Privilege escalation in Liman MYS (HAVELSAN Inc.) versions 2.2.3 through pre-2.3.1 enables authenticated low-privilege users to gain administrator-level access via missing server-side authorization checks (CWE-862). The platform, a centralized Linux server management system used primarily in Turkish government and enterprise environments, fails to verify whether the requesting user has rights to perform privileged operations before executing them. No public exploit identified at time of analysis, but the CVSS 8.8 score with network vector and low privilege requirement makes this a high-priority patch target for any organization running the affected versions.
Blind password hash disclosure in Ghost Admin API versions prior to 6.54.1 allows any authenticated staff-level user to retrieve hashed passwords of other staff accounts by crafting filtered API queries against the posts or pages browse endpoints. The root cause is insufficient field-level access control in MongoDB filter queries, exposing internal authentication fields (CWE-200). No active exploitation is confirmed (not in CISA KEV), and downstream account takeover is partially mitigated by Ghost's Device Verification and email MFA features, though the hash disclosure itself is confirmed and unambiguously fixed in 6.54.1.
Ghost CMS subscription checkout accepts redemption of archived offers due to missing offer-status validation in the member router controller, affecting all self-hosted Ghost instances from v4.22.0 through v6.54.0. Unauthenticated users who possess or can discover an archived offer ID can submit a valid checkout request and obtain unauthorized subscription discounts or access at a revoked price point. No public exploit code has been identified and this CVE is absent from CISA KEV, but the direct financial impact on subscription-based Ghost sites makes it a meaningful business-logic risk for affected operators.
Stored cross-site scripting in the Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 allows contributor-level (and higher) WordPress users to inject arbitrary JavaScript into quiz question settings via an unquoted HTML attribute. The injected payload persists and executes in the browser of any site visitor who views the affected quiz, enabling session hijacking, credential theft, or defacement targeting the broader user base. No active exploitation is confirmed by CISA KEV, but a public proof-of-concept is available via WPScan, and vendor-released patch version 11.2.2 is available.
Race condition in the Linux kernel's KVM nVMX (nested VMX) subsystem allows a low-privileged local attacker to trigger a use-after-free via shadow VMCS teardown, with potential for full hypervisor compromise. The flaw arises because free_nested() releases the shadow VMCS page while vmcs01 still holds a dangling pointer; if the vCPU migrates to another physical CPU before the pointer is cleared, __loaded_vmcs_clear() executes VMCLEAR against the freed page, corrupting kernel memory. No public exploit code exists and no active exploitation is confirmed (EPSS 0.16%, 5th percentile), but the S:C scope change in the CVSS vector and the C:H/I:H/A:H impact triad indicate this could enable a guest-to-host escape under the right conditions.
Shadow MMU ordering flaw in the Linux kernel KVM x86 subsystem allows a low-privileged guest process to corrupt the hypervisor's page table state by triggering invalid root population during shadow page reclamation. Kernels from 5.9 through multiple unpatched stable branches permit child shadow pages to be created under an invalidated parent root, violating a core MMU invariant and potentially enabling guest-to-host privilege escalation. No public exploit has been identified and EPSS is low (0.16%), but the confirmed scope change to the host hypervisor makes this a high-priority patch for any KVM-based multi-tenant or cloud virtualization environment.
Stored cross-site scripting in the Nested Pages WordPress plugin (all versions before 3.2.15) allows authenticated users holding the Editor role - or Contributor/Author roles when the plugin is configured to manage those post types - to inject arbitrary JavaScript via unsanitized post titles that are reflected unescaped into HTML attributes on the plugin's administrative listing screen. Any higher-privileged user (including Administrators) who subsequently loads that screen will execute the attacker-controlled script within their own authenticated session, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available proof-of-concept exploit exists per the WPScan advisory; the vulnerability is not listed in CISA KEV and the EPSS score is negligible (0.15%, 5th percentile), suggesting opportunistic rather than widespread active exploitation.
Server-side file-write and server-side request forgery (SSRF) in Django's GeoDjango spatial lookups expose authenticated staff users as an attack surface capable of writing arbitrary files to disk or issuing outbound network requests as the Django process user. Affected are Django 5.2 (before 5.2.17) and 6.0 (before 6.0.8), where the Django admin changelist's standard filter mechanism made the flaw reachable by any staff account holding view permissions on a model with a spatial field. Depending on the GDAL raster driver available on the server, file writes can escalate to remote code execution. No public exploit is identified at time of analysis; patched releases Django 5.2.17 and 6.0.8 were issued August 4, 2026.
Denial of service in OpenSIPS SIP server versions prior to 3.6.6 allows an unauthenticated remote attacker to crash worker processes by sending a SIP request containing a malformed SDP bandwidth line that omits the required colon delimiter. The crafted payload triggers a null pointer dereference (CWE-476) in the SDP parsing layer; when dialog or QoS modules subsequently clone the corrupted SDP state, the worker process terminates abnormally. No active exploitation is confirmed at time of analysis, though publicly readable patch commits expose the exact byte-level trigger, significantly lowering the barrier to exploit construction.
Denial of service in OpenSIPS versions 3.4.0 through 3.6.5 and 4.0.0-beta allows remote attackers to crash the server with a single crafted SIP PUBLISH request targeting the presence module. The crash stems from a NULL pointer dereference in handle_publish() triggered when enable_sphere_check=1 is configured: get_content_type() is invoked without first calling parse_content_type_hdr(), leaving Content-Type parsing state uninitialized and producing a segmentation fault via either a NULL parsed sub-pointer or a NULL content_type pointer. No public exploit has been identified at time of analysis, but the attack mechanics are fully described in the vendor advisory (GHSA-h3ww-hchh-x2g9), and the fix is available in 3.6.6 and 4.0.0-rc1.
Memory exhaustion in jackson-core's non-blocking async parser allows remote unauthenticated attackers to exhaust JVM heap by streaming JSON integer digit sequences in small chunks without ever sending a terminator byte. The prior fix for GHSA-72hv-8253-57qq (CVE-2026-18401) failed to insert a `validateIntegerLength()` call on the `NOT_AVAILABLE` return path inside `MINOR_NUMBER_INTEGER_DIGITS`, allowing the internal `TextBuffer` accumulator to grow bounded only by `maxStringLength` (20 MiB default) rather than `maxNumberLength` (1000 chars default) - a ~20,000x amplification yielding approximately 40 MiB of heap pressure per connection due to Java's 2-byte char representation. Reactive frameworks that feed inbound HTTP or gRPC bytes incrementally to the async parser - Spring WebFlux/Reactor, Quarkus, Helidon, and Vert.x - are the primary risk surface; no public exploit identified at time of analysis.
Unauthenticated remote denial-of-service in Eclipse Milo 0.6.0-1.1.4 allows any network-accessible client to exhaust the OPC UA server's off-heap direct memory pool by repeatedly sending incomplete UASC message chunks and disconnecting before message assembly completes. The UASC server-side asymmetric handler and ChunkDecoder fail to invoke ReferenceCountUtil.safeRelease() on retained Netty ByteBuf objects when the channel lifecycle ends, causing unbounded off-heap memory accumulation. No authentication is required and no special server configuration is necessary; the fix commit is publicly available on GitHub, serving as an effective blueprint for exploitation, though no standalone POC tool or CISA KEV listing has been identified at time of analysis.
OS command injection in Lenovo XClarity Orchestrator (LXCO) 2.2.0 enables an authenticated low-privileged attacker to execute arbitrary operating system commands with elevated privileges under a specific, undisclosed circumstance. LXCO is an enterprise data center orchestration platform that manages Lenovo server and chassis infrastructure, making successful exploitation highly impactful to infrastructure availability, integrity, and confidentiality. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the Lenovo advisory.
Authorization bypass in Eclipse Milo's OPC UA Call service (versions 1.0.0-1.1.4) permits unauthenticated or low-privileged OPC UA clients to invoke server-side methods they are explicitly denied access to. The server correctly computes per-method authorization for a mixed batch CallRequest but then dispatches the original unfiltered batch - including denied methods - to address-space handlers, rendering the authorization check effectively inert. No active exploitation is confirmed and no public exploit code has been identified, but the attack requires only standard OPC UA client tooling and zero authentication, making exploitation trivially accessible to any network-reachable client.
Memory exhaustion in Veeam Service Provider Console (VSPC) allows unauthenticated remote attackers to deplete host memory and cause a denial of service, with no authentication or user interaction required. The CVSS 4.0 score of 8.7 reflects the network-accessible, zero-prerequisite nature of exploitation (AV:N/AC:L/AT:N/PR:N/UI:N) with high availability impact confined to the vulnerable system. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low exploitation barrier makes any internet-exposed VSPC instance a realistic target.
Unauthenticated arbitrary file read in Veeam ONE exposes sensitive server-side files to remote attackers without requiring any credentials, user interaction, or special configuration. The flaw, rooted in CWE-287 (Improper Authentication), enables a network-accessible authentication bypass that returns host filesystem content directly to the attacker. Exfiltrated files - likely including configuration data, database connection strings, or stored credentials - can then be used to escalate privileges locally, extending the impact beyond the initial confidentiality breach. No public exploit or active exploitation confirmed at time of analysis.
Code injection in the LINE Android app (prior to version 26.7.2) allows an attacker who controls a LINE profile to embed malicious script content in profile templates, which executes with the app's full privileges when a victim views that profile. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact against the vulnerable system, with network-accessible, zero-privilege exploitation requiring only passive victim interaction. Critically, LY Corporation has deployed a server-side mitigation that protects even unpatched Android clients; no public exploit has been identified at time of analysis and no CISA KEV listing exists.
Open redirect in Clearfy Cache WordPress plugin (versions before 2.4.3) allows unauthenticated attackers to redirect site visitors to arbitrary external URLs by exploiting the Cyrlitera old-URL redirect handler, which passes a decoded request URI to an unsafe redirect function without target validation. Exploitation requires that the non-default Cyrlitera redirect option is enabled on the target site, and a victim must interact with an attacker-crafted URL. No public KEV listing exists, EPSS sits at the 4th percentile (0.14%), but a publicly available proof-of-concept has been published by WPScan.
Remote code execution in Veeam ONE, the enterprise backup monitoring and analytics platform, is achievable by high-privileged authenticated users via a network-accessible code injection flaw (CWE-94). The vulnerability carries a CVSS 4.0 score of 8.6 with full confidentiality, integrity, and availability impact on the vulnerable system, reported through HackerOne and detailed in Veeam KB4892. No public exploit code or CISA KEV listing has been identified at time of analysis, moderating near-term mass-exploitation risk despite the critical impact class.
Unrestricted file upload in freo2 (by refirio) versions prior to 2.0.0-alpha-14 enables highest-privilege administrative users to upload executable files and trigger arbitrary OS command execution on the underlying server. Reported by JPCERT and covered under JVN#52865575, this is a post-authentication code execution path requiring no user interaction once admin access is established. No public exploit code or CISA KEV listing has been identified at time of analysis.
Insufficient input validation in Amazon Bedrock AgentCore harness allows authenticated remote users to bypass model invocation and associated security controls by submitting crafted content blocks within conversation messages, directly triggering configured tool execution outside the intended agentic pipeline. The vulnerability carries a CVSS 4.0 score of 8.6 with high confidentiality and integrity impact against the vulnerable system (VC:H/VI:H), reflecting the potential for an attacker to invoke tools with whatever permissions those tools hold - such as S3 read access, database queries, or external API calls - without passing through model-layer guardrails. AWS has fully remediated this issue server-side; no public exploit has been identified at time of analysis, and no customer action is required.
SQL injection in Veeam ONE ≤ 13.0.2 allows any authenticated low-privileged user to extract database contents over the network. The CVSS 4.0 vector records high subsequent-system confidentiality, integrity, and availability impact (SC:H/SI:H/SA:H), indicating the backend database contains infrastructure-sensitive data - backup job configurations, managed-system credentials, or topology records - whose compromise extends well beyond the Veeam ONE console itself. No public exploit code or CISA KEV listing is present at time of analysis; EPSS is 0.27% (18th percentile), consistent with SSVC exploitation status of 'none'.
Stored XSS in CVAT annotation guide asset handling (versions 2.5.0-2.66.0) allows an authenticated attacker to upload a file with an attacker-controlled Content-Type header; CVAT then serves the asset with that header intact, causing a victim's browser to render the file as an HTML page and execute any embedded JavaScript. The attack targets collaborative annotation workflows where guides are shared across users or teams, enabling session hijacking, credential theft, or unauthorized actions within the victim's browser context. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV. The vendor-released fix is version 2.67.0.
Uncontrolled search path execution in Amazon Kiro CLI on Windows allows arbitrary code execution when a local user opens the CLI within a maliciously crafted project directory. Affected versions are all Kiro CLI releases before 2.10.0 on Windows; the flaw bypasses workspace trust protections by placing a malicious executable in a directory that Kiro CLI resolves via an uncontrolled search path. No public exploit code has been identified at time of analysis, though exploitation requires only user interaction - not attacker presence on the system - making social engineering a viable delivery mechanism.
Remote code execution via uncontrolled search path (CWE-427) in Amazon Kiro IDE before 1.0.228 on Windows allows an unauthenticated remote actor to execute arbitrary code on a victim's machine by supplying a maliciously crafted project directory containing a strategically placed executable. Exploitation requires the local user to open the attacker-controlled directory, at which point Kiro IDE resolves an uncontrolled search path and executes the malicious binary, bypassing workspace trust protections intended to prevent exactly this class of attack. No public exploit has been identified at time of analysis, and a vendor-released patch is available at version 1.0.228.
ASUSTOR Backup Plan (ABP) and EZSync (AES) background services run as NT AUTHORITY\SYSTEM and expose a file-based IPC channel whose AES encryption key is readable by standard users and recoverable via Windows DPAPI, allowing any authenticated local account to forge valid service requests. The services further fail to verify the identity of the requesting process and validate filesystem paths using an insufficient substring check, enabling directory traversal sequences to bypass path restrictions. A local attacker can chain these weaknesses to perform arbitrary file reads and writes as SYSTEM, achieving full local privilege escalation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary code execution affects Vim v9.2.0389 and earlier through a memory management flaw in the OpenVMS-specific vms_fixfilename() function in vim/src/os_vms.c. A local attacker on an OpenVMS system can trigger this CWE-401 condition to achieve full code execution with high confidentiality, integrity, and availability impact. No public exploit confirmed at time of analysis, and the extremely low EPSS score (0.15%, 4th percentile) combined with the platform-specific attack surface indicates minimal real-world exploitation risk.
Veeam ONE's Reporter service exposes an improper privilege management flaw (CWE-269) that enables a locally authenticated, high-privileged user to escalate into the Reporter service's security context, achieving full confidentiality, integrity, and availability impact on the vulnerable system. All versions of the product appear affected per the wildcard CPE string, and the vulnerability was responsibly disclosed via HackerOne. No public exploit code or active exploitation has been identified at time of analysis.
Improper access control in the wpForo Forum WordPress plugin before 3.1.3 permits any subscriber-level authenticated user to write to administrator-controlled profile fields - including account activation status and forum reputation score - during a standard self-service profile update. This allows a banned or pending user to self-activate their own account, bypassing moderator enforcement, and to forge an arbitrarily high reputation score that may unlock elevated forum privileges. No CISA KEV listing exists, but a publicly available exploit is documented by WPScan; the EPSS score of 0.14% (4th percentile) indicates low observed exploitation probability at scale, though the low barrier to attack (any registered user) makes it a meaningful integrity risk for moderated forums.
Missing authorization in the Wired Impact Volunteer Management WordPress plugin (versions before 2.8.2) allows any authenticated WordPress user with at least a Subscriber role to remove RSVPs belonging to other users from any volunteer opportunity. The vulnerability stems from an AJAX action handler that neither verifies the requesting user's authorization level nor confirms ownership of the RSVP being deleted, enabling unauthorized data manipulation across the entire volunteer management system. A publicly available proof-of-concept exists via WPScan, though EPSS sits at 0.13% (3rd percentile) and SSVC confirms no active exploitation, suggesting limited real-world attacker interest at this time.
Clearfy Cache WordPress plugin versions before 2.4.3 exposes admin-only settings pages and their contents - including administrative nonces - to any authenticated user at Subscriber level or above due to a missing capability check on an alternate admin-page dispatch path. While the canonical admin URL enforces access controls correctly, the unguarded dispatch path bypasses those restrictions entirely. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.13% (3rd percentile), indicating low observed exploitation probability despite POC availability; no confirmed active exploitation (CISA KEV) has been recorded.
Contest Gallery WordPress plugin (all versions before 30.0.7) exposes the site's complete stored OpenAI prompt history to any authenticated user holding at minimum a Subscriber role, due to a handler that performs neither a capability check nor a nonce verification. An attacker with a basic WordPress account can call the unprotected AJAX endpoint directly to exfiltrate the full prompt history, potentially exposing confidential business logic, AI workflows, or sensitive data embedded in prompts. No active exploitation is confirmed (not in CISA KEV), but a publicly available proof-of-concept exists per WPScan, and EPSS remains low at 0.13% (3rd percentile).
Missing authorization in the miniOrange 2FA WordPress plugin before 6.2.7 allows any authenticated low-privileged user to trigger OTP email delivery to arbitrary email addresses and exhaust the site's metered OTP quota. The plugin's second-factor enrollment endpoint neither restricts which users may invoke it nor binds the OTP recipient to the enrolling user's own address, enabling both unsolicited OTP email delivery and a denial-of-service attack against other users' 2FA flows. No public exploitation or KEV listing has been identified, though a public proof-of-concept is available via WPScan; EPSS stands at 0.13% (3rd percentile), indicating low observed exploitation activity.
The terminal file-preview feature in Open WebUI 0.9.0 through 0.10.2 allows an authenticated attacker with access to a configured terminal server to execute arbitrary scripts in the application's own browser origin by exploiting a hardcoded iframe sandbox misconfiguration, enabling full session token theft and account takeover. The `serveUrl` iframe branch unconditionally combined `allow-same-origin` with `allow-scripts` for HTML files served from the application's own domain, completely negating iframe sandbox isolation regardless of user settings. In the highest-impact scenario, if the victim holds admin privileges or `workspace.functions`, the account takeover extends to server-side code execution on the Open WebUI host. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; a vendor patch is available in version 0.11.0.
Deserialization of untrusted data in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) exposes unauthenticated remote attackers to denial-of-service conditions and data integrity compromise. The flaw is rooted in CWE-502 - unsafe handling of externally supplied serialized objects - and carries a CVSS 8.2 score driven by a fully unauthenticated, low-complexity network attack vector. No public exploit code and no active exploitation have been identified at time of analysis, but the absence of authentication and configuration prerequisites makes the attack surface broad for any internet-accessible Dynamo deployment.
Out-of-bounds write in NVIDIA Dynamo for Linux enables remote unauthenticated attackers to cause denial of service or tamper with data via network-reachable attack surface, scoring CVSS 8.2 High. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no special conditions, and no user interaction are required for exploitation. No public exploit code has been identified and CISA KEV listing is absent at time of analysis, but self-disclosure by NVIDIA and a High CVSS score warrant prompt patching in AI inference infrastructure environments.
Unauthenticated Portal Administrator impersonation in Veeam Service Provider Console (VSPC) exposes the proxied appliance API to unauthorized access during a short race window that opens immediately after a legitimate administrator session is initiated. The flaw, rooted in CWE-306 (Missing Authentication for Critical Function), allows a network attacker without any credentials to issue API calls that the system processes with Portal Administrator privileges. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the managed service provider management role targeted makes this a significant concern for MSP environments.
Remote code execution, data tampering, denial of service, and information disclosure are possible through vulnerabilities in NVIDIA Dynamo for Linux examples and recipes, affecting all versions through v1.1.0. The root cause is CWE-1357 (Relies on Insufficiently Trustworthy Component), meaning the examples or recipes bundle or reference a dependency or component without adequate integrity or trust verification, enabling an attacker to exploit that trust boundary over a network. No public exploit code exists and no active exploitation has been confirmed; EPSS places probability at 0.36% (29th percentile) and SSVC confirms exploitation status as none with a non-automatable attack path, suggesting low near-term weaponization risk despite the high CVSS base score.
Authentication bypass in Qualcomm Snapdragon SoCs allows adjacent network attackers to exploit a cryptographic flaw during registration request processing, yielding high confidentiality and integrity compromise without requiring any privileges or user interaction. The flaw, rooted in CWE-306 (Missing Authentication for Critical Function), occurs when registration requests carry malformed or absent authentication parameters, causing the cryptographic subsystem to proceed without validating caller identity. No public exploit has been identified at time of analysis and Qualcomm has not confirmed active exploitation, but the CVSS 8.1 score and zero-privilege adjacent-network profile represent meaningful risk for devices on shared wireless segments.
Client-side SSRF in Open WebUI (pip package versions 0.6.34 through 0.10.x) allows any authenticated user who can post chat content to redirect victims' browsers into issuing arbitrary outbound GET requests against internal hosts, same-origin endpoints, or CORS-permissive targets. The vulnerability stems from the Vega visualization renderer accepting its default resource loader against untrusted chat-embedded chart specs, providing two independent fetch paths - `data.url` at view construction and image-mark `url` attributes emitted into the rendered SVG - both entirely invisible to server-side SSRF controls. No public exploit was identified in CISA KEV, but a working proof-of-concept was published in the GitHub security advisory itself (GHSA-rffm-9q57-q649), significantly lowering the exploitation bar.
Use-after-free in the Linux kernel rhashtable walk subsystem allows a local attacker with low privileges to dereference a stale pointer into freed slab memory, enabling kernel memory disclosure, crash, or potential privilege escalation. The defect is in rhashtable_walk_start_check(): when a hash table is freed during resize (iter->walker.tbl == NULL), the restart path clears slot and skip but omits clearing iter->p, leaving a dangling pointer that rhashtable_walk_next() then dereferences. Confirmed callers affected include netlink_diag and TIPC socket diagnostics. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.15% (5th percentile), reflecting low current exploitation activity despite real kernel memory-safety impact.
Stack-based buffer overflow in Autodesk FBX SDK's fbxsdk::ExtractDrive function allows arbitrary code execution in the context of the current process when a user opens a maliciously crafted FBX file. Any application embedding the FBX SDK for 3D asset import - including game engines, VFX pipelines, and CAD tools - inherits this attack surface, making the blast radius broader than the SDK itself. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-impact CVSS score (7.8) and RCE primitive make this a priority for organizations ingesting untrusted 3D content.
Stack-based buffer overflow in Autodesk FBX SDK's binary file parser allows arbitrary code execution when a user opens a maliciously crafted FBX file. The vulnerable function `fbxsdk::FbxIO::BinaryReadSectionHeader` fails to properly bound-check attacker-controlled data from binary section headers, overflowing the call stack and enabling control-flow hijacking in the context of the host process. Any application embedding the affected SDK version - including Autodesk DCC tools and third-party game engine editors - is exposed when users import FBX assets from untrusted sources; no public exploit or CISA KEV listing has been identified at time of analysis.
Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve full confidentiality, integrity, and availability impact on the affected system. The flaw (CWE-822: Untrusted Pointer Dereference) allows a process to supply invalid pointer arguments via IOCTL calls that the driver dereferences without adequate validation, corrupting kernel memory. No public exploit code or CISA KEV listing has been identified at time of analysis; however, kernel-level driver bugs in Snapdragon have historically been chained with initial-access exploits to achieve full Android device compromise.
Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker to corrupt memory by sending malformed request parameters, resulting in full compromise of confidentiality, integrity, and availability. The vulnerability resides within the TrustZone Trusted Execution Environment (TEE), making successful exploitation particularly severe as it targets the secure world isolated from the Android normal world. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the EPSS signal is absent from available data.
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable limit is processed, triggering an integer overflow (CWE-190) that leads to a buffer overflow condition. Affected Snapdragon chipsets - used extensively in Android smartphones, IoT, and automotive platforms - are exposed to local exploitation with low privileges, yielding high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing are identified at time of analysis; the vulnerability was disclosed via Qualcomm's August 2026 Security Bulletin.
Arbitrary code injection in Vim 9.2.0389 and earlier exposes OpenVMS deployments to local code execution through a flaw in the platform-specific `vms_fixfilename()` function in `os_vms.c`. A local attacker can craft a malicious filename that bypasses sanitization controls in this VMS-only code path, causing Vim to execute injected code. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though a researcher's technical write-up is publicly accessible via GitHub Gist; the EPSS score of 0.16% (6th percentile) indicates very low exploitation probability in practice.
Signature forgery in the MonsterInsights WordPress plugin before 11.1.0 allows unauthenticated network attackers to overwrite plugin configuration values when the site is not connected to Google Analytics. The root cause is that the HMAC signing key used to authenticate a specific AJAX action defaults to an empty string in that disconnected state, making any forged HMAC trivially valid. The practical impact is limited to disrupting server-side analytics in Manual GA4 mode; no public exploit identified as actively exploited (not in CISA KEV), though a publicly available proof-of-concept exists and the EPSS probability is low at 0.15%.
Memory corruption in Qualcomm Snapdragon's fastboot command handler for audio framework configuration allows an attacker with physical USB access to a device in bootloader mode to send malformed input and trigger memory corruption with cross-scope impact - potentially reaching privileged firmware or TrustZone-adjacent components (S:C in the CVSS vector). The full confidentiality, integrity, and availability impact (C:H/I:H/A:H) indicates the compromise can extend beyond the vulnerable component itself. No public exploit code exists and no CISA KEV entry is present at time of analysis.
Buffer overflow in open62541 1.5.5's Local Discovery Server (LDS) enables an unauthenticated remote attacker to crash the discovery service by sending a RegisterServer or RegisterServer2 request containing an abnormally large number of unique discoveryUrls, but only when the MDNSD multicast discovery backend is enabled at build time. The impact is a denial of service (A:H) with no confidentiality or integrity exposure. No active exploitation is confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis.