12.26 allows any contributor-level WordPress user to delete the site's booking configuration and functionally disable the appointment system. The vulnerable action handler performs neither a WordPress capability check nor nonce validation, meaning any authenticated user at or above contributor role can trigger the deletion without administrative approval. A publicly available exploit exists per WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation; no CISA KEV listing is present.
Broken access control in the Easy Appointments WordPress plugin through version 3.12.26 permits any contributor-level authenticated user to perform privileged appointment-management actions - including reading all customer booking details and creating, modifying, or deleting appointments - without holding the required capabilities. The plugin relies exclusively on WordPress nonce verification as its authorization gate for these AJAX actions, but nonces are available to all authenticated users regardless of role and do not encode privilege level. A publicly available exploit exists per WPScan; no vendor patch has been identified at time of analysis.
Stack-based buffer overflow in IBM Db2's setgid helper binary db2flacc allows a local user with low privileges to overwrite the stack frame and execute arbitrary code with the elevated group permissions of the binary. Both Db2 11.5.x (through 11.5.9) and 12.1.x (through 12.1.4) are affected. No public exploit has been identified and exploitation status is confirmed as none per SSVC, though IBM has released a patch and the SSVC technical impact is rated total, warranting prompt remediation on shared-access Db2 hosts.
Local OS-level privilege escalation in Google Chrome's Updater component on macOS versions prior to 151.0.7922.72 allows a local attacker to elevate privileges by planting a malicious file that the Updater processes with higher rights. The flaw stems from improper privilege management (CWE-269) in the auto-update workflow, requires local access plus user interaction, and carries a CVSS 7.8 (High) rating; no public exploit has been identified at time of analysis. Rated Medium severity by Chromium's own security team despite the High CVSS.
Local privilege escalation in Google Chrome on Windows prior to 151.0.7922.72 lets a local attacker gain elevated privileges through a malicious file that the victim opens or that Chrome processes, stemming from an inappropriate implementation in the Browser process. Google rates the Chromium security severity as Medium, while the NVD-style CVSS of 7.8 reflects high confidentiality, integrity, and availability impact once triggered. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor has shipped a fix.
Local privilege escalation in Google Chrome for Windows before 151.0.7922.72 stems from a use-after-free in the Tracing component (CWE-416), letting a local attacker who lures a user into opening a malicious file execute code that escalates to OS-level privileges. Chromium rates the security severity as Medium, but the assigned CVSS 3.1 score is 7.8 (High) reflecting full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor patch is available.
Local privilege escalation in Google Chrome's Updater component allows a local attacker who can plant a malicious file to gain OS-level privileges once the update process acts on it. The flaw stems from insufficient validation of untrusted input (CWE-20) and affects all Chrome desktop builds prior to 151.0.7922.72; Google rates the Chromium security severity as Medium while the CVSS base score is 7.8 (High). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Bit Form WordPress plugin before version 3.1.2 fails to enforce form deactivation state on its public submission handlers, enabling unauthenticated network-accessible attackers to submit data to forms the site owner has intentionally disabled and trigger any configured backend workflows such as email notifications. The vulnerability carries a low CVSS score of 3.7 with AC:H, reflecting that exploitation requires knowledge of a specific deactivated form's endpoint, and real-world impact is limited to low integrity effects - spurious entries and unwanted workflow executions rather than data exfiltration or system compromise. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.15% (5th percentile) indicates exploitation has not meaningfully materialized across the wild.
Server-side request forgery in the kyegomez Swarms multi-agent framework (all versions through 6.8.1) lets remote unauthenticated attackers coerce the server into fetching attacker-chosen internal endpoints. The flaw lives in the _is_safe_url blocklist check, which validates the literal hostname but never re-checks the address returned by DNS resolution - so a hostname that resolves to a private, loopback, or cloud-metadata address slips past the filter. Supplied as an image or audio URL to an agent, this can be abused to reach internal services and exfiltrate cloud credentials. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Second-order PHP code execution in e107 CMS before version 2.3.8 lets an attacker who already holds out-of-band write access to the database plant a crafted payload in the user_prefs column, which is later fed to eval() when that user's preferences load. The e_array::unserialize() handler validates only that the stored string begins with 'array' before evaluating it, so any account whose preferences are materialized triggers arbitrary PHP execution. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Stored cross-site scripting in the DFIR-IRIS incident-response platform (iris-web 2.4.26 and possibly earlier) lets an authenticated low-privileged user persist malicious JavaScript through the assets function, which then executes in the browser of any other analyst who views the affected case data. Because IRIS holds sensitive investigation material and the CVSS scope is changed (S:C), a successful payload can hijack higher-privileged analyst or administrator sessions. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; disclosure comes from an SBA Research advisory (SBA-ADV-20260126-01).
Stored cross-site scripting in DFIR-IRIS (iris-web) version 2.4.26 and possibly earlier lets an authenticated, low-privileged user inject persistent JavaScript through the datastore upload function that executes in the browser of any other user who later views the affected datastore content. Because the injected script runs in the security context of victims - including higher-privileged analysts and administrators of the incident-response platform - an attacker can hijack sessions, exfiltrate case data, or perform actions on the victim's behalf. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.6 (scope-changed, high confidentiality impact).
Stored cross-site scripting in the DFIR-IRIS incident-response platform (iris-web 2.4.26 and possibly earlier) lets an authenticated low-privileged user inject persistent JavaScript through the custom attributes function, which then executes in the browser of any analyst or administrator who later views the affected record. Because IRIS is a collaborative DFIR case-management tool, a successful payload can hijack higher-privileged sessions and exfiltrate sensitive investigation data. No public exploit identified at time of analysis; the issue was reported by SBA Research (SBA-ADV-20260126-01) and carries a CVSS 3.1 base score of 7.6.
Broken authorization in OpenProject before 17.6.0 lets authenticated users holding only the edit_work_packages permission manipulate file-storage links they should not control. By submitting _links.fileLinks to PATCH /api/v3/work_packages/{id}, an attacker lacking manage_file_links can resolve Storages::FileLink records by raw id to detach or hard-delete them, re-parent FileLinks from other projects onto their own work package, and read origin filename, origin id, and MIME-type metadata. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is remotely reachable by any low-privileged project editor.
Service-account token disclosure in the Red Hat OpenShift koku-metrics-operator lets a user with edit rights on the CostManagementMetricsConfig custom resource redirect metrics uploads to an attacker-controlled URL, to which the operator blindly attaches its own Kubernetes bearer token. This CWE-918 server-side request forgery (tagged SSRF/Kubernetes/Red Hat) yields the operator's service-account credentials, enabling in-cluster privilege escalation. Reported by Red Hat with a CVSS 3.1 base of 7.6 (scope-changed); no public exploit identified at time of analysis and it is not in CISA KEV.
Arbitrary file read in IBM App Connect Enterprise (versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27) allows a remote, unauthenticated attacker to retrieve files outside the intended directory via a path traversal flaw (CWE-22), scoring CVSS 7.5. The vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no privileges or user interaction, though impact is confined to confidentiality (C:H/I:N/A:N). There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low-complexity, no-auth profile makes it a straightforward disclosure risk once details are known.
PHP object injection in the BuddyPress plugin for WordPress (all versions through 14.5.0) allows authenticated users with subscriber-level access or higher to deserialize attacker-controlled data through XProfile textbox fields, which can escalate to remote code execution when a usable POP gadget chain exists in the WordPress stack. The flaw stems from bp_unserialize_profile_field() calling @unserialize() on user-supplied profile data without the allowed_classes safeguard. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the moderate CVSS of 7.5 reflects the dependency on an available gadget chain (high attack complexity).
Arbitrary file read in IBM Langflow OSS versions 1.0.0 through 1.10.1 allows remote unauthenticated attackers to retrieve files outside the intended web root by submitting URLs containing directory-traversal ("../") sequences. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation needs no authentication or user interaction and can expose sensitive files such as configuration, secrets, or source code. No public exploit identified at time of analysis, and there is no indication of active exploitation.
Local information disclosure in IBM App Connect Enterprise (versions 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27) occurs because the integration runtime writes potentially sensitive information into log files that any local user can read. An attacker with local access to the host can harvest secrets such as credentials, connection strings, or message payload data from these logs to escalate access or pivot to backend systems. No public exploit identified at time of analysis, and there is no KEV listing; note that the NVD CVSS vector (AV:N) conflicts with the description's explicit 'local user' wording.
Payment-authorization bypass in the Sylius Mollie Plugin (versions before 2.2.8, 3.2.4, and 3.3.1) lets an unauthenticated attacker mark any victim order as paid without transferring funds. The plugin's POST /{_locale}/update-payment webhook trusts attacker-supplied id and orderId parameters and never verifies that the referenced Mollie payment belongs to the referenced Sylius order, so possession of any single valid paid Mollie payment ID is enough to forge a paid status on arbitrary orders. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the root cause is straightforward and the impact is a direct financial-fraud primitive against the shop.
Security constraint bypass in IBM WebSphere Application Server 8.5/9.0 (Traditional) and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.7 allows a remote, unauthenticated attacker to circumvent access controls and reach protected resources, resulting in disclosure of confidential information (CVSS 3.1 base 7.5, C:H). The flaw stems from an authentication-bypass-by-alternate-name weakness (CWE-289) in how the server evaluates security constraints. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in IBM DataPower Gateway (versions 10.5.0, 10.6.0, 10.6cd, and 11.0.0) allows a remote unauthenticated attacker to exhaust system resources due to improper resource limitations (CWE-770), rendering the gateway unavailable. The CVSS 3.1 base score is 7.5 with an availability-only impact (A:H) and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a vendor patch is available.