Remote code execution is achievable in Windows SMB Server via a heap-based buffer overflow exploitable by a low-privileged, authenticated network attacker. The vulnerability (CWE-122) spans a wide range of Microsoft Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. Microsoft has released patches via the MSRC update guide; no KEV listing or public exploit code is present in the available intelligence at time of analysis.
Remote code execution in Microsoft Office Outlook stems from an integer overflow or wraparound condition (CWE-190) that allows an unauthenticated network attacker to execute arbitrary code on a victim's system, achieving full confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R reflects low attack complexity and no authentication requirement, though exploitation is gated by a user interaction step. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the attack profile is consistent with phishing-delivered malicious email or attachment campaigns targeting Outlook users.
Remote code execution is possible in Windows GDI+ across a broad range of Windows 10, 11, and Windows Server versions due to an integer overflow that leads to a heap-based buffer overflow (CWE-122). Network-based attackers with no privileges required can exploit this by delivering a crafted image or graphic file, requiring only that the victim open or preview the content. A vendor patch is available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Microsoft's Remote Desktop Client (mstsc.exe) enables remote code execution on unpatched Windows 10 1607 and Windows Server 2012/2016 systems. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered and requires no attacker privileges, but demands that a victim actively connect to an attacker-controlled RDP server - a meaningful but achievable social-engineering hurdle. Microsoft has released patches for all affected version branches; no public exploit identified at time of analysis.
Remote code execution in Microsoft Exchange Server stems from a heap-based buffer overflow (CWE-122) exploitable by any network-accessible authenticated user with low privileges. Affected versions span Exchange Server 2016 CU23, 2019 CU14 and CU15, and the Subscription Edition - all major currently-supported release lines. Vendor patches are available, and no public exploit identified at time of analysis, though the low attack complexity and full CIA impact make this a critical patching priority for enterprise Exchange deployments.
SSRF in Microsoft Exchange Server enables authenticated, low-privilege network attackers to escalate privileges, with Microsoft reporting high confidentiality, integrity, and availability impact across Exchange 2016, 2019, and Subscription Edition. Vendor-released patches are available covering all affected cumulative update branches. No public exploit code exists and no active exploitation has been confirmed - EPSS sits at 0.62% (46th percentile) and CISA SSVC assigns Exploitation: none - meaning the CVSS 8.8 score outpaces current real-world threat activity.
Remote code execution in Windows LDAP (Lightweight Directory Access Protocol) affects a broad swath of Microsoft Windows desktop and server editions, from Windows 10 through Windows 11 and Windows Server 2012 through 2025. A use-after-free memory corruption flaw (CWE-416) in the LDAP client implementation allows a network-accessible, unauthenticated attacker to achieve arbitrary code execution with high confidentiality, integrity, and availability impact, contingent on user interaction - most likely the victim system initiating or being induced to make an LDAP connection to an attacker-controlled server. No public exploit identified at time of analysis and no CISA KEV listing, but the CVSS score of 8.8 and the breadth of affected Windows versions make this a high-priority patching target.
Privilege escalation via SSRF in Microsoft Office SharePoint exposes authenticated users to full system compromise - confidentiality, integrity, and availability all rated High. The CVSS vector (PR:L/AV:N/AC:L/UI:N) confirms that any authenticated SharePoint user can trigger the vulnerability over the network without additional complexity. No active exploitation or public exploit code has been identified at time of analysis, though the low attack complexity and broad privilege impact make this a credible near-term risk.
Server-side request forgery in Microsoft Office SharePoint enables low-privileged authenticated attackers to escalate privileges with no user interaction required, achieving high confidentiality, integrity, and availability impact. The flaw (CWE-918) allows a legitimate but low-privilege account holder to forge server-side HTTP requests, likely reaching internal administrative interfaces or credential endpoints inaccessible from the network perimeter. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in Microsoft Azure CycleCloud (versions prior to 8.9.1) allows an authenticated low-privilege network attacker to elevate to higher privilege levels due to missing authorization checks (CWE-862). The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability with no user interaction required, though exploitation demands valid credentials. No public exploit has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog, though SSVC rates the technical impact as total.
Remote code execution in Windows DNS exposes a wide range of Windows Server and desktop systems to unauthenticated exploitation from adjacent network positions. Rooted in a CWE-787 out-of-bounds write triggered during DNS processing, the flaw carries a CVSS 8.8 score reflecting full confidentiality, integrity, and availability impact with no credentials or user interaction required. No public exploit identified at time of analysis, but a vendor-released patch is available and the broad affected version list - spanning Windows 10/11 and Server 2019 through 2025 - makes prioritized patching urgent for any environment where the DNS service is internet-edge or internally exposed.
Unauthenticated code execution in Windows DHCP Server allows an attacker positioned on an adjacent network segment to trigger a heap-based buffer overflow and achieve full system compromise. The vulnerability spans a wide range of Microsoft server and desktop platforms, from Windows Server 2012 through Windows Server 2025 and select Windows 10 builds, making it broadly relevant in Windows-centric enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-interaction exploitation profile and vendor-confirmed patch availability make this a high-priority patching candidate for any organization running Windows DHCP Server.
Remote code execution in Microsoft Power BI enables low-privileged authenticated attackers to execute arbitrary code over the network via improper input validation (CWE-20). The CVSS 3.1 score of 8.8 (High) reflects full confidentiality, integrity, and availability impact with low attack complexity and no user interaction required beyond holding a valid account. No public exploit code or active exploitation has been identified at time of analysis, though the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65811 should be consulted for patch and scope details.
OS command injection in GitHub Copilot and Visual Studio Code enables a local unauthorized attacker to escalate privileges on the affected developer workstation, achieving full High impact across confidentiality, integrity, and availability. The CWE-78 root cause indicates that attacker-influenced input containing shell metacharacters is improperly incorporated into OS-level command execution within one or both products, triggering upon a user action such as opening a malicious file or repository. No public exploit code has been identified and this vulnerability has not been confirmed actively exploited by CISA KEV at time of analysis; however, the local privilege escalation path on widely deployed developer tooling represents a meaningful risk in supply chain and social engineering scenarios.
Local security feature bypass in Visual Studio Code allows an attacker with local access to circumvent an authorization control, achieving high-impact compromise of confidentiality, integrity, and availability on the affected system. The vulnerability (CWE-693, Protection Mechanism Failure) is exploitable locally without elevated privileges but requires user interaction, making social engineering or physical access the likely delivery path. No public exploit code or active exploitation has been identified at time of analysis.
Security feature bypass in Visual Studio Code (versions 1.0.0 through 1.132.1) exploits CWE-639, where authorization decisions rely on attacker-controllable keys, allowing a local attacker to circumvent an intended access control with high impact across confidentiality, integrity, and availability. The attack requires no elevated attacker privileges but does require a legitimate VS Code user to interact with the manipulated environment, pointing to shared-workstation or social-engineering delivery paths. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog at time of analysis; a vendor-released patch is available at version 1.132.1.
Security feature bypass in the Python extension for Visual Studio Code (versions prior to 1.132.1) allows a local attacker to load functionality from an untrusted control sphere, achieving full compromise of confidentiality, integrity, and availability. The attack requires user interaction - specifically opening a malicious workspace or project directory - making it highly relevant in developer supply-chain and social engineering scenarios such as cloning a weaponized repository. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the full CIA impact and low attack complexity elevate real-world concern for development environments.
Type confusion in Microsoft Office Excel's file-processing engine enables remote code execution when a user opens a specially crafted spreadsheet document. The vulnerability carries a CVSS 8.8 High score with full confidentiality, integrity, and availability impact against the Excel process, requiring only user interaction to trigger - the classic phishing-attachment threat model. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthorized read and write access beyond their authorized security scope by exploiting improper input validation in file processing. The attack requires social engineering - a victim with higher privileges must open a specially crafted malicious file - after which the attacker's effective permissions cross security boundaries (scope change, S:C) to reach resources outside the original ColdFusion component. No public exploit or CISA KEV listing has been identified at time of analysis, though the high CVSS score of 8.7 and scope-change impact warrant prompt remediation per Adobe advisory APSB26-90.
Code injection (CWE-94) in Microsoft PowerShell enables a local, unauthenticated attacker to bypass a security feature through user interaction, resulting in high-impact compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects a local attack vector requiring user interaction, with no privileges needed from the attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the RCE tag and full C/I/A impact make this a priority for environments running PowerShell on Windows.
Heap-based buffer overflow in the Windows Reliable Multicast Transport (RMCAST) kernel driver enables unauthenticated adjacent-network attackers to execute arbitrary code at kernel privilege level across a broad range of Windows desktop and server releases, from Server 2012 through Windows 11 version 26H1. The CVSS 8.8 rating reflects the zero-credential, zero-interaction exploitation path, constrained only by the requirement for network adjacency. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in the CISA KEV catalog; a vendor-released patch with confirmed fixed build numbers is available via Microsoft MSRC.
Local privilege escalation in Microsoft .NET runtimes (versions 8.0, 9.0, and 10.0) enables a local attacker to gain elevated system privileges by triggering an integer overflow condition, requiring only user interaction and no prior authentication. The flaw carries a CVSS 7.8 score with high impact across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the broad deployment of .NET across enterprise Windows and Linux environments makes this a meaningful patching priority.
Portainer CE through 2.44.0 exposes root-level Docker host access to any authenticated low-privileged user via a URL path normalization flaw in the Docker proxy endpoint. The authorization middleware evaluates a non-canonical request path (e.g., percent-encoded slashes, double slashes, or traversal sequences) differently from the proxy layer that ultimately forwards it to the Docker daemon - allowing crafted requests to bypass all access controls while executing with full Docker API privileges. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit code has been identified at time of analysis; EPSS data was not provided in the source intelligence.
Privilege escalation in Windows Win32K via a heap-based buffer overflow enables a locally authenticated attacker to gain SYSTEM-level access across a broad range of Microsoft operating systems from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The flaw (CWE-122) requires only standard user privileges and no user interaction, making post-compromise escalation straightforward for any attacker who has already obtained local access. No public exploit has been identified at time of analysis, but the Microsoft Security Response Center has issued a patch and the wide affected product surface warrants urgent remediation.
Unintended internal method dispatch in electerm prior to v3.15.186 allows any authenticated WebSocket client to invoke arbitrary Upgrade and filesystem export methods - including OS command execution, file mutation, and process termination - by supplying attacker-controlled function names to the `upgrade-func` and `handleFs` WebSocket handlers. The root cause is the absence of allowlist validation in `src/app/server/dispatch-center.js` and `src/app/server/fs.js`, where client-supplied `func` strings were passed directly to dynamic method calls, including paths exploitable via JavaScript prototype chain traversal. No public exploit or CISA KEV listing exists at time of analysis; CVSS 8.8 reflects the high impact and low complexity once a valid authenticated session is held.
Out-of-bounds read (CWE-125) in Microsoft Office enables local code execution across a broad range of Office product editions on both Windows and macOS. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms the attack requires no privileges but does require a victim to open a crafted file, consistent with a malicious document delivery scenario. A patch has been released by Microsoft; no public exploit code or CISA KEV listing has been identified at the time of analysis, though the full CIA impact (C:H/I:H/A:H) and breadth of affected products make this a high-priority patching target for enterprise environments.
Heap-based buffer overflow in Microsoft Office enables local code execution with high impact across confidentiality, integrity, and availability. Affecting Office 2016 through 2024, including LTSC and Microsoft 365 variants on both Windows and macOS, the vulnerability is triggered when a user opens a specially crafted document - requiring no privileges but mandatory user interaction (CVSS AV:L/UI:R). Patch is available from Microsoft; no public exploit identified at time of analysis.
AcyMailing WordPress plugin (all versions through 10.11.1) allows authenticated attackers with subscriber-level access to exploit an authorization bypass and silently overwrite the BCC field of the plugin's core notification template, redirecting all subsequent WordPress password-reset emails - including those for administrator accounts - to an attacker-controlled address. By then triggering the standard WordPress lost-password flow for any account, the attacker intercepts the one-time reset token and achieves full site administrator compromise without any victim interaction. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is gated by a non-default plugin configuration that partially narrows the real-world attack surface below what the CVSS 8.8 score implies.
Local privilege escalation in Microsoft .NET Framework exploits a relative path traversal flaw (CWE-23), enabling an unprivileged local user to gain elevated system rights through user interaction. The vulnerability affects .NET Framework on Windows and is rated CVSS 7.8 (High), with full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Kernel via an untrusted pointer dereference (CWE-822) enables a low-privileged, locally authenticated attacker to gain full SYSTEM-level control with high confidentiality, integrity, and availability impact. Affected systems span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 in both full and Server Core configurations. No public exploit has been identified at time of analysis, but the low attack complexity (AC:L) makes this a reliable second-stage privilege escalation primitive for adversaries who have already achieved local access through any initial foothold.
Command injection in electerm prior to version 3.15.120 enables a malicious FTP or SFTP server operator to execute arbitrary OS commands on a connecting user's machine. The root cause is server-controlled folder names being interpolated without quote-escaping into shell commands — both `du -sh '${folder}'` in `src/app/lib/fs.js` and equivalent calls in `src/client/components/sftp/file-info-modal.jsx` — allowing a crafted single-quote-bearing folder name to break out of the intended shell quoting context. No public exploit has been identified at time of analysis; a vendor-released patch exists in v3.15.120.
Unrestricted file upload in Cockpit CMS versions up to and including 2.6.0 allows any authenticated user to upload PHP scripts via the asset upload endpoint, achieving remote code execution as the web server process. The root cause is the default wildcard (*) value for the allowed_uploads configuration combined with storage of uploaded files in a web-accessible directory - a textbook CWE-434 condition. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low barrier of entry (any authenticated account) makes this a high-priority remediation target for internet-facing deployments.
Password reset authorization bypass in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) allows any authenticated subscriber to overwrite the credentials of any account on the site, including administrators, leading to full account takeover and complete site compromise. The plugin improperly validates authorization during password reset operations and protects user identity with a CBC-mode encrypted token; an attacker who legitimately obtains that token through an authorized Edit User form submission can apply standard CBC bit-flipping techniques to forge a token resolving to any other user identity, including site admins, without possessing the encryption key. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV, though the low technical barrier and well-documented nature of CBC bit-flipping make this high-urgency for affected deployments.
Missing authorization checks in SAP ABAP Developer Tools (the Eclipse-based IDE for ABAP development) allow any low-privileged SAP user to execute unauthorized database operations against SAP NetWeaver AS ABAP backends. The flaw spans a wide range of SAP_BASIS releases (750 through 920) and yields full confidentiality, integrity, and availability compromise of the ABAP application layer - including the ability to read sensitive business data, modify application records, and disrupt legitimate user access. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage elevate real-world risk considerably for enterprises running ADT-connected NetWeaver systems.
Use-after-free in Blink, Google Chrome's rendering engine, allows remote unauthenticated attackers to execute arbitrary code within the browser sandbox by delivering a crafted HTML page. All Chrome releases prior to 151.0.7922.137 are confirmed affected. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score and memory corruption class reflect serious exploitation potential.
Remote code execution within Chrome's renderer sandbox is possible in Google Chrome versions prior to 151.0.7922.137 due to a use-after-free flaw in the HTML subsystem. An unauthenticated remote attacker can exploit this by inducing a victim to visit a crafted HTML page, triggering heap corruption that results in arbitrary code execution scoped to the sandboxed renderer process. No public exploit code has been identified at time of analysis, and EPSS stands at a low 0.31% (23rd percentile), suggesting limited attacker uptake despite the high CVSS score of 8.8.
Use-after-free in Chrome's V8 JavaScript engine (versions prior to 151.0.7922.137) enables remote code execution inside the browser sandbox when a victim visits a crafted HTML page. The vulnerability carries a CVSS 8.8 score reflecting its network-reachable, low-complexity attack path requiring only a single user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Chromium security team rated severity as High and issued an emergency stable-channel update.
Unauthenticated server-side request forgery in Commvault Command Center's legacy endpoint allows a remote, unauthenticated attacker to cause the server to issue HTTP requests to arbitrary URLs, exposing internal services, cloud metadata endpoints, and credentials accessible from the Command Center's privileged network position. All versions of Commvault Cloud are indicated as affected per wildcard CPE, with Commvault releasing a resolved maintenance release per advisory CV_2026_07_5. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the CVSS 4.0 score of 8.8 with no authentication or precondition requirements makes this a high-priority remediation target in enterprise environments.
Privilege escalation in Authentik Security authentik through 2026.5.6 allows any holder of a source-scoped SCIM provisioning token to seize superuser control over the entire Identity Provider and permanently lock out all legitimate administrators. The root cause is the SCIM group ingest function's failure to validate whether the requesting token's source scope has authority over the target group - when an attacker provisions a SCIM group whose name matches an existing administrator group, authentik silently adopts and replaces that group's membership without authorization checks. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the high CVSS score of 8.8 and the total-takeover impact warrant immediate remediation.
Code injection in the Perl DBI module as packaged for Red Hat Enterprise Linux allows a network-accessible, low-privileged attacker to execute arbitrary code, resulting in full confidentiality, integrity, and availability compromise. This CVE is a remediation of an incomplete fix for CVE-2026-14380, specifically targeting RHEL 9.8.z and 10.2.z patch levels where the prior partial fix left an exploitable residual path. No public exploit or CISA KEV listing is identified at time of analysis, but the CWE-94 classification and RCE tag indicate high potential impact if exploitation conditions are met.
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrative user when a victim opens a crafted malicious file. The vulnerable component is restricted to the administrative network zone by default (AV:A), limiting exposure to internal or VPN-connected segments, but the scope change (S:C) with full CIA impact confirms that successful exploitation can cascade beyond the immediate ColdFusion application context. No public exploit has been identified at time of analysis; however, Adobe's advisory APSB26-90 confirms the RCE potential and the high severity rating of 8.8.
Privilege escalation in Authentik Security authentik through version 2026.5.6 allows an attacker holding a source-scoped SCIM provisioning token to take over any local account, including superuser accounts, by provisioning a SCIM user whose username matches an existing account. The SCIM user ingest function adopts pre-existing local accounts by username without enforcing scope boundaries, meaning a limited-privilege provisioning credential can rewrite or delete accounts entirely outside its intended scope. No public exploit has been identified at time of analysis, but the attack requires only network access and a valid SCIM token, making the exploitation bar low for any attacker who has obtained such a credential.
Privilege escalation in Azure SQL Database allows a locally authenticated attacker to gain elevated permissions through incorrect permission assignment on a critical resource. The flaw is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource), meaning a resource - likely a file, registry key, named pipe, or shared object - is accessible with overly permissive settings. An attacker with existing local access and low-privilege credentials could exploit this to achieve high confidentiality, integrity, and availability impact on the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authorization controls and execute arbitrary code in the context of the ColdFusion service account. The vulnerable administrative component is confined to an administrative network zone by default, limiting internet-scale exposure but leaving internal networks and misconfigured deployments at significant risk. No public exploit code or CISA KEV listing has been identified at time of analysis, though the complete CIA impact and zero-authentication requirement make this a high-priority patch target for any organization running ColdFusion.
Privilege escalation in the Windows Remote Access API via a heap-based buffer overflow (CWE-122) allows an authenticated local attacker with low privileges to gain full SYSTEM-level control over affected Windows 11 and Windows Server 2022/2025 hosts. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a valid local account and no user interaction, making it a reliable post-compromise escalation path. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all enumerated affected versions.
Privilege escalation via heap buffer overflow in the Windows Remote Access (RAS) API affects every major in-support Windows desktop and server release, from Server 2012 R2 through Windows 11 26H1 and Server 2025. An authenticated local attacker with low-privileged access can trigger a CWE-122 heap overflow to achieve full SYSTEM-level compromise with High confidentiality, integrity, and availability impact and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released a patch across all affected build lines.
Privilege escalation in the Windows Kernel (CVE-2026-65773) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control over affected systems, with high impact on confidentiality, integrity, and availability. The flaw affects a wide swath of Windows releases - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity (AC:L) means a working exploit, once developed, would require minimal environmental preconditions.
Privilege escalation in Windows Schannel via a use-after-free (CWE-416) memory corruption flaw allows a locally authenticated, low-privileged attacker to elevate privileges - likely to SYSTEM - on Windows 11 and Windows Server 2025 systems. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects reliable, low-complexity exploitation requiring only a standard user account and no user interaction. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in Pimcore admin-ui-classic-bundle (all versions through 2.3) permits authenticated backend users to execute arbitrary SQL against the underlying database via the DataObject grid id column filter. The filter value is concatenated unsanitized directly into a SQL WHERE clause, bypassing parameterization entirely, enabling an attacker to exfiltrate or modify all database contents. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS score of 8.8 with full C/I/A:H impact and the straightforward CWE-89 pattern make this a meaningful risk for any unpatched Pimcore deployment.
SQL injection in CiviCRM through version 6.18.alpha1 allows authenticated staff-level users to exfiltrate the entire backend database via the contact search RLIKE clause. The vulnerability arises because user-supplied input is concatenated directly into the SQL query without sanitization, satisfying CWE-89. Sensitive records including donor, member, and organizational data are exposed to any user holding staff-level credentials. No public exploit or CISA KEV listing has been identified at the time of analysis, though the low exploitation complexity elevates real-world risk.