Memory exhaustion denial-of-service in Bouncy Castle's DTLS implementation allows remote unauthenticated attackers to crash or degrade Java applications by sending crafted handshake messages with inflated 24-bit length fields. Affected are bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FJA (bctls-fips) before 1.0.24, 2.0.24, or 2.1.24 depending on the deployed branch. The buffer allocation occurs pre-authentication during the DTLS handshake reassembly phase - before any signature or Finished verification - making this exploitable without credentials against any exposed DTLS endpoint. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Uncontrolled recursion in Bouncy Castle for Java's lazy ASN.1 parser enables remote unauthenticated denial of service across all three library release lines (bc-java, bc-lts-java, and bc-fja FIPS). When a LazyEncodedSequence is forced during tree traversal, it resets the nesting-depth guard to its configured maximum instead of continuing with the remaining depth budget, allowing crafted deeply-nested ASN.1 structures to bypass StreamUtil's recursion limit and trigger a StackOverflowError. No public exploit has been identified at time of analysis, but any Java application accepting externally-supplied ASN.1 data - TLS certificates, CMS signatures, PKCS structures - is potentially exposed without authentication.
Heap exhaustion via uncontrolled memory allocation in Bouncy Castle for Java's MLS wire decoder allows remote unauthenticated attackers to crash any application using the bc-java MLS module. The MLSInputStream.readOpaque() method decodes an attacker-supplied Varint length field (up to 0x3FFFFFFF, approximately 1 GiB) and allocates that buffer before verifying the input stream actually contains that many bytes; a handful of concurrent few-byte crafted messages can exhaust the JVM heap. No public exploit has been identified at time of analysis and CISA KEV listing is absent, though the attack is trivially constructable from the published patch and regression test.
Out-of-memory denial-of-service in Bouncy Castle for Java allows remote unauthenticated attackers to crash Java applications by submitting a crafted ASN.1 definite-length object with an inflated declared size. The ASN.1 parser in `DefiniteLengthInputStream.toByteArray()` allocated a full heap-sized byte array before reading any body bytes, meaning a few-byte header claiming a near-JVM-heap payload was sufficient to trigger OOM. All major Bouncy Castle release lines are affected - including the FIPS-certified BC-FJA variant - and a vendor patch is available; no public exploit code or CISA KEV listing exists at time of analysis.
Bouncy Castle for Java's OpenPGP session-key decryption path re-exposes the Mister-Zuccherato adaptive-chosen-ciphertext oracle by failing to suppress the legacy CFB 'quick check' on the PKESK/session-key route, enabling an attacker with decryption oracle access to recover plaintext from SEIPD v1 encrypted messages. Affected are bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FJA (bcpg-fips) across the 1.0.X, 2.0.X, and 2.1.X series - three distinct product lines used broadly in enterprise and open-source Java applications. No public exploit or CISA KEV listing has been identified at time of analysis; however, the attack technique is well-established in cryptographic literature dating to the Mister-Zuccherato paper.
CPU exhaustion in Bouncy Castle for Java's MLS (Messaging Layer Security) implementation allows a network attacker to trigger unbounded HKDF key-derivation iterations by supplying a crafted 32-bit generation counter in an MLS message. The hash-ratchet in GroupKeySet.get(int generation) advances one HKDF step per skipped generation without any upper bound, so a maximally crafted counter forces up to ~4.29 billion derivation steps on the receiving process. Scored CVSS 4.0 at 8.7 with High availability impact and no authentication prerequisites per vendor scoring; no public exploit code or KEV listing has been identified at time of analysis.
Unbounded recursion in Bouncy Castle's OER (Octet Encoding Rules) parser enables remote unauthenticated denial-of-service against any Java application processing IEEE 1609.2 V2X messages. Because the IEEE 1609.2 schema is cyclic - an Ieee1609Dot2Data structure can nest inside its own SignedData payload - a few kilobytes of crafted input drive the parser into unbounded recursive descent, terminating in a JVM StackOverflowError. Critically, parsing occurs before signature verification, so no authentication or trust relationship is needed to trigger the crash. No public exploit has been identified at time of analysis, but the patch commit exposes two additional heap-exhaustion vectors alongside the primary recursion flaw, all reachable from the same pre-verification code path.
Memory exhaustion in Bouncy Castle for Java's OpenPGP parser enables unauthenticated remote denial of service via a crafted User Attribute subpacket with an oversized length header. All Java applications importing untrusted OpenPGP certificates using bc-java before 1.85, bc-lts-java before 2.73.12, or BC-FJA (FIPS) in affected series are vulnerable to pre-authentication JVM heap exhaustion. No KEV listing or public exploit has been confirmed at time of analysis, but the zero-complexity unauthenticated network attack vector and CVSS 4.0 score of 8.7 signal high operational priority for services that accept OpenPGP certificates from external sources.
CCMBlockCipher in Bouncy Castle for Java decrypts ciphertext directly into the caller-supplied output buffer before verifying the authentication tag, leaving unverified CTR-decrypted plaintext in memory when tag verification fails and violating NIST SP 800-38C §6.2. Every edition - bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FJA across three active release lines (1.0.x, 2.0.x, 2.1.x) - is affected. Applications that reuse pooled byte buffers, log failure-path output, or otherwise expose the buffer on an authentication failure inadvertently become CTR decryption oracles, allowing attackers to submit forged ciphertexts and recover plaintext without possessing a valid authentication tag. No public exploit and no CISA KEV listing exist at time of analysis.
RSA PKCS#1 v1.5 signature forgery is possible in Bouncy Castle for Java (bc-java before 1.85, bc-lts-java before 2.73.12) when the DigestInfo encoding omits the NULL AlgorithmIdentifier parameter. The off-by-two bytes in the RSADigestSigner comparison loop allows any forged signature whose DigestInfo matches all bytes except the final two of the message hash to pass verification as valid, achieving a high-integrity bypass. No public exploit has been identified at time of analysis, but the public patch commit includes a step-by-step test demonstrating the exact forgery technique, substantially lowering the bar to exploitation.
Cross-nonce AEAD forgery in Bouncy Castle for Java's KCCMBlockCipher (DSTU 7624 CCM mode) allows an attacker with chosen-plaintext oracle access to forge valid authenticated ciphertext under an un-queried nonce when no associated authenticated data is present. All bc-java releases before 1.85 and bc-lts-java releases before 2.73.12 are affected. The G1 initialization block - which binds the nonce into the MAC under the DSTU 7624:2014 standard - was conditionally skipped when no AAD bytes were supplied, leaving the authentication tag independent of the nonce and breaking the core AEAD security guarantee. No public exploit has been independently released and this vulnerability is not listed in CISA KEV, though the fix commits include a working regression test that fully demonstrates the forgery technique.
Signature bypass in Bouncy Castle for Java allows any attacker-supplied content wrapped in a zero-signer CMS envelope to pass `CMSSignedData.verifySignatures()` without any valid cryptographic signature. The method iterates an empty signerInfos SET, falls through to a vacuous `return true`, and any application using it as its top-level authenticity check silently accepts unsigned attacker-controlled content as authenticated - a classic fail-open flaw (CWE-347). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack primitive is trivially constructible using any standard CMS/PKCS#7 library.
Signature forgery via back-dated signingTime in Bouncy Castle's S/MIME validator allows an attacker holding a revoked or expired signing certificate to have that certificate accepted as valid by unpatched validators. The SignedMailValidator in bc-java before 1.85, bc-lts-java before 2.73.12, and all bc-fja (FIPS) lines before their respective 1.0.7/2.0.7/2.1.7 fixes unconditionally used the signer-asserted CMS signingTime attribute as the PKIX path-validation date, making certificate expiry and revocation checks bypassable. No public exploit or CISA KEV listing exists at time of analysis, but the flaw is architecturally straightforward to exploit by any party that holds or has previously held a Bouncy Castle-validated signing certificate.
OpenPGP inline-signature policy enforcement in Bouncy Castle for Java silently discards rejection exceptions, causing signatures that use prohibited weak hash algorithms (MD5, SHA-1, RIPEMD-160) or otherwise violate the configured OpenPGPPolicy to be reported as cryptographically valid. Affected are bc-java before 1.85 and bcpg-fips (bc-fja) before 2.0.13; the detached-signature and prefixed-signature verification paths are not affected - only the inline one-pass path. A vendor patch is available; no public exploit code has been identified at time of analysis, though the CVSS 4.0 score of 8.7 reflects a high integrity impact driven by the unauthenticated network vector.
CMS AuthEnvelopedData decryption in Bouncy Castle for Java fails to enforce a minimum AEAD authentication tag length, allowing a network attacker to supply a crafted CMS message carrying a truncated AES-GCM/CCM ICV (e.g., 32 bits instead of the standard 128 bits), effectively reducing the authentication space to the point where tag forgery becomes computationally feasible. Affected are bc-java before 1.85, bc-lts-java before 2.73.12, and all bc-fja (FIPS) 1.0.x/2.0.x/2.1.x series before their respective .12 patch releases. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with VI:H reflects the high integrity impact of bypassing authenticated encryption guarantees.
OpenPGP AEAD decryption in Bouncy Castle for Java silently bypasses the final authentication tag when plaintext is an exact multiple of the AEAD chunk length, allowing an attacker who can tamper with ciphertext to strip trailing plaintext chunks and have the truncated message accepted as cryptographically authentic. Affected libraries span bc-java before 1.85, bc-lts-java before 2.73.12, and all three active BC-FJA FIPS series before their respective bcpg-fips 1.0.13, 2.0.13, and 2.1.13 releases. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, but the CVSS 4.0 score of 8.7 (Integrity: High) reflects a complete and silent bypass of AEAD integrity guarantees for chunk-aligned messages with no downstream exception or warning.
IESEngine in Bouncy Castle for Java allows cross-message MAC forgery when stream mode is used with static key pairs, affecting bc-java before 1.85 and bc-lts-java before 2.73.12. The flaw stems from a length-dependent KDF output split: in the static-key path (no ephemeral V component), the MAC key K2 was placed at a byte offset equal to the message length after the keystream K1, so an observer of one known-plaintext encryption can recover K2 and forge valid ciphertext-plus-tag pairs for shorter messages. No public exploit beyond the vendor's own proof-of-concept regression test exists, and no CISA KEV listing is present at time of analysis.
CMS AuthenticatedData integrity verification in Bouncy Castle for Java is bypassable when authenticated attributes (authAttrs) are present, allowing an attacker to substitute arbitrary content while the recipient MAC check passes without error. Affected are bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FJA across the 1.0.x, 2.0.x, and 2.1.x series - all widely deployed in Java enterprise and FIPS environments. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VI:H) reflects unauthenticated remote exploitation with high integrity impact; no public exploit or CISA KEV listing is confirmed at time of analysis.
Cross-site scripting in @angular/platform-server's domino DOM emulation library allows attackers to inject executable script blocks into SSR-rendered HTML by supplying closing-tag sequences inside user-controlled data bound to <iframe>, <noembed>, <noframes>, or <noscript> Angular template elements. Angular 20.x through 22.x applications using Server-Side Rendering that reflect user input into these specific fallback raw-content elements are affected; Angular 19.x and earlier receive no backport patch. No public exploit has been identified at time of analysis, though the mechanism is straightforward once the vulnerable application pattern is present, and patches are available across three supported Angular branches.
Arbitrary public static PHP method invocation in Grav CMS 2.0.7-2.0.10 allows any account holding page-editing rights (admin.pages) to read arbitrary server-readable files and create or copy files and directories under the web-server account. The flaw lies in Blueprint::isSafeDynamicCall(), which skips its dangerous-callable denylist entirely for strings containing '::' - meaning fully-qualified Class::method notation in blueprint dynamic-field directives is never checked against the blocklist. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code is identified at time of analysis, but the low-privilege requirement and high-impact outcome make this a credible internal threat in multi-tenant or shared Grav deployments.
DLL hijacking in Zucchetti FirmaCheck for Windows before 1.3.16 allows local low-privileged attackers to achieve arbitrary code execution at the privilege level of the FirmaCheck startup process. FirmaCheck.exe loads OpenSSL configuration from the unvalidated path C:\Program Files (x86)\Common Files\SSL\ without verifying the integrity or ownership of the directory; an attacker who can write to this location may plant a crafted openssl.cnf referencing an attacker-controlled DLL, which is then loaded automatically when FirmaCheck runs at system startup. No public exploit code or active exploitation has been identified at time of analysis; exploitation is reported by VulnCheck and is bounded by the local access requirement.
Arbitrary command execution in Ouroboros (ouroboros-ai pip package, versions <= 0.42.0) is reachable when a developer runs `ooo` inside a malicious cloned repository, due to an incomplete denylist that left several execution-routing environment variable keys unblocked. The 0.39.0 fix for CVE-2026-47211 introduced `_UNTRUSTED_ENV_DENYLIST` but omitted keys spanning backend config-home roots, MCP bridge config, plugin trust roots, SSRF transport toggles, and capability override paths - all of which are auto-loaded from a project-directory `.env` at import with no review step. A separate code path additionally auto-loaded `./.ouroboros/mcp_servers.yaml` from the current working directory, enabling RCE with no `.env` file at all. No public exploit code has been identified at time of analysis, though the GHSA advisory provides sufficient technical specificity for independent derivation. Vendor-released patch 0.42.1 resolves both attack surfaces.
Endress+Hauser FDI Package Library versions 1.00.00 through 2.01.00 exposes a CWE-427 (Uncontrolled Search Path Element) flaw in its iDTM FDI component, allowing a locally privileged attacker to activate the debug interface by dropping a crafted file into the application directory. Successful exploitation grants unauthorized access to connected industrial field devices, enabling data exfiltration, configuration manipulation, or operational disruption. No public exploit code has been identified at time of analysis, and exploitation is constrained by the requirement for elevated privileges and local host access - significantly limiting the realistic attack surface.
Path traversal in SiYuan's attribute-view read endpoints allows low-privileged users to read arbitrary JSON files outside the intended storage directory on versions before v3.7.3. The avID parameter is unsanitized across all code branches, enabling RoleReader-level authenticated users - or anonymous clients when publish authentication is disabled - to exfiltrate cross-scope database content stored as JSON on the server filesystem. No public exploit has been identified at time of analysis, and a vendor patch is available in v3.7.3.
Shared embedded certificates across all TP-Link Omada deployments enable impersonation of trusted controllers and managed devices by any attacker who extracts those certificates from a single unit. The CVSS 4.0 vector (AV:A/PR:N/VC:H/SC:H) confirms that an unauthenticated attacker with adjacent network access to the Omada management plane can intercept management communications at high confidentiality impact across both the vulnerable and subsequent systems, with no patch complexity required beyond certificate possession. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog, though the authentication-bypass tagging and the breadth of affected product lines (gateways, switches, access points, controllers, OLTs) give this meaningful real-world weight in environments relying on Omada for network management.
Origin validation bypass in Microsoft Edge (Chromium-based) enables a remote, unauthenticated attacker to circumvent Same-Origin Policy protections, resulting in unauthorized cross-origin access to sensitive data. The flaw (CWE-346) affects all versions of Chromium-based Edge and carries a vendor CVSS of 8.1 with both high confidentiality and high integrity impact - the latter is notable given the description characterizes this as an information disclosure issue, a discrepancy that warrants verification against the MSRC advisory. No public exploit code exists and the vulnerability is not listed in CISA KEV; Microsoft has released an official patch.
XML Signature Wrapping in Net::SAML2 before 0.86 allows any party holding a single valid IdP-signed assertion to authenticate as an arbitrary user against Perl applications that use this SAML SP library. Identity fields - NameID, attributes, SessionIndex, audience - are extracted via document-wide XPath queries selecting the first matching element in document order, not the element covered by the verified signature; an attacker who prepends an unsigned forged assertion to a Response containing their own legitimate signed assertion bypasses identity verification entirely while the signature check still passes. A vendor-released patch exists in version 0.86, and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges without credentials or user interaction on chipsets MT7986, MT7916, MT7915, MT7981, and MT6890. The missing bounds check in the driver's AP-mode frame processing allows memory corruption that yields high confidentiality and integrity impact on the affected device. No public exploit has been identified and EPSS remains very low at 0.17%, though SSVC rates technical impact as total - underscoring the severity if a capable, range-proximate attacker develops working exploit code.
SQL injection in Z-BlogPHP 1.7.5 enables authenticated low-privilege attackers to execute arbitrary SQL commands against the underlying database via the unsanitized `id` parameter in the CommentBat feature. Successful exploitation yields high-severity confidentiality and integrity impact - including extraction of password hashes, user data, and arbitrary record manipulation - with no availability impact indicated. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at the 5th percentile, suggesting limited real-world exploitation activity despite the high CVSS score.
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT7921, MT7922, MT7925, MT7927) due to a missing permission check (CWE-862) that allows a standard user-level process to invoke restricted driver operations. An attacker with low-privilege local access can fully compromise confidentiality, integrity, and availability of the affected system without any user interaction. No public exploit identified at time of analysis; EPSS at 0.15% (5th percentile) and SSVC exploitation status of 'none' confirm negligible current exploitation activity.
Deserialization of untrusted data in TUBITAK BILGEM's eta-otp-lock (all versions before 1.0.4) enables object injection leading to full system compromise on affected hosts. The attack requires local access and user interaction with a malicious serialized payload, resulting in high confidentiality, integrity, and availability impact (CVSS 7.8). TR-CERT has confirmed the issue under advisory TR-26-0730; a vendor patch exists at version 1.0.4, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Dell Monitor Driver exploits a symlink (link-following) flaw to allow a low-privileged local attacker to elevate to higher system privileges, achieving full confidentiality, integrity, and availability impact on the host. The vendor has released a patch via Dell Security Advisory DSA-2026-295, and no public exploit code has been identified at time of analysis. EPSS rates exploitation probability at 0.11% (2nd percentile), and SSVC classifies exploitation as none and automatable as no - consistent with the local-only attack vector and the absence of CISA KEV listing.
Privilege escalation in Dell Display and Peripheral Manager (DDPM Mac) versions prior to 2.3.0.1005 allows a low-privileged local attacker to invoke critical functions that lack authentication controls, gaining elevated system privileges. The root cause is CWE-306 (Missing Authentication for Critical Function), a well-understood vulnerability class in macOS privileged helper architectures. No public exploit or CISA KEV listing exists at time of analysis; Dell has released a patched version per advisory DSA-2026-319.
Elevation of privileges and arbitrary code execution in Dell Display and Peripheral Manager (DDPM) for macOS exposes endpoints running versions prior to 2.3.0.1005 to local privilege escalation attacks. An improper access control flaw (CWE-284) allows a low-privileged local account to bypass access controls enforced by DDPM, ultimately achieving arbitrary code execution with elevated rights. No public exploit has been identified at time of analysis, and no KEV listing exists, but the low attack complexity and complete impact across confidentiality, integrity, and availability make this a meaningful risk in environments where untrusted or shared local users exist on managed macOS endpoints.
Authorization bypass in Apache NiFi 1.10.0 through 2.10.0 allows read-only authenticated users to submit Parameter Context validation requests that the system should restrict to write-privileged users. By supplying proposed parameter values in these requests, a low-privileged user can override active configuration and invoke component validation methods with attacker-controlled settings, potentially exposing sensitive configuration data or disrupting running data flow operations. No public exploit has been identified at time of analysis, but the CVSS 4.0 supplemental metrics flag the flaw as automatable (AU:Y) with concentrated value density (V:C), indicating scripted exploitation against high-value targets is plausible.
Deserialization of untrusted data in Canon PRISMAproduction version 6.5 and earlier enables adjacent-network attackers to achieve arbitrary code execution without credentials. The CVSS 4.0 vector (AV:A/AC:H/PR:N) indicates exploitation requires physical or logical network adjacency and elevated attack complexity, but successful exploitation yields full confidentiality, integrity, and availability compromise of the host. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present; Canon PSIRT has published an advisory (cp2026-007) acknowledging the issue.
Improper certificate hostname validation in TP-Link Omada networking devices (gateways, switches, and access points) allows a network-positioned attacker to intercept or modify encrypted management traffic between those devices and their cloud controllers. The flaw - classified as CWE-295 - means the devices do not adequately confirm that a presented TLS certificate belongs to the expected cloud controller hostname, enabling a machine-in-the-middle to substitute a fraudulent certificate and break the trust boundary. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; vendor has released patched firmware.
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of its declared Android permissions - to invoke protected telephony operations by exploiting a missing authorization check (CWE-862). The flaw affects 35 MediaTek chipsets spanning the Helio and Dimensity families and yields high confidentiality and integrity impact over telephony functions such as call management and SMS routing. No public exploit has been identified and EPSS of 0.15% (5th percentile) indicates negligible current exploitation activity, though the zero-privilege-required nature of local exploitation lowers the attacker bar once device access is established.
Remote code execution in Microsoft Edge (Chromium-based) is possible via a use-after-free memory corruption flaw exploitable over a network by an unauthenticated attacker who can induce user interaction with malicious content. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full impact potential against confidentiality, integrity, and availability, tempered by high attack complexity and mandatory user interaction. No public exploit identified at time of analysis and the temporal metric E:U (Unproven) aligns with this; a vendor-released patch is confirmed available via the Microsoft Security Response Center.
Security feature bypass in Adobe Campaign Classic (ACC) exposes sensitive data to unauthenticated remote attackers via a violation of secure design principles (CWE-657). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that exploitation requires no credentials, no user interaction, and low attack complexity against any network-accessible ACC instance, yielding high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis; Adobe has published advisory APSB26-120 addressing this issue.
Microsoft Edge for Android exposes device file contents to remote attackers through an external file path control flaw (CWE-73), enabling information disclosure across a scope boundary. The CVSS vector (S:C, C:H) confirms the vulnerability crosses from the browser sandbox into the broader Android file system or other protected resources. No public exploit code exists and an official vendor fix is available; exploitation requires user interaction, making this a meaningful but not critical-priority risk for most deployments.
Remote denial of service in the Unisoc UDX710 modem allows a network-adjacent or remote attacker to crash the modem subsystem of affected devices by sending malformed or crafted input that bypasses input validation. The vulnerability requires no authentication and no user interaction, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. Impact is limited to availability - there is no confidentiality or integrity exposure - but a successful attack would disrupt cellular connectivity on the affected device. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote denial of service in the Unisoc UDX710 modem allows unauthenticated remote attackers to crash or disable modem functionality by sending crafted network input that bypasses input validation in the baseband stack. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no elevated privileges - only network-reachable access to the modem. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Remote denial of service in Unisoc T8100/T9100/T8200/T8300 modem firmware allows unauthenticated remote attackers to crash or render the modem inoperable through crafted network input. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms exploitation requires no authentication, no user interaction, and low complexity, making any exposed device potentially reachable. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low barrier to exploitation warrants prompt firmware patching.
Remote denial of service in the modem firmware of Unisoc T8100, T9100, T8200, and T8300 chipsets allows an unauthenticated remote attacker to crash the modem subsystem by sending crafted cellular signaling data, disabling cellular connectivity on affected devices. The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects full availability impact with no victim-side prerequisites, though practical exploitation requires the attacker to control or simulate cellular network infrastructure in radio proximity. No public exploit has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.
Remote denial of service in Unisoc modem firmware affects T8100, T9100, T8200, and T8300 chipsets due to improper input validation in the modem stack. Unauthenticated remote attackers can crash or render the modem unresponsive - severing cellular connectivity on affected devices - without requiring any privileges or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible, zero-complexity attack path represents a meaningful availability risk for devices dependent on continuous cellular communication.
Remote denial of service in the Unisoc modem component of T8100, T9100, T8200, and T8300 chipsets allows unauthenticated network-adjacent or remote attackers to crash the modem by sending malformed input, severing cellular connectivity on affected devices. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms no privileges or user interaction are required, and the attack surface is the baseband network interface. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Remote denial of service in Unisoc modem firmware affects T8100, T9100, T8200, and T8300 chipsets through improper input validation. An unauthenticated remote attacker can send crafted network input to the modem component, causing an availability failure - effectively cutting off cellular connectivity on affected devices. No public exploit has been identified at time of analysis, and no KEV listing exists, but the CVSS:3.1/AV:N/AC:L/PR:N/UI:N profile means no preconditions limit the attacker's reach against any device using these chipsets.
Improper input validation in Unisoc's NR (5G New Radio) modem component affects T8100, T9100, T8200, and T8300 chipsets, enabling remote denial-of-service against devices incorporating these baseband processors. The modem's failure to validate incoming data can be triggered remotely, causing an availability impact classified as High - effectively crashing or disrupting the modem subsystem. No public exploit code has been identified at time of analysis, and the vulnerability was disclosed by Unisoc via their product security bulletin.
Path traversal in Apache Jena Fuseki (all versions through 6.1.0) allows unauthenticated remote attackers to read arbitrary files outside the application's intended directory via crafted HTTP requests. The CVSS 3.1 score of 7.5 with High Confidentiality impact and no authentication required (PR:N, AC:L) underscores a low-barrier information disclosure risk against any network-accessible Fuseki instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial exploitation conditions make this a meaningful priority for organizations exposing Fuseki to untrusted networks.