Dozzle's webhook SSRF guard can be bypassed by authenticated users in versions 10.5.2 through 10.6.14 by supplying webhook URLs that resolve to IPv6 transition addresses encoding blocked IPv4 targets such as 127.0.0.1 or 169.254.169.254. The `isBlockedIP` function in `internal/notification/dispatcher/webhook.go` validated literal IPv4 and native IPv6 addresses but did not unwrap IPv4 addresses embedded inside 6to4, NAT64, Teredo, or IPv4-compatible IPv6 forms, making the guard trivially circumvented by encoding a loopback or link-local address in any of those transition formats. The CVSS 4.0 score is 2.3; publicly available exploit code exists per SSVC classification, though no active exploitation has been confirmed and the vulnerability is not in CISA KEV.
Hardcoded credentials embedded in SAP Advanced Planning and Optimization (Model Mix Planning) source code enable authenticated high-privilege attackers to bypass the application's authorization layer and delete specific planning-related restrictions. Confirmed by SAP via Security Note 3763028 and disclosed on SAP Security Patch Day, the flaw spans a wide range of APO versions including SCM 700, S4CORE, and S4COREOP release lines. No public exploit code exists and the vulnerability is not listed in CISA KEV; real-world impact is constrained by the high-privilege prerequisite and limited to low-severity confidentiality and integrity effects.
Improper error condition handling in SAP Approuter (the node.js routing component of SAP Business AI Platform) allows a low-privileged network attacker to cause a partial availability disruption under a non-default configuration. The attack is highly complex, requiring conditions outside the attacker's control, and produces only low availability impact with no confidentiality or integrity loss. No public exploit has been identified at time of analysis, and a vendor patch is available in Approuter node.js package version 23.0.0 and later.
Tenant context spoofing in SAP Approuter (node.js package < 23.0.0) allows unauthenticated remote attackers to craft requests that bypass tenant isolation, resulting in limited cross-tenant information disclosure. Exploitation is constrained by High Attack Complexity (AC:H per vendor CVSS), meaning conditions necessary for success are not fully under attacker control. No public exploit has been identified at time of analysis and a vendor patch is available, making this a low-urgency but compliance-relevant issue for SAP BTP multi-tenant deployments.
SAP Data Services Management Console versions 4.3 and 2025 expose an overly permissive Content Security Policy that omits key restrictive directives, creating a prerequisite condition for script injection attacks within the application context. An authenticated attacker who also controls or exploits a separate vulnerability - such as a stored or reflected XSS vector - can leverage the absent CSP controls to execute malicious scripts in a victim user's browser session. Confidentiality and integrity suffer limited impact; availability is unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis.
FPU register state leakage in Zephyr RTOS ARM port exposes callee-saved floating-point registers across thread boundaries when CONFIG_FPU is enabled without CONFIG_FPU_SHARING. Under CONFIG_USERSPACE builds, an unprivileged co-resident thread can directly read FP registers s16-s31 left behind by a victim thread after a context switch, because FP register access is not privilege-gated on ARM and the kernel performs no save/restore of those registers in the unshared configuration. No public exploit is identified at time of analysis, EPSS data is not provided, and the vulnerability is not listed in CISA KEV; impact is bounded to 16 callee-saved single-precision registers and requires an attacker-controlled thread executing concurrently with the victim.
OpenSSH ssh-agent before version 10.5 permits remote execution of agent operations - including adding authentication tokens and using SSH keys - that were architecturally intended to be restricted to local access only. The trust boundary failure stems from a misinteraction between the agent locking mechanism and the session-bind@openssh.com extension, allowing an authenticated remote actor to cross the local/remote privilege boundary. No public exploit has been identified at time of analysis, and SSVC assessment confirms no current exploitation activity; however, the network-accessible vector and ubiquitous deployment footprint of OpenSSH make patching to 10.5 the appropriate response for any environment using agent forwarding.
Use-after-free in Vim's JSON channel parsing (versions 9.2.0511 through 9.2.0843) causes the socketserver process to crash when processing malformed JSON messages that straddle read-buffer boundaries. The stale pointer p in json_decode_item() is invalidated when channel_fill() frees the underlying buffer mid-parse; the error-reporting code then reads freed memory, producing a crash with no code-execution or data-exfiltration potential. No active exploitation is confirmed and no public exploit code has been identified; vendor-released patch v9.2.0844 resolves the flaw.
Privilege escalation in Adobe Commerce and Magento Open Source exposes restricted resources to authenticated high-privilege users through a flawed authorization check (CWE-863). Affected products span the full 2.4.x series of Adobe Commerce and Magento Open Source, plus the 1.3.x-1.5.x Adobe Commerce B2B extension. No public exploits are known, CISA SSVC rates exploitation as none, and vendor-released August 2026 patches are available across all affected release lines per advisory APSB26-92.
OpenSSH sshd before version 10.5 fails to enforce the `restrict` keyword in `authorized_keys` against tunnel forwarding, allowing a constrained SSH key holder to establish tun-device tunnels that the administrator explicitly intended to block. The flaw affects all OpenSSH releases prior to 10.5 and is classified as a policy-enforcement bypass with low integrity impact. No active exploitation is confirmed per SSVC (exploitation: none) and the vulnerability is absent from the CISA KEV catalog, placing this firmly in the low-urgency tier despite OpenSSH's near-ubiquitous deployment footprint.
Integer overflow in Intel Slim Bootloader UEFI firmware exposes systems to limited information disclosure and denial of service. Exploitation requires local, authenticated access with active user interaction, yielding only low-impact confidentiality and availability consequences with no integrity impact. No active exploitation has been identified; the CVSS 4.0 score of 2.4 reflects the constrained exploitation conditions and limited blast radius.
Temporal UI Server versions 2.7.0 through 2.53.1 incorrectly derive the Secure attribute for OAuth authentication cookies from the proxy-to-server connection rather than the browser-facing connection, causing access-token and refresh-token cookies to be issued without Secure when TLS terminates at a reverse proxy forwarding over HTTP. An attacker who can additionally redirect browser traffic for the UI hostname away from HTTPS - beyond merely serving attacker-controlled content - can potentially intercept a live credential transmitted in a plaintext HTTP request. No public exploit code exists and CISA KEV does not list this vulnerability; the SSVC assessment confirms exploitation is currently none and the attack is not automatable, consistent with the very low CVSS 4.0 score of 2.3.
Cross-site scripting in cti-transmute's MISP event-browser allows a malicious or compromised remote MISP instance to inject arbitrary HTML and JavaScript into the operator's browser by returning crafted values in event data fields. Affected fields include event IDs, event information text, organization names, tags, tag colors, TLP labels, distribution labels, and flash/error messages - all previously interpolated via innerHTML without sanitization. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; the low CVSS 4.0 score of 2.3 reflects the hard prerequisite that an attacker must control or compromise the specific MISP instance being queried.
MongoDB Server 8.3.x through 8.3.7 permits certificate-based authentication to succeed for a client holding a valid x.509 certificate and a corresponding user account, even when the administrator has explicitly configured the server to restrict allowable authentication mechanisms to other methods such as SCRAM. The vulnerability undermines deliberate access-control policy decisions rather than enabling unauthenticated access, meaning the attacker must already possess legitimate credential material. With a CVSS 4.0 score of 2.3, CISA SSVC exploitation status of 'none', and no public exploit identified at time of analysis, this is a low-urgency compliance and policy-integrity issue rather than an imminent exploitation threat.
Stack-based buffer overflow in NETGEAR RAX-series and XR-series routers enables an authenticated administrator, operating from an adjacent network, to trigger unauthorized modifications to router firmware and core functionality beyond what the admin interface normally permits. Affected hardware spans at least 19 model variants including RAX20, RAX35V2, RAX41/V2, RAX42/V2, RAX43/V2, RAX45, RAX49S, RAX50, RAXE450, RAXE500, XR1000, and XR1000V2. No public exploit code has been identified and this CVE is absent from CISA KEV; a vendor-released patch is available from NETGEAR for affected models.
Stack-based buffer overflow in multiple NETGEAR router models (R7000, RAX and XR series) allows an authenticated admin user on an adjacent network to make unauthorized modifications to the router's software and functionality. Exploitation is highly constrained by CVSS 4.0 metrics - adjacent network access, high attack complexity, and pre-existing administrative credentials are all required, yielding an extremely low composite score of 1.9. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing real-world risk well below what the CWE-121 classification alone might suggest.
Out-of-bounds write (CWE-787) in Intel Slim Bootloader firmware enables a denial of service condition on the local system. Exploitation requires a privileged local account and the presence of specific attack preconditions (AT:P per CVSS 4.0), and impact is confined to low availability on the vulnerable system with no confidentiality or integrity consequences. Intel disclosed this issue through advisory INTEL-SA-01475 with a CVSS 4.0 base score of 1.8; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in multiple NETGEAR consumer and prosumer router and mesh system models enables an authenticated administrator with adjacent network access to crash affected devices, causing temporary service unavailability. Affected hardware spans the MR, MS, and RAX product lines across at least 15 models and carries a CVSS 4.0 score of 1.1, reflecting the high-privilege prerequisite and narrow impact scope limited to transient availability loss. No public exploits exist and no active exploitation has been reported; vendor firmware patches are available through NETGEAR per-product support pages.
Stack-based buffer overflow across ten NETGEAR RAX-series WiFi 6 routers allows a device administrator with adjacent network access to temporarily disrupt normal device operation, producing a transient denial-of-service. The vulnerability carries a CVSS 4.0 score of 1.1, reflecting its highly constrained attack conditions: high-privilege access and adjacent network adjacency are both required, and the only impact is a brief availability disruption with no confidentiality or integrity consequence. No public exploit code exists and the vulnerability is not listed in CISA KEV; NETGEAR has released firmware patches for all affected models.
Privilege escalation in AMD Vitis Unified on Windows enables a low-privileged local user to plant malicious code in the installation directory due to misconfigured filesystem permissions, potentially leading to arbitrary code execution under a more privileged context. Affected installations are the Vitis Unified Installer for FPGAs and Adaptive SoCs on Windows, patched in release 2026.1. No public exploit code and no active exploitation have been identified at time of analysis; CISA SSVC rates exploitation as none and the attack as non-automatable.
Binary hijacking is possible on Windows machines running AMD Vitis Unified due to weak filesystem permissions on the installation directory. A low-privileged local user can write arbitrary executables into paths traversed by higher-privileged processes, causing those processes to load attacker-controlled code when triggered by an interactive user. The CVSS 4.0 score of 1.0 reflects significant limiting prerequisites: local access, low-privilege credentials, specific attack preconditions, and required user interaction are all mandatory for exploitation. No public exploit has been identified at time of analysis.