Path traversal in o1lab/xmysql (all versions) allows unauthenticated remote attackers to read and download arbitrary files from the host server via a crafted query parameter. The flaw exists in lib/xapi.js at lines 338 and 424, where the unsanitized req.query.name value is joined with the working directory and passed directly to res.download(), enabling ../ sequences to escape the application root. No patch has been released and all versions are confirmed affected, making every exposed instance immediately actionable for attackers with network access.
Path traversal in mustafaakin/cast-localvideo (all versions) exposes arbitrary server files to unauthenticated remote attackers with trivial effort. The Node.js HTTP handler in app.js at lines 151-153 passes the user-supplied `req.body.dir` parameter directly to `res.sendFile()` without any path sanitization, permitting `../` sequences or absolute paths to escape the intended directory. No patch has been identified at time of analysis, no public exploit has been confirmed, and the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector means any internet-facing deployment is trivially exploitable.
Heap out-of-bounds write in GStreamer's adpcmdec element allows a crafted WAV file containing malformed multi-channel IMA/DVI ADPCM audio to corrupt application memory, cause denial of service, or potentially achieve arbitrary code execution. Affected deployments include Red Hat Enterprise Linux 7 through 10, where the vulnerable gst-plugins-bad package is distributed. No confirmed active exploitation (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 7.6 reflects the realistic network-deliverable, user-interaction-dependent attack path.
Stored XSS in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to persist malicious JavaScript in the application by uploading an SVG file as a profile avatar. The avatar upload pipeline trusts the client-supplied filename to determine both the stored file extension and the S3 content-type header, so a crafted SVG containing a script element is stored and later served with a permissive content type. Any user who subsequently views the attacker's profile or avatar triggers execution of the injected script in their browser, enabling session theft or further client-side attacks. No public exploit code has been identified at time of analysis.
OS command injection in NASA HyperCP's OBPGSession.py enables arbitrary code execution on a researcher's workstation when a network-adjacent attacker spoofs or intercepts responses from oceandata.sci.gsfc.nasa.gov. The vulnerable handler passes unsanitized server response header fields directly to subprocess calls, meaning a MitM-positioned attacker can achieve full compromise of the victim machine by injecting shell metacharacters into crafted HTTP response headers during any HyperCP data download operation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-adjacent attack vector combined with complete C/I/A impact makes this a critical threat for research institutions operating on untrusted or shared networks.
Denial of service in ml-metadata (MLMD), a core metadata tracking component of Red Hat OpenShift AI (RHOAI), stems from an outdated statically-linked gRPC stack that retains known HTTP/2 resource exhaustion weaknesses. An in-cluster adversary with network reachability to the MLMD pod can crash it by sending specially crafted HTTP/2 requests, halting all ML pipeline runs within the affected namespace. No public exploit has been identified at time of analysis, and exploitation is constrained to actors already operating inside the Kubernetes cluster.
Unauthenticated remote access to all stored contract documents is possible in OpenSignLabs opensignserver through version 2.37.0 due to a missing authentication check in the fileupload Parse cloud function. Any unauthenticated attacker who can reach the endpoint can supply an arbitrary URL and receive a MASTER_KEY-signed file access token, completely defeating the only access control layer protecting stored documents. No public exploit has been identified at time of analysis, but the zero-privilege, low-complexity attack vector makes this highly accessible to unsophisticated threat actors.
Unauthenticated denial-of-service in Mastodon's admin statistics API allows any remote caller to exhaust server database resources by submitting crafted requests to the measures and retention endpoints before authorization is enforced. Mastodon instances on versions prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1 are exposed; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, authentication-free exploitation at network range. No public exploit code or CISA KEV listing has been identified, but the low attack complexity and broad API exposure make unpatched public-facing instances an easy target for service disruption.
Unauthenticated classpath asset disclosure in Apache Tapestry 5.5.0 through 5.9.0 exposes arbitrary files on the Java classpath to remote attackers via specially crafted HTTP URLs. The tapestry-core component fails to restrict URL-based access to classpath resources, meaning attackers can retrieve sensitive files such as configuration files, properties files containing credentials, and compiled .class files. No public exploit code has been identified at time of analysis, but the attack requires no authentication, no user interaction, and minimal complexity - lowering the bar for exploitation significantly.
Authentication bypass in opensignserver through 2.37.0 exposes all stored files to unauthenticated remote attackers by allowing them to mint MASTER_KEY-signed file access tokens via the getsignedurl Parse cloud function. The bypass requires no credentials and no prior knowledge of valid document records - supplying any arbitrary string as the docId parameter causes the function to skip its isAuthenticated check entirely and issue a fully trusted signed token. No public exploit code or CISA KEV listing exists at time of analysis, but the bypass condition is trivially reproducible from the CVE description alone, making this a realistic and immediate threat to any internet-exposed instance storing sensitive signed documents.
TLS hostname verification failure in Apache Ranger Client Code allows network-positioned attackers to intercept sensitive traffic via man-in-the-middle attacks against all deployments running version 2.8.0 or earlier. The client fails to validate that a server's TLS certificate hostname matches the actual server being contacted (CWE-297), meaning a forged or mismatched certificate will be accepted silently. A vendor-released patch is available in version 2.9.0; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Credential derivation in Red Hat OpenShift AI's Data Science Pipelines Operator allows unauthenticated remote attackers to predict MariaDB root/user passwords and MinIO access/secret keys by exploiting a cryptographically weak PRNG (CWE-338). Any attacker who can reach the MinIO Route or MariaDB Service over the network can compute valid credentials without prior authentication, then access all pipeline artifacts and metadata stored in the system. No active exploitation is confirmed and no public exploit code has been identified at time of analysis, but the CVSS 7.5 High rating with AV:N and PR:N reflects a no-authentication-barrier condition against exposed services.
Unauthenticated access to complete historical sensor data is possible in FUXA through version 1.3.3 because the DAQ_QUERY Socket.IO event handler in server/runtime/index.js omits the isSocketAdminAuthorized() check that guards every other sensitive Socket.IO event. Remote attackers can exfiltrate all sensor history without credentials even on deployments where secureEnabled=true is configured, silently undermining an operator's assumption that authentication is fully enforced. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS AV:N/AC:L/PR:N vector confirms this is trivially exploitable by any network-reachable party.
NULL pointer dereference in fastschema through v0.15.1 enables an unauthenticated remote attacker to crash the entire server process with a single HTTP request targeting the password-recovery endpoint. The flaw originates in the sendOTPEmail function in pkg/auth/local.go, which dereferences a pointer from an unchecked error path without nil validation, triggering a fatal Go panic that terminates the server. No public exploit or CISA KEV listing has been identified at time of analysis, but the trivial exploitation path (no authentication, no special configuration, single request) makes this a high-priority availability risk for any internet-exposed fastschema deployment.
Zephyr RTOS versions 3.7.0 through 4.4.1 expose a remotely triggerable NULL pointer dereference in the UpdateHub OTA firmware-update agent that crashes and resets any affected device. The probe handler parses CoAP-delivered JSON metadata into a fixed nested-array struct but validates only the outer array length, leaving the inner sha256sum pointer NULL when the server returns an empty inner object array; a subsequent strlen() on that NULL pointer produces a fatal CPU fault. A malicious or compromised UpdateHub server - or a network man-in-the-middle when DTLS is disabled - can trigger this unconditionally. No public exploit is identified at time of analysis; a vendor patch is available in version 4.4.2.
Broken object-level authorization in OpenSignLabs OpenSignServer through 2.37.0 exposes complete contract records - including sender and signer PII and pre-signed document download URLs - to unauthenticated remote attackers via the getDocument Parse cloud function. The function internally calls useMasterKey, bypassing Parse's ACL enforcement, and returns full records whenever the document's IsEnableOTP flag is false, which is the default configuration across all deployments. No public exploit has been identified at time of analysis, but the network-accessible, zero-authentication attack path against default configurations makes this a high-priority data protection issue, particularly for organizations subject to GDPR or similar data regulation.
GitHub App provider injection in Dokploy PaaS (prior to v0.29.13) allows unauthenticated remote attackers to insert attacker-controlled GitHub App credentials - including client_secret, webhook_secret, and PEM private key material - into any target organization's configuration by forging the state parameter in the GitHub OAuth callback route. The route /api/providers/github/setup performed no session authentication (CWE-306), blindly trusting organizationId and userId values supplied by the caller in the state query parameter. No public exploit identified at time of analysis; a vendor-released patch is confirmed available as v0.29.13.
Authenticated regular users on Mastodon instances running 4.6.0-beta.1 through 4.6.3 can access personally identifying information - specifically the email address and last-used IP address - belonging to any other local user by invoking the admin collections controller show action, which incorrectly resolved to the general collection policy instead of the admin-scoped policy. The root cause is a single missing namespace argument in a Pundit authorize call (authorize @collection vs. authorize [:admin, @collection]), confirmed by commit diff and fixed in the 4.6.4 stable release. No public exploit code has been identified at time of analysis; notably, the NVD-assigned CVSS PR:N (unauthenticated) conflicts with the description's explicit requirement for a logged-in local user, overstating the raw score.
Missing authorization in OpenSignLabs opensignserver through 2.37.0 lets unauthenticated remote attackers irreversibly decline any in-flight signing document and forge the decline attribution to an arbitrary user. The vulnerable declinedoc Parse cloud function writes the IsDeclined flag, DeclineReason text, and a caller-supplied DeclineBy pointer to the document record without verifying the caller's identity, enabling both workflow termination and evidentiary record falsification. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Denial of service in Apache IoTDB's Thrift-based RPC service allows remote unauthenticated attackers to crash the database by sending a single crafted malformed frame. Improper validation of length fields (CWE-789) causes IoTDB to attempt arbitrarily large heap allocations, exhausting JVM memory and terminating the process with an OutOfMemoryError. Versions before 1.3.8 on the 1.x branch and 2.0.0 through 2.0.8 on the 2.0.x branch are affected; no public exploit code or CISA KEV listing has been identified at time of analysis.
Memory exhaustion in the Linux kernel TCP stack allows remote network-reachable attackers to trigger a reference leak in tcp_tw_bucket structures when PSP (Packet Security Protocol) policy lookup fails during packet processing in both IPv4 and IPv6 receive paths. TIME_WAIT socket references are not released on this failure path, causing a gradual accumulation of unreclaimable kernel memory. The CVSS score of 7.5 (High) reflects the network accessibility and potential for denial-of-service via memory exhaustion, though EPSS at 0.21% (11th percentile) and the absence from CISA KEV indicate no public exploit or confirmed active exploitation at time of analysis.
Null pointer dereference in the Linux kernel's libceph client crashes affected hosts processing malformed CRUSH map data from a Ceph cluster. Specifically, get_immediate_parent() during localized read selection fails to validate that a parent bucket's type has a corresponding entry in type_names before dereferencing type_cn, which may be NULL when the CRUSH map contains an incomplete hierarchy. Any Linux host acting as a Ceph client - including Kubernetes nodes with Ceph-backed persistent volumes and OpenStack compute nodes - is vulnerable to a kernel panic triggerable by a party controlling or compromising the upstream Ceph cluster. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.20% (10th percentile), but the network-accessible crash path and the wide deployment of Ceph in enterprise environments make patching a practical priority.
Kernel panic via crafted zero-monitor Ceph monmap in Linux libceph allows a network-reachable attacker to crash systems running the Ceph client. The libceph subsystem's ceph_monmap_decode() function fails to reject CEPH_MSG_MON_MAP messages advertising zero monitors - a logically impossible state, since no live monitor could emit such a map - accepting the corrupted payload as valid. Subsequent session establishment in __open_session() calls pick_new_mon(), where the hardcoded assertion BUG_ON(monc->monmap->num_mon < 1) triggers an immediate kernel panic. With EPSS at 0.20% (10th percentile) and no CISA KEV listing, large-scale exploitation is not currently observed, but the unauthenticated network-reachable CVSS vector makes this relevant for any environment running Ceph-attached Linux hosts.
Kernel panic via buffer overrun in the Linux kernel's drop_monitor subsystem when reporting packet drop events on 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS. The size calculation functions net_dm_packet_report_size() and net_dm_hw_packet_report_size() under-budget SKB allocation by up to 4 bytes, failing to account for the alignment padding that nla_put_u64_64bit() inserts on affected architectures, resulting in skb_over_panic() and a full kernel crash. No public exploit is known, and EPSS at 0.20% (10th percentile) reflects low exploitation probability consistent with the architecture-specific trigger condition.
Recursive locking deadlock in the Linux kernel audit subsystem causes a complete, unrecoverable kernel hang when a file matching an executable audit rule is renamed. Affected kernels from 4.3 through stable branches prior to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc1 are vulnerable. Any local user able to rename a file that matches an active exe= audit rule can trigger the deadlock, forcing a hard reboot; no public exploit exists and EPSS is 0.18%, consistent with the specific preconditions required.
NULL pointer dereference in the Linux kernel's af_iucv network subsystem allows a remote attacker to crash a vulnerable kernel via a crafted SYN packet under low-memory conditions, resulting in a denial of service. The flaw resides in afiucv_hs_callback_syn(), where an unconditional call to iucv_sock_kill(nsk) is made even when nsk is NULL following a failed GFP_ATOMIC socket allocation, causing an immediate kernel panic. No public exploit is identified at time of analysis, and EPSS sits at 0.18% (7th percentile), reflecting low probability of widespread exploitation; however, the mainframe-specific HiperSockets network path reduces the realistic attacker pool significantly.
Kernel crash via assertion failure in the RBD (RADOS Block Device) subsystem of the Linux kernel allows a denial-of-service condition when a crafted or corrupted OSD reply message with a positive result code is received during an object map update. Affected kernels from 5.3 onward lack the positive-result-code reset in `rbd_object_map_callback()` that already exists in `rbd_osd_req_callback()`, causing `rbd_assert(*result < 0)` in `__rbd_obj_handle_request()` to trigger and crash the kernel. No public exploit has been identified at time of analysis, and EPSS stands at 0.18% (7th percentile), indicating low observed exploitation probability.
Permanent network Rx queue stall in the Linux kernel GVE (Google Virtual Ethernet) driver allows denial of service under extreme memory pressure conditions affecting Google Cloud VM instances. When page allocations fail during the Rx buffer refill loop, posted buffers can drop below the 32-descriptor threshold, causing the device to drop incoming packets; because no Rx completions are generated, NAPI is never rescheduled, creating a self-reinforcing deadlock that persists even after memory is freed. No public exploit has been identified and EPSS is 0.18% (7th percentile), but the availability impact is total network loss for the affected VM - the assigned CVSS 7.5 reflects the severity of that outcome, not ease of triggering it.
Kernel panic via integer overflow in the SCTP stream-reset path allows an unauthenticated remote peer to crash Linux systems running SCTP on interfaces with MTU exceeding 65535 bytes. sctp_process_strreset_inreq() fails to validate that the RESET_OUT_REQUEST constructed in response to a peer's RESET_IN_REQUEST would stay within SCTP_MAX_CHUNK_LEN, causing a __u16 overflow in sctp_make_strreset_req() that produces an undersized socket buffer and a fatal kernel BUG. No public exploit has been identified and EPSS is 0.17% (6th percentile), but the impact is total denial of service on affected hosts.
Kernel panic (denial of service) in the Linux kernel vmxnet3 driver affects VMware-hosted Linux guests receiving Geneve-encapsulated network traffic. The vmxnet3_get_hdr_len() function contains unguarded BUG_ON() assertions that assume hardware completion descriptor flags always describe outer headers; when the VMware VMXNET3 hardware signals inner-header processing of a Geneve tunnel packet via the VMXNET3_RCD_HDR_INNER_SHIFT bit, these assertions fire against the wrong protocol fields, crashing the kernel. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), reflecting very low current exploitation interest despite the elevated CVSS 7.5 base score.
TX hang vulnerability in the Linux kernel rtase driver allows denial of service by causing the Realtek RTASE hardware packet parser to stall when it encounters incomplete IPv4, IPv6, TCP, or UDP transport headers, or undersized UDP packets on PTP ports 319/320. Systems running kernels from commit d6e882b89fdf80be0ab4f914ec10f75215e49495 through the respective patched releases and equipped with Realtek RTASE network hardware are affected. No public exploit has been identified at time of analysis, and EPSS at 0.17% (6th percentile) indicates extremely low real-world exploitation probability.
Uninitialized kernel memory disclosure via TCP-AO padding bytes affects Linux kernels since v6.7 (commit decde2586b34). When constructing standalone TCP responses - ACKs and RSTs - with TCP Authentication Option (TCP-AO) enabled, one to three alignment padding bytes following a non-four-byte-aligned MAC are left uninitialized and transmitted on the wire, leaking small amounts of kernel memory to on-path observers. No public exploit exists and EPSS is 0.17% (6th percentile), making this low-urgency despite the vendor-assigned CVSS 7.5 score; the C:H rating is likely overstated given the 1-3 byte disclosure boundary.
Use-after-free in the Linux kernel cfg80211 WiFi subsystem exposes systems with wireless adapters to potential kernel memory corruption via a race condition between scheduled scan result processing and WiFi device unregistration. All Linux kernel versions from approximately 3.0 (commit 807f8a8c) through stable releases prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6 are affected wherever cfg80211-based WiFi drivers are in use. No public exploit has been identified at time of analysis, and EPSS at 0.16% (6th percentile) reflects low current exploitation probability despite the kernel-level C:H/I:H/A:H impact potential.
Remote unauthenticated account takeover in fastschema through v0.15.1 is enabled by a TOCTOU race condition in the OTP-based account recovery flow. The verifyOTPSession function in pkg/auth/local.go reads and increments the attempt counter in separate non-atomic operations, allowing concurrent HTTP requests to race past the attempt limit before any counter update is committed. With no effective limit enforced on a 6-digit OTP (1,000,000 possible values), an attacker can brute-force valid codes; no public exploit is identified at time of analysis and this CVE is not in CISA KEV.
Hard-coded credentials embedded in the Zyxel WAH7601 mobile Wi-Fi hotspot firmware expose sensitive constants within the device executable, enabling adjacent-network attackers without any prior privileges to bypass authentication and achieve high-impact confidentiality and integrity compromise. All WAH7601 firmware versions through 20.07.2026 are confirmed affected per TR-CERT advisory TR-26-0799 and NVD. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity characteristic of CWE-798 makes this a credible near-term risk in environments where adjacent access is not tightly controlled.
Buffer overflow in the Linux kernel's Amlogic C3 ISP driver allows a local low-privileged attacker to trigger out-of-bounds memory access via crafted camera parameter configurations, with potential for kernel memory disclosure and system crash. Affected functions c3_isp_params_awb_wt() and c3_isp_params_ae_wt() in drivers/media/platform/amlogic/c3/isp/c3-isp-params.c fail to validate zones_num against the fixed-size zone_weight array bounds (768 entries for AWB, 255 for AE). Patched upstream in kernel versions 6.18.42, 7.1.6, and 7.2-rc1; EPSS is 0.21% with no public exploit or CISA KEV listing, indicating low active exploitation pressure.
Out-of-bounds kernel memory access in the Linux drm/xe Intel GPU driver allows a local low-privileged user to read sensitive kernel memory, cause a kernel panic, or potentially corrupt kernel state. The flaw exists in the BO (buffer object) prefetch path of the Intel Xe GPU subsystem, where DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC (value -1) is incorrectly used as an array index into region_to_mem_type[], accessing memory before the array's base address. Discovered via AI-assisted static analysis confirmed by Intel Product Security; no public exploit or CISA KEV listing identified at time of analysis.
Missing hardware facility validation in the Linux kernel's ptp_s390 driver exposes IBM System z (s390x) mainframes to potential kernel crashes and hardware register state disclosure when the driver registers the physical clock without confirming that Facility 28 is installed and that PTFF QPT is available. The vulnerability affects kernel versions from commit 2d7de7a3010d713fb89b7ba99e6fdc14475ad106 through the respective fix commits across multiple stable branches, with patched releases at 6.18.42, 7.1.6, and 7.2-rc5. No public exploit has been identified and EPSS probability stands at 0.17%, consistent with the niche IBM mainframe hardware dependency that sharply constrains the exploitable population.
Heap buffer overflow in the Linux kernel's SCTP authentication subsystem allows a local low-privileged user to corrupt kernel memory by adding more than 16 authentication chunk types to an SCTP endpoint. The capacity mismatch between sctp_auth_ep_add_chunkid()'s limit of SCTP_NUM_CHUNK_TYPES (20 entries) and the destination struct sctp_cookie's SCTP_AUTH_MAX_CHUNKS (16 entries) causes sctp_association_init() to memcpy up to 4 bytes past the auth_chunks buffer boundary. No public exploit has been identified at time of analysis and EPSS sits at the 6th percentile, but the kernel-space memory corruption potential and CVSS score of 7.3 warrant timely patching on any system where untrusted local users have shell access.
Command injection in Kitty terminal emulator prior to v0.48.2 allows arbitrary shell command execution when a user views attacker-controlled terminal output. The @kitty-echo DCS handler writes printable shell command characters directly to the child shell's stdin without sanitization, while the @kitty-ssh handler emits a newline via get_ssh_data - chaining the two handlers delivers a complete command-plus-newline to the running shell, executing attacker-supplied code as the user. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; a vendor-released patch is available in v0.48.2.
Incorrect default permissions in Samsung Bixby prior to version 4.0.86.0 allow a local attacker with low privileges to execute arbitrary commands within the Bixby process context. The flaw exists in the out-of-box permission configuration - no special user-triggered setup is required to be vulnerable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the local privilege escalation to Bixby's execution context presents meaningful risk for shared-device and enterprise fleet environments.
Privilege escalation in Red Hat OpenShift AI's Data Science Pipelines component allows authenticated tenants to bypass authorization controls in the setDefaultServiceAccount function by submitting a crafted CreateRun request that references a more privileged ServiceAccount than they are entitled to use. Successful exploitation enables the tenant's pipeline containers to run with elevated Kubernetes RBAC permissions, resulting in cross-namespace secret disclosure and the ability to execute commands inside other tenants' pods. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Full application database read in Metabase is achievable by any authenticated low-privileged user due to a missing authorization check (CWE-862). Any user with a valid account - regardless of their assigned role or permissions - can issue requests that return the entire contents of the Metabase backend database, potentially exposing database connection credentials, API keys, user account data, and sensitive query results. No public exploit has been identified at time of analysis, but the low exploitation complexity and broad attacker pool (any registered user) make this a high-priority remediation item.
Broken access control in ERPNext's accounts module permits authenticated low-privilege users to invoke privileged write operations across five functions - merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center - without any server-side permission enforcement. All v15 releases prior to 15.112.0 and all v16 releases prior to 16.22.0 are affected. An attacker with any valid ERPNext session can directly call these whitelisted API endpoints to corrupt financial accounts, payment reconciliation jobs, purchase invoices, and cost centers beyond their assigned role, with no public exploit identified at time of analysis.
Broken access control in ERPNext's Accounts Receivable and Payable report engine allows any authenticated user to read cross-company financial data they are not authorized to view. The `ReceivablePayableReport.prepare_conditions()` method fails to enforce Customer and Supplier user permissions against the Payment Ledger Entry dynamic-link party field, meaning permission boundaries set via Frappe's user permission system are silently bypassed for this report path. Fixed in versions 15.112.0 and 16.23.0; no public exploit identified at time of analysis.
Cross-tenant authorization bypass in Attendize through commit 9289acb permits an authenticated organizer to inject persistent, mandatory survey questions into a different organizer's events by supplying an arbitrary event_id to the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method resolves the target event without applying tenant-isolation scoping, so the write succeeds across tenant boundaries; the injected question is then irremovable by the victim because the victim's account-scoped delete path cannot resolve a record owned by another tenant. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Integer overflow and underflow flaws in GStreamer's gst-plugins-ugly ASF demuxer expose systems to denial of service and limited heap data disclosure when processing attacker-controlled media files. The asfdemux plugin fails to adequately validate length and size fields inside ASF/WMV/WMA header objects, allowing arithmetic overflows to bypass bounds checks and trigger out-of-bounds heap reads. Any application or user that opens an untrusted media file through a GStreamer pipeline - browsers, media players, thumbnailers - is exposed; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Redis Cluster Bus PING message parsing affects Redis through version 8.8.1, enabling adjacent unauthenticated attackers to trigger denial of service or extract limited heap memory contents. The root cause is in the getPingExtLength() function, which fails to validate extension length fields against the actual remaining buffer size, allowing a crafted gossip-protocol PING packet to drive the parser past the allocated buffer boundary. No public exploit has been identified at time of analysis, and this vulnerability has not been confirmed in the CISA KEV catalog.
SQL injection in Discourse's Data Explorer plugin exposes the entire database to unauthorized reads by any user who can execute a shared parameterized query, including non-staff group members. The flaw stems from recursive parameter interpolation: a crafted parameter value could introduce additional parameters, and SQL comment syntax could be used to inject arbitrary statements. Queries execute in a read-only PostgreSQL transaction, so writes are blocked, but every database table - including private messages, user emails, hashed credentials, and API keys - is readable. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Out-of-bounds read in the Linux kernel Cedrus V4L2 stateless H.264 video decoder driver exposes kernel memory and can cause system instability when a local low-privileged user submits crafted H.264 decode requests with invalid DPB reference indices. The flaw exists in `_cedrus_write_ref_list()`, which uses userspace-supplied ref_pic_list0/ref_pic_list1 index values to index into the fixed `decode->dpb[]` array without bounds validation, accepting out-of-range sentinel values that are technically legal in the stateless H.264 API but were never guarded at the driver use site. No public exploit identified at time of analysis; EPSS of 0.20% at the 10th percentile reflects the niche hardware platform and local-only access requirement.