Denial of service via crafted HTTP requests to the Remote Access SSL VPN service affects Cisco Secure Firewall ASA and FTD Software across a broad range of versions, enabling unauthenticated remote attackers to force an unexpected device reload and take down the firewall entirely. The Changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the VPN process itself to the entire device, disrupting all traffic passing through it. This vulnerability is confirmed actively exploited (CISA KEV), with SSVC marking it as automatable, making it a high-priority remediation target for any organization with internet-exposed ASA or FTD VPN endpoints.
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attacker to gain SYSTEM-level privileges through a use-after-free memory corruption flaw. Affected systems include Windows installations where the WinSock subsystem is active, which covers virtually all Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, though the high-complexity exploitation bar somewhat limits immediate opportunistic risk.
Remote code execution in Microsoft SharePoint is achievable by unauthenticated network attackers exploiting improper input validation (CWE-20), with the 'Authentication Bypass' tag indicating the flaw may circumvent access controls entirely. Three active SharePoint product lines are confirmed affected - Enterprise Server 2016, Server 2019, and the Subscription Edition - across a defined version range for each. Vendor patches are available from Microsoft; no public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible, zero-privilege attack vector makes this a high-priority patching target.
Privilege escalation via capture-replay authentication bypass in Microsoft Exchange Server 2016, 2019, and Subscription Edition exposes organizations to full mailbox and administrative compromise. An already-authorized low-privilege network user can intercept and replay authentication tokens to impersonate higher-privileged accounts, achieving high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing exists at time of analysis, but Microsoft has released patches across all affected cumulative update tracks.
Unauthenticated remote code execution in SAP Commerce Cloud's Data Hub Adapter lets attackers abuse a default authentication client to send specially crafted input to functions that lack sufficient validation, yielding arbitrary code execution and a scope change that compromises internal components. This is a maximum-severity CVSS 10.0 flaw (CWE-94 code injection) affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis, but the trivial attack profile (network, low complexity, no authentication, no user interaction) makes it a top-priority patch.
Path-traversal-driven remote code execution affects the Microsoft Teams client for Android in all builds prior to 1.0.0.2026133602, where improper restriction of pathnames (CWE-22) lets an unauthorized attacker escape the app's restricted directory and execute code over the network. Microsoft rates it CVSS 9.8, but real-world signals are muted: EPSS is 0.62% (47th percentile), CISA SSVC records exploitation status as 'none', and there is no public exploit identified at time of analysis. A vendor patch is available, making prompt client updates the decisive control.
Unauthenticated arbitrary file write in DB-GPT v0.8.1 lets remote attackers achieve remote code execution by smuggling directory-traversal sequences (../) through the user_id HTTP header of the Python file-upload endpoint. Because the header value is used unsanitized as a path component of the upload directory, an attacker can escape the intended python_uploads directory and drop attacker-controlled files into code-execution-sensitive locations such as Python startup hooks, cron directories, or agent scripts. Rated CVSS 4.0 9.3 (Critical); no public exploit identified at time of analysis, though a VulnCheck advisory and an upstream fix commit confirm the flaw.
Cross-site scripting in Microsoft Office SharePoint lets a remote, unauthenticated attacker inject script that executes in a victim's browser session to conduct spoofing, provided the victim is lured into interacting with the malicious content. Microsoft rates it 9.3 (Critical) with a scope-changed vector, reflecting that injected script escapes into the victim's authenticated SharePoint context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side request forgery with response read-back in SeaweedFS distributed storage (versions prior to 4.24) lets anyone able to reach a volume server's gRPC port coerce the server, via the unauthenticated VolumeServer.FetchAndWriteNeedle RPC, into fetching arbitrary attacker-chosen URLs and returning the response. Because the volume server gRPC plane is unauthenticated by default and the documented JWT hardening does not cover this RPC, an unauthenticated remote attacker (CVSS:3.1 AV:N/PR:N, base 9.3) can reach loopback, RFC 1918, link-local, and cloud metadata endpoints such as 169.254.169.254 to steal IAM credentials and pivot to internal services. No public exploit identified at time of analysis, and it is not in CISA KEV; the fix landed in version 4.24.
Privilege escalation in Adobe Commerce and Magento Open Source (including Adobe Commerce B2B) lets a remote attacker gain elevated access to sensitive resources through an incorrect authorization flaw, with no user interaction required. All supported branches from 2.4.4 through 2.4.9 (and B2B 1.3.3-1.5.3) prior to the August 2026 patch set are affected, and the CVSS 9.1 rating reflects high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as an unauthenticated, low-complexity authorization bypass in a widely deployed storefront platform it warrants urgent patching.
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results from a heap-based buffer overflow triggered by an integer overflow or wraparound condition in the runtime's memory handling. An unprivileged local user who interacts with a crafted input - such as a malicious file processed by a .NET application - can exploit the flaw to gain elevated privileges on the host system. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available from Microsoft.
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET release streams (8.0, 9.0, 10.0) and associated Visual Studio tooling. The flaw requires user interaction - consistent with a file-processing or input-parsing trigger - but no elevated privileges, meaning an attacker can exploit it by inducing a user to open or process a maliciously crafted artifact within a vulnerable .NET context. Full confidentiality, integrity, and availability compromise of the affected process is possible on successful exploitation. No public exploit identified at time of analysis and no CISA KEV listing; Microsoft has released patches across all affected branches.
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full code execution upon successful exploitation, with high impact across confidentiality, integrity, and availability. The vulnerability requires user interaction - such as opening a malicious file or running a crafted application - making social engineering a likely delivery vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Microsoft Security Response Center has acknowledged the issue.
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows a low-privileged local attacker to elevate privileges by triggering an uncaught exception (CWE-248) within the runtime. The CVSS scope change (S:C) indicates impact extends beyond the .NET security boundary to the underlying host system. No public exploit identified at time of analysis, and Microsoft has released patched versions across all affected branches.
Unauthenticated OS command injection in Claude Code Templates before 1.29.4 allows arbitrary shell command execution with the developer's privileges when the --studio flag is active. The vulnerable sandbox server (cli-tool/src/sandbox-server.js) bound to all network interfaces on port 3444, emitted Access-Control-Allow-Origin: *, and passed HTTP request-body fields - the prompt parameter to /api/execute and the agentName parameter to /api/install-agent - directly into child_process.spawn() with shell:true enabled, causing the shell to interpret attacker-controlled metacharacters. This vulnerability is not listed in CISA KEV; no confirmed public exploit code has been identified at time of analysis, but the detailed commit diff and security advisory provide sufficient technical disclosure for trivial reproduction.
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang .NET applications by supplying crafted input that exploits an unchecked loop termination condition. Affected are .NET 8.0 (all releases through 8.0.29), .NET 9.0 (through 9.0.18), .NET 10.0 (through 10.0.10), and bundled Visual Studio 2022 and 2026 installations. No public exploit has been identified at time of analysis, but the low attack complexity and lack of authentication requirement make this a credible automated threat against any internet-exposed .NET service. Vendor-released patches are available and should be applied promptly, particularly for externally reachable endpoints. Note: the ENISA EUVD tags this as 'Authentication Bypass,' which conflicts with the description and CVSS impact metrics (C:N/I:N/A:H); this discrepancy should be verified with Microsoft's advisory.
Cross-tenant authorization bypass in SeaweedFS filer JWT path authorization allows any authenticated tenant to read and write data belonging to sibling tenants whose path names share a string prefix. Versions prior to 4.24 are affected: a scoped JWT issued for /tenant1 inadvertently passes the authorization check for /tenant1234, /tenant1-old, and any other path that begins with the same character sequence, because the check used Go's raw strings.HasPrefix rather than a path-component boundary comparison. No public exploit code has been identified at time of analysis, but the bypass is mechanically trivial for any holder of a valid scoped token and the exact attack patterns are documented in the fix's test suite.
Unauthenticated remote code execution affects Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) gateways running Industrial OS with Node-RED installed, in all versions prior to V4.3.4.1. The Node-RED HTTP interface ships without authentication, exposing programming nodes that run system commands, so any attacker with network reachability can push malicious flows and execute code as the highest-privilege user. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 10.0 rating and trivial exploitation make this a top-priority patch for exposed devices.
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process compromise (C:H/I:H/A:H) across a broad product surface spanning .NET Framework 3.5 through 4.8.1, .NET 8.0, 9.0, 10.0, and Visual Studio 2022 and 2026. An attacker who can deliver crafted input processed by a vulnerable .NET application can trigger arithmetic wraparound (CWE-190) to corrupt runtime memory and execute arbitrary code within the process context. Microsoft has released patches across all affected product lines; no public exploit identified at time of analysis, and no CISA KEV listing is present.
Heap-based buffer overflow in Microsoft Office Word enables local code execution with full user-level impact when a victim opens a specially crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 (both Windows and Mac), and Office 365 for Mac. No public exploit identified at time of analysis, and no CISA KEV listing; however, the CVSS 7.8 score and complete C/I/A impact triad reflect the severity of arbitrary code execution achievable through a standard phishing or malicious file delivery scenario.
Code execution in Microsoft Word stems from a numeric truncation error (CWE-197) in the document processing engine, affecting Word 2016, Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise. Exploitation requires a user to open a specially crafted document, after which an attacker can execute arbitrary code with full confidentiality, integrity, and availability impact under the victim's session. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, Microsoft has confirmed and released a patch, indicating completed vendor triage.
Heap-based buffer overflow in Microsoft Office Word enables arbitrary local code execution when a user opens a specially crafted document. The vulnerability spans a broad set of affected products across both Windows and macOS platforms, including Office LTSC 2021/2024, Office 2019, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Outlook 2016. No public exploit code has been identified at time of analysis, though Microsoft has released a patch and the document-based delivery model is a proven and widely abused attack vector in enterprise phishing campaigns.
Stack-based buffer overflow in Microsoft Office Word enables local arbitrary code execution when a user opens a maliciously crafted document. Affected products span Word 2016 through Microsoft 365 Apps for Enterprise and LTSC 2021/2024 on both Windows and macOS. No public exploit identified at time of analysis, but Microsoft has released patches across all affected product lines via the August 2026 security update cycle.
Use-after-free memory corruption in Microsoft Office Word enables local code execution when a user opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms this is a social-engineering-dependent attack - no system privileges are required, but the victim must open a malicious file, making phishing or drive-by document delivery the likely delivery mechanism. All three impact dimensions (Confidentiality, Integrity, Availability) are rated High, yielding a 7.8 CVSS score; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word enables local code execution with High confidentiality, integrity, and availability impact when a user opens a specially crafted document. Affects Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Word 2016, and corresponding Mac editions. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the broad product footprint and low attack complexity make patch application a near-term priority for enterprise defenders.
Code execution via buffer over-read in Microsoft Office Word affects multiple Windows and Mac Office product lines when a user opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms this is a local exploitation scenario requiring user interaction - consistent with a malicious document delivery attack - yielding full confidentiality, integrity, and availability impact on the affected system. No special privileges are required from the attacker. No public exploit code or CISA KEV listing was identified in the provided intelligence at time of analysis.
Stack-based buffer overflow in Microsoft Office Word enables arbitrary code execution when a victim opens a specially crafted document, affecting Word 2016 through Microsoft 365 Apps and Office LTSC 2024 on both Windows and macOS. The flaw (CWE-121) scores CVSS 7.8 with high impacts across confidentiality, integrity, and availability, constrained by local attack vector and mandatory user interaction. No public exploit has been identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.
Arbitrary JavaScript code execution in Faker.js prior to 10.5.0 is achievable when attacker-controlled strings reach the `faker.helpers.fake` template engine. The vulnerability resides in `fakeEval.resolveProperty` in `src/modules/helpers/eval.ts`, where direct property access on a function return value (`entrypoint?.[key]`) allows traversal to the `Function` constructor via `constructor.constructor`, a classic sandbox escape. Applications that pass any user-supplied input to `faker.helpers.fake` on the server side are directly exposed to remote code execution; in local/development contexts, exploitation requires low-privileged access to control template strings. No public exploit identified at time of analysis, and the fix is available in version 10.5.0.
Cross-site scripting in Microsoft Teams for Android (versions below 1.0.76.202611302) enables an authenticated attacker to inject and render malicious content within a target user's Teams client, achieving spoofing of interface elements or participants over the network. The scope-changed CVSS vector (S:C, C:H) indicates the vulnerability can expose data beyond the Teams application boundary - potentially including session tokens or cross-context information - when a victim views attacker-controlled content. No public exploit code has been identified and SSVC classifies exploitation as none, though the high confidentiality impact warrants prioritized patching for organizations reliant on Teams for sensitive communications.
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to unauthenticated remote attackers over the network, resulting in high-severity information disclosure. Affected software spans .NET 8.0, 9.0, and 10.0 runtimes and Microsoft Visual Studio 2022 and 2026, all of which embed MsQuic as their QUIC and HTTP/3 transport layer. No CISA KEV listing or public exploit code has been identified at time of analysis, but the network-reachable, zero-authentication attack vector gives this a realistic exposure profile for any .NET service accepting QUIC connections from untrusted networks.
Prototype pollution and denial-of-service in Browserslist prior to 4.28.7 enable attackers to crash Node.js processes or corrupt object prototypes by supplying crafted stats data to the unconditionally-called `normalizeStats()` function. Any application that invokes `browserslist()` with attacker-influenced `browserslist-stats.json`, `opts.stats`, or CLI `--stats` input is at risk of an uncaught TypeError or object prototype modification. The vendor-released patch is available in version 4.28.7, and no public exploit has been identified at time of analysis.
Unbounded in-memory caches in Browserslist prior to 4.28.7 allow unauthenticated remote denial-of-service via Node.js out-of-memory crash when an attacker can influence repeated query values passed to browserslist() at runtime. Both the query-result cache and the parseQuery AST cache grew as plain JavaScript objects with no size cap, TTL, or eviction - the `since <year>-<month>-<day>` syntax provides a practically infinite key space ideal for flooding. The caller-controlled BROWSERSLIST_DISABLE_CACHE environment variable is ineffective as a compensating control because it only suppresses the result cache, not parseCache. No public exploit code has been identified and the vulnerability is not in CISA KEV; the vendor-released fix is version 4.28.7.
Integer overflow in nanoid's size coercion path silently corrupts the process-wide CSPRNG pool, causing every identifier generated after the trigger event to collapse to the deterministic fixed string 'uuuuuuuuuuuuuuuuuuuuu' for the entire remaining lifetime of the Node.js process. Applications relying on nanoid versions prior to 3.3.12 (v3 branch) or 5.1.11 (v5 branch) for session tokens, CSRF tokens, or API key generation are exposed to complete token predictability and forgery with no runtime error or log entry to signal the failure. No public exploit has been identified at time of analysis, but fixes are confirmed available in GitHub releases 3.3.12 and 5.1.11.
Authentication bypass in the Mira fertility-tracking cloud API allows any remote attacker to take over user accounts by supplying only a victim's email address and an arbitrary password, since the login endpoint validates the email but accepts any format-valid string as the password and returns a live active session token. Affecting Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4 (Quanovate Tech Inc, operating as Mira / Mira Care), this reported by CISA (ICSMA-26-223-01) carries a CVSS 4.0 base score of 9.3 and exposes sensitive reproductive-health (hormone) records and account settings. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated read/write access to reproductive-health profiles in the Mira Android app (v4.5.15.4) lets internet-based attackers view, forge, delete, or destroy stored fertility and reproductive health records. The flaw stems from hard-coded credentials (CWE-798) and is reachable over the network with no authentication or user interaction, carrying a CVSS 4.0 base score of 9.3. It was reported through CISA/DHS ICS-CERT as medical advisory ICSMA-26-223-01; no public exploit code or active-exploitation listing has been identified at time of analysis.
Remote code execution in Windows Deployment Services (WDS) allows an unauthenticated network attacker to trigger a use-after-free (CWE-416) and run arbitrary code on the affected server. The flaw spans virtually every supported Windows Server release (2012 through 2025) plus Windows 10 clients running the WDS role, and carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). Microsoft has released patches; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical but the low-complexity, no-auth network vector makes this a high patch priority.
Remote code execution in Microsoft High Performance Computing (HPC) Pack allows an unauthorized network attacker to run arbitrary code by submitting maliciously crafted serialized data that the product deserializes without validation (CWE-502). The flaw carries a CVSS 9.8 and requires no authentication or user interaction per the vector. A vendor patch is available; no public exploit has been identified at time of analysis.
HTTP request smuggling in System.Net.HttpListener across .NET 8.0, 9.0, and 10.0 enables unauthenticated remote attackers to bypass security features on Linux and macOS deployments. The flaw stems from inconsistent HTTP request interpretation (CWE-444), allowing crafted requests to circumvent authentication or access controls with high confidentiality impact. Exploitation carries high attack complexity (AC:H), no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing this in a monitored-but-not-emergency posture for most organizations.
Remote code execution in Microsoft's QUIC transport implementation (MsQuic) allows an unauthenticated network attacker to run arbitrary code by triggering a use-after-free (CWE-416) in the QUIC protocol handler across supported Windows 11 (23H2/24H2/25H2/26H1) and Windows Server 2022/2025 builds. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical, reflecting no authentication or user interaction and full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.
Remote code execution in the Windows DNS component allows an unauthenticated network attacker to run arbitrary code by triggering a stack-based buffer overflow (CWE-121). The flaw affects a broad range of Microsoft platforms from Windows 10 1607/1809 through Windows Server 2012 to Server 2025, including Server Core installations, and carries a CVSS 9.8 rating with no required privileges or user interaction. Microsoft has shipped fixes; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote code execution in the Windows iSCSI Target Service allows an unauthenticated network attacker to run arbitrary code by exploiting a heap-based buffer overflow (CWE-122) in the service's network-facing request handling. The flaw carries a critical 9.8 CVSS rating and is remotely reachable with no privileges or user interaction, meaning any exposed iSCSI Target endpoint can be compromised end-to-end. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote code execution in Malcolm (cisagov) prior to version 26.06.1 allows an authenticated user holding the ROLE_UPLOAD role to upload arbitrary PHP files through the FilePond file-upload component and trigger their server-side execution. The file-type allowlist in `file-upload/php/config.php` is an empty array by default, making the type check a no-op; the filename sanitizer further preserves the `.php` extension intact, and nginx routes any URL terminating in `.php` to php-fpm. No public exploit code has been confirmed and Malcolm is not listed in the CISA KEV catalog at time of analysis, but the CVSS 8.8 rating (CWE-434) and straightforward exploitation path make this a genuine priority for any deployment running a pre-26.06.1 release with RBAC enabled.
Unauthenticated arbitrary file read in Siemens License Server (SLS) versions prior to V5.3 allows remote attackers to traverse the filesystem and access sensitive files without any credentials. The root cause is missing sanitization of user-supplied path input (CWE-35), and the CVSS 4.0 score of 8.7 reflects network-exploitable access with no authentication or user interaction required and high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack complexity is low and the attack surface is any network-reachable SLS instance.
Privilege escalation in Microsoft OneDrive for macOS exploits improper symbolic link resolution (CWE-59), enabling a locally authorized high-privileged attacker to redirect OneDrive file operations to unintended filesystem locations and gain elevated access beyond their sanctioned scope. Affected versions span 26.0.0.0 up to but not including 26.095.0519.0003 on macOS exclusively. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog, though the full high-high-high CIA impact within the unchanged scope warrants prompt patching for any enterprise deploying OneDrive on macOS endpoints.
Unauthenticated BLE command execution in Mira hormone monitor firmware v1.7.1.47 build 01070147 allows any attacker within Bluetooth range (10-30 meters) to silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, and trigger denial-of-service via undocumented opcodes - all without credentials or user interaction. The device's static, non-rotating BLE address additionally enables persistent passive tracking of the user across physical encounters. Reported via CISA ICS Medical Advisory ICSMA-26-223-01; no public exploit code or CISA KEV listing identified at time of analysis.
Privilege elevation in Microsoft Azure Kubernetes Service (AKS) lets a network-based, unauthenticated attacker gain elevated privileges by reaching a critical function that lacks an authentication check (CWE-306). Microsoft rates it 9.4 (Critical) with an AV:N/AC:L/PR:N/UI:N vector, indicating trivial remote reachability and no user interaction, though scope is unchanged. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the missing-auth root cause and high confidentiality/integrity impact make it a high-priority cloud-platform issue.
OS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary operating-system commands in the context of the ColdFusion service account. Rated CVSS 10.0 with a scope change (S:C), this flaw stems from improper neutralization of special elements passed into an OS command and requires no user interaction. No public exploit identified at time of analysis, but ColdFusion's history as an attacker-favored target makes rapid patching essential.
Root-level OS command injection in wg-easy 15.3.0 lets a low-privileged web user holding the clients.create permission escalate to full host compromise. Because the client name is written verbatim into the WireGuard config, an attacker embeds newline-separated PostUp directives that wg-quick later executes as root. No public exploit identified at time of analysis, but the CVSS 9.9 (S:C, full C/I/A) and simple, GUI-driven injection make this a high-priority issue for any exposed wg-easy instance.
Local privilege escalation in Siemens License Server (SLS) versions prior to V5.1 allows a local attacker with elevated operating system privileges to execute arbitrary commands and write malicious files as root, resulting in full system compromise. The root cause is an insecure sudoers policy (CWE-732) that grants overly permissive command execution rights, enabling abuse of sudo rules to break out of intended privilege boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-integrity and high-confidentiality impact on the vulnerable system underscores urgency for organizations running SLS in multi-user or shared infrastructure environments.
BLE peripheral spoofing in Mira Android companion app v4.5.15.4 allows an adjacent attacker to impersonate a Mira hormone analyzer by broadcasting a matching BLE advertisement name substring, bypassing all peripheral authentication. An attacker within Bluetooth range can intercept live session tokens from a victim's device and inject falsified hormone measurements directly into the victim's cloud health record and clinical trend views. Reported via CISA ICS Medical Advisory ICSMA-26-223-01; no public exploit code or CISA KEV listing is identified at time of analysis.