Integer overflow in Firefox's Graphics component crashes the browser for any user who loads attacker-controlled graphical content, resulting in a denial-of-service condition. All Firefox versions prior to 154 and all Firefox ESR versions prior to 153.1 are affected, covering effectively the entire unpatched Firefox install base globally. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the AV:N/AC:L/PR:N CVSS vector indicates a low-complexity, unauthenticated remote path, making this a high-priority patch target given Firefox's ubiquitous deployment footprint.
Denial-of-service in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated remote attackers to crash or indefinitely hang the service via crafted HTTP/2 traffic. Disclosed as part of Oracle's Critical Security Patch Update (CPU) for August 2026, the vulnerability is rated CVSS 7.5 with low attack complexity and no privileges required, making automated exploitation straightforward against any exposed instance. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service in Oracle Helidon 3.2.19's Imperative Web Server allows unauthenticated network attackers to hang or crash the server entirely via HTTP/2 traffic. The CVSS 3.1 score of 7.5 reflects the low attack complexity and complete availability impact, with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Remote denial-of-service in Oracle Helidon 4.5.0 Imperative Web Server allows unauthenticated network attackers to cause a persistent hang or repeated crash of the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with no authentication or user interaction required, making this reliably triggerable against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity means operational risk for teams running Helidon 4.5.0 in production microservice environments is meaningful.
Unauthenticated remote denial-of-service in Oracle Helidon 3.2.19 allows a network attacker to hang or crash the Imperative Web Server component via crafted HTTP requests, causing complete loss of service availability. The vulnerability requires no privileges, no user interaction, and is reachable over standard HTTP, making it trivially exploitable against any exposed Helidon 3.2.19 instance. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Remote denial-of-service in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network attackers to crash or indefinitely hang the server by sending crafted HTTP/2 traffic. The vulnerability carries a CVSS 7.5 rating with low attack complexity and no credential or interaction requirement, making it trivially scriptable from any network-accessible position. No active exploitation has been confirmed and no public proof-of-concept is known at time of analysis.
Denial-of-service in Oracle Helidon 3.2.19's Imperative Web Server component allows remote unauthenticated attackers to cause a complete hang or repeatable crash via HTTP, fully disrupting service availability. The vulnerability requires no authentication, no user interaction, and no special configuration, making it trivially exploitable against any network-accessible Helidon 3.2.19 instance. No public exploit code has been identified and it does not appear in CISA KEV at time of analysis, though the low attack complexity elevates operational risk for any exposed deployment.
Broken access control in the Charitable WordPress donation plugin (versions 1.8.11.3 and earlier) allows unauthenticated remote attackers to perform unauthorized write operations against protected plugin functionality. Classified under CWE-862 (Missing Authorization), the flaw reflects absent or bypassed capability and nonce checks on one or more plugin endpoints, enabling integrity-impacting actions without any credentials. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the unauthenticated, low-complexity attack surface warrants prompt patching on any internet-exposed WordPress installation running this plugin.
Broken access control in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows unauthenticated remote attackers to perform privileged administrative actions without any credentials. The flaw stems from missing authorization checks (CWE-862), meaning the plugin executes sensitive operations without validating the requester's identity or permission level. With a CVSS 3.1 score of 7.5 and an attack vector of network/no-privileges-required, exploitation is trivially achievable against any WordPress site running the affected plugin; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized data disclosure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all application-accessible financial hierarchy and metadata to unauthenticated remote attackers over HTTP, with no user interaction required. The flaw resides in the Access and Security component and is classified as an authentication bypass, enabling complete confidentiality compromise of the DRM platform's data assets without any credential requirement. No public exploit has been identified at time of analysis, but the absence of authentication barriers and low attack complexity make this a credible remote threat against any network-exposed deployment.
Unauthenticated remote attackers can access all data within Oracle iSupplier Portal 12.2.3 through 12.2.15 via a trivially exploitable HTTP flaw in the Internal Operations component, with no credentials, no user interaction, and no special configuration required. The 'Authentication Bypass' tag indicates that access controls protecting internal operations endpoints can be circumvented entirely over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity makes opportunistic exploitation realistic if portal instances are internet-facing.
Unauthenticated remote information disclosure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes critical financial planning and performance management data over HTTP. The authentication bypass flaw in the Installation and Configuration component allows a network-adjacent attacker with no credentials to gain complete read access to all data accessible within the Hyperion environment. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-complexity, zero-authentication attack vector makes this a high-priority patching target for any enterprise running the affected version.
Full takeover of Oracle MySQL Cluster is achievable by an unauthenticated remote attacker over HTTP across three active release trains: 8.0.0-8.0.48, 8.4.0-8.4.11, and 9.7.0-9.7.2. The attack carries high complexity and requires human interaction from a victim user, but successful exploitation yields complete confidentiality, integrity, and availability compromise of the cluster. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated, network-adjacent attackers to read critical application data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial exploitability with no authentication or user interaction required. Classified under the Authentication Bypass tag by Oracle, this vulnerability is covered in the Oracle Critical Patch Update for August 2026, with no public exploit code or CISA KEV listing identified at time of analysis.
Unauthenticated remote access to sensitive data affects Oracle Helidon 4.5.0's Imperative Web Server component via HTTP/2, allowing an attacker with network access to read critical or all data accessible to the Helidon application. The vulnerability is tagged as an authentication bypass, consistent with the CVSS vector showing no privileges or user interaction required. No public exploit identified at time of analysis, and the flaw is disclosed through Oracle's Critical Patch Update for August 2026.
Unauthenticated remote access to critical data in Oracle Business Intelligence Enterprise Edition (BIEE) is possible via a BI Platform Security authentication bypass reachable over HTTP. Affected versions 8.2.0.0.0 and 26.01.0.0.0 allow a network attacker with no credentials to read all data accessible through the BIEE platform, including potentially sensitive business reports, dashboards, and underlying data source content. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero authentication requirement make this a high-priority patching target.
Unauthenticated remote access to all Oracle Agile PLM 9.3.6 data is achievable via a flaw in the product's Security component, exploitable over HTTP with no credentials or user interaction. Tagged as an Authentication Bypass by the Oracle Security Alerts team, this vulnerability allows complete unauthorized read access to PLM-managed data - including product designs, intellectual property, and supply chain records - making it a significant data exfiltration risk for affected deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-complexity, unauthenticated attack profile makes this a high-priority patch target for any internet-exposed instance.
Unauthenticated remote access to sensitive data is possible in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 via a network-accessible HTTP attack requiring no user interaction and no prior privileges, consistent with an authentication bypass flaw. The CVSS 7.5 High rating reflects the complete confidentiality impact - full read access to all data accessible by the component - with no integrity or availability consequence. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the low-complexity, zero-authentication attack profile makes this straightforward to exploit if targeted.
Unauthenticated data exposure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows remote attackers to access all data managed by the Content Acquisition System component over HTTP with no credentials required. Tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.5 (High) with a fully unauthenticated, low-complexity network attack vector, enabling complete confidentiality compromise of indexed and managed content. No public exploit code or active exploitation has been identified at the time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated HTTP access to Oracle Purchasing (a component of Oracle E-Business Suite versions 12.2.3-12.2.15) enables remote attackers to read critical or complete procurement data with no credentials, user interaction, or elevated attack complexity. Tagged as an authentication bypass by EUVD (EUVD-2026-61894) and disclosed through Oracle's August 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.5, reflecting a fully network-exposed, zero-prerequisite attack path. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Unauthenticated network exposure in Oracle Payments (E-Business Suite versions 12.2.3 through 12.2.15) allows remote attackers to access all data handled by the File Transmission component without credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network reachability with no authentication or user interaction required. Tagged as an authentication bypass, this flaw yields complete confidentiality loss over Oracle Payments data; no public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes exploitation straightforward once a target instance is reachable.
Sensitive data exposure in the Duitku Payment Gateway WordPress plugin (versions up to and including 2.11.14) allows unauthenticated remote attackers to retrieve sensitive information without any credentials or user interaction. The vulnerability, classified under CWE-497, stems from the plugin failing to restrict access to system or operational data that should be shielded from public consumers. Reported by Patchstack, this flaw carries a CVSS 7.5 High rating driven entirely by confidentiality impact, with no public exploit or CISA KEV listing identified at time of analysis.
Full system takeover is achievable in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via a network-accessible SQL attack vector targeting the Common Events component. A low-privileged authenticated attacker who can meet the high-complexity exploitation conditions may fully compromise confidentiality, integrity, and availability of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor-confirmed total impact - described explicitly as 'takeover' - warrants priority patching in any environment running the affected version.
Unauthenticated broken access control in the FormyChat WordPress plugin (versions 2.15.7 and earlier) allows remote, unauthenticated attackers to access restricted plugin functionality or data due to missing authorization checks. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) confirms this is exploitable from the network without credentials, with high confidentiality impact but no integrity or availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication requirements make this straightforwardly exploitable on any exposed WordPress installation running the affected plugin.
WP Sort Order WordPress plugin versions 1.3.5 and below expose an unauthenticated broken access control flaw (CWE-862: Missing Authorization) that allows remote attackers without any credentials to invoke restricted plugin functionality. The CVSS vector confirms network-accessible, zero-complexity, unauthenticated exploitation with high confidentiality impact, meaning protected data can be read by any external party. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker targeting the Security component over HTTP, resulting in complete confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 7.5 (High) reflects this total impact, though high attack complexity (AC:H) constrains opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS data was supplied in the source intelligence.
Full system takeover is possible in Oracle Hyperion Data Relationship Management version 11.2.25.0.000 via a network-exploitable flaw in the Access and Security component. A low-privileged authenticated attacker with HTTP access can, under high-complexity conditions, achieve complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the product is not listed in the CISA KEV catalog; the high attack complexity (AC:H) meaningfully reduces the realistic exploitation probability despite the severe potential impact.
Unauthenticated remote data manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes the Endeca Application Controller to attackers who can create, delete, or modify critical commerce data over HTTP with no credentials required. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and Oracle's own characterization of the flaw as 'easily exploitable' confirm a low-barrier attack path with high integrity impact. No public exploit and no CISA KEV listing are identified at time of analysis, though the authentication bypass tag signals a fundamental access control failure in the controller interface.
Unauthenticated SQL injection in the Depicter Slider WordPress plugin (versions <= 4.8.0) allows remote attackers to query the underlying WordPress database without any credentials. The scope-changed CVSS vector (S:C, C:H) indicates the attack reaches beyond the WordPress application layer into the database tier, enabling high-confidentiality data extraction including user credentials and sensitive site content. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated nature of the flaw substantially lowers the bar for exploitation.
Full takeover of Oracle Applications DBA within Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible via an unauthenticated, network-based HTTP attack targeting the JRI and associated Java utility components. Exploitation is rated difficult (CVSS AC:H) and requires human interaction from a legitimate user, but successful compromise yields complete loss of confidentiality, integrity, and availability of the affected component. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Oracle's August 2026 Critical Patch Update addresses this issue.
Full platform takeover is possible in Oracle Commerce Platform 11.4.0 via the Dynamo Application Framework component, exploitable by an unauthenticated attacker who can reach the adjacent network segment hosting the server. The CVSS vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that successful exploitation yields complete compromise of confidentiality, integrity, and availability - consistent with Oracle's characterization of 'takeover.' No public exploit code has been identified at time of analysis, and this CVE does not appear on the CISA KEV catalog.
Full system takeover of Oracle Agile Engineering Data Management 6.2.1 is achievable by unauthenticated attackers who can reach the physical network segment hosting the EDM hardware, specifically via the Engineering Communication Interface (ECI) component. The CVSS vector (AV:A/AC:H/PR:N) confirms adjacency is mandatory and complexity is high, constraining realistic exposure to internal networks or co-located infrastructure. No public exploit code or active exploitation has been identified at time of analysis; this is patched under Oracle's August 2026 Critical Security Patch Update.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by an unauthenticated attacker positioned on the same physical network segment as the affected host, exploiting a flaw in the Installation and Configuration component. The CVSS vector confirms adjacent-network vector (AV:A) with high attack complexity (AC:H), meaning exploitation requires specific conditions but no credentials. Despite the adjacent-network constraint limiting broad internet exposure, successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
TLS certificate verification is globally disabled in fbeta-GmbH's ePA3-Service-OpenSource prior to version 1.3.0, exposing all traffic between the integration service and Germany's electronic patient record system and Konnektor devices to interception by network-positioned attackers. Both the primary TLS layer - via hardcoded `verify=False` in Python requests sessions across two independent modules - and the VAU protocol's application-layer certificate validation are broken simultaneously, eliminating all cryptographic trust anchors with no defense-in-depth fallback. On the Konnektor communication path, an impersonating attacker can additionally capture the client's mutual TLS certificate exchange and observe smartcard operations. No public exploit or CISA KEV listing exists at time of analysis.
Heap-based buffer overflow in Open5GS v.2.7.0 allows remote unauthenticated attackers to crash the NAS 5GS decoder chain by sending a NAS PDU with a mutated message type byte, resulting in denial of service to the AMF component and all connected UEs. The vulnerability is network-accessible with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), making it trivially reachable from any host with access to the AMF N1 interface. A public proof-of-concept exploit exists, no public exploit identified as confirmed active exploitation (no CISA KEV listing), and no vendor patch has been confirmed at time of analysis.
Memory leak in Open5GS v2.7.0's AMF component allows remote unauthenticated attackers to exhaust process memory and crash the Access and Mobility Management Function via crafted NGAP messages. The vulnerable function ngap_send_to_nas() in src/amf/ngap-path.c fails to release allocated memory (CWE-401), enabling a sustained DoS against the 5G core network's connection management plane. No public exploit confirmation as CISA KEV, but a proof-of-concept gist has been published by the reporter, and the CVSS score of 7.5 with network vector and no authentication requirement reflects meaningful real-world risk for exposed deployments.
Unauthenticated remote information disclosure in SJRC F11 SJ-GPS-PRO drone firmware (build 2019-09-17) exposes sensitive data through the tcp_actions() function over an open TCP service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that any network-reachable attacker, requiring no credentials or user interaction, can trigger the vulnerable function and retrieve sensitive device information. No public exploit or CISA KEV listing has been identified at time of analysis, though a researcher GitHub repository linked in references may contain disclosure details or proof-of-concept material.
Full takeover of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 is possible by an unauthenticated attacker positioned on the same physical network segment as the connector host, resulting in complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's August 2026 Critical Patch Update, the vulnerability carries a CVSS 3.1 score of 7.5 but is significantly constrained by its adjacent-only attack vector and high attack complexity. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
Site isolation bypass in Firefox's Graphics: CanvasWebGL component allows a malicious web page to leak cross-origin data through the browser's graphics subsystem. All Firefox releases prior to version 154 are affected, along with ESR branches fixed in 115.39, 140.14, and 153.1. No public exploit code or active exploitation has been confirmed; EPSS places this in the 6th percentile, suggesting widespread automated exploitation is currently unlikely despite the High CVSS score.
Denial-of-service in Mozilla Firefox's Widget component allows remote attackers to crash or hang the browser via specially crafted web content, exploiting uncontrolled resource consumption (CWE-400). All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected, with Mozilla issuing patches across four security advisories (mfsa2026-74, -77, -78, -80). No public exploit has been identified and EPSS sits at the 5th percentile, indicating low real-world exploitation probability despite the high CVSS base score.
Information disclosure in Firefox's Form Autofill component exposes sensitive personal data stored by the browser to unauthorized actors via a network-accessible, unauthenticated attack path scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H). All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected, with Mozilla issuing four separate security advisories (mfsa2026-74, mfsa2026-77, mfsa2026-78, mfsa2026-80) across release channels. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS exploitation probability stands at 0.14% (4th percentile).
Full takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged local attacker exploiting a flaw in the Security component, with confirmed scope change enabling impact on additional adjacent products. The CVSS vector (AV:L/AC:H/PR:H) reflects a difficult-to-exploit, infrastructure-local attack requiring significant access prerequisites, yet successful exploitation yields complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is best understood as an insider or post-compromise escalation threat rather than an opportunistic remote attack.
Full hypervisor takeover in Oracle VM VirtualBox 7.2.14 is achievable by a locally authenticated, highly privileged attacker exploiting a flaw in the Core component, with successful attacks producing a scope change that may compromise systems beyond the primary VirtualBox instance. The CVSS vector confirms local-only access with high privilege and complexity prerequisites, but the S:C scope change elevates real-world impact substantially - a compromised hypervisor exposes all hosted guest VMs and their data. Disclosed in Oracle's August 2026 Critical Security Update, no public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
Local privilege escalation with scope change in Oracle Siebel CRM's Email Marketing component affects versions 17.0 through 26.6, confirmed via the Oracle August 2026 Critical Security Update advisory (EUVD-2026-61438). Low-privileged attackers with existing logon access to the Siebel infrastructure can, under difficult-to-reproduce conditions, bypass access controls to read or modify critical marketing data and cascade impacts to other integrated Siebel products. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 contain an authentication bypass in the Security component, exploitable by a low-privileged attacker with local infrastructure access to achieve full confidentiality and integrity compromise of PeopleTools data, with scope change enabling lateral impact across additional integrated Oracle products. The local attack vector (AV:L) and high complexity (AC:H) constrain exploitation to insider threats or post-compromise scenarios, but the S:C scope change and H/H confidentiality-integrity impact make successful exploitation highly consequential in large Oracle ERP environments. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege abuse in PeopleSoft Enterprise FIN Lease Administration 9.2 enables a low-privileged attacker with infrastructure logon access to bypass authorization controls and achieve full confidentiality and integrity compromise of financial lease data. The vulnerability carries a scope change, meaning successful exploitation can cascade into additional PeopleSoft products beyond the directly targeted Lease Administration component, amplifying the impact across the ERP environment. No public exploit code has been identified at time of analysis; Oracle disclosed this in the August 2026 Critical Patch Update advisory.
Unvalidated Class.forName() with initialization enabled in RabbitMQ Java Client's JSON-RPC tooling allows a network-positioned attacker to trigger arbitrary static initializers in the victim JVM. Applications using com.rabbitmq:amqp-client before 5.33.0 that employ the JsonRpcClient class are exposed when an attacker can control or spoof the system.describe broker response - either as a co-tenant on a shared broker or via network interception. Successful exploitation achieves code-like effects through static initializer execution and a secondary type-confusion path via mapper.parse, with full confidentiality, integrity, and availability impact on the client process. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Side-channel information disclosure in Firefox's Storage: Cache API (CWE-203) allows remote unauthenticated attackers to infer sensitive cached data through observable timing discrepancies between cache hits and misses. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected per Mozilla advisories mfsa2026-74 through mfsa2026-80. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact rating and broad Firefox deployment footprint make patching a near-term priority.
Global SSL/TLS certificate verification is silently disabled across all puma web process outbound connections in Mastodon when LDAP authentication is configured with LDAP_TLS_NO_VERIFY=true, enabling man-in-the-middle interception of federation traffic, API callbacks, and media fetches. Affecting versions prior to 4.4.19 and 4.5.0 through 4.5.11, the root cause is a Ruby object mutation defect: calling .tap directly on the shared global OpenSSL::SSL::SSLContext::DEFAULT_PARAMS constant (rather than a .dup copy) permanently sets VERIFY_NONE for the entire puma process lifetime, not just the LDAP connection. No public exploit identified at time of analysis, but the exact one-line fix is visible in the public commit diff, making the vulnerability trivially reproducible.