SSRF classification bypass in the ip-address npm library (versions 10.1.1-10.2.1) allows network-accessible applications to be deceived into treating internal IP addresses as external. When a caller-supplied CIDR suffix such as /0 is retained during parsing, the isInSubnet() guard short-circuits before any bit comparison, causing every special-use classifier - isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), and others - to return false for internal addresses, while correctForm() still resolves to the real internal target. A publicly available proof-of-concept is included in the GHSA advisory; no CISA KEV listing exists at time of analysis, so active exploitation is not confirmed.
Wildcard DNS SAN matching in python-cryptography's X.509 chain verifier prior to 49.0.0 allows a leaf certificate bearing *.example.com to satisfy a constrained intermediate CA's permittedSubtrees restriction of foo.example.com, enabling scope escape to sibling domains such as bar.example.com. Applications relying on the PolicyBuilder/Store verification API are exposed to acceptance of invalid certificate chains that should be rejected per RFC 5280 §4.2.1.10. A public proof-of-concept is confirmed in the GHSA advisory; the vulnerability is not in the CISA KEV catalog, but the CVSS 4.0 E:P modifier reflects the POC's availability.
Channel lifecycle enforcement failure in russh (Rust SSH library, versions <= 0.62.4) allows authenticated clients to invoke server-side handler callbacks - including exec_request, shell_request, subsystem_request, data, channel_eof, and channel_close - for SSH channel IDs that were never opened or confirmed by the transport layer. An authenticated peer can send crafted SSH_MSG_CHANNEL_REQUEST packets without ever issuing SSH_MSG_CHANNEL_OPEN, or after having a channel_open_session request explicitly denied by the application, and still trigger all channel-scoped callbacks. A working Python PoC is publicly available demonstrating 32 exec_request invocations with zero channels ever opened; no active exploitation is confirmed (not in CISA KEV) and a vendor patch exists in v0.62.5.
Cookie domain scope bypass in Guzzle PHP HTTP client (prior to 7.15.2 and 8.0.1) allows improper cookie sharing via non-canonical IP address representations in cookie Domain attributes. The flaw in SetCookie::matchesDomain() fails to recognize hexadecimal (e.g., 0x7f000001), mixed-base octal (e.g., 0177.0.0.0x1), and percent-escaped (e.g., 192.168.0.%31) host spellings as IP literals, so cookies set for such domains incorrectly gain subdomain scope while libcurl resolves the same strings as actual IP addresses. This divergence enables an adversary-controlled host (e.g., evil.0x7f000001) to receive session cookies intended for the target IP, facilitating credential disclosure and session fixation; no public exploit identified at time of analysis.
Unauthorized lesson content disclosure in Academy LMS WordPress plugin before 3.8.3 allows any subscriber-level authenticated user to read arbitrary lesson content via the REST API - including lessons from paid courses they have not purchased and lessons in unpublished states (draft, pending, private). The root cause is a complete absence of enrollment and publication-status validation in the single-lesson REST API endpoint. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.13% (3rd percentile) and SSVC classification as non-automatable indicate limited observed exploitation activity at the time of analysis.
Post-deletion authorization bypass in the Contest Gallery WordPress plugin before 30.0.7 allows any authenticated Author-level or higher user to permanently delete arbitrary posts, pages, and other WordPress content they do not own. The plugin's post-deletion AJAX handler enforces only a coarse role-membership test, entirely omitting per-object capability verification and nonce validation - the two controls that WordPress's built-in permission model relies on to prevent cross-user destructive actions. A public exploit is available via WPScan, lowering the skill barrier; though EPSS is low at 0.13%, any multi-author site with untrusted Author accounts faces real and irreversible content destruction risk.
Broken access control in Simply Schedule Appointments WordPress plugin before 1.6.12.11 exposes all customer appointment records to any authenticated Contributor-level user site-wide. The administrative appointment-listing shortcode omits a capability check, and the per-user result scoping logic defaults to showing all records when the requesting user is not recognized as staff. Any WordPress user holding the Contributor role or higher - a commonly granted role in multi-author sites - can enumerate names, email addresses, phone numbers, and appointment notes belonging to every customer in the system. A publicly available proof-of-concept exists, though EPSS at 0.13% and SSVC Automatable:No suggest exploitation remains targeted rather than widespread.
Uncontrolled search path exploitation in CheckMAL AppCheck Pro 3.1.43.10's kernel mini-filter driver (AppCheckD.sys) allows a local attacker with low privileges to redirect the driver's library loading path, potentially achieving kernel-level code execution on the target host. A public proof-of-concept exploit has been released despite the vendor declining to respond to coordinated disclosure, making this a no-patch, public-exploit scenario. While high attack complexity (AC:H) reduces opportunistic risk, the complete confidentiality, integrity, and availability impact at the kernel layer makes successful exploitation highly damaging.
Path traversal in PostCSS npm package (versions through 8.5.22) allows disclosure of arbitrary `.map` files from the server filesystem when applications process attacker-controlled CSS without the `from` option. The vulnerability is an incomplete fix bypass of prior advisory GHSA-6g55-p6wh-862q: the traversal guard added to `PreviousMap.loadFile()` was gated on `cssFile` being truthy, which is never the case when `opts.from` is absent. No CISA KEV listing, but a verified proof-of-concept is included in the upstream GHSA advisory GHSA-fxqj-rqcc-2cmp. The CVSS 4.0 score of 6.3 with AT:P correctly reflects the specific deployment condition required.
HTTP request smuggling in aiohttp's server-side parser allows unauthenticated remote attackers to inject and misdirect HTTP traffic by exploiting a protocol-switch race in the WebSocket upgrade path. Versions 3.14.1 and earlier prematurely mark the connection as upgraded before the full request body is consumed, causing trailing bytes - potentially an attacker-controlled HTTP request - to be interpreted as WebSocket or pipelined data by the server or any upstream proxy. No public exploit code exists and the vulnerability is not listed in CISA KEV, but CVSS 4.0 AC:H reflects the edge-case nature of the trigger condition.
Stored cross-site scripting in the Simple Membership WordPress plugin before 4.7.8 allows unauthenticated attackers to inject arbitrary JavaScript into the WordPress administration dashboard by supplying a malicious subscriber name in a payment approval request. Because the plugin neither sanitizes the input at ingestion nor escapes it on output when rendered for administrators, the payload persists server-side and executes in any administrator's browser session upon viewing the affected dashboard panel. A public proof-of-concept exploit exists (reported by WPScan); however, EPSS stands at 0.17% (7th percentile) and CISA KEV listing is absent, indicating limited observed mass exploitation at time of analysis.
Stored cross-site scripting in the Blog Floating Button WordPress plugin (≤1.4.20) allows unauthenticated attackers to inject malicious JavaScript via the HTTP User-Agent header into the plugin's visitor tracking REST endpoint. The payload persists in the database and executes in the browser session of any administrator who opens the plugin's access report page, enabling full site takeover through the hijacked admin session. A publicly available proof-of-concept from WPScan confirms the attack path; no vendor-released patch has been identified at time of analysis.
Stored XSS in the SVG Support WordPress plugin (before 2.5.17) is achieved by uploading a script-bearing .svgz file, bypassing the plugin's sanitization logic that applies only to .svg uploads despite both extensions being registered and served as SVG content. Any WordPress user role granted SVG upload access - such as an Author - can plant the payload, which then executes in the browser of any subsequent visitor, including administrators, enabling session hijacking or privileged action injection. A public proof-of-concept exists via WPScan; EPSS is low (0.16%, 6th percentile) and SSVC rates exploitation as non-automatable, but the stored nature of the payload and admin-reachability elevate practical impact.
Path traversal in danpros HTMLy up to version 3.1.1 allows remote unauthenticated attackers to read arbitrary files from the server filesystem by manipulating the Author Name argument in /system/htmly.php. A publicly available proof-of-concept exploit (E:P per CVSS 4.0 supplemental metric) exists at a referenced GitHub issue, materially lowering the exploitation bar. The vendor was unresponsive to responsible disclosure, leaving no vendor-confirmed patch and no official mitigation guidance.
Out-of-bounds read in mz-automation libiec61850 up to version 1.6.1 allows remote unauthenticated attackers to crash the IEC 61850 MMS server process and potentially leak heap or stack memory contents by sending a crafted MMS DataSet access request. The root cause is unconstrained string copy operations in the checkDataSetAccess function, now confirmed fixed in v1.6.2 via bounded copy with a 129-byte limit. A public exploit has been disclosed; however, this vulnerability is not listed in CISA KEV and the CVSS 4.0 score of 6.9 (Medium) reflects limited impact scope confined to availability of the vulnerable system.
Remote unauthenticated crash in mz-automation libiec61850 1.6.0-1.6.1 allows a network attacker to terminate an IEC 61850 MMS server by supplying an oversized Report ID string to the Report Control Block write handler, triggering a free of non-heap memory (CWE-590). No authentication or user interaction is required per the CVSS 4.0 vector (PR:N/UI:N/AV:N), and a public proof-of-concept exploit exists at the referenced GitHub issue. Active exploitation has not been confirmed by CISA KEV, but the combination of a public PoC and trivial exploitation path elevates practical risk in operational technology environments where IEC 61850 server continuity is safety-critical.
Unauthenticated remote access to the /EIP_Com_FileList.aspx endpoint in NewType WebEIP up to version 3.0 exposes file listing functionality to any network-reachable attacker due to improper authentication enforcement (CWE-287). A public proof-of-concept exploit hosted on Google Drive is confirmed available, lowering the exploitation bar significantly. No vendor patch exists as the vendor did not respond to disclosure; organizations must rely entirely on compensating controls.
Server-side request forgery in jina-ai Reader's Puppeteer-based crawler allows unauthenticated remote attackers to manipulate the `isValidTLD` function to coerce the server into issuing arbitrary HTTP requests to internal or restricted network targets. All deployments up to commit 1574bfd380d249c86c82db4dace0d9c8fe17e2b1 are affected with no vendor-issued patch, as the maintainers did not respond to disclosure. A public proof-of-concept exploit exists (no CISA KEV listing), and the rolling release model means there is no safe pinned version for operators to target.
Path traversal in the 'Import and export users and customers' WordPress plugin (versions before 2.4.3) enables high-privileged WordPress users to read arbitrary files on the underlying server by supplying a crafted file path during the CSV import workflow. Confidentiality impact is rated High by NVD (CVSS:3.1 C:H), exposing sensitive server files such as wp-config.php, /etc/passwd, or application secrets. A publicly available proof-of-concept exists via WPScan, though EPSS sits at a low 0.16% (6th percentile), indicating that mass exploitation has not materialized despite POC disclosure - likely because high-privilege access is a prerequisite.
Stored XSS in Microweber CMS through version 2.0.20 allows admin-authenticated attackers to persist arbitrary JavaScript via the tag_names parameter of the GET /api/save_content_admin endpoint, defeating three independent sanitization layers through a combination of HTTP-method blind middleware, an overly narrow unsafe-attribute pattern, and a titlecase normalizer that passes HTML decimal entity-encoded payloads unchanged. Injected scripts execute silently for every public blog visitor and within the admin post editor, enabling same-origin CSRF token abuse for session riding and account takeover chaining. A public proof-of-concept exploit exists; no CISA KEV listing is present at time of analysis.
Stored cross-site scripting in OpenEMR's patient portal template system (through version 8.2.0) allows authenticated administrators to inject persistent JavaScript payloads that execute in the browsers of any admin, clinician, or portal patient who views a poisoned template. The combination of absent output encoding at the template retrieval endpoint and missing HttpOnly attributes on session cookies enables direct document.cookie exfiltration, resulting in full session hijacking of privileged healthcare accounts. No public exploit identified in CISA KEV, but a publicly available proof-of-concept and detailed researcher writeup (VulnCheck / jivasecurity.com) significantly lower the bar for exploitation in targeted scenarios.
Broken object-level authorization in the Dokan WordPress plugin (versions before 5.0.9) allows any authenticated vendor on a multivendor marketplace to overwrite product attributes and default attributes belonging to other vendors via the plugin's REST API write endpoints. Exploitation requires only a low-privilege vendor account - no admin access needed - making this accessible to any registered seller on the platform. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating limited observed exploitation activity so far; the vulnerability is not listed in CISA KEV.
Order ownership bypass in Dokan Multivendor for WordPress (versions before 5.0.9) allows any authenticated vendor to modify the status of arbitrary WooCommerce orders across the entire marketplace, including orders owned by other vendors and customers. The flaw stems from a REST endpoint handling bulk order-status changes that accepts attacker-supplied order IDs without verifying the requesting vendor's ownership of those orders. No active exploitation is confirmed (not in CISA KEV), but a publicly available proof-of-concept exists and EPSS at 0.13% (3rd percentile) reflects low observed exploitation to date.
ProfileGrid WordPress plugin before version 6.0.0.0 exposes pending group membership request data to any authenticated user due to missing authorization checks on the listing endpoint. Any subscriber-level account can enumerate the names and request timestamps of users awaiting approval for any group, including groups configured as private. No active exploitation is confirmed (not in CISA KEV), though a public exploit exists via WPScan; EPSS of 0.13% (3rd percentile) places real-world exploitation probability as very low.
GEO my WP WordPress plugin versions before 4.5.5.3 allows any subscriber-level (or higher) authenticated user to modify or permanently delete geolocation records belonging to other users or posts by supplying arbitrary record IDs to two unprotected AJAX actions. The root cause is a complete absence of ownership and capability checks on these endpoints, a textbook CWE-639 IDOR. A publicly available exploit exists per WPScan; however, no public exploit identified at time of analysis corresponds to confirmed active exploitation (not in CISA KEV), and the EPSS score of 0.13% at the 3rd percentile reflects low observed exploitation activity despite POC availability. A vendor-released patch is available in version 4.5.5.3.
PHP Object Injection in Clearfy Cache WordPress plugin (versions before 2.4.3) exposes administrator-authenticated users to potential remote code execution through unrestricted deserialization during settings import. The plugin's import handler passes attacker-controlled serialized data to PHP's unserialize() without class whitelisting, enabling object injection. A publicly available POC exists via WPScan, though RCE is conditional on a suitable gadget chain being present in the WordPress environment; EPSS is low (0.21%, 12th percentile) and no CISA KEV listing has been issued, indicating no confirmed widespread exploitation.
OS command injection in the Wavlink WL-NU516U1 firmware (build 708c073-mt7628) allows remote attackers to execute arbitrary operating system commands by supplying a crafted Password argument to the Config Import component. The CVSS 4.0 score of 7.7 reflects meaningful constraints - high attack complexity (AC:H) and required user interaction (UI:P) - yet the full confidentiality, integrity, and availability impact on the vulnerable system remains high. A proof-of-concept exploit has been publicly published on GitHub, and the vendor has already released a patched firmware binary, making this a time-sensitive patching priority for any deployment of the affected firmware build.
PaperCut NG/MF's login component fails to enforce account lockout or rate-limiting controls in certain configurations, allowing unauthenticated remote attackers to conduct unrestricted brute-force or credential-stuffing attacks against user accounts. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, though the 'in some configurations' qualifier in the CVE description indicates exploitation is conditional on the absence of hardening controls. PaperCut published a security bulletin on August 3, 2026; no public exploit code or CISA KEV listing has been identified at time of analysis.
Username enumeration is possible in PaperCut NG/MF via an observable timing side-channel in the authentication component, exploitable by unauthenticated remote attackers. The system conditionally executes password hash comparison only when a submitted username corresponds to a valid account, producing a measurable latency difference that reveals account existence. No public exploit code or CISA KEV listing has been identified at time of analysis; however, with a CVSS 4.0 score of 6.9 and an AV:N/PR:N vector, the attack surface is entirely remote and requires no credentials, making it accessible to any attacker with network reach to the login endpoint.
Unauthenticated network access to address book editing and Document Filing features is possible on Sharp and Toshiba Tec multifunction printers (MFPs) sold outside Japan, because these devices ship from the factory with user authentication disabled. The root cause is CWE-1188 (Insecure Default Initialization of Resource) - the authentication control exists but is not activated in the initial configuration, meaning any network-reachable attacker can access sensitive stored data and modify contact directories without credentials. No public exploit code and no CISA KEV listing exist at time of analysis, but the CVSS vector confirms network-level unauthenticated access with no interaction required.
Sharp Corporation's Network Scanner Tool and Network Scanner Tool Lite expose unauthenticated, unlimited file upload endpoints by default, enabling two distinct attack outcomes against any PC running the software in its initial configuration. An unauthenticated network attacker can flood the host with uploaded files to exhaust disk or system resources, causing a denial-of-service condition; separately, a threat actor can stage malicious executables that a local PC user may be socially engineered into running, enabling downstream attacks against other systems. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, though the default-insecure nature and zero authentication requirement lower the barrier to exploitation significantly.
LDAP filter injection in Bouncy Castle bc-java before 1.85 allows network-reachable attackers to manipulate LDAP directory search queries by supplying certificates with crafted Subject or Issuer CN values containing LDAP metacharacters. This is a bypass of the CVE-2023-33201 fix: the escaping was applied to the main-Java LDAPStoreHelper and both X509LDAPCertStoreSpi variants, but the jdk1.4 Ant build overlay carries its own private parseDN method that was never patched, leaving bcprov-jdk14 consumers exposed. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Stored XSS via Vue template injection in FlowIntel allows an authenticated low-privilege user to persist malicious Vue interpolation expressions across multiple data fields, causing arbitrary JavaScript execution in the browsers of any user who views the poisoned content. The root cause is that Jinja2's standard HTML escaping neutralizes raw HTML tags but does not prevent FlowIntel's custom [[ ... ]] Vue delimiters from being evaluated when the server-rendered output is later compiled by Vue on the client side. Successful exploitation can expose session tokens, sensitive case data, and any information visible to the victim, or perform privileged actions within the victim's authenticated session. No public exploit code or CISA KEV listing has been identified at time of analysis.
Man-in-the-middle interception of SSH sessions and file transfers is possible through the EMR SSH helper commands in Amazon AWS CLI v1 before 1.45.28 and v2 before 2.35.3 due to missing entity authentication during the SSH key exchange. Network-positioned attackers - requiring no privileges or user interaction - can substitute their own key material during the handshake and silently relay or inspect the session. No active exploitation is confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the impact on downstream EMR cluster confidentiality is rated high (SC:H in the CVSS 4.0 vector).
CPU-exhaustion denial of service in Bouncy Castle for Java affects any server that verifies CMP (Certificate Management Protocol) password-MAC protected messages using PKMACBuilder without an explicit iteration ceiling. The library's PKMACBuilder accepted the iteration count directly from the unauthenticated PBMParameter field in an incoming CMP message with no upper bound, allowing a remote unauthenticated attacker to supply a count near 2^31 and force billions of hash iterations on the target. No active exploitation is confirmed (not in CISA KEV), but the attack is unauthenticated, requires no special configuration beyond standard CMP usage, and a patch is available upstream.
Heap and CPU exhaustion in Bouncy Castle for Java's OpenPGP implementation allows remote unauthenticated attackers to cause denial of service by crafting OpenPGP messages with extreme Argon2 S2K cost parameters. The library honoured attacker-controlled memory, passes (iterations), and parallelism fields embedded in unauthenticated OpenPGP packets before any message authentication could occur, meaning a single crafted packet could instruct the JVM to allocate up to 2^30 KiB (approximately 1 TiB) of heap. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the vulnerability is straightforward to exploit given that the cost parameters are trivially crafted and processed unconditionally.
Unauthenticated network access to stored image data affects Sharp and Toshiba Tec multifunction printers via a forced browsing vulnerability (CWE-425). Remote attackers without any credentials can directly request URLs referencing scanned or copied image data held on the device, bypassing the authorization layer entirely. Reported by JPCERT, this is an information disclosure issue with no public exploit identified at time of analysis and no confirmed active exploitation.
Reflected XSS in Admidio's SSO/SAML endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in victims' browsers by injecting payloads into SAML Issuer elements or LightSaml library parameters, which the server echoes back unencoded in exception messages. All Admidio installations before version 5.0.11 with SSO/SAML functionality enabled are affected. Successful exploitation can lead to session hijacking and account takeover. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Hard-coded cryptographic keys in the TP-Link Omada adoption protocol allow adjacent-network attackers to impersonate trusted controllers or managed devices, exposing sensitive authentication material exchanged during device adoption. The flaw affects the entire Omada product line - gateways, switches, access points, and controllers - because all share the same embedded keys, meaning any attacker who extracts the keys from firmware can spoof identity during any adoption event on the same network segment. No public exploit or CISA KEV listing exists at time of analysis, but a vendor patch is available and should be applied promptly given the high confidentiality impact on subsequent systems.
Cross-organization role manipulation in Admidio before 5.0.11 allows authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations hosted on the same instance. The flaw exists because `groups_roles.php` handlers accept role UUIDs without verifying that the target role belongs to the requesting user's organization, enabling cross-tenant privilege structure sabotage. No public exploit has been identified at time of analysis; vendor-released patch version 5.0.11 is available.
Metadata disclosure in SiYuan before v3.7.3 exposes document titles, notebook paths, root IDs, and icons for administrator-restricted documents via the unauthenticated `/api/block/getBlockInfo` endpoint. The publish-access control flag is never checked server-side before returning document root metadata, making this a complete bypass of SiYuan's per-document publish exclusion feature. No public exploit is identified at time of analysis and no KEV listing exists, but the CVSS 4.0 vector (PR:N, AC:L) confirms exploitation requires no credentials and no special conditions against the network-facing API.
Credential interception in TP-Link Omada's device adoption process exposes site management authentication to offline cracking due to use of a weak, unsalted hash algorithm (CWE-759). An adjacent-network attacker who captures adoption-phase traffic can recover plaintext credentials and authenticate to the Omada controller or managed devices including gateways, switches, access points, and OLTs. No public exploit identified at time of analysis, but a vendor patch is available; the CVSS 4.0 score of 6.9 reflects meaningful real-world constraints including network adjacency, high attack complexity, and a required adoption event.
Insufficient entropy in session key generation within the TP-Link Omada adoption protocol exposes encrypted controller-to-device communications to decryption by adjacent network attackers. The adoption protocol - the handshake sequence by which Omada Controllers onboard and establish management sessions with gateways, switches, and access points - generates session encryption keys with insufficient randomness, making them potentially recoverable through cryptanalytic means after traffic interception. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 6.9 and the high confidentiality impact on both the vulnerable and subsequent systems indicate meaningful confidentiality risk for organizations relying on Omada-managed network infrastructure.
Cross-site scripting in HP DesignJet large-format printers allows adjacent-network unauthenticated attackers to inject malicious scripts via crafted HTTP requests that execute when a user views print job previews through the device's embedded web interface. The CVSS 4.0 vector (AV:A/VI:H) constrains the attack to local network adjacency while indicating high integrity impact - consistent with an attacker manipulating displayed print job content or forging actions within the printer's management UI. No public exploit has been identified at time of analysis, and HP has self-disclosed the issue.
Origin validation error in Microsoft Edge (Chromium-based) enables a local, unauthenticated attacker to bypass cross-origin restrictions and perform data tampering. The CVSS vector (AV:L/PR:N) indicates that any unprivileged local user - including guest or kiosk session users - can trigger this flaw without requiring prior authentication or user interaction. With a high confidentiality impact (C:H) and low integrity impact (I:L), exploitation could expose sensitive browser-held data while also permitting limited content manipulation. No public exploit code has been identified and CISA KEV does not list this CVE; the temporal metric E:U corroborates no known active exploitation at time of analysis.
Incorrect error handling in the MediaTek imgsensor (camera/image sensor) kernel driver across multiple MediaTek chipsets allows a local attacker who already holds System-level privilege to crash an application and potentially escalate to a higher privilege tier. Affected chipsets span eleven models including MT8395, MT8799, MT6895, MT6991, and MT8910, covering a broad range of mid-to-high-end Android-targeted SoCs. No public exploit is identified at time of analysis and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation interest, though the post-exploitation utility of this flaw makes it relevant in chained attack scenarios.
Out-of-bounds write in the MediaTek HEVC video decoder enables further privilege escalation on devices running MT6761, MT8766, and MT8768 chipsets. The flaw, rooted in an integer overflow during HEVC bitstream processing, can be triggered without user interaction but only by an actor who already holds System-level privilege on the device. No public exploit code has been identified at time of analysis, and EPSS sits at 0.18% (8th percentile), consistent with SSVC's 'Exploitation: none' assessment - though SSVC rates Technical Impact as total, reflecting the severity of what a successful second-stage exploit could achieve.
Denial of service in MediaTek WLAN STA (station mode) firmware causes affected devices to become fully unresponsive via uncontrolled logging resource exhaustion (CWE-770). An unauthenticated attacker within wireless proximity can trigger this condition with no user interaction required, targeting chipsets including MT7921, MT7922, MT7902, MT8532, and MT8518S - devices spanning consumer laptops, embedded systems, and IoT hardware. No public exploit or active exploitation has been identified; EPSS of 0.15% (5th percentile) indicates low probabilistic exploitation risk at this time.
HCL iControl v3.2.0 exposes sensitive data in transit by advertising support for deprecated TLS 1.0 and TLS 1.1 protocol versions, which lack modern cryptographic protections. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates a network-reachable flaw requiring high attack complexity - consistent with a man-in-the-middle positioning requirement for exploitation. No public exploit code and no CISA KEV listing exist at time of analysis, placing this in the medium-priority tier despite its network exposure, though organizations with regulatory requirements around cryptographic standards (PCI-DSS, NIST SP 800-52) should treat remediation as mandatory.
Unauthorized data disclosure via the Server Announcements API in Misskey affects all instances running versions 2024.5.0 through 2026.5.3, allowing remote callers to read restricted announcement data without appropriate authorization. The flaw stems from CWE-285 (Improper Authorization) - the API endpoint fails to enforce privilege checks before returning data, making restricted content accessible to actors who should not see it. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, no-authentication-required vector makes this straightforwardly reachable on any exposed instance.