Microsoft Exchange Server's handling of serialized data exposes organizations running Exchange 2016 CU23, Exchange 2019 CU14/CU15, and Exchange Subscription Edition to denial-of-service attacks from low-privileged, network-authenticated users. An authorized attacker exploiting this CWE-502 deserialization flaw can disrupt Exchange availability without requiring elevated permissions, potentially taking down email infrastructure for all dependent users and connected services. Microsoft has released cumulative update patches addressing this vulnerability; no public exploit has been identified at time of analysis.
Privilege escalation in Windows DNS affects a broad range of Windows 10, Windows 11, and Windows Server releases through a numeric truncation error (CWE-197) in the DNS component. An authorized local attacker already holding high-privilege credentials can exploit this flaw to achieve full compromise of confidentiality, integrity, and availability on the affected host. Microsoft has released patched builds across all affected version lines; no public exploit code exists and no active exploitation has been identified at time of analysis.
Privilege escalation in the Windows DNS service affects a broad range of Windows client and server versions from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all major feature releases. The vulnerability stems from a numeric truncation error (CWE-122, heap-based buffer overflow) that an already-privileged local attacker can trigger to gain elevated access beyond their current privilege level. No public exploit code and no CISA KEV listing are present at time of analysis, but Microsoft has released patches across all affected product lines.
Local privilege escalation in Windows DNS affects a broad range of Windows client and server operating systems, enabling an already-authenticated local attacker to gain elevated privileges on the target system. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates the attacker requires high existing privileges - consistent with the description's reference to an 'authorized attacker' - yet can achieve full confidentiality, integrity, and availability impact post-exploitation. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog; a vendor-released patch is available via Microsoft's Update Guide.
Privilege escalation in Windows DNS across a wide range of Windows 10, Windows 11, and Windows Server releases exploits a numeric truncation error (CWE-122, heap-based buffer overflow) to allow an authorized local attacker with high privileges to fully compromise the vulnerable system. Affected builds span from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, with vendor-supplied patches now available from Microsoft MSRC. SSVC assessment confirms no current exploitation activity and the vulnerability is not automatable, though technical impact is rated total across confidentiality, integrity, and availability.
Deserialization of untrusted data in Microsoft SharePoint Server exposes networks to spoofing attacks by authenticated low-privileged users. Confirmed affected versions span SharePoint Enterprise Server 2016, SharePoint Server 2019, and the Subscription Edition. The CVSS vector (PR:L, C:H, I:N) indicates an authenticated attacker can leverage unsafe deserialization to impersonate another identity or access confidential data, though no public exploit code or CISA KEV listing has been identified at time of analysis.
Information disclosure in Intel PROSet/Wireless WiFi Software at Ring 0 (kernel level) exposes sensitive system data to privileged local adversaries who bypass improper authentication controls within the kernel driver. Affected systems include any platform running Intel PROSet/Wireless WiFi Software, with the exact version range deferred to Intel Security Advisory INTEL-SA-01468. No active exploitation has been confirmed (not listed in CISA KEV), no public exploit code has been identified, and the CVSS 4.0 base score of 6.7 reflects the significant mitigation offered by the high-privilege local access prerequisite.
Heap out-of-bounds read in Tesseract OCR prior to version 5.5.3 allows an attacker who can supply a crafted .traineddata model file to crash the OCR process before any image processing occurs. The flaw in SquishedDawg::read_squished_dawg accepts unterminated forward-edge runs, after which num_forward_edges(0) causes last_edge to read beyond the edges_ heap buffer - triggering a process crash. No public exploit has been identified at time of analysis; vendor-released patch version 5.5.3 is available and the fix is confirmed by PR #4581 and the GitHub release tag.
Remote Registry Service denial of service in Microsoft Windows allows network-authenticated attackers to crash the service via a crafted RPC request triggering a null pointer dereference. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that any domain or local account with network access to the service is sufficient for exploitation - no elevated privileges required. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Null pointer dereference in the Windows Remote Registry Service enables an authenticated network attacker to crash the service, resulting in denial of availability for remote registry operations across a broad range of Microsoft platforms. Affected builds span Windows 10/11 consumer releases and Windows Server 2012 through Server 2025, representing the near-entirety of Microsoft's currently supported Windows footprint. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact, positioning this as a standard patch-cycle priority rather than an out-of-band emergency.
Remote code execution via race condition in Windows DNS affects authorized, high-privileged attackers across a broad range of Windows Server and Windows client versions. The CWE-362 race condition allows an attacker who already holds elevated credentials to exploit concurrent shared-resource access in the DNS service, achieving full code execution (C:H/I:H/A:H) over the network. No public exploit or CISA KEV listing is identified at time of analysis, and Microsoft has released patches; the PR:H and AC:H constraints substantially limit realistic exploitation.
Out-of-bounds read in Microsoft Office Excel enables remote information disclosure when a user opens a specially crafted spreadsheet. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms that an unauthenticated network-based attacker can trigger the flaw, but only after social engineering a victim into opening a malicious file. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches across all affected Office product lines.
Out-of-bounds read in Microsoft Excel exposes sensitive memory contents over a network to unauthenticated remote attackers, resulting in high-confidence information disclosure (C:H). Exploitation requires user interaction - specifically, opening a crafted Excel document - placing this firmly in the phishing/malicious-attachment delivery class. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at the time of analysis, though the patch is available and should be applied promptly given the ubiquity of the affected product across enterprise environments.
Information disclosure in Windows Remote Desktop Client across nearly all supported Windows versions exposes client-side memory contents to a network-based attacker who controls a malicious RDP server. The flaw is an out-of-bounds read (CWE-125) triggered when the client parses crafted server-sent protocol data, resulting in high confidentiality impact with no integrity or availability consequence. No public exploit code exists and CISA has not added this to KEV; however, the breadth of affected Windows versions - from Server 2012 through Windows 11 26H1 - makes patch prioritization important for organizations permitting outbound RDP connections to untrusted hosts.
Information disclosure in AMD Zen processor microarchitecture, surfaced through Windows system software, enables a local low-privileged attacker to read high-sensitivity data across security boundaries. The CVSS Scope Changed metric (S:C) combined with C:H and the AMD Zen tag strongly suggests a microarchitectural side-channel capable of leaking data from outside the attacker's security context - a pattern consistent with speculative execution or cache-based cross-boundary leakage. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none; however, the breadth of affected Windows versions (Server 2012 R2 through Server 2025 and Windows 10/11 across all supported channels) gives this a wide potential exposure surface on AMD Zen-equipped systems.
Information disclosure in AMD Zen processors on Windows allows a locally authenticated low-privileged attacker to read sensitive memory contents across security boundaries via a high-complexity microarchitectural technique. Affecting Windows versions from Windows 10 1607 to Windows 11 26H1 and Server 2012 R2 through Server 2025, this vulnerability was reported by Microsoft's security team (secure@microsoft.com) and carries a CVSS 5.6 medium score with Scope:Changed (S:C) indicating the attacker can cross a privilege boundary to reach data outside their own security context. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog, though vendor-released patches are confirmed available via MSRC.
Missing authorization controls in Microsoft Dynamics 365 Business Central enable authenticated network attackers to access sensitive business data beyond their permitted scope. Rooted in CWE-862 (Missing Authorization), the flaw affects multiple release waves spanning 2024 through 2026, with a CVSS 6.5 score reflecting high confidentiality impact at low attack complexity. No public exploit code is identified and CISA SSVC rates exploitation as none and non-automatable, though the high confidentiality impact warrants prompt patching for organizations with broad user bases.
Server-Side Request Forgery in Microsoft SharePoint Server 2016, 2019, and Subscription Edition enables authenticated network-adjacent attackers to coerce the SharePoint server into issuing outbound HTTP requests to attacker-controlled or internal network destinations, resulting in high-confidentiality-impact spoofing. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms exploitation is low-complexity, requires only a standard SharePoint account, and yields significant information disclosure with no integrity or availability loss. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Improper input validation across Adobe's Content Credentials JS SDK, Rust SDK, and command-line tool allows a remote unauthenticated attacker to bypass integrity verification and gain unauthorized write access to C2PA-signed content metadata. All three SDK components prior to their respective patch releases are affected, and exploitation requires a victim to visit a maliciously crafted URL or interact with a compromised web page. No public exploit code or active exploitation has been identified at time of analysis, though the write-impact on content authenticity signals carries meaningful trust implications for downstream consumers.
Microsoft Dynamics 365 on-premises version 9.1 exposes sensitive information to authenticated network attackers via an improper access control flaw (CWE-200), allowing disclosure of data beyond a user's authorization level. The CVSS vector (PR:L) confirms exploitation requires a valid low-privilege account, limiting exposure to insider threats or compromised credentials rather than unauthenticated external actors. No public exploit code and no active exploitation have been identified; SSVC rates this as non-automatable with partial technical impact, consistent with a medium-priority finding.
Information disclosure via a buffer over-read in the Windows SMB Client component affects a broad spectrum of Microsoft Windows desktop and server editions, from Windows Server 2012 through Windows 11 25H2. An attacker who controls a malicious SMB server and induces a target Windows user to connect to it can trigger the client to read beyond allocated memory buffer boundaries, leaking potentially sensitive process memory contents across the network. SSVC rates exploitation status as none and no public exploit code has been identified at time of analysis, though the high confidentiality impact (C:H) and the near-universal deployment footprint of the Windows SMB Client make this a meaningful routine patch priority.
Information disclosure in Azure CycleCloud allows an authenticated network attacker to bypass authorization checks and read sensitive data. Rooted in CWE-862 (Missing Authorization), the flaw affects versions up to 8.9.2 and is exploitable by any authorized user who can reach the service over a network without elevated privileges. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released a patch.
Tampering via partial string comparison in the Windows HTTP Protocol Stack (http.sys) exposes a broad range of Windows client and server editions to integrity compromise by unauthenticated adjacent-network attackers. Affected platforms span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, with Microsoft tagging the issue as an authentication bypass rooted in CWE-187. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected product lines.
Credential exposure in Microsoft SharePoint Server (CWE-522) enables an authenticated network attacker to intercept insufficiently protected credentials and perform identity spoofing against the affected deployment. All three active on-premises SharePoint release lines are confirmed affected - 2016 Enterprise, 2019, and Subscription Edition - with patched thresholds provided by EUVD. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a standard SharePoint user account, with high confidentiality impact; no active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis.
ColdFusion 2023 and 2025 contain an Incorrect Authorization flaw (CWE-863) that allows any low-privileged authenticated user to remotely crash the application server, producing a denial-of-service condition. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires only network access and a valid low-privilege credential with no interaction from other users, making repeated service disruption trivial for any credentialed attacker. No public exploit code or CISA KEV listing has been identified at time of analysis.
Integer underflow in the Windows DHCP Server service exposes adjacent-network unauthenticated attackers to high-confidentiality memory disclosure across a broad range of Windows Server releases from 2012 through 2025, plus Windows 10 1607 and 1809. The root cause (CWE-125 out-of-bounds read triggered by arithmetic underflow) allows a crafted DHCP packet to cause the server to read and return memory beyond the intended buffer boundary. No active exploitation is confirmed (not in CISA KEV) and SSVC rates exploitation status as none; a vendor patch is available via the Microsoft Security Response Center.
Incorrect Authorization in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B allows a network-accessible, high-privileged attacker to bypass platform security controls and gain unauthorized write access, resulting in high integrity and availability impacts. Affected are Adobe Commerce through 2.4.9-2026-jul, Magento Open Source through 2.4.9-2026-jul, and Adobe Commerce B2B through 1.5.3-2026-jul, with August 2026 patches available per Adobe APSB26-92. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Missing authorization in Microsoft Exchange Server allows authenticated low-privilege network users to bypass a security feature, achieving high-integrity impact without requiring elevated credentials or user interaction. Rooted in CWE-862, Exchange fails to enforce a required authorization check on at least one network-accessible endpoint, enabling unauthorized high-integrity modifications - such as changes to mailbox permissions, transport rules, or security policy - by any valid account holder. No active exploitation is confirmed by CISA KEV, no public exploit code is identified, and Microsoft has released patches across all affected cumulative update tracks.
Integer underflow in the Windows DHCP Server service exposes out-of-bounds memory to unauthenticated attackers on the adjacent network, enabling high-impact information disclosure across multiple Windows Server generations from 2012 through 2025. The CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction, only Layer 2 or broadcast-domain adjacency to a host running the DHCP Server role. Microsoft has released patches for all affected builds; no public exploit code has been identified and the vulnerability does not appear in CISA KEV at time of analysis.
Information disclosure via integer underflow in the Windows DHCP Server service exposes server process memory to unauthenticated attackers on the same network segment, affecting Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 where the DHCP Server role is installed. The root cause is a CWE-125 out-of-bounds read triggered when an integer underflows and wraps around, causing DHCP packet-processing code to read memory outside intended bounds and potentially return it in a server response. No public exploit has been identified at time of analysis, and CISA's SSVC framework rates exploitation as none with partial technical impact, indicating contained but real risk requiring timely patching.
Out-of-bounds memory read in the Windows DHCP Server service exposes sensitive server memory to unauthenticated attackers on the adjacent network. The root cause is an integer underflow (CWE-125) in DHCP packet processing, where a miscalculated length or index wraps around, causing the service to read and potentially return memory beyond intended buffer boundaries. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected Windows Server versions via the August 2026 Patch Tuesday cycle.
Incorrect authorization in Microsoft SharePoint Server exposes authenticated network attackers to unrestrained content tampering across three supported product lines. The flaw, rooted in CWE-863 (Incorrect Authorization), allows a low-privileged but authenticated user to perform write or modification operations that server-side access controls should restrict to higher-privileged roles. Microsoft has released patches for all three affected versions; no public exploit code or CISA KEV listing exists at time of analysis.
Information disclosure in Windows DHCP Server across six major Windows Server generations exposes heap or stack memory contents to unauthenticated adjacent-network attackers via an integer underflow defect. The vulnerability affects all Windows Server editions from 2012 through 2025 that have the DHCP Server role installed and running, with exploitation constrained to Layer 2 adjacency rather than the open internet. A vendor-released patch is available from Microsoft MSRC; no public exploit code has been identified at time of analysis.
Integer underflow (CWE-125, out-of-bounds read) in the Windows DHCP Server service allows an unauthenticated attacker on an adjacent network segment to disclose sensitive memory contents. Affected systems span Windows Server 2012 through 2025 and certain Windows 10 builds running the DHCP Server role. No public exploit has been identified at time of analysis, and a vendor patch is available via Microsoft's July 2026 update cycle.
Information disclosure in the Windows DHCP Server service allows unauthenticated attackers on adjacent network segments to read out-of-bounds server memory via a malformed DHCP request that triggers an integer underflow. Affected builds span Windows Server 2012 through Windows Server 2025, as well as Windows 10 versions 1607 and 1809, making the version footprint unusually wide for a single service-role flaw. No public exploit has been identified at time of analysis and CISA's SSVC framework rates exploitation as none with non-automatable characteristics, though the high confidentiality impact and the breadth of affected builds warrant prompt patching.
Quota accounting bypass in Coturn TURN/STUN server prior to 4.17.0 allows authenticated remote clients to exhaust relay ports by repeatedly creating and disconnecting mobility-enabled allocations. The `shutdown_client_connection()` function in `src/server/ns_turn_server.c` prematurely releases the user and total quota charge during the first-stage mobility close while the allocation, relay socket, session, and mobility ticket remain alive, making `--user-quota` and `--total-quota` enforcement ineffective. Publicly available exploit code exists per SSVC classification; no active exploitation is confirmed in CISA KEV.
Information disclosure in Windows Win32K affects a broad range of Microsoft Windows client and server operating systems, from Windows Server 2012 through Windows 11 26H1 and Server 2025. A locally authenticated low-privilege user can trigger a buffer over-read (CWE-126) in the Win32K kernel-mode subsystem, causing the kernel to return out-of-bounds memory contents to user space. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact, though the kernel information disclosure primitive carries chaining risk for privilege escalation.
Uncontrolled resource consumption in the Windows DHCP Client enables an unauthenticated attacker on the same network segment to crash or deny service to affected hosts without any user interaction. Affected platforms span Windows 11 (versions 24H2, 25H2, and 26H1) and Windows Server 2025, all in unpatched builds. No public exploit code or active exploitation (KEV) has been identified at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Integer underflow (CWE-125) in the Windows DHCP Server service exposes server memory contents to unauthenticated attackers positioned on the same adjacent network segment. Affecting Windows Server versions from 2012 through 2025 (confirmed by ENISA EUVD-2026-56370), the flaw allows crafted DHCP packets to trigger an out-of-bounds read, resulting in high-confidence confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact - a vendor patch is available via Microsoft MSRC.
Broken access control in Faveo Helpdesk 2.0.3's v1 REST API exposes all ticket conversations to any self-registered customer. The endpoint validates that a requested ticket exists but performs no ownership check, so any authenticated customer can enumerate and read tickets belonging to other customers - including internal agent notes that may contain sensitive operational or personal data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low exploitation barrier (valid account only) makes this a practical risk in any multi-tenant deployment.
Arbitrary file deletion in Subrion CMS through 4.2.1 is enabled by the admin panel file deletion endpoint passing user-supplied paths directly to PHP's unlink() function without sanitization or path canonicalization, allowing directory traversal outside the web root. Authenticated administrators on affected instances can delete sensitive system files, risking server instability, loss of critical configuration, or creating conditions for follow-on privilege escalation. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Authenticated workspace members in Windmill through 1.783.0 can exfiltrate plaintext resource credentials stored in legacy ownerless draft scripts by querying the drafts API endpoint. The ACL enforcement logic fails to restrict access when a draft's owner email field is null, allowing any workspace member - regardless of their actual permissions - to retrieve these drafts and the secrets embedded within them. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low exploitation complexity and high confidentiality impact make it a meaningful internal threat wherever legacy drafts containing credentials persist.
Unrestricted archive upload in WildFly Core enables authenticated 'deployer' role users to deploy malicious Java archives via HTTP POST requests, potentially achieving arbitrary file reads and further system compromise. Affected products span multiple Red Hat enterprise offerings including JBoss EAP 7 and 8, Red Hat Fuse 7, Process Automation 7, and Single Sign-On 7, all of which embed wildfly-core as a foundational dependency. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Denial of service in Velociraptor allows any authenticated user - including those holding only the read-only reader role - to immediately terminate the entire server process with a single API call. By invoking SetPassword with a username that does not exist, an attacker triggers a null pointer dereference (CWE-476) that crashes the process, rendering the DFIR platform completely unavailable. No public exploit has been identified at time of analysis, but the trivially low exploitation barrier - any valid credential suffices - makes this a credible insider or compromised-account threat in any environment where Velociraptor is operationally depended upon.
XML External Entity (XXE) injection in SAP BusinessObjects Business Intelligence (Web Intelligence) enables a low-privileged authenticated attacker to read arbitrary server-side files by uploading a crafted spreadsheet containing malicious external entity references and using it as a report data source. Affected versions span the 2025, 2027, ENTERPRISE 430, and ENTERPRISECLIENTTOOLS 430 release lines, all confirmed by ENISA EUVD-2026-55877 and SAP Note 3753141. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low authentication bar and high confidentiality impact make this a material risk for any enterprise running Web Intelligence.
Buffer over-read in the Zoom Clients annotator function allows any meeting participant to crash another participant's client, resulting in denial of service. The flaw (CWE-126) is exploitable remotely over the network with no privileges required but demands that the target be an active meeting participant with annotation data processed by their client. No active exploitation or public proof-of-concept code has been identified at time of analysis, and the impact is limited entirely to availability - no confidentiality or integrity effects are present.
Server-side request forgery in Apioo Fusio 8.8.3 enables authenticated consumer-role users to direct the application server to issue arbitrary HTTP POST requests to internal network addresses by registering a crafted webhook URL. The root cause is insufficient input validation: the webhook registration endpoint applies PHP's FILTER_VALIDATE_URL for syntactic URL checking but enforces no IP or host denylist to block private RFC 1918 ranges, loopback, or link-local addresses. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Broken authorization on the update_resource_type endpoint in Windmill through 1.783.0 allows any authenticated workspace member to overwrite resource type schemas without administrator privileges. The delete_resource_type endpoint on the same platform correctly enforces an admin permission check, but the update counterpart omits it entirely, creating an inconsistent and exploitable trust boundary. No public exploit is identified at time of analysis and the vulnerability is absent from CISA KEV, but integrity of all resource type definitions - and the workflows depending on them - is at risk from any workspace member account.
Stored SQL injection in Koha's patron card layout feature allows authenticated staff with the label_creator permission to exfiltrate the entire library database, including patron PII and staff bcrypt password hashes. The image_name field is persisted verbatim into layout XML without sanitization and later concatenated raw into a SQL query inside patroncards/create-pdf.pl when a patron card batch is printed, creating a second-order injection that fires on a routine staff action. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact and low privilege requirement make this a meaningful priority for library operators running affected releases.
Cleartext storage of sensitive credentials in Windows Hello exposes authentication material to local tampering by authorized but low-privileged attackers across a broad range of Windows 10, Windows 11, and Windows Server releases. The flaw, rooted in CWE-312, means that sensitive data used by the Windows Hello subsystem is persisted without adequate encryption, enabling an attacker with local access to modify it and undermine the integrity of the authentication mechanism. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none with non-automatable attack paths.