Out-of-bounds write in the Contiki-NG MQTT client (os/net/app-layer/mqtt/mqtt.c) lets a malicious or compromised MQTT broker overflow a 65-byte topic[] buffer and corrupt the adjacent payload_chunk pointer, producing an arbitrary-pointer-write primitive that can escalate to remote code execution on embedded targets lacking memory protection. The flaw stems from parse_publish_vhdr() setting topic_len_received=1 before enforcing the 64-byte topic length limit, so an over-length topic split across TCP segments bypasses the guard on parser re-entry and reaches a memcpy() that trusts the unvalidated 16-bit topic_len. Because the stack has no TLS, the plaintext channel also exposes devices to network man-in-the-middle injection; there is no public exploit identified at time of analysis and it is not in CISA KEV.
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who can place a crafted state file in the configured slot_save_path corrupt heap memory and potentially achieve arbitrary code execution. The flaw lives in state_read_data(), which computes a write size from an attacker-influenced cell_count without integer-overflow checking, so a malicious slot file can write past the tensor buffer. No public exploit identified at time of analysis and it is not listed in CISA KEV; the only reference is a third-party security-patches repository, so exploitation currently appears theoretical rather than active.
Unauthenticated remote code execution in OpenChamber 1.11.7 lets remote attackers run arbitrary OS commands by POSTing to the /api/fs/exec endpoint, which hands input directly to Node.js spawn() with no allowlist, blocklist, or argument sanitization. Because the authentication middleware silently no-ops when UI_PASSWORD is unset - the state of the default Docker deployment - the endpoint is reachable without credentials and returns full stdout, stderr, and exit code to the attacker. Reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the flaw is trivially exploitable.
Remote code execution in llama.cpp's llama-server (builds b7492 through b9060) allows unauthenticated attackers to run arbitrary code by racing the server's idle-sleep transition when the --sleep-idle-seconds feature is enabled. Concurrent worker threads dereference a freed vocab pointer that can be reclaimed with attacker-controlled data. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; exploitation is gated by a non-default configuration and a tight timing window (CVSS 4.0 base 9.2, AT:P/AC:H).
Unauthenticated blind server-side request forgery in sgoudelis Ground Station before 0.6.0 lets any network attacker coerce the ground-station process into issuing outbound HTTP requests to arbitrary destinations, including cloud instance metadata at 169.254.169.254 and internal RFC1918/loopback services. Because the Socket.IO server on port 7000 enforces no authentication and uses a wildcard CORS policy, an attacker persists a malicious orbital-source URL and triggers a sync, then reads returned HTTP status codes and error strings as an oracle for probing the internal network. There is no public exploit identified at time of analysis, but the flaw is durable: the malicious source survives restarts and re-fires automatically every 24 hours.
Use-after-free in the llama-server component of llama.cpp (builds b7492 through b9060) lets remote unauthenticated attackers crash the server or potentially execute code by racing six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, /anthropic/count_tokens) that read ctx_server.vocab directly on HTTP worker threads instead of going through the task queue. The flaw is only reachable when the server is started with --sleep-idle-seconds, since idle-driven vocab teardown on the main thread is what frees the object mid-handler. No public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 9.2 but real-world exploitation is constrained by a hard-to-win TOCTOU race.
Arbitrary file upload in WSO2 API Manager and related Carbon-based products (API Control Plane, Universal Gateway, Traffic Manager) allows an authenticated publisher-privileged user to write attacker-controlled files to arbitrary server-accessible paths via the System REST API, which can escalate to remote code execution depending on how uploaded content is served or executed. The vendor rates it CVSS 9.1 (scope-changed) and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the CTX Feed (WebAppick Product Feed for WooCommerce) WordPress plugin through version 6.6.42 allows a user holding the Shop Manager role to inject and execute arbitrary code (CWE-94) on the underlying server. The CVSS 3.1 score of 9.1 reflects a scope change where WooCommerce-level access translates into full host compromise. No public exploit identified at time of analysis, and no EPSS or KEV data was provided.
SQL injection in the Apache Portable Runtime Utility (APR-util) affects the apr_dbd_oracle database provider in versions 1.6.0 through 1.6.3, letting remote attackers inject arbitrary SQL through an application that relies on this DBD backend for query construction or escaping. Rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, it allows unauthorized reading and modification of Oracle-backed data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds heap read in the node-re2 npm package (versions <= 1.26.0) exposes up to 3 bytes of adjacent heap memory per call to JavaScript when Buffer arguments ending in a truncated multi-byte UTF-8 lead byte are passed to replace() or split(). The overread is deterministic, requires no heap grooming, and a working proof-of-concept is included in the GitHub advisory. Applications that pass only strings - not Buffers - are entirely unaffected, but those that process untrusted Buffer input through re2 are at real risk of incremental heap disclosure. No CISA KEV listing was identified; this is a library-layer flaw fixed in re2@1.26.1.
Broken tenant isolation in WSO2 API Manager's Publisher REST APIs lets a privileged user in one tenant reach across tenant boundaries in multi-tenant deployments. Because the APIs do not correctly scope operations to the caller's tenant, an authenticated publisher-level account can enumerate, expose, or modify API metadata belonging to entirely separate tenant environments. No public exploit identified at time of analysis, but the vendor-assigned 9.0 (Critical) score and CVSS scope-change flag reflect the cross-tenant reach of the flaw.
Arbitrary file deletion and read access in the File Manager WordPress plugin (versions 6.0-6.9) allows any authenticated user with subscriber-level access or above to delete or read arbitrary server files, including wp-config.php, which can be leveraged for remote code execution. The flaw is rooted in a parameter-source discrepancy in elFinder's connector: the bind registration for the rm.pre permission handler reads exclusively from $_POST, while the dispatcher reads from the merged $_GET+$_POST superglobal - allowing an attacker to inject cmd=rm or cmf=file via the URL query string of a POST request, entirely bypassing authorization checks. A patched version (6.9.1) has been released per the WordPress plugin repository changeset; no public exploit has been identified at time of analysis, though the Wordfence disclosure provides sufficient technical specificity for exploitation.
Remote code execution within the V8 JavaScript engine affects Google Chrome prior to 151.0.7922.109, allowing a remote attacker to execute arbitrary code inside the browser sandbox by luring a victim to a crafted HTML page. The flaw stems from an inappropriate implementation in V8 (CWE-693, Protection Mechanism Failure), carrying a CVSS 8.8 rating with high confidentiality, integrity, and availability impact. No public exploit code has been identified and CISA SSVC confirms no active exploitation at time of analysis, though the technical impact is rated total by SSVC, underscoring the severity if exploited.
Remote code execution within the Chrome sandbox is possible in Google Chrome versions prior to 151.0.7922.109 due to a use-after-free vulnerability in the V8 JavaScript engine, triggerable by a remote attacker through a specially crafted HTML page. The attacker achieves arbitrary code execution confined to the Chrome renderer sandbox, requiring no privileges but necessitating user interaction to visit a malicious page. Google has released a fix in version 151.0.7922.109; SSVC assessment confirms no known active exploitation at time of analysis, and no public exploit code has been identified.
Remote code execution within Chrome's sandboxed renderer process is achievable in Google Chrome prior to 151.0.7922.109 through a crafted HTML page exploiting an inappropriate implementation in the V8 JavaScript engine. An unauthenticated remote attacker needs only to lure a victim to a malicious page - no credentials or special privileges are required on the attacker's side. Google has rated this High severity (Chromium classification); no public exploit has been identified at time of analysis, and CISA SSVC reports exploitation status as none, though technical impact is rated total within the sandbox boundary.
Unauthenticated database destruction and arbitrary SQL injection in Ground Station's Socket.IO server allows any network peer to permanently wipe or replace the entire SQLite database without credentials. The `database_backup` event handler on port 7000 accepts a caller-supplied SQL blob and executes it via raw `exec_driver_sql`, enabling complete erasure of satellite records, orbital sources, hardware configurations, and observation schedules, or implantation of malicious orbital-source URLs that redirect the ground station to attacker-controlled infrastructure on the next scheduled sync. No public exploit has been identified at time of analysis, and CISA KEV status is not confirmed, but the attack requires no authentication and no special configuration, making exploitation trivial from any host with network reach to port 7000.
Remote code execution within the Chrome sandbox via an integer overflow in the V8 JavaScript engine affects Google Chrome prior to version 151.0.7922.109. An unauthenticated remote attacker can trigger the flaw by enticing a user to visit a specially crafted HTML page, resulting in full compromise of confidentiality, integrity, and availability within the renderer process. No public exploit code has been identified and CISA SSVC confirms exploitation status as none, though the total technical impact and low attack complexity elevate real-world priority for patching.
Remote code execution within the Chrome renderer sandbox is possible in Google Chrome versions prior to 151.0.7922.109 through an out-of-bounds write flaw in the V8 JavaScript engine, triggerable by a crafted HTML page. An unauthenticated remote attacker needs only to lure a victim to a malicious page, achieving code execution confined to the sandboxed renderer process. No public exploit or active exploitation has been identified at time of analysis; however, the CVSS 8.8 score and SSVC total technical impact classification indicate significant potential consequences if exploitation is developed.
Use-after-free in Google Chrome's Translate component (versions prior to 151.0.7922.109) enables remote attackers to execute arbitrary code within the browser's renderer sandbox by directing a user to a crafted HTML page. The CVSS 8.8 score reflects network-accessible, low-complexity exploitation gated only by a single user interaction - visiting an attacker-controlled page. No public exploit code or CISA KEV listing has been identified at time of analysis, though the RCE primitive within one of the world's most widely deployed browsers represents a materially significant attack surface.
Authorization bypass across multiple API endpoints in eScriptorium through version 26.04.1 allows any authenticated user to read, modify, and delete transcription content belonging to other users. The root cause is a CWE-639 Insecure Direct Object Reference: primary keys supplied by the client in request bodies are resolved against the global Django model manager rather than a queryset scoped to the requesting user's own objects, eliminating all per-user data isolation on the Line, LineTranscription, VirtualCollection, tag, and process endpoints. No public exploit or active exploitation has been confirmed at time of analysis, but the low attack complexity makes this straightforward to exploit with a standard user account.
Privilege escalation in Google Chrome's Contextual Tasks feature (prior to 151.0.7922.109) allows a remote attacker to escalate privileges by luring a victim to a crafted HTML page that delivers insufficiently validated untrusted input. The vulnerability carries a CVSS 8.8 score, reflecting high confidentiality, integrity, and availability impact with no prior authentication required from the attacker. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low attack complexity and Chrome's ubiquitous deployment surface make prompt patching a priority.
Privilege escalation in the Forminator WordPress plugin (≤1.56.0) allows authenticated Contributor-level users to elevate their privileges to a higher role, potentially achieving administrative control over the WordPress installation. The flaw, rooted in CWE-266 (Incorrect Privilege Assignment), carries a CVSS score of 8.8 and a full High C/I/A impact rating, indicating that successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected site. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-privilege entry bar and network accessibility make this an elevated priority for WordPress deployments using this plugin.
Super Socializer plugin for WordPress (versions ≤ 7.14.5) contains a broken authentication vulnerability (CWE-288) that permits unauthenticated remote attackers to bypass the social login authentication mechanism and gain unauthorized access to WordPress user accounts. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates low-complexity network exploitation requiring victim interaction, consistent with a social login callback or token-verification bypass where a victim must initiate or interact with the login flow. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the high CVSS score (8.8) and full C/I/A impact reflect the potential for complete account takeover.
Server-side request forgery in Fedify's getNodeInfo() function allows unauthenticated remote attackers to pivot through a Fedify server into internal network services - including loopback interfaces, cloud metadata endpoints (e.g., AWS IMDS at 169.254.169.254), and RFC 1918 private networks - by returning a crafted /.well-known/nodeinfo document with a malicious links[].href value. Affected versions span the 1.9 through 2.3 maintenance lines starting from 1.2.0, with response bodies from internal services returned directly to the initiating attacker. No confirmed active exploitation (not in CISA KEV) and no POC status was provided in the input data, but SSRF against cloud metadata is a high-value, well-understood attack path.
Use-after-free in Google Chrome's HTML engine (all versions prior to 151.0.7922.109) exposes users to potential heap corruption and code execution when they visit a crafted HTML page. The CVSS 8.8 score reflects unauthenticated, network-reachable exploitation requiring only a single user interaction - consistent with Chromium's own 'High' severity classification. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch (151.0.7922.109) has been released and is the primary mitigation.
Kernel crash vulnerability in the Linux SMB client subsystem results from a type mismatch in smb2_aead_req_alloc() where an unsigned 32-bit integer is incorrectly passed to ERR_PTR(), generating an invalid error pointer that causes a system panic upon dereference. Systems running the Linux kernel with the SMB client module (cifs) and SMBv2/v3 AEAD encryption enabled are affected across multiple stable branches, with patches available in versions 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1. No public exploit code exists and no CISA KEV listing applies; EPSS probability is extremely low at 0.16% (5th percentile), indicating this is primarily a kernel reliability fix with negligible active exploitation interest despite the high official CVSS score.
Use-after-free race condition in the Linux kernel brcmfmac Broadcom WiFi driver enables adjacent-network attackers to corrupt kernel memory during concurrent device removal and bus_reset work execution. Affected systems include any Linux host running brcmfmac on PCIe, SDIO, or USB Broadcom chipsets - including Raspberry Pi devices - on kernel versions since 5.2 through pre-7.1.6. No public exploit or CISA KEV listing exists at time of analysis, and EPSS probability is low at 0.14% (4th percentile), though the kernel-level impact class remains high.
Namespace isolation bypass in Traefik's Kubernetes CRD provider allows a tenant confined by RBAC to a single namespace to bind their own router to a `TraefikService` owned by a different namespace, exposing or rerouting that namespace's backend services - defeating the isolation boundary that `allowCrossNamespace=false` (the default) is meant to enforce. All Traefik v2 releases through 2.11.53, v3.0.0-3.6.24, and v3.7.0-3.7.9 are affected; patches are available at v2.11.54, v3.6.25, and v3.7.10. A proof-of-concept test harness accompanies the advisory confirming the bypass; the vulnerability has not been added to CISA KEV at time of analysis.
Arbitrary file write via Zip-Slip in Nx's self-hosted HTTP remote cache extractor allows a malicious or MITM-positioned cache server to overwrite files anywhere on the developer's machine, escalating to remote code execution. Affected are Nx workspaces using self-hosted remote cache (NX_SELF_HOSTED_REMOTE_CACHE_SERVER, @nx/s3-cache, @nx/gcs-cache, @nx/azure-cache, @nx/shared-fs-cache) running nx >= 20.8.0 and < 22.7.7; Nx Cloud and the default local cache are confirmed unaffected. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, but the CVSS 4.0 score of 8.7 and trivial exploitability once positioned reflect significant real-world risk for teams using self-hosted caching.
Out-of-bounds heap read in Contiki-NG's LwM2M TLV parser discloses adjacent heap memory - including cryptographic key material and peer IP addresses - to any unauthenticated network attacker. The flaw in `lwm2m_tlv_read()` (os/services/lwm2m/lwm2m-tlv.c) is triggered by a single crafted CoAP WRITE request whose final TLV supplies exactly one byte, causing the parser to read up to five bytes beyond the buffer boundary. Because LwM2M NoSec mode is the default for constrained IoT devices, no authentication is required, and the upstream fix is confirmed in commit f1673b5766d4d4d514cefb8a0350f43653574997 (PR #3165) but a tagged release has not been independently confirmed. No public exploit or CISA KEV listing has been identified at time of analysis.
XML External Entity (XXE) injection and recursive entity expansion in WSO2's SchemaValidator Mediator expose server-side file contents and enable SSRF across a broad range of WSO2 API management products. Exploitation requires a highly privileged actor - confirmed by PR:H in the CVSS vector - who can supply crafted XML payloads to affected mediator flows, triggering unauthorized outbound requests, server file reads, or resource exhaustion that degrades service availability. Vendor patches are available for all listed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated credential disclosure in Dinky v1.2.5 exposes the full live system configuration - including cleartext API tokens, LDAP passwords, and object storage keys - via a single parameterless GET request to /api/sysConfig/getAll. The root cause is a method-level @SaIgnore annotation that silently overrides the class-level @SaCheckLogin guard in the Sa-Token framework, leaving the endpoint fully unprotected on the default port 8888. Critically, the leaked dinkyToken directly unlocks a sibling arbitrary file write endpoint (POST /download/uploadFromRsByLocal), meaning this disclosure neutralises token rotation as a mitigation for that chained vulnerability; no public exploit has been identified at time of analysis.
Unauthenticated OAuth token rotation in Flowise through 3.1.4 allows any network-reachable attacker to force OAuth credential refresh against credentials belonging to any workspace by exploiting incomplete prefix-based whitelist matching in the authentication middleware. The authentication bypass targets the OAuth2 credential refresh endpoint, where appending a trailing credential identifier satisfies the prefix check without triggering authorization logic. This is a confirmed bypass of CVE-2026-41273, meaning a prior patch for the same middleware was incomplete. No public exploit identified at time of analysis from KEV, though a public advisory with technical detail exists via the Caycon GitHub repository, and the product has been announced as sunset.
HTML sanitization bypass in jsoup versions 1.14.3 through 1.23.0 allows cross-site scripting when applications deploy a custom Safelist that explicitly permits raw-text elements. The parser's tag-name normalization trimmed trailing control characters (e.g., U+001E) from malformed tag names, causing a crafted element to acquire the parsing behavior of a recognized raw-text element; content intended to remain escaped text was then serialized as active markup, bypassing sanitization. jsoup's built-in Safelists are unaffected, and no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated denial-of-service in sgoudelis/Ground Station prior to 0.6.0 allows any network peer to forcibly terminate the application process by emitting a single Socket.IO event requiring no credentials. Authentication enforcement is disabled and a wildcard CORS policy is in place, exposing the service_control handler - which triggers process shutdown via a restart_service command - to any host with TCP access to port 7000. In Docker deployments, the attack can be repeated in a loop to sustain a persistent outage of all satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers. No public exploit or CISA KEV listing is identified at time of analysis.
Unauthenticated remote shutdown of OpenChamber 1.11.7 is possible by sending a single POST request to /api/system/shutdown, terminating the server process and instantly denying service to all active AI coding sessions. The flaw stems from the /api/system/shutdown route being registered before the authentication middleware in the Express handler chain within bootstrap-runtime.js, meaning authentication is never evaluated for that endpoint regardless of whether UI_PASSWORD is configured. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack requires no privileges or user interaction and is trivially reproducible against any network-exposed instance.
Memory exhaustion denial-of-service in Sonic 3 A.I.R.'s UDP networking stack allows unauthenticated remote attackers to crash the multiplayer server process with a single crafted packet. The root cause is in ReceivedPacketCache::enqueuePacket() within the OxygenEngine netcore layer: the mUniquePacketID field is read directly from the UDP wire format without bounds validation, and when set to UINT32_MAX the server attempts to allocate one CacheItem per missing packet ID gap, exhausting host memory until an uncaught std::bad_alloc propagates to std::terminate(). No public exploit code and no CISA KEV listing exist at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, score 8.7) reflects that the attack is trivially automatable from any network-reachable position.
Cross-tenant insecure direct object reference in Amazon Strands Agents Tools' memory backends exposes multi-tenant deployments to unauthorized read, write, and delete operations on other tenants' stored memories. Authenticated users of versions before 0.8.3 can influence the LLM intermediary to emit tool calls carrying a forged namespace parameter, bypassing tenant isolation in mongodb_memory, elasticsearch_memory, and mem0_memory. No public exploit code or CISA KEV listing exists at time of analysis; the vendor-released fix is version 0.8.3.
Command injection in sysPass's backup service allows any authenticated administrator to execute arbitrary OS commands as the web server process user by storing shell metacharacters in the backup path configuration setting and triggering a backup operation. Because sysPass is a self-hosted password manager, successful exploitation grants direct read access to the master encryption key and entire credential vault, enabling mass credential disclosure and lateral movement to every system whose passwords are stored in sysPass. A public proof-of-concept is available via the referenced gist (https://gist.github.com/W40X/6747ba1b7da7bb69b0c0e162628df279); no CISA KEV listing was identified at time of analysis.
NoSQL injection in Dgraph prior to 25.3.8 enables unauthenticated remote attackers to inject DQL operators through unvalidated regexp filter arguments in GraphQL queries and mutations, bypassing intended node-level access controls. The `maybeQuoteArg` function in `graphql/resolve/query_rewriter.go` writes regexp arguments verbatim into generated DQL without validating the `/pattern/flags` structure, allowing a crafted filter value like `/x/) OR has(pred` to close the regexp call and append attacker-controlled DQL expressions. No confirmed active exploitation at time of analysis and no CISA KEV listing, but the fix commit includes a working injection payload as a regression test, confirming ease of exploitation against accessible endpoints.
Host header injection in Frappe's magic login link generation exposes users to account takeover via authentication token hijacking. Frappe versions prior to 15.108.0 (v15 branch) and 16.18.3 (v16 branch) construct emailed magic login URLs using the attacker-controlled HTTP Host header, allowing an unauthenticated remote attacker to craft a request that causes the application to send a seemingly legitimate email containing a login link pointing to an attacker-controlled domain - capturing the one-time token when the recipient clicks. No public exploit is identified at time of analysis, but the attack requires no authentication and minimal technical complexity, making it accessible to a broad range of threat actors.
Sandbox escape in Google Chrome on Android prior to 151.0.7922.109 is achievable by a local attacker via a malicious file exploiting insufficient input validation in WebAPK processing. The CVSS scope change (S:C) with high confidentiality, integrity, and availability impacts reflects the potential for full breakout beyond Chrome's sandbox boundary into the broader Android process space. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available in the stable channel release.
SQL injection in the WP Job Portal WordPress plugin (versions up to and including 2.5.6) is exploitable by any authenticated subscriber-level user, the lowest WordPress role available to registered users. The CVSS scope change (S:C) indicates the injection escapes the plugin's own query context and can reach the broader WordPress database, yielding high confidentiality impact against data owned by other plugins or core tables. No public exploit code or CISA KEV listing exists at time of analysis, but the low authentication bar significantly lowers the effective exploitation threshold on sites with open user registration.
SQL injection in Creative Mail by Constant Contact (WordPress plugin, versions ≤1.6.9) allows authenticated subscribers to execute arbitrary SQL against the WordPress database. The CVSS scope change (S:C) indicates the injection can reach database resources beyond the plugin's own tables, including WordPress user credentials, private posts, and configuration data. No public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in eScriptorium through 26.04.1 allows remote authenticated users to pivot from the application server into internal networks, including cloud instance metadata services (IMDS), by supplying attacker-controlled URIs to the METS or IIIF import API endpoint. The vulnerability is rooted in the default wildcard value of the IMPORT_ALLOWED_DOMAINS setting combined with a total absence of address filtering, redirect-following caps, or request timeouts - meaning any authenticated user can coerce the server into issuing arbitrary HTTP requests. With CVSS S:C (scope changed) and C:H, the primary risk is exfiltration of cloud credentials via IMDS (e.g., AWS 169.254.169.254), which can escalate a low-privilege application account into full cloud environment compromise. No public exploit or KEV listing identified at time of analysis.
Out-of-bounds heap write in FFmpeg's native GoPro CineForm HD (CFHD) decoder affects versions 4.4 through 8.x, allowing remote attackers to corrupt heap memory by supplying a crafted AVI file that is opened or probed by a vulnerable build. The root failure - missing output-width bounds enforcement in the transform-type-2 reconstruction path - causes horiz_filter_clip() to write 16-bit sample rows far beyond the allocated frame buffer, with a concrete escalation path to arbitrary code execution through overwrite of a live cleanup callback pointer. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; three upstream fix commits and PR #23898 are available at code.ffmpeg.org pending a formal stable release.
Integer underflow and heap out-of-bounds read in llama.cpp's DRY sampler (builds b3978 through b9058) allows remote unauthenticated attackers to crash the inference server or corrupt token sampling probabilities by sending a single crafted HTTP request. Setting the `dry_allowed_length` parameter to INT32_MIN triggers arithmetic wrap-around in the sampler, causing it to read memory before the allocated heap buffer and producing a SIGSEGV that terminates service for all connected users. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the trivially reproducible single-parameter trigger makes this a high-priority issue for any deployment exposing the llama.cpp HTTP API on a network.
Server-Side Request Forgery in Foxit PDF Services API allows low-privileged remote attackers to bypass local file access restrictions by embedding redirect-chain URLs in PDF creation requests, causing the server to fetch arbitrary internal resources and disclose sensitive information. The CVSS vector (S:C/C:H) confirms the scope change extends to internal backend systems inaccessible to the attacker directly, making this a meaningful lateral-visibility primitive in environments where the API reaches internal network segments. No public exploit identified at time of analysis, and no KEV listing, though the low attack complexity elevates urgency for internet-exposed deployments.
Heap buffer overflow in FFmpeg's DVB subtitle parser (libavcodec/dvbsub_parser.c) affects all releases from version 0.5 through 8.x, enabling potential remote code execution when a victim processes a crafted WTV file. A signed integer overflow causes the bounds-check guard to wrap to INT_MIN, silently bypassing the PARSE_BUF_SIZE comparison and allowing attacker-controlled data to be written out-of-bounds on the heap via memcpy(). No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the RCE-capable heap corruption primitive in a ubiquitously embedded media library represents material risk for any pipeline that ingests untrusted media files.
Integer overflow in llama.cpp's llama_batch_init() function across builds b1283 through b9058 enables heap corruption via unchecked multiplicative arithmetic in malloc() size calculations - when computed allocation sizes wrap past INT32_MAX, the resulting under-sized heap buffer is overwritten by subsequent batch operations, creating a credible path to arbitrary code execution in the context of the host process. The vulnerability affects versions 0.4.0 through 0.17.1 and any application embedding the affected build range of the library. No public exploit code has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog, but the heap corruption primitive paired with the RCE tag warrants expedited patching in production AI inference pipelines.