Arbitrary file read in Craft CMS 4.x and 5.x exposes .env files, database credentials, and security keys by exploiting an incomplete blocklist in the create() Twig function that omits PHP's SplFileObject class. An authenticated administrator with allowAdminChanges=true can plant a malicious entry type title or URI format; when any user subsequently creates an entry in the affected section, the Twig renderer instantiates SplFileObject and renders the contents of arbitrary server files as entry titles. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the GitHub Security Advisory GHSA-957r-qf9p-67xw provides full technical disclosure of the technique.
Unauthenticated network-based denial of service in the Windows Kernel results from unconstrained resource allocation (CWE-770), where the kernel fails to impose limits or throttling on network-triggered resource consumption. Affecting Windows 10, Windows 11, and Windows Server editions spanning 2012 through 2025, a remote attacker with no credentials or user interaction can exhaust system resources and render the host unavailable. No public exploit code or active exploitation has been identified at the time of analysis, though the low-complexity, unauthenticated attack surface warrants prompt patching across all affected enterprise environments.
Unsafe deserialization of untrusted data in Adobe Lightroom Classic (versions ≤15.4.1) enables arbitrary code execution in the context of the authenticated user when a victim opens a specially crafted file. Classified as CWE-502, this file-format exploit carries a CVSS 3.1 score of 8.6 with changed scope (S:C), indicating impact extends beyond the Lightroom process itself to broader user-accessible system resources. No public exploit identified at time of analysis and no CISA KEV listing; Adobe has released a fix in version 15.5 via security bulletin APSB26-94.
Path traversal in XAgent's ToolServerNode workspace file endpoint allows any network-accessible user to read arbitrary files on the host by exploiting missing path containment validation in the `/workspace/file` handler. Because XAgent permits self-registration without email verification, an attacker requires no prior credentials - trivial account creation is sufficient to reach the vulnerable endpoint. Sensitive targets include application secrets, database credentials, and system configuration files that may be reachable through Docker volume mounts, with no public exploit identified at time of analysis but the fix commit publicly available.
Server-side authentication bypass in FreeRDP 3.x (confirmed through 3.27.1) allows an unauthenticated remote attacker to obtain a fully authenticated RDP session without supplying any credentials, GUID, or reconnect cookie when the server has RdstlsSecurity enabled. The flaw combines PDU-type confusion - the server routes inbound messages based solely on the client-supplied wire pduType without enforcing handshake state - with a calloc-zeroed result code that maps directly to RDSTLS_RESULT_SUCCESS, so sending a Capabilities PDU in place of the required Authentication Request PDU produces an unconditional authentication success response. No public exploit code or CISA KEV listing has been identified at time of analysis; the upstream fix commit is confirmed but a released patched version was not independently verified at advisory time.
Heap-based out-of-bounds read and write in FreeRDP before 3.30.0 can be triggered by a malicious peer during CredSSP/NLA Kerberos authentication, allowing information disclosure, heap memory corruption, or denial of service. The flaw exists in kerberos_DecryptMessage() where the peer-supplied 16-bit EC field of a GSS Wrap token is used directly in pointer arithmetic without bounds validation, enabling any RDP peer - rogue server or malicious client - to shift decrypt pointers up to 65535 bytes past the end of a ~60-byte token buffer. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authenticated path traversal in Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus (versions below 4820) allows a low-privileged authenticated attacker to traverse outside intended directory boundaries within the Exchange Online backup module, resulting in high availability impact and limited integrity compromise across a changed scope. The vendor has released a patched build (4820) and published an advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this a credible threat in environments running affected builds.
Unauthenticated remote attackers can invoke the stripeCreateIntent GraphQL mutation in Chaskiq (through commit 46dfdd1) without any session or credential, enabling manipulation of Stripe payment intents for any tenant on the platform. The root cause is CWE-306 (Missing Authentication for Critical Function): the mutation bypasses all authentication and authorization checks, exposing a financial operation to the open internet. No public exploit or CISA KEV active exploitation has been identified at time of analysis, but the trivially low attack complexity (AV:N/AC:L/PR:N/UI:N) means any internet-reachable instance with Stripe configured is structurally exploitable.
Unauthenticated remote access to Stripe Billing Portal sessions in Chaskiq through commit 46dfdd1 allows any attacker to mint valid customer portal sessions for arbitrary tenants by invoking the `stripeCustomerPortal` GraphQL mutation without credentials. The mutation performs zero authentication or tenant-ownership checks before calling the Stripe API, enabling cross-tenant subscription manipulation - including plan changes and cancellations - against any Chaskiq-hosted tenant with Stripe Billing configured. No public exploit code has been identified at time of analysis, though the attack surface requires only network access and knowledge of a target tenant identifier.
Command injection in Vim's netrw plugin before version 9.2.0840 enables arbitrary Ex and operating-system command execution against GUI Vim users who browse or bookmark attacker-controlled directory paths. The flaw spans five construction sites in s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), and netrw#MakeTgt() where Vim's pipe separator | and single quotes are not neutralized before path data is interpolated into executed :menu commands. No public exploit code has been identified at time of analysis and the vulnerability does not appear in CISA KEV; a vendor-confirmed patch is available as Vim 9.2.0840.
Cross-tenant IDOR in Roskus Prospero Flow CRM's ticket management component allows any authenticated user - regardless of company affiliation - to read full ticket content (titles, descriptions, attachments), hijack tickets by overwriting their company_id, and delete tickets belonging to any other tenant on the shared instance. The root cause is a missing authorization boundary in three distinct Eloquent query paths that retrieve tickets by numeric ID without scoping results to the authenticated user's company, compounded by the delete controller accepting a generic HTTP request class that bypassed the application's own permission gate entirely. No public exploit code or CISA KEV listing exists at time of analysis; however, the Secur0 advisory documents the attack surface with sufficient detail for reproduction, and the CVSS 4.0 score of 8.6 reflects the genuine severity of multi-tenant isolation failure.
Server-Side Request Forgery in Microsoft PowerShell Core versions 7.4.x, 7.5.x, and 7.6.x enables network-accessible unauthenticated attackers to forge outbound requests from the PowerShell process, resulting in high-impact information disclosure against resources outside the component's security boundary. The CVSS scope change (S:C) indicates that attacker-controlled SSRF requests can reach internal services inaccessible from the network perimeter, potentially exposing sensitive internal endpoints or metadata. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV; Microsoft has released patched versions across all three affected branches.
Server-side request forgery in Kestra's Pebble http() template function allows unauthenticated remote attackers to force the Kestra server to make outbound HTTP requests to private, loopback, or link-local addresses - including cloud Instance Metadata Service endpoints - by supplying a crafted URI inside an imported workflow flow. All Kestra releases prior to 2.0.0 are affected, with no scope restriction on reachable internal hosts, making cloud-hosted deployments particularly exposed to IAM credential theft via AWS/GCP/Azure IMDS APIs. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of network-accessible, zero-authentication, low-complexity exploitation warrants high-priority remediation.
Path traversal in Adobe Lightroom Classic versions up to 15.4.1 allows an attacker to read arbitrary files from the victim's local file system by supplying a crafted project or catalog file. The scope-changed CVSS vector (S:C) indicates the vulnerability breaks out of Lightroom's intended file-access sandbox, potentially exposing OS-level files and credentials accessible to the process. No public exploit code has been identified at time of analysis, and Adobe has released a patched version (15.5) via advisory APSB26-94.
Path traversal in Sub2API versions 0.1.135-0.1.168 allows authenticated tenants to relay API requests to arbitrary upstream endpoints using operator-owned provider credentials (ChatGPT/Codex OAuth tokens, OpenAI platform keys, or operator-configured base URLs). The POST /responses/*subpath wildcard route accepted client-controlled subpaths and concatenated them into upstream URLs without sanitization, enabling scope-changing abuse of pooled shared accounts. No public exploit code has been identified at time of analysis, but the fix is publicly documented via GitHub advisory, PR diff, and release tag - including specific bypass path examples - substantially reducing reconstruction effort for any authenticated tenant.
Server-Side Request Forgery in usememos/memos through v0.30.0 allows authenticated users to redirect server-side HTTP requests to arbitrary internal network addresses by configuring a malicious webhook target URL. The CVSS S:C (Scope Changed) rating reflects that exploitation breaks the application boundary, enabling access to internal infrastructure such as cloud metadata endpoints, internal APIs, or RFC1918-addressed services. A publicly available proof-of-concept exists via GitHub gist; however, EPSS remains low at 0.22% (13th percentile), indicating limited observed exploitation in the wild at time of analysis despite the high CVSS score of 8.5.
Python code injection in FreeCAD's FEM Displacement Constraint dialog (all versions prior to 1.1.2) enables arbitrary code execution at the FreeCAD process's privilege level when a victim opens and accepts a weaponized project file. The root cause is an incomplete sanitization routine in TaskFemConstraintDisplacement.cpp that strips double-quotes from user-supplied formula fields but leaves backslash characters unhandled, allowing crafted input to escape the Python string boundary constructed by Gui::Command::doCommand(). SSVC rates technical impact as total and confirms a proof-of-concept exists; no CISA KEV listing is present, indicating no confirmed active exploitation campaigns at time of analysis.
Arbitrary Python code execution in calibre's template engine affects all versions prior to 9.12.0, triggered when a user opens or imports a crafted EPUB, OPF, PDF, or OPF file containing malicious composite_template metadata. The root cause is a sandbox policy inheritance failure: nested formatter invocations via template(), eval(), re_group(), and list_re_group() instantiated fresh formatter objects without propagating allow_python_templates=False from the parent, allowing an embedded python: sub-template to bypass the restriction and reach compile_python_template. No public exploit has been identified at time of analysis, though the full patch diff is publicly visible on GitHub and makes the attack straightforward to reproduce.
Heap buffer overflow in Vim's spell file parser prior to version 9.2.0846 enables arbitrary code execution when a user opens a maliciously crafted spell file. The flaw lies in set_sofo() reusing the sl_sal_first[] array without resetting values written by set_sal_first(), so a spell file ordering an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-controlled out-of-bounds heap writes (CWE-122). No public exploit has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog; a vendor-released patch exists at version 9.2.0846.
Timing side-channel in AMD Vitis Libraries' ECDSA secp256k1 Security Module exposes private cryptographic keys to local attackers via statistical analysis of operation timing or electromagnetic emanations. Affected are versions prior to 2026.1 of the Vitis Libraries Security Module and Vitis Unified Installer for FPGAs and Adaptive SoCs on Windows. AMD has released version 2026.1 as the fix; no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in the Alias Checking Trusted Module (ACTM) firmware for certain Intel Xeon processors allows a local privileged attacker to escalate to System Management Mode (SMM) execution, achieving high confidentiality and integrity impact across both the directly compromised system and subsequent systems such as co-hosted hypervisors or tenant workloads. The attack requires high-complexity local technique combined with pre-existing privileged user access, placing it firmly in the advanced persistent threat actor category. No public exploit has been identified at time of analysis, and Intel has published advisory INTEL-SA-01439 to address this firmware flaw.
Insecure deserialization in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier enables a local attacker who can interact with the affected service to perform unauthorized actions resulting in full compromise of confidentiality, integrity, and availability. The root cause is CWE-502: the service deserializes attacker-controlled objects without adequate validation, allowing manipulation of application logic or execution of unintended code paths. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS places exploitation probability in the 18th percentile, indicating low current exploitation interest despite a high CVSS score.
Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass security controls and gain unauthorized read and write access with scope change to components beyond the vulnerable server. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H) confirms local access with minimal complexity is sufficient - no user interaction is needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the deterministic, non-rotating nature of a hard-coded key means any attacker who extracts it retains persistent capability until the key is replaced via patch.
Command injection in Vim's shell-related filetype plugins (sh.vim, zsh.vim, ps1.vim) allows arbitrary OS command execution when a user editing a shell or PowerShell file invokes the K keywordprg help lookup on a Visual-mode selection containing shell metacharacters. Affected versions are all Vim releases prior to 9.2.0839; no public exploit or CISA KEV listing has been identified at time of analysis. The CVSS 4.0 score of 8.4 reflects high confidentiality, integrity, and availability impact, tempered by the requirement for user interaction to trigger the vulnerable code path.
Code injection in Vim's vimball plugin prior to version 9.2.0847 allows arbitrary operating-system command execution when a user installs a crafted vimball archive and later uninstalls it. An attacker who delivers a malicious vimball containing a member named .VimballRecord can overwrite the installation record with arbitrary Ex commands - including shell invocations via :! - which execute with the victim user's full privileges when vimball#RmVimball() is subsequently called. No public exploit has been identified at time of analysis, and no active exploitation is confirmed in CISA KEV; the upstream patch is available as Vim 9.2.0847.
Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows exposes local systems to code execution by unprivileged attackers via a Ring 2 (device driver layer) improper access control flaw. Any local process with no privileges required and no user interaction can leverage the driver's failure to enforce access boundaries to achieve local code execution, with follow-on high confidentiality impact on the broader system - consistent with a kernel-level scope change. No public exploit identified at time of analysis, and no CISA KEV listing; however, the low complexity and zero-privilege requirement make this a credible post-compromise escalation vector for threat actors with any form of local code execution already established.
Privilege escalation via untrusted pointer dereference in ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and VGAdll exposes local attackers to arbitrary kernel memory writes through vulnerable IOCTL handlers in the associated kernel-mode drivers. The flaw (CWE-822) permits a caller supplying an attacker-controlled pointer to force the driver to write a specific value to an arbitrary memory address, enabling elevation of privileges. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the high CVSS 4.0 score of 8.4 and confirmed arbitrary-write primitive make this a meaningful local privilege escalation risk on affected systems.
Local privilege escalation in the Windows Cross Device Service (CVE-2026-66804) allows a low-privileged authenticated user to gain SYSTEM or elevated permissions on the local machine. The flaw stems from CWE-284 (Improper Access Control), meaning the service fails to adequately enforce authorization boundaries between user privilege levels. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a straightforward target for post-compromise lateral movement or privilege escalation tooling.
Heap and stack buffer overflow in CivetWeb's read_websocket() function (through commit 4a4f0c95) allows unauthenticated remote attackers to corrupt memory by sending crafted compressed WebSocket frames, but only against instances compiled with both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES build flags. Attackers negotiate permessage-deflate during the WebSocket handshake and send an RSV1-flagged frame that triggers a 4-byte zlib sync trailer write past the allocated buffer boundary, corrupting heap metadata and enabling denial of service or potential code execution (per VulnCheck tagging). No public exploit code is confirmed and this CVE does not appear in CISA KEV at time of analysis, but the deterministic 4-byte overwrite primitive is a credible research target; the non-default build configuration substantially limits the real-world exploitable population.
Command injection in Azure Monitor Agent Linux Extension (versions 1.0.0 through pre-1.43) enables privilege escalation over a network by an authorized attacker with high-privilege access. The CVSS:3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms network-based exploitation yielding full confidentiality, integrity, and availability impact on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is confirmed available from Microsoft MSRC.
Remote code execution in Zoom Clients allows a malicious meeting participant to exploit a buffer over-write vulnerability in the annotator function, achieving code execution on another participant's device over the network. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects high-complexity exploitation with a changed scope, meaning impact extends beyond the Zoom process to the underlying host. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE potential and network vector make this a high-priority patch target for organizations relying on Zoom for sensitive communications.
Remote code execution in Zoom Clients' annotator function allows a malicious meeting participant to compromise another participant's device by exploiting a use-after-free memory corruption flaw during a live meeting session. The CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H vector confirms network-accessible cross-participant exploitation with full CIA impact and scope change, requiring no in-meeting privileges but demanding high attack complexity consistent with UAF heap manipulation. No public exploit code has been identified at time of analysis, and no CISA KEV listing was found.
Server-side RDSTLS authentication bypass in FreeRDP prior to 3.30.0 allows a remote unauthenticated client to skip credential verification entirely - RedirectionGuid, username, domain, and password checks are all circumvented. The flaw exists in libfreerdp/core/rdstls.c: the server's rdstls_server_authenticate function accepted a RDSTLS_TYPE_CAPABILITIES PDU when it was expecting RDSTLS_TYPE_AUTHREQ, and because resultCode was initialized to RDSTLS_RESULT_SUCCESS rather than ACCESS_DENIED, the function returned success without any actual authentication occurring. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the bypass is mechanically straightforward for any attacker with RDSTLS protocol knowledge.
Privilege escalation in Microsoft PowerShell 7.4.x, 7.5.x, and 7.6.x stems from incorrect default permissions (CWE-276), enabling a locally authenticated low-privilege attacker to gain full system control. Exploitation requires local shell access and a user interaction trigger - an already-privileged user or process must execute PowerShell after the attacker has tampered with an incorrectly permissioned file or directory. No public exploit code and no active exploitation have been identified; SSVC confirms exploitation status as none and the attack is not automatable. Microsoft has released patched versions across all three affected branches.
Privilege escalation in the Windows Program Compatibility Assistant (PCA) Service, affecting a broad range of Windows 10, Windows 11, and Windows Server releases, stems from an integer underflow (CWE-191) that an authenticated local attacker can trigger to gain elevated - likely SYSTEM-level - privileges. The vulnerability requires only low-privileged local access with no user interaction, producing total confidentiality, integrity, and availability impact per the CVSS vector. SSVC assessment confirms no exploitation activity at time of analysis and no public exploit code has been identified.
Heap out-of-bounds read and write in FreeRDP's Kerberos SSPI layer (all versions prior to 3.30.0) allows a malicious RDP peer to corrupt memory during CredSSP/NLA Kerberos decryption by supplying a crafted GSS Wrap-token with an unbounded EC or EC+RRC field value. The flaw sits in the pre-session authentication path, meaning exploitation does not require an established authenticated session from the attacker's side. No public exploit has been identified at time of analysis and CISA KEV listing is absent, but the network-reachable attack surface during a common enterprise authentication flow warrants prompt patching.
Sandbox escape in Google Chrome on macOS exploits a use-after-free condition in the TabStrip browser component, enabling a renderer-level attacker to break out of Chrome's security sandbox. Affected are all Chrome for Mac versions prior to 151.0.7922.137. Critically, this vulnerability is a second-stage exploit primitive - it requires the renderer process to already be compromised via a separate, chained vulnerability before this UAF can be weaponized for full sandbox escape. No public exploit code or CISA KEV listing has been identified at time of analysis.
Spoofing via origin validation failure in Windows Network Address Translation (NAT) exposes Windows Server 2025 and Windows 11 (versions 24H2 through 26H1) to network-layer address spoofing by unauthenticated attackers on an adjacent network. The flaw, rooted in CWE-346, allows crafted packets to bypass NAT's origin-trust enforcement, potentially enabling man-in-the-middle interception or manipulation of traffic transiting the NAT boundary. The CVSS scope change (S:C) reflects that the impact extends beyond the host running NAT to other systems whose traffic passes through it. No public exploit code or active exploitation has been confirmed at time of analysis.
Kernel-mode stack overflow in Intel PROSet/Wireless WiFi Software for Windows allows adjacent unauthenticated attackers to crash affected systems, resulting in a full system denial of service. The flaw resides in Ring 0 (kernel privilege level) WiFi driver code, meaning a successful exploit triggers a kernel panic or Blue Screen of Death rather than a user-space crash. No public exploit or CISA KEV listing has been identified at time of analysis, and no exact patched version is confirmed in the available reference data - the Intel advisory INTEL-SA-01468 should be consulted directly.
Kernel-mode denial of service in Intel PROSet/Wireless WiFi Software for Windows allows an adjacent unauthenticated attacker to crash the target system by triggering an improper buffer restriction in the Ring 0 (kernel-level) WiFi driver component. The vulnerability carries a CVSS 4.0 score of 8.3, requires no authentication or user interaction, and is confined to adjacent-network attackers. Intel has acknowledged the issue via security advisory INTEL-SA-01468; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Denial of service in Intel PROSet/Wireless WiFi Software affects the Ring 2 device driver layer, where an improper conditions check (CWE-754) can be triggered by an adjacent, unauthenticated attacker with no user interaction required. The vulnerability collapses wireless availability on the affected host and, per the CVSS 4.0 vector, cascades to subsequent system availability as well, meaning dependent network-connected services may also be disrupted. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Intel PROSet/Wireless WiFi Software for Windows contains a null pointer dereference in Ring 0 (kernel space) that an adjacent, unauthenticated attacker can exploit to crash the target system, resulting in a denial of service. The flaw resides in the WiFi kernel driver, meaning a successful trigger causes a kernel panic (BSOD on Windows) with high availability impact on both the vulnerable component and the broader system. No public exploit code has been identified at time of analysis, and no KEV listing exists, but the adjacent-network attack vector and zero-privilege requirement make this relevant for any environment where untrusted parties share a wireless segment with Intel WiFi-equipped Windows endpoints.
Insufficient certificate validation in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier exposes a privileged internal communication workflow to man-in-the-middle interception, enabling an attacker with adjacent network access to present a fraudulent certificate the application accepts without proper verification. Under controlled network conditions allowing a successful MitM position, an unauthenticated attacker (per CVSS PR:N) can read, modify, or inject data into what GMS treats as a trusted management channel, resulting in unauthorized configuration changes that propagate to managed SonicWall infrastructure. No active exploitation has been confirmed (SSVC exploitation: none) and no public exploit is identified at time of analysis, though the S:C scope change elevates potential downstream impact across the full managed appliance fleet.
Improper access control in Intel PROSet/Wireless WiFi Software device drivers (Ring 2) allows a local unprivileged process to cause a denial of service affecting both the wireless subsystem and, to a lesser extent, downstream system integrity. Affected systems running Intel wireless drivers are exposed to any unprivileged local code - no authentication, no elevated privileges, and no user interaction are required. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security controls, gaining unauthorized read and limited write access to affected systems. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a low-complexity, network-exploitable flaw requiring no privileges or user interaction, elevating real-world risk for any internet-facing ColdFusion deployment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but ColdFusion's history as a high-value target warrants prompt patching.
Memory exhaustion in Coturn's DTLS listener allows unauthenticated remote attackers to crash or degrade the TURN/STUN service by flooding it with fragmented DTLS ClientHello messages before cookie validation occurs. All Coturn deployments prior to version 4.16.0 are affected, as both dtls_server_input_handler() and create_new_connected_udp_socket() in dtls_listener.c retain OpenSSL reassembly state for attacker-declared inflated handshake lengths without first completing RFC 6347 cookie exchange. No public exploit has been identified at time of analysis, but the attack requires only UDP connectivity to the listener and no credentials whatsoever, making it accessible to any internet-facing adversary.
Local privilege escalation in Windows User Profile Service affects all major current Windows client and server releases, allowing any authenticated local user to gain SYSTEM-level privileges by exploiting improper symlink or junction-point resolution (CWE-59). The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms low attack complexity with no user interaction required - a standard domain or local account is sufficient. Vendor patch is available; no public exploit is identified at time of analysis, but the low barrier to exploitation makes this a practical post-compromise escalation primitive.
Privilege escalation via use-after-free in the Windows Kernel allows a locally authenticated low-privilege attacker to gain SYSTEM-level access on Windows 11 and Windows Server 2025. The vulnerability carries a CVSS 7.0 score with high attack complexity (AC:H), indicating exploitation likely requires precise timing or heap-grooming to succeed. No public exploit identified at time of analysis, and Microsoft has released patches addressing all affected build versions.
Cleartext SQL credential transmission in Ivanti Endpoint Manager Core before version 2024 SU7 exposes database credentials to any attacker capable of occupying a man-in-the-middle network position on the path between EPM Core and its external SQL backend. The underlying root cause is classified as CWE-295 (Improper Certificate Validation), suggesting the Core component fails to properly enforce TLS certificate validation - likely causing connections to proceed over unencrypted or improperly verified channels. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog; however, the network-accessible attack surface and high-value credential target make this a meaningful priority for organizations running EPM in network environments with untrusted segments.
Stored XSS in telegram-search (versions ≤ 1.2.8) allows any group member to execute arbitrary JavaScript in co-members' browsers by sending crafted messages to a shared Telegram group. The highlightKeyword function in MessageList.vue returned attacker-controlled message text directly to Vue's v-html directive without HTML escaping, creating a persistent, cross-user sink that fires when victims browse or search the message archive - zero clicks required on the victim's side beyond opening the interface. No public exploit has been confirmed as actively exploited and no CISA KEV listing exists, but the public fix commit (PR #654) fully documents the vulnerable code path, making payload construction trivial for any XSS-proficient attacker with group access.