Cross-user SSR payload disclosure in Nuxt 4.x allows unauthenticated network attackers to retrieve another authenticated user's full server-side rendered data by fetching `/<page>/_payload.json` after any authenticated user has warmed a cached route. The runtime `cache:nuxt:payload` storage introduced in nuxt 4.4.0 keyed payloads by URL path alone - omitting cookie, authorization header, or `cache.varies` dimensions - causing the renderer to serve one user's SSR data (including `useFetch`/`useAsyncData` results such as profile, tenant, billing, and token-like values) to any subsequent requester. No public exploit identified at time of analysis; vendor-released patch is available as nuxt@4.5.1.
Process crash in imagecli's seam-carving pipeline allows denial of service via a negative ratio argument to the `carve` operation. The `Carve::apply()` function in `src/image_ops.rs` validates only that `ratio <= 1.0`, omitting a positivity check; a negative input saturates to zero through Rust's defined float-to-uint cast, which is forwarded to `imageproc::seam_carving::shrink_width` - a function that panics on widths below 2, terminating the process. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects that any application exposing imagecli pipeline construction to untrusted input is exploitable with no authentication or interaction.
Remote unauthenticated denial of service in Systerel S2OPC Toolkit 1.7.3 is exploitable via the OPC UA AddNodes service, triggering a classic buffer overflow (CWE-120) in address_space_bs.c and sopc_node_mgt_helper_internal.c that crashes the server. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is reachable from the network without credentials or user interaction, making it trivially automatable against exposed OPC UA endpoints. No public exploit code or CISA KEV listing has been identified at time of analysis, though the impact is particularly acute in OT/ICS environments where S2OPC is deployed, as availability loss in industrial control infrastructure can translate to physical process disruption.
Stack-based buffer overflow in Systerel S2OPC 1.7.3 enables remote denial of service against OPC UA client applications. A malicious or compromised OPC UA server can send a crafted DeleteMonitoredItemsResponse message that triggers an overflow in LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse and SOPC_StaMac_NewDeleteMonitoredItems within the client_wrapper state machine, crashing the client process. No public exploit or active exploitation has been identified at time of analysis, though source code references confirm the vulnerable code path exists in the published repository.
Heap-based buffer overflow in Systerel S2OPC Toolkit 1.7.3 enables remote denial of service by sending a crafted OPC UA PublishResponse containing malformed EventNotificationList data to the Alarm/Conditions client wrapper. The affected code paths - libs2opc_client_alarm_conditions.c, state_machine.c, and sopc_event_manager.c - process incoming subscription notification data without adequate bounds checking, allowing a malicious or compromised OPC UA server to crash any connected S2OPC client. No public exploit identified at time of analysis, and no CISA KEV listing; however, the CVSS 7.5/High rating and unauthenticated network vector make this a meaningful risk in OPC UA-enabled industrial environments.
Integer underflow in the raster Rust crate's crop() function enables remote process crash via a single crafted request. When offset_x or offset_y exceeds the source image dimension, the signed subtraction wraps to a large negative i32 in release builds; that value is then cast to usize and passed to Vec::with_capacity(), triggering an unrecoverable capacity-overflow panic that kills the host process. No active exploitation is confirmed (not in CISA KEV) and no public POC is listed, but the AV:N/AC:L/PR:N/UI:N CVSS vector indicates zero-friction denial-of-service for any application that exposes the crop() call to untrusted input.
Memory exhaustion denial-of-service in OpenSSL 3.6.0-3.6.3 and 4.0.0-4.0.1 allows a malicious TLS server to leak attacker-tunable amounts of heap memory per handshake in connecting client applications that have explicitly enabled OCSP staple verification. By delivering a syntactically valid BasicOCSPResponse containing an empty SingleResponse sequence - optionally padded with bogus certificates to amplify each allocation - the server causes the internal OCSP_BASICRESP structure to be allocated but never freed, bypassing the cleanup path. No public exploit has been identified at time of analysis and no CISA KEV listing exists; risk is bounded by the non-default OCSP flag requirement.
Uncontrolled resource consumption in open62541 v1.5.5 and earlier allows unauthenticated remote attackers to crash or exhaust resources on OPC UA servers by sending crafted NodeManagement type-instantiation requests. The flaw resides in the server-side node management service logic and is exploitable over the network with no privileges or user interaction under the default access control configuration. No CISA KEV listing exists as of analysis, but the SSVC framework classifies the attack as automatable with a proof-of-concept present; the EPSS score of 0.25% (16th percentile) indicates limited observed exploitation in the wild despite that automation potential.
Denial of service in Systerel S2OPC 1.7.3 allows remote unauthenticated attackers to crash or render unavailable an OPC UA server by sending crafted requests that trigger uncontrolled resource consumption in the event monitored-item queue resize handling. Affected source code is confirmed across subscription_core.c and monitored_item_notification_queue_bs.c. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in S2OPC Toolkit 1.7.3's RepublishResponse message handler enables unauthenticated remote attackers to crash the OPC UA service via a crafted network message, resulting in denial of service. The vulnerable code paths span the subscription publish service layer (msg_subscription_publish_bs.c, msg_subscription_publish_ack_bs.c) and the common encoder module (sopc_encoder.c). No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector indicates low-barrier remote exploitation requiring no authentication against reachable OPC UA endpoints.
Arbitrary file write via path traversal in TECNO Mobile's Hi Browser 2.23.1.1 on Android exposes device filesystems to attacker-controlled writes when a user downloads a crafted file with traversal sequences in its filename. Any server delivering a download with a malicious Content-Disposition filename can redirect the saved file outside the intended download directory, potentially overwriting application data or configuration files on the device. No confirmed active exploitation (not in CISA KEV) and an EPSS score of 0.24% (15th percentile) indicate low real-world exploitation probability despite the high CVSS base score.
Stack-based buffer overflow in Domoticz's MochadTCP component allows an unauthenticated attacker on the local network to corrupt the Domoticz worker thread's stack and potentially achieve arbitrary code execution. The MochadTCP::MatchLine() handler in hardware/MochadTCP.cpp uses strcpy() to copy up to 1028 bytes of network-received data into a fixed 50-byte stack buffer (tempRFSECbuf) across three separate device-type branches, with no length validation whatsoever. No CISA KEV listing and no public exploit code have been identified at time of analysis; exploitation requires adjacency to the Domoticz host's network and benefits from the complete absence of authentication on port 1099.
Denial of service in Apache Qpid Proton-J through 0.34.1 allows unauthenticated remote attackers to crash the service by sending AMQP messages with deeply nested type structures that exhaust the JVM call stack via a StackOverflowError. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, unauthenticated network exploitation with no user interaction required, targeting availability exclusively. No active exploitation has been confirmed - this vulnerability is absent from CISA KEV and carries a low EPSS score of 0.21% (11th percentile) - but the zero-prerequisite attack path warrants prompt patching for any internet-facing AMQP deployment.
Remote unauthenticated denial of service in Apache Qpid Broker-J (all versions through 10.0.1) is achievable by exploiting unbounded symbol value caching in the AMQP message processing layer. A pre-authentication attacker can exhaust broker resources without supplying any credentials, crashing or hanging the service. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.21% (11th percentile) indicates low exploitation probability at time of analysis, though the network-accessible, zero-complexity attack path keeps it a meaningful patching priority for exposed deployments.
Unauthenticated remote denial of service in Apache Qpid Broker-J (all versions through 10.0.1) is achievable by exploiting uncontrolled recursion during type-nesting processing, which exhausts the JVM call stack and triggers a StackOverflowError. The attack requires no credentials and no user interaction against any reachable broker instance. No public exploit identified at time of analysis; EPSS of 0.19% (9th percentile) indicates low real-world exploitation probability. Vendor-released patch: 10.1.0.
Unauthenticated denial-of-service in Apache Qpid Broker-J through 10.0.1 allows any network-reachable attacker to crash or hang the broker by sending crafted AMQP protocol messages that exploit improper type size/count validation, triggering unbounded memory allocation. The flaw resides in the pre-authentication protocol parsing path, requiring no credentials, user interaction, or special configuration. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.19% (9th percentile) indicates minimal observed exploitation activity despite the straightforward attack vector.
Context isolation bypass in Electron allows untrusted web content loaded by an Electron app to escape the contextBridge security boundary and access the isolated preload world - and potentially Node.js - by hijacking Function.prototype.bind on exposed Promise-returning functions. The vulnerability (CVSS 7.5, S:C) affects the standard pattern developers use to wrap ipcRenderer.invoke calls, meaning a wide class of real-world apps is susceptible if they load any untrusted content. No vendor-side workarounds exist; patched releases are available across all active Electron version lines. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in Apache Answer through 2.0.1 allows unauthenticated remote attackers to exhaust CPU resources by sending a specially crafted Accept-Language HTTP header that triggers runaway parsing logic. The root cause is improper handling of a length parameter inconsistency (CWE-400) during header processing, meaning any unauthenticated HTTP request reaching the application can be weaponized for resource exhaustion. No public exploit code or CISA KEV listing has been identified at time of analysis, and the Apache Software Foundation has released a remediated version 2.0.2.
Remote kernel panic in the Linux kernel's GTP (GPRS Tunneling Protocol) driver allows an unauthenticated network attacker to crash a GTP-enabled host by sending a malformed echo request packet of 16-19 bytes. The vulnerability arises because gtp1u_send_echo_resp() ignores the NULL return from skb_pull_data() on an undersized buffer, causing skb->data to be pushed below skb->head by subsequent header operations, which trips skb_under_panic() and causes an immediate kernel BUG halt. No public exploit has been identified at time of analysis and EPSS of 0.18% (8th percentile) reflects low current exploitation probability, but the unauthenticated network-triggerable DoS against mobile core infrastructure warrants prompt patching for telecom operators.
Unauthenticated information disclosure in Apache Answer through 2.0.1 allows any remote user to retrieve deleted or pending answers via the single-answer read API path, provided the parent question remains publicly visible. The flaw bypasses moderation-state access controls, exposing content that was intentionally withheld from public view. No public exploit code or active exploitation has been identified; EPSS at 0.17% (7th percentile) reflects limited real-world exploitation interest despite the high CVSS score.
Account takeover in Apache Answer through 2.0.1 allows unauthenticated remote attackers to seize arbitrary user accounts by exploiting a missing authorization check in the external-login OAuth email binding workflow. The attacker crafts a malicious confirmation link and socially engineers a target into clicking it, after which the attacker's external identity is silently bound to the victim's Answer account. No active exploitation has been identified (CISA KEV absent, EPSS at 7th percentile), but the SSVC framework flags the attack as automatable, making phishing-at-scale campaigns mechanically feasible.
Memory allocation with excessive size value in Apache Lucy (all versions) enables potential denial-of-service and information disclosure against a retired, unsupported search library. The vulnerability stems from CWE-789, where the library processes externally supplied size values without adequate bounds checking, potentially allowing an attacker to trigger abnormal memory allocation behaviour. No patch will ever be released - the Apache Software Foundation has officially retired Lucy and explicitly recommends migration to an alternative; no public exploit has been identified at time of analysis.
Unauthenticated access to the Material Dashboard WordPress plugin's task management AJAX endpoint exposes all WordPress sites running versions up to and including 1.4.10 to task enumeration, arbitrary task execution, and task deletion. The root cause is a missing capability check on the `amd_ajax_target_task_manager()` function, which is registered via the publicly accessible `public_amd_ajax_handler` AJAX action - reachable without any authentication by design of the hook registration. An attacker can enumerate scheduled tasks (potentially exposing PII stored in task parameters), force arbitrary task execution to trigger unintended server-side operations, or delete tasks to disrupt site functionality. No active exploitation confirmed at time of analysis; no public POC code referenced in available data.
Command injection in Fledge's backup-restore upload handler allows an authenticated administrator to execute arbitrary OS commands on the underlying host by uploading a crafted tar archive. The vulnerable function upload_backup() in python/fledge/services/core/api/backup_restore.py constructs a shell command via unsanitized string formatting and passes it directly to os.system(), while filename validation only checks prefix and suffix - a filename such as fledge_backup_$(id>/tmp/pwn).db satisfies both checks while embedding a shell command substitution. CVSS 7.2 (PR:H) reflects the admin privilege prerequisite; no public exploit or CISA KEV listing has been identified at time of analysis, but the technique is trivially reproducible given access.
Unauthenticated access to NeuVector's manager /network/graph API exposes cached network topology data in all versions through 5.4.9, allowing any network-reachable attacker to retrieve sensitive container environment details without credentials. The missing authentication on this endpoint (CWE-202) means the container security platform itself becomes a reconnaissance source, potentially revealing Kubernetes service relationships, container names, and network flow data to adversaries. No public exploit code or active exploitation (KEV) has been identified at time of analysis, but the unauthenticated network vector significantly lowers the bar for exploitation.
Memory corruption in libkcapi's one-shot asynchronous I/O path allows a local process to induce kernel writes into application-owned output buffers after an error return. Affected platforms include Red Hat Enterprise Linux 8, 9, and 10, Red Hat Hardened Images, and OpenShift Container Platform 4. An unprivileged local attacker or a compromised application can exploit this use-after-free-class condition to crash the calling process (high availability impact) or corrupt buffer contents for limited confidentiality and integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary PHP function execution in ShopLentor (woolentor-addons) for WordPress up to and including version 3.3.7 allows authenticated administrators to invoke any PHP callable on the server via the woolentoropt/v1/custom-action REST API endpoint. The root cause is the plugin's handle_action() method passing the user-supplied 'callback' parameter directly into PHP's call_user_func() with no allowlist restriction, enabling full server-side code execution under the web server's privilege context. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the admin-level requirement limits the realistic attacker pool to compromised or malicious site administrators.
Remote code execution in Pluck CMS through 4.7.21 is achievable by any authenticated administrator who exploits a gap in the file upload blacklist: the extension '.php8' is absent from the hardcoded deny-list in data/inc/files.php, allowing a crafted file to be stored and subsequently executed as PHP on servers running PHP 8.x. Reported by TuranSec, this CWE-434 flaw carries a CVSS 7.2 (PR:H), meaning exploitation is constrained to admin-level accounts but delivers full confidentiality, integrity, and availability impact once triggered. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the bypass is trivially reproducible from the CVE description by any administrator with upload access.
Remote code execution in MacCMS10's admin template editor enables authenticated administrators to execute arbitrary OS commands by exploiting an incomplete PHP function blacklist in conjunction with ThinkPHP's native `{if}` template tag. The `Template.php` controller filtered dangerous functions via regex but omitted `exec`, `passthru`, `popen`, `create_function`, `register_shutdown_function`, `register_tick_function`, `show_source`, and `error_log`, allowing payloads such as `{if condition="exec('id > /tmp/pwned.txt')"}{/if}` to pass validation and execute at render time. No public exploit repository has been independently cited and this CVE is not listed in the CISA KEV catalog; an upstream fix was committed on 2026-06-22.
WP-DownloadManager WordPress plugin (all versions prior to 1.69) grants any WordPress administrator holding the manage_downloads capability the ability to achieve full remote code execution by uploading arbitrary PHP files through the unvalidated download-add.php handler. The upload path is additionally constructed from a raw, unsanitized POST parameter, enabling directory traversal into web-accessible locations under WP_CONTENT_DIR where uploaded PHP files execute on direct request. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the complete absence of server-side file-type controls and path sanitization makes exploitation trivially simple for any attacker who has obtained admin credentials.
SQL injection in Subrion CMS's admin grid sorting helper exposes virtually all admin grid endpoints to authenticated SQL injection via a raw, unescaped `sort` GET parameter interpolated directly into an ORDER BY clause. Any valid admin session can exploit approximately 29 grid controllers - most of which carry no or incomplete column whitelists - using error-based (EXTRACTVALUE) or time-based (SLEEP) techniques to exfiltrate full database contents, including administrator password hashes. No public exploit code or CISA KEV listing has been identified at time of analysis, though the breadth of affected endpoints and straightforward technique make exploitation trivial for any attacker holding admin credentials.
Sandboxed iframe popup restriction bypass in Electron allows untrusted iframe content to open new windows or trigger `setWindowOpenHandler` without user interaction, despite the `allow-popups` keyword being absent from the sandbox attribute. Electron versions prior to 42.0.1, 41.10.3, and 39.8.10 are affected. The bypass occurs because `FrameLoader::StartNavigation` and `WebContents::OpenURLFromTab` in the OpenURL code path did not check the iframe's sandbox popup flags, permitting emulated Ctrl+click events from untrusted JavaScript to create new browsing contexts. No public exploit or CISA KEV listing is confirmed at time of analysis, but the patch diff includes a working proof-of-concept test.
Stored Cross-Site Scripting in VikRentItems - Flexible Rental Management System (WordPress plugin, versions up to and including 1.2.1) allows unauthenticated attackers to inject persistent JavaScript via the customer email field of the public booking checkout form. The payload is stored in the database through the saveorder() function and executes in the browser of any authenticated user - including administrators - who subsequently views the affected order record in the WordPress admin panel. No public exploit or CISA KEV listing has been identified at the time of analysis, but the unauthenticated injection vector and admin-context execution make this a meaningful privilege escalation path on affected sites.
Stored Cross-Site Scripting in the Independent Analytics WordPress plugin (≤2.15.0) permits unauthenticated attackers to plant persistent malicious scripts via the 404 not_found_url tracking mechanism. The flaw exploits a broken sanitization sequence in get_cell_content(): esc_url() encodes special characters as safe URL entities, but a subsequent urldecode() call reconstructs raw HTML before rendering - and wp_kses_post() fails to strip the resulting markup because it explicitly permits img elements and data-* attributes. The attack entry point, the /iawp/search REST endpoint, accepts requests signed with a token that is itself embedded in public-facing page HTML, making injection effectively unauthenticated. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
MLflow's AI Gateway proxy exposes internal network services - including cloud-instance metadata endpoints - to any authenticated user, including read-only accounts, via an unvalidated api_base field in the CreateGatewaySecret endpoint. All MLflow releases through 3.14.0 are affected; the attack requires only basic credentials and no special configuration, making IAM credential theft a realistic outcome for cloud-hosted deployments. No public exploit has been identified at time of analysis, but the two-step attack (create secret, invoke proxy) involves only standard HTTP requests and no technical barrier beyond holding a valid account.
Cross-user chat history disclosure in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to read other users' conversation history by exploiting session_id collision in the MemoryComponent. The MemoryComponent.retrieve_messages and store_message methods validate only session_id when filtering records, omitting flow_id and user_id ownership checks, which exposes multiple REST API endpoints to unauthorized cross-user data access. No public exploit has been identified at time of analysis, but the straightforward exploitation path and High confidentiality impact make this a genuine remediation priority for any multi-user Langflow deployment.
Resource exhaustion in boringproxy through 0.10.0 allows any authenticated user to permanently consume server file descriptors, goroutines, and memory by repeatedly requesting the GET /loading endpoint with arbitrary id parameter values. The handler blindly attempts to receive from a nil channel - a Go-language primitive that blocks forever - with no map-lookup validity check, no HTTP server timeouts, no context cancellation, and no runtime reclamation, meaning each malicious request permanently holds one goroutine (~50 kB stack), one file descriptor, and associated heap memory. Once the server's file descriptor limit is exhausted, all listener Accept calls fail and tunnel traffic forwarding halts for every connected user. A public proof-of-concept writeup exists on GitHub; no CISA KEV listing has been identified at time of analysis.
SQL injection in Mautic's `getLeadIdsByFieldValueAction` endpoint allows any authenticated user to extract arbitrary database contents by supplying a malicious `field` parameter that is concatenated directly into a SQL query as an unvalidated column identifier. The flaw is rooted in Doctrine ORM's structural inability to parameterize SQL identifiers - the only sanitizer applied, `InputHelper::clean()`, HTML-entity-encodes quotes and angle brackets but leaves the spaces, parentheses, and SQL keywords needed for injection entirely intact. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low authentication barrier (any valid session) makes this a meaningful risk for organizations with untrusted or externally provisioned Mautic accounts.
Remote code execution, arbitrary file write, and privilege escalation vulnerabilities in Jenkins core (through 2.575 / LTS 2.568.1) and multiple plugins expose CI/CD infrastructure to full controller compromise. The most critical issue (CVE-2026-70426) allows agent processes and users with Agent/Connect permission to bypass the JEP-200 deserialization class filter via an unguarded fallback path in the Remoting library, enabling code execution on the Jenkins controller. Two independent arbitrary file write vectors (CVE-2026-70427 via malicious tar archives, CVE-2026-70428 via path traversal in file parameter names) can achieve equivalent controller-level code execution by writing Groovy scripts to JENKINS_HOME/init.groovy.d/ or deploying rogue plugins. No CISA KEV listing or public exploit has been identified at time of analysis, though the Jenkins security team coordinated a pre-announcement, suggesting no known active exploitation at disclosure.
SQL injection in Magistrala's message-readers API exposes PostgreSQL and TimescaleDB backends to arbitrary query manipulation by any authenticated platform user. The unvalidated `format` HTTP query parameter is interpolated directly into raw SQL at the table-name identifier position via Go's `fmt.Sprintf()` in both readers/postgres/messages.go and readers/timescale/messages.go, enabling exfiltration of database contents with high confidentiality impact (CVSS C:H). The wildcard CPE (cpe:2.3:a:absmach:magistrala:*) indicates all known versions are affected; no vendor-released patch has been confirmed in available references, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.10.3 enables authenticated low-privilege users to coerce the application server into issuing arbitrary outbound HTTP requests against internal infrastructure. The root cause is unsanitized pass-through of the OLLAMA_BASE_URL parameter directly into requests.get() inside validate_model_provider_key(), with no scheme enforcement, host allowlisting, or private-range (loopback, RFC1918, link-local) filtering. No active exploitation confirmed (not in CISA KEV), but the network-accessible, low-complexity attack path and high confidentiality impact (C:H) make this a meaningful internal-network pivot risk for organizations running Langflow with AI provider integration enabled.
Uninitialized stack memory dereference in the Linux kernel's IPv4 nexthop subsystem (net/ipv4/nexthop.c) enables local low-privileged attackers to cause kernel panic or leak sensitive stack contents on systems built with CONFIG_INIT_STACK_NONE. Versions from 5.13 through stable branches prior to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5 are affected. No public exploit code has been identified and EPSS stands at 0.16% (5th percentile), placing this in the low-urgency tier despite a CVSS 7.1 score driven by dual high-impact outcomes.
Path traversal in Livebook's notebook import pipeline allows an attacker who supplies a crafted `.livemd` file to write attacker-controlled content to arbitrary filesystem paths accessible by the Livebook process. Affected versions span 0.11.0 through 0.18.6 and 0.19.0 through 0.19.8, and the attack requires no credentials on the target instance - only that the victim open the malicious notebook and trigger a URL entry fetch. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the attack surface is realistic given Livebook's design as a notebook-sharing platform.
Uncontrolled Recursion in Apache Lucy, a retired full-text search library, enables remote unauthenticated attackers to crash the service via a crafted input, resulting in a complete denial of availability across all versions ever released. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms low-complexity, unauthenticated network exploitation with no confidentiality or integrity impact. No patch exists or will be issued by the Apache Software Foundation, as the project is officially retired; EPSS is low at 0.15% (5th percentile) and no active exploitation (CISA KEV) has been identified at time of analysis.