The getLocalStorage API endpoint in SiYuan before v3.7.4 exposes the administrator's full local storage map to unauthenticated network callers and publish readers, with only three keys redacted by an incomplete sanitization filter. Sensitive operational metadata - including closed-tab history, search keywords, private document identifiers, and expanded folder paths - can be harvested in a single unauthenticated HTTP request against any network-accessible instance. No public exploit has been identified at time of analysis, but the zero-authentication, low-complexity attack path means any internet-exposed SiYuan deployment running a version below 3.7.4 is trivially reachable.
Privilege escalation in Teltonika Networks RUTOS (versions 7.07.1-7.24.1) and TSWOS (versions 1.03-1.10) allows an adjacent-network attacker with a low-privileged account to gain full administrative control of the device by exploiting unsafe argument handling in an execl() system call. The vulnerability enables complete integrity compromise of the affected router or switch operating system without requiring elevated privileges at entry. No public exploit code has been identified at time of analysis, and the flaw is not currently listed in the CISA KEV catalog.
The getBookmarkLabels API endpoint in SiYuan before v3.7.4 exposes all workspace bookmark labels to unauthenticated and publish-mode readers due to missing authorization checks (CWE-862), leaking organizational metadata - topic taxonomy, project labels, and subject-matter vocabulary - from documents the requester cannot otherwise access. Any network-reachable SiYuan instance prior to v3.7.4 is affected regardless of publish-mode configuration, as the endpoint applies no access-control filtering. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; risk is primarily reconnaissance-enabling intelligence disclosure rather than direct data exfiltration.
Unauthorized document outline disclosure in SiYuan before v3.7.4 exposes heading identifiers for any document to unauthenticated network callers via the `/api/storage/getOutlineStorage` endpoint, which performs no authorization verification whatsoever. Affected are all SiYuan deployments (cpe:2.3:a:siyuan-note:siyuan:*) configured to listen on externally reachable interfaces running any version prior to v3.7.4. No public exploit has been identified at time of analysis, though the attack requires no credentials and is trivially automatable - any caller who supplies a document identifier retrieves its structural outline regardless of document-level access restrictions.
Unauthenticated access to the /api/block/getRefIDs endpoint in SiYuan before v3.7.4 exposes block reference metadata from password-protected documents, allowing remote attackers without any credentials to enumerate internal document structures. The endpoint fails to enforce the document-level password tier before returning block identifiers, meaning the password protection on sensitive documents is effectively bypassed for this API route. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in v3.7.4 per the GitHub Security Advisory GHSA-vg99-7gj7-2fr5.
Unauthenticated filesystem reconnaissance in SiYuan versions before v3.7.4 allows any network-reachable anonymous reader to probe arbitrary absolute paths on the host via the `getUniqueFilename` endpoint, which performs no authorization check or path confinement before returning existence results. The missing authorization control (CWE-862) means the attack requires zero credentials and zero user interaction against any exposed SiYuan HTTP interface, enabling structured enumeration of filesystem layout, installed software, and sensitive path locations as a precursor to more targeted attacks. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-barrier exploitation profile makes pre-attack reconnaissance trivially achievable against internet-exposed or LAN-accessible instances.
Arbitrary file deletion with elevated privileges is possible in the VantageCoreAddin component of Lenovo Vantage and Lenovo Commercial Vantage via an improper link following (symlink) attack. A local authenticated user operating with low privileges can exploit this to delete files outside their authorized scope by placing a malicious symbolic or hard link in a path the addin traverses with elevated rights. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Path traversal in rsync before 3.5.0 allows a malicious sender to write arbitrary files outside the receiver's intended destination directory by exploiting symlink following in --relative mode. The make_path() function creates intermediate directories while following symlinks without enforcing that resolved paths stay within the destination tree boundary, enabling controlled file writes to arbitrary locations on the receiver's filesystem. No public exploit or CISA KEV listing is confirmed at time of analysis, but the CVSS 4.0 score of 6.9 with high integrity and availability impact reflects meaningful real-world risk given rsync's ubiquity in backup and synchronization workflows.
Arbitrary file deletion with elevated privileges affects Lenovo Dock Manager across all tracked versions (CPE: cpe:2.3:a:lenovo:dock_manager:*:*:*:*:*:*:*:*). An authenticated local user can exploit this CWE-59 link-following flaw to redirect the application's privileged file deletion routine to arbitrary targets outside the user's permitted scope, threatening both system integrity and availability. The vulnerability was identified through Lenovo's own internal security assessment; a vendor patch is available via advisory LEN-223470, and no public exploit has been identified at time of analysis.
Unauthorized Osquery live query execution in Elastic Kibana allows a low-privileged authenticated user to run endpoint queries against Elastic Agents assigned to Kibana spaces they have no authorization to access, violating the platform's space-based multi-tenancy access control model. By exploiting a user-controlled key authorization bypass (CWE-639 / CAPEC-1), an attacker can exfiltrate host telemetry - running processes, network connections, file system state - from isolated organizational spaces, with results written to the Osquery results data stream accessible to the attacker. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified at the time of analysis; however, the network-accessible vector and high confidentiality impact make this a meaningful risk in multi-tenant deployments.
Silent integer overflow in ERC7984ERC20Wrapper's confidential total supply counter allows fund loss when an fhEVM token wrapper is exhausted. In versions prior to 0.3.1, the wrap() and onTransferReceived() functions did not check whether the internal _mint call succeeded, meaning that once the euint64 supply counter reached its maximum (~18.4 trillion tokens), subsequent wrapping operations transferred the caller's underlying ERC-20 tokens into the contract while crediting no confidential wrapped tokens in return. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 0.3.1.
Process termination in baseline-browser-mapping 2.x before 2.11.0 can be triggered by supplying invalid or conflicting parameters to the library, causing the entire Node.js runtime to exit via `process.exit()` rather than throwing a catchable error. Any application that exposes externally-supplied input to this library's API - such as `getCompatibleVersions()` or `getAllVersions()` - is vulnerable to complete process-level denial of service that cannot be recovered by application-layer error handlers. No public exploit exists and exploitation is rated unlikely per the CVSS 4.0 supplemental E:U tag, but impact when triggered is absolute: the process dies and cannot be restarted without operator intervention.
Out-of-bounds memory read in sblim-sfcb's provider-manager IPC message parser allows a local low-privileged attacker to crash the provider-manager process, causing denial of service and potentially leaking limited adjacent memory contents. The vulnerability stems from unsafe deserialization of attacker-controlled IPC messages without adequate boundary validation, affecting sblim-sfcb as shipped across Red Hat Enterprise Linux versions 6 through 10. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained to local system access.
Prototype pollution in Mongoose's update casting mechanism allows remote attackers (PR:N per CVSS vector) to corrupt Object.prototype by embedding a __proto__-prefixed dotted key inside a $set operator in any update payload passed without sanitization to Mongoose update operations. All major Mongoose release lines are affected below versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2, impacting Node.js application integrity and availability wherever the req.body-to-updateOne anti-pattern exists. Publicly available exploit code exists in the GHSA advisory; no CISA KEV listing is recorded at time of analysis.
Buffer overflow in IBM i 7.3 through 7.6 enables remote authenticated attackers to obtain sensitive information from the system. The vulnerability (CWE-787, out-of-bounds write) exposes memory contents under network-accessible conditions, with IBM confirming a patch is available. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, and EPSS data was not provided.
Denial of service in Kibana allows an authenticated low-privileged user to crash the entire Kibana process by submitting specially crafted input data. The crafted payload triggers an uncaught exception (CWE-248) on a critical execution path, causing Kibana to terminate and become unavailable to all users until manually restarted. Because the condition is repeatable, an attacker holding only basic credentials can maintain a persistent denial-of-service state. No public exploit has been identified at time of analysis, and no KEV listing exists.
Stack exhaustion in Elasticsearch allows any low-privileged authenticated user to crash an Elasticsearch node with a single crafted request. Affected are all Elasticsearch versions across the 8.x and 9.x release lines, with Elastic releasing fixed versions 8.19.20, 9.4.5, and 9.5.1 under ESA-2026-78. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and minimal privilege requirement make this a straightforward denial-of-service vector for any credentialed user.
Node process termination in Elasticsearch via the ingest simulate pipeline API allows low-privilege authenticated users to crash individual cluster nodes by submitting a crafted request that induces uncontrolled recursion. The vulnerability affects multiple Elasticsearch version lines, with Elastic releasing fixes in versions 8.19.1, 9.3.8, and 9.4.4 per advisory ESA-2026-75. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, but the low attack complexity and broad enterprise footprint of Elasticsearch make this a meaningful availability risk, particularly in multi-tenant or shared-cluster deployments.
Sensitive subscriber data exposure in the Payment Forms for Paystack WordPress plugin (versions ≤ 4.0.5) allows authenticated users holding a subscriber-level WordPress account to retrieve confidential payment-related information beyond their authorization scope. Rooted in CWE-497, the flaw is network-exploitable with low attack complexity and requires no user interaction beyond possession of a valid low-privilege session. No public exploit identified at time of analysis; the vulnerability was disclosed by Patchstack and is tracked under ENISA EUVD-2026-57869.
Broken access control in the Service Finder Booking WordPress plugin (versions up to and including 6.2) allows authenticated subscribers to trigger high-availability-impact actions they should not be authorized to perform. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify that the requesting user has sufficient privileges before executing sensitive operations. No public exploit or active exploitation has been identified at time of analysis, though the low attack complexity and network accessibility make it straightforward to trigger once a subscriber account is obtained.
Broken access control in the AcyMailing SMTP Newsletter WordPress plugin (versions <= 10.11.1) permits subscriber-level users to access restricted functionality reserved for higher-privileged roles. The flaw, rooted in missing authorization checks (CWE-862), allows a low-privileged but authenticated WordPress user to read sensitive newsletter data - including subscriber lists, campaign details, or configuration - that should require administrator or editor access. No public exploit or active exploitation via CISA KEV is confirmed at time of analysis, though Patchstack has documented and disclosed the vulnerability.
Broken Access Control in the Tourfic WordPress plugin (all versions up to and including 2.23.1) allows authenticated subscriber-level users to access restricted functionality or data beyond their intended authorization scope. The flaw stems from missing authorization checks (CWE-862), enabling low-privileged authenticated users to bypass access controls and retrieve sensitive information, as reflected by the High confidentiality impact in the CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-complexity, network-accessible nature of the flaw makes it straightforward to exploit for any registered site user.
Broken object-level authorization in Elastic Kibana's Fleet module exposes sensitive proxy configuration data to under-privileged users who should not have access to it. A user holding only the 'read agent policies' permission - a scope far narrower than Fleet administrative access - can read the full Fleet proxy configuration, including proxy authentication credentials and private key material. No public exploit code has been identified at time of analysis, but the CVSS Scope Changed metric (S:C) reflects that stolen credentials could be leveraged against proxy infrastructure well beyond the Kibana instance itself.
Out-of-bounds read in IBM i 7.3 through 7.6 enables a remote authenticated attacker to read beyond allocated memory boundaries, leaking sensitive information and causing limited availability impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable attack requiring only low-privilege credentials with no user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the patch is available via IBM's support portal.
Denial of service in Elasticsearch's wildcard matching component allows any authenticated user with search access to terminate an affected node by submitting a single crafted query. The recursive wildcard evaluator has no bounds on recursion depth or total match operations; a pattern containing many wildcard groups evaluated against a sufficiently long field name exhausts the JVM thread stack, triggering a StackOverflowError that Elasticsearch treats as unrecoverable, causing immediate node shutdown rather than graceful request failure. No public exploit has been identified at time of analysis, but exploitation requires only low-privilege search access (CVSS PR:L), meaning any application service account or authenticated API user represents a viable threat origin.
Denial-of-service in Kibana's connector reporting endpoint allows any authenticated user - including those with read-only privileges - to permanently incapacitate the Kibana process with a single crafted request. The flaw stems from accepting arbitrarily large query expressions without size limits, causing the process to consume unbounded CPU evaluating the expression and rendering the instance unable to serve any user until manually restarted. No public exploit has been identified, but the low privilege bar (read-only access) and single-request reproducibility make this an attractive target for internal threat actors or compromised low-privilege accounts seeking to disrupt SOC or observability operations.
Memory exhaustion in Elasticsearch's search highlighting subsystem allows any authenticated read-only user to terminate a node process with a single crafted request. The highlighting API accepts an unbounded user-supplied count, and the internal data structure allocated from that count is not tracked by Elasticsearch's circuit breaker system, bypassing the existing OOM safeguards entirely. The defect is non-volumetric - one small request is sufficient - and degrades cluster routing and health beyond the targeted node. No public exploit has been identified at time of analysis, though the low attack complexity and minimal privilege requirement make this a realistic internal threat.
Uncontrolled recursion in Elasticsearch's custom analysis definition processing allows an authenticated low-privileged user to crash an individual cluster node with a single request. By submitting a malformed index creation request whose custom analyzer, tokenizer, or filter components reference each other without termination, the resolution logic enters unbounded recursion, exhausts the JVM thread stack, and terminates the targeted node. No public exploit has been identified at time of analysis, but the attack requires only index creation privileges - a permission commonly granted to application service accounts - making the practical barrier lower than the authentication prerequisite might suggest.
Uncontrolled recursion in Elasticsearch's search request processing allows an authenticated user with only read-level privileges on a single index to crash any cluster node by submitting a specially crafted query containing pathologically nested structures. The absence of a recursion depth limit causes thread stack exhaustion during deserialization of the nested payload, triggering an unhandled stack overflow that terminates the affected node. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE, but the low privilege bar (read-only access) makes the attack surface broad in multi-tenant or exposed deployments.
Elasticsearch exposes an authenticated denial-of-service path where a user holding only read privileges on a single index can crash an entire cluster node with one small, crafted search request. Rooted in CWE-789 (Memory Allocation with Excessive Size Value) and matching CAPEC-130 (Excessive Allocation), the flaw causes the JVM heap to be exhausted, terminating the affected node and disrupting all workloads on it. No CISA KEV listing and no public exploit code have been identified at time of analysis, but the low attack complexity makes this a credible threat in multi-tenant or broadly-credentialed Elasticsearch deployments.
ES|QL query processing in Elasticsearch allows an authenticated low-privileged user to exhaust heap memory on any receiving cluster node by submitting a specially crafted query, rendering that node unavailable. The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects remote, low-complexity exploitation requiring only a valid account, with high availability impact but no data exposure. Elastic has released fixes in versions 8.18.0 and 9.0.0 per advisory ESA-2026-111; no public exploit or active exploitation has been identified at time of analysis.
Resource exhaustion in Elastic Kibana allows an authenticated user who holds maintenance window management privileges to crash the Kibana process for all users by submitting a specially crafted malformed payload. The Kibana process consumes unbounded resources and becomes fully unresponsive, requiring manual operator intervention to restore service - there is no automatic recovery. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the low access complexity and broad multi-tenant availability impact make it a meaningful operational risk for shared Kibana deployments.
Denial of service in Elastic Kibana's alerting feature allows an authenticated user with read-only alerting privileges to crash the Kibana process for all users by submitting a single crafted malformed payload. The resource exhaustion is unbounded - a single HTTP request is sufficient to render Kibana unable to serve any users until the process is manually restarted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and broad impact make it a meaningful risk in any multi-tenant Kibana deployment where alerting access is granted to partially-trusted users.
Algorithmic complexity exhaustion in Kibana's TSVB (Time Series Visual Builder) expression evaluator allows any authenticated user to render the entire Kibana instance unresponsive with a single crafted request. The synchronous evaluation of a specially crafted deeply nested expression monopolizes the Kibana request-processing thread indefinitely, blocking all subsequent requests until the service is manually restarted. Patched versions 8.19.20 and 9.4.5 are available per Elastic advisory ESA-2026-104; no public exploit or CISA KEV listing has been identified at time of analysis.
Denial of service in Elastic Kibana allows any authenticated low-privileged user to crash the entire Kibana service for all users by submitting a specially crafted, malformed payload to a visualization feature. The root cause is CWE-770 (resource allocation without throttling): Kibana fails to validate the malformed input before processing, causing unbounded heap growth until the host OS kills the process. No public exploit has been identified at time of analysis, and exploitation requires authenticated access, but the low privilege bar and total service disruption make this a meaningful insider or compromised-credential threat. Patch versions 8.19.20 and 9.4.5 are referenced in the vendor advisory ESA-2026-100.
Unbounded resource allocation in Kibana's Observability log analysis validation feature enables any authenticated low-privilege user to exhaust the Kibana process memory and deny service to all users. The flaw (CWE-770, CAPEC-130) requires only minimal credentials - no elevated roles - and a single inexpensive HTTP request triggers concurrent work without throttling. Notably, the request can be repeated trivially, sustaining pressure even on well-provisioned deployments that might otherwise degrade gracefully rather than crash outright. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, though the low exploitation bar makes this a credible insider or credential-abuse threat.
Denial of service in Kibana's Playground for RAG feature allows a low-privileged authenticated user to exhaust the memory and processing resources of a Kibana instance via a single crafted request. The vulnerable endpoint accepts a user-supplied list of document fields without enforcing any length bound or deduplication, enabling a request to trigger construction of a response orders of magnitude larger than the underlying data. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis. Elastic has released fixes in versions 9.3.8 and 9.4.4.
Denial of service in Elasticsearch allows any authenticated user holding only read-only index privileges to crash a cluster node by submitting a single crafted search request. The intervals query type does not enforce Elasticsearch's configurable input-length restriction, so a deeply nested pattern drives unbounded recursion that exhausts the JVM thread stack and terminates the node process. No public exploit or CISA KEV listing exists at time of analysis; however, the low complexity and minimal privilege bar make this a credible internal threat, and Elastic has released fixes in versions 8.19.20 and 9.4.5 per ESA-2026-81.
Memory exhaustion in Elasticsearch allows any authenticated user with only read privileges to crash an Elasticsearch node with a single small crafted API request. The root cause is missing validation of a user-controlled size value that is passed directly to an internal memory reservation routine, enabling uncontrolled heap allocation that terminates the node process and degrades cluster health. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the non-volumetric nature - one request is sufficient regardless of heap configuration - significantly lowers the bar for disruption by low-privileged insiders or compromised service accounts.
Denial of service in Elasticsearch allows any low-privileged authenticated user to crash an affected cluster node with a single crafted HTTP request. The root flaw is a validate-after-deserialize ordering error: Elasticsearch decodes and deserializes an opaque identifier before confirming the cluster issued it, and an attacker-controlled size value embedded in the forged identifier drives an uncapped heap allocation (CWE-789) that exhausts available memory and fatally terminates the node process. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Denial of service in Elasticsearch allows an authenticated user with only read privileges to crash a cluster node by submitting a crafted search request. Processing the malicious input triggers unbounded memory allocation in a specific internal component, bypassing existing memory accounting controls and causing a fatal out-of-memory condition that terminates the affected node process. No public exploit code has been identified at time of analysis, but the low privilege requirement (read-only access) significantly broadens the potential attacker pool in multi-tenant or SaaS deployments.
Stack-based buffer overflow in IBM i 7.3 through 7.6 allows a remote attacker with low-privileged network access to crash the system, causing a denial of service. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms network reachability at low complexity, but impact is limited strictly to availability - no confidentiality or integrity consequences are indicated. IBM has released a patch; no public exploit or active exploitation has been identified at time of analysis.
Broken Access Control in the Motors WordPress plugin (car dealership and classified listings, by Stylemix) through version 1.4.113 allows subscriber-level authenticated users to perform privileged actions that should be restricted to higher roles, resulting in a high integrity impact. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user has sufficient privileges before executing sensitive operations. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cleartext token exposure in Elastic Cloud on Kubernetes allows any principal with namespace workload-spec read access to retrieve live Elasticsearch service account credentials. Affected deployments are those running Fleet Server resources configured to authenticate to Elasticsearch via service account tokens - ECK writes the token directly into the generated Pod specification in cleartext rather than referencing the Kubernetes Secret where other credentials are stored, bypassing an intentional RBAC boundary. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the confidentiality impact is high given that the exposed credential grants direct Elasticsearch data-plane access.
Sensitive customer data exposure in the WP Event Solution WordPress plugin (versions up to and including 4.1.18) allows authenticated low-privileged users to access confidential customer information over the network. The vulnerability, classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), results in high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate realistic risk for sites collecting customer data via this plugin.
Policy information disclosure in Elastic Fleet Server allows any enrolled agent with valid credentials to retrieve policy documents it was not assigned to by substituting a client-controlled key in artifact download requests. The authorization decision relied on a client-supplied value that was persisted without being cross-checked against the server-side record of the requesting agent's actual policy assignment - a textbook CWE-639 flaw. The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N) reflects network-accessible, low-complexity exploitation by any authenticated agent; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization in Elastic Kibana's Security solution allows users holding only detection rule authoring privileges to associate and indirectly trigger Elastic Defend endpoint response actions - including host isolation, process termination, and remote execution - against managed hosts, without ever being granted the dedicated Endpoint response action privileges that are supposed to govern those capabilities. The exploitation path is indirect: a restricted user crafts a detection rule with embedded response actions, and when that rule generates alerts against matching endpoints, the privileged actions execute autonomously through the Elastic Defend agent. No public exploit has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Path traversal in Zimbra Collaboration Suite (ZCS) Briefcase document editing exposes sensitive web application files to authenticated low-privileged users. The vulnerability stems from improper validation of the `packages` parameter, enabling directory escape via crafted traversal sequences. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor has released a fix in version 10.1.17.
Missing authorization in Kibana's internal data retrieval capability for Elastic Defend endpoint response actions exposes sensitive security telemetry to any authenticated low-privileged user. The internal API endpoint used for endpoint response actions bypasses the Security Solution and endpoint privilege checks applied to its user-facing equivalents, executing with elevated internal permissions rather than the requesting user's permissions. No public exploit or CISA KEV listing exists at time of analysis; however, any authenticated Kibana user - regardless of Security Solution role assignments - can exploit this to read endpoint response records and host-returned response content from managed endpoints.
XML External Entity (XXE) injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to exfiltrate sensitive information by submitting crafted XML payloads to an XML-processing component on the platform. The CVSS vector (AV:N/AC:L/PR:L) confirms low-complexity network exploitation requiring only a low-privileged account, with high confidentiality impact and no integrity or availability effect. No active exploitation has been confirmed (not in CISA KEV), and IBM has released a patch via its support portal.