Symlink traversal in TP-Link Aginet home networking devices exposes sensitive filesystem files to any attacker who can physically insert a prepared USB storage device. The firmware resolves symbolic links placed on external USB media without validating that the resolved path remains within the intended storage boundary, enabling unauthorized read access to device-internal files such as configuration and credential stores. No public exploit or CISA KEV listing exists at time of analysis; however, the vendor has confirmed patches for all affected models.
Samsung Message on Android devices prior to SMR Aug-2026 Release 1 exposes sensitive user information to physical attackers through improper input validation. An attacker with physical access to an unlocked or accessible device can interact with the Samsung Message application to trigger the flaw and read confidential message content or related data. No public exploit code has been identified, and exploitation requires hands-on device access, limiting widespread automated abuse.
Stored XSS in ReadyEcommerce before 4.5.2 allows authenticated customers to inject arbitrary JavaScript into chat and support ticket messages, which executes in the browsers of any shop owner or administrator who views the messages. The root cause is unsanitized rendering via Vue.js's v-html directive across four frontend components, bypassing the framework's built-in template escaping protections. Successful exploitation can lead to session cookie theft and full administrative account takeover. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds memory write in the VC1 codec implementation within libsavsvc.so on Samsung Mobile Devices exposes affected handsets to local memory corruption with limited but confirmed multi-property impact. Devices running Samsung firmware prior to SMR Aug-2026 Release 1 are vulnerable, with the flaw addressable by updating to the August 2026 Samsung Monthly Release. No public exploit code has been identified and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis.
Out-of-bounds memory write in libsmsd.so affects all Samsung Mobile Devices running firmware prior to SMR Aug-2026 Release 1, exploitable by a local unprivileged attacker with no special privileges required. The flaw in Samsung's SMS daemon shared library allows memory corruption that could destabilize the smsd process or, with additional technique, enable code execution within the daemon's privilege context. No public exploit identified at time of analysis, and no CISA KEV listing; however, low attack complexity combined with zero privilege requirements makes this actionable for any malicious app or shell-level actor on an unpatched device.
Out-of-bounds memory write in Samsung's libcodec2_sec_flacdec.so FLAC decoder library exposes Samsung Mobile Devices to local exploitation on firmware prior to the SMR Aug-2026 Release 1 patch. The root cause is improper input validation in the secure FLAC decoding component, allowing a local attacker to write beyond allocated memory boundaries and potentially corrupt adjacent memory. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists for this CVE.
Out-of-bounds memory write in Samsung Mobile Devices' MPEG4 codec library libsavsvc.so enables local attackers with no special privileges to corrupt memory, potentially leading to code execution or service disruption across affected system components. All Samsung Mobile Devices running firmware prior to SMR Aug-2026 Release 1 are exposed via this improper input validation flaw in the proprietary media codec. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of privilege requirements lower the bar for exploitation on any affected device with an unprivileged app installed.
Out-of-bounds memory write in Samsung's VC1 codec library libsavsvc.so allows local attackers to corrupt process memory on affected Samsung mobile devices. The root cause is an incorrect numeric type conversion during VC1 video decoding, a class of error that can produce exploitable integer truncation or overflow conditions leading to heap or stack corruption. No public exploit code has been identified at time of analysis, and the vendor has addressed this in the SMR Aug-2026 Release 1 security update.
SamsungPassAutofill prior to version 5.2.10.x on Samsung Android devices improperly exports application components, enabling a locally-installed malicious app to access sensitive autofill credential data with user interaction. The CVSS 4.0 vector (AV:L/PR:L/UI:A/VC:H) confirms the attack is constrained to on-device, low-privilege access requiring user-triggered activity, yielding a moderate score of 5.1 despite high confidentiality impact. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Cross-site request forgery in PingFederate's Administrative Console allows remote actors to trick authenticated administrators into unknowingly executing unauthorized actions - such as altering federation trust relationships, adding rogue identity providers, or modifying SP connections - by luring them to load attacker-crafted links while an admin session is active. All PingFederate releases prior to version 13.1 are affected, and the June 2026 release of 13.1 contains the vendor-confirmed fix. Proof-of-concept exploit code is publicly available per the CVSS 4.0 E:P threat metric, and no CISA KEV listing exists at time of analysis.
Stored cross-site scripting in Discourse's moderation review queue allows a low-privileged registered user to execute arbitrary JavaScript in a moderator's browser session. All Discourse deployments running versions prior to 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 are affected, but only when the platform's default Content Security Policy has been modified or disabled. No public exploit identified at time of analysis and no CISA KEV listing; real-world risk is bounded by both the CSP prerequisite and the requirement for moderator interaction.
Heap buffer overflow in entr's run_utility() function allows a local low-privileged user to trigger memory corruption, process abort, and denial of service by supplying crafted command-line arguments or by using the slash-underscore substitution feature, which expands a short token into a longer pathname at runtime. The flaw stems from incorrect use of strlcpy()'s return value - which reflects the total source length rather than bytes written - to advance a destination pointer, causing an unsigned size_t underflow in the remaining-buffer counter and subsequent out-of-bounds heap writes. No public exploit has been identified and this vulnerability is absent from CISA KEV; an upstream fix is available via commit 2467fe0.
Out-of-bounds write in Samsung's libcodec2secqcelpdec.so QCELP audio codec decoder library allows local attackers holding low-privilege execution on affected Samsung devices to corrupt adjacent memory regions, with limited confidentiality, integrity, and availability impact confined to the vulnerable system. The flaw is addressed in SMR Aug-2026 Release 1, Samsung's August 2026 Security Maintenance Release covering all prior unpatched firmware builds. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 4.4 reflects the strictly local attack surface and bounded impact scope.
SemClipboardService on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes an authorization bypass that allows a locally authenticated attacker to read clipboard contents without the expected permission check. The flaw is confined to Samsung's proprietary clipboard service and does not affect stock Android builds. No public exploit has been identified at time of analysis, and no active exploitation is listed in CISA KEV.
Device identity spoofing in Samsung Smart Switch's trouble scanning mode allows adjacent network attackers to impersonate trusted devices, potentially enabling interception or manipulation of data during device transfer sessions. All Smart Switch versions prior to 3.7.72.6 are affected, as reported by Samsung Mobile. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Process termination via systemd-machined v259 and later enables unprivileged users with active desktop graphical sessions to kill arbitrary system processes, including those running with elevated privileges, by exploiting an improper access control gap in the `register-machine` polkit action. The affected component - systemd-machined - is typically distributed as an optional, non-default package (such as `systemd-container`), and exploitation is strictly limited to desktop graphical login sessions, ruling out remote and SSH-based attack vectors entirely. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog.
Persistent XSS in Typemill CMS 2.x enables authenticated users holding theme-configuration access to store malicious JavaScript URI payloads via Markdown link syntax, which execute in victim browsers upon link click. The vulnerability exists in ParsedownExtension.php and TwigMarkdownExtension.php, where href values in Markdown links are rendered into HTML anchor tags without filtering the javascript: URI scheme, resulting in stored payloads that persist across all page loads. Successful exploitation delivers session cookie theft, authenticated request forgery, and credential harvesting against every visitor who clicks an injected link. No public exploit code or CISA KEV listing has been identified at time of analysis.
Hard-link path traversal in GNU cpio's tar extraction mode enables an attacker-controlled archive to create hard links pointing to files outside the intended extraction directory, defeating the security boundary that `--no-absolute-filenames` is designed to enforce. All GNU cpio versions tracked under CPE cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:* are affected when processing tar archives in copy-in mode; the upstream fix exists only as a source commit with no tagged release confirmed at time of analysis. No active exploitation has been identified (no CISA KEV listing, no public exploit code), and exploitation requires a user to actively extract an attacker-supplied archive, materially constraining opportunistic risk.
Terminal escape sequence injection and output spoofing in GNU cpio's archive-listing mode (`cpio -it`) allows an attacker who supplies a crafted archive to manipulate terminal display or forge listing entries on the victim's screen. All versions of GNU cpio are affected per CPE data (cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*), reported by CERT-PL. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, exploitation requires only basic knowledge of cpio archive format and ANSI escape sequences once a victim can be induced to inspect a crafted archive.
Stack overflow in GNU cpio's make_path function (src/makepath.c) causes a denial of service when a victim extracts a crafted archive. The function uses alloca() to allocate stack memory sized by an attacker-controlled pathname embedded in the archive, allowing unbounded stack growth and a process crash with no confidentiality or integrity impact. No active exploitation or public proof-of-concept has been identified at time of analysis; the upstream fix is available as a single commit.
Out-of-bounds memory copy in QEMU's vhost inflight migration VMState handler allows a privileged attacker with control of the migration channel to crash the destination QEMU process or corrupt heap memory. The root cause is a numeric type mismatch - the inflight buffer size is stored as uint64_t but deserialized by the VMS_VBUFFER load path as signed int32_t, so a crafted value with bit 31 set wraps to a massive size_t, causing qemu_get_buffer() to read far beyond the mmap-backed inflight region. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS score of 4.4 reflects the realistic high-privilege barrier to exploitation.
Improper cryptographic signature verification in Estonian RIA's libdigidocpp core library and its consumer applications - DigiDoc4, DigiDoc for Android, and DigiDoc for iOS - enables bypassing of XAdES signature validity checks through unhandled exceptional conditions during BDOC container parsing. Affected versions span libdigidocpp 4.1.0-4.2.0, DigiDoc4 4.7.0-4.8.1, DigiDoc Android 2.7.0-2.7.1, and DigiDoc iOS 2.8.0, all of which have vendor-released patches. A proof-of-concept is indicated by the CVSS 4.0 E:P exploit maturity modifier, though no active exploitation has been confirmed and this CVE is not listed in CISA KEV.
Discourse's Chat plugin exposes private thread message content to authenticated users who lack access to the private channel. The onebox handler in plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread using the route's thread_id before verifying whether the requesting user can access the associated channel_id, allowing a mismatched public-channel/private-thread pair to be submitted via /onebox.json. This is confirmed fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0; no public exploit or CISA KEV listing has been identified at time of analysis.
TopicLink authorization bypass in Discourse exposes restricted content metadata to authenticated users who lack permission to view those resources. All Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are affected. An authenticated user can craft internal links to private messages, restricted topics, or hidden posts and recover their canonicalized slugs or titles via the composer_messages duplicate_lookup API endpoint, even though those resources are not visible to them. No public exploit code or active exploitation has been identified at time of analysis.
Tag name information disclosure in Discourse's discourse-templates plugin exposes hidden tag names to any authenticated user via the /discourse_templates endpoint. The TemplatesSerializer in the plugin bypassed Discourse's Guardian authorization layer when serializing topic tags, causing tags belonging to restricted tag groups - such as staff-only labels - to appear in API responses regardless of the requesting user's permissions. Vendor-released patches are available across four version branches; no public exploit code or active exploitation has been identified.
Authorization bypass in Rocket.Chat's channels.convertToTeam REST endpoint allows any authenticated user holding the create-team permission to convert public channels they do not own or moderate into teams, circumventing the edit-room permission check entirely. Affected are all Rocket.Chat server deployments prior to versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1. No active exploitation has been confirmed and this vulnerability is not in CISA KEV, but the low exploitation complexity combined with network accessibility warrants timely patching in multi-tenant or community-facing deployments.
HCL BigFix Mobile leaks sensitive application internals through verbose error messages and improper exception handling, enabling authenticated network users to harvest stack traces, internal paths, or configuration details that materially assist reconnaissance. Confirmed by HCL under CVSS 4.3 (AV:N/AC:L/PR:L), the flaw requires only a low-privileged account to exploit and produces no integrity or availability impact - purely a confidentiality concern. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Missing authorization in ERPNext's Process Statement of Accounts module allows any authenticated low-privilege user to invoke the send_emails function and dispatch automated account statement emails to customers without holding the required role. Versions prior to 15.111.0 (v15 branch) and 16.22.0 (v16 branch) are affected across all ERPNext deployments using this accounts feature. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the vendor has released confirmed patches for both active version branches.
HashiCorp Vault's ACL policy engine inconsistently enforces wildcard (glob) deny rules against LIST requests when a trailing slash is appended to the denied path, enabling an authenticated token holder to enumerate secret entry names beneath paths it was intended to be denied access to. Affected versions span multiple Vault Enterprise release trains and Vault Community Edition prior to 2.0.3, with confirmed fixes released across all active branches. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 4.3 (Medium) reflects the constrained impact - path enumeration only - and the authenticated access prerequisite.
CyberChef's client-side pretty-recipe parser freezes victim browser tabs via a crafted URL fragment containing large numbers of unmatched quote characters, triggering catastrophic backtracking in a synchronous global regular expression. Any user of CyberChef prior to 11.3.0 who opens a malicious #recipe= URL - whether shared in phishing, chat, or embedded in a page - is subject to a temporary denial-of-service condition. No code execution, data exfiltration, or privilege escalation is possible; impact is confined to browser tab availability. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV.