Froxlor's standalone AJAX endpoint (lib/ajax.php) entirely bypasses the CSRF token enforcement present in lib/init.php, allowing a remote attacker to forge state-changing POST requests on behalf of any authenticated administrator who visits a malicious page. Successful exploitation modifies administrator API key properties - specifically injecting the attacker's IP into the allowed_from whitelist and setting valid_until to -1 (never expires) - creating a persistent foothold for future API abuse if the API secret is later obtained. A working proof-of-concept HTML page is included in the public GitHub security advisory (GHSA-xpr4-8vp6-c87j); no CISA KEV listing found at time of analysis. EPSS data was not provided, but the UI:R requirement and niche product footprint constrain real-world exploitation.
Privilege escalation in Netflix Lemur's certificate authority API allows any authenticated non-read-only user to mint a sub-CA chained to an internal root CA they do not control, when the ADMIN_ONLY_AUTHORITY_CREATION flag is disabled. The POST /api/1/authorities endpoint (type=subca) failed to verify AuthorityPermission on the caller-supplied parent, allowing the caller to invoke cryptography-issuer which signed the new intermediate using the parent root's private key. The resulting sub-CA can issue trusted certificates outside normal issuance controls and its private key can be extracted and used entirely outside Lemur. No public exploit has been identified at time of analysis, and the fix is available in version 1.9.3.
Server-side request forgery in MagicMirror² versions prior to 2.37.0 allows unauthenticated remote attackers to make the mirror server issue arbitrary outbound HTTP requests to attacker-controlled URLs, including to internal network services. The vulnerability stems from the ADD_CALENDAR handler on the unauthenticated Socket.IO /calendar namespace accepting a fully attacker-controlled URL, authentication headers, and a TLS-bypass flag with no SSRF validation. When the internal target returns valid iCal data, the parsed event content is returned to the attacker via CALENDAR_EVENTS, enabling blind-to-semi-open SSRF with data exfiltration. A working proof-of-concept (exploit-ssrf-calendar.js) is documented in the GHSA advisory; no CISA KEV listing at time of analysis.
Unauthenticated Server-Side Request Forgery in MagicMirror² versions prior to 2.37.0 allows any network-reachable attacker to weaponize the smart mirror as an internal network probe. By connecting to the unguarded Socket.IO `/newsfeed` namespace and emitting a `CHECK_ARTICLE_URL` notification with an attacker-controlled URL, the server performs an unsanitized `fetch()` HEAD request and returns timing and framing data via `ARTICLE_URL_STATUS`, creating a boolean-plus-timing oracle for internal host and port enumeration. A proof-of-concept exploit is documented in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been reported.
Denial of service in the RabbitMQ Java client library (com.rabbitmq:amqp-client ≤ 5.30.0) allows a malicious or compromised AMQP broker to forcibly terminate any active client connection by sending a crafted malformed frame sequence. The flaw in CommandAssembler.consumeBodyFrame subtracts a peer-controlled body-frame payload length before validating it fits within the declared body size, driving remainingBodyBytes negative and triggering an unhandled UnsupportedOperationException - a legacy stub - rather than a proper MalformedFrameException, causing AMQConnection to perform a hard connection shutdown. A PoC is referenced in the GHSA advisory; no active exploitation is confirmed in CISA KEV.
Blind SSRF in Netflix Lemur's certificate revocation URL validation allows authenticated operators to induce internal network requests targeting loopback, RFC1918, link-local, or cloud instance-metadata addresses. Two distinct bypass paths exist in versions prior to 1.9.3: the `_validate_revocation_url` function in `verify.py` followed HTTP redirects without validating Location targets, allowing a whitelisted CRL or OCSP URL to silently redirect the actual fetch to an internal address; and separate DNS resolutions at validation and connection time created a TOCTOU window exploitable via DNS rebinding on both CRL and OCSP code paths. No public exploit or CISA KEV listing has been identified at time of analysis.
Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing internationalized domain names (IDNs) under IDNA 2003. The module incorrectly applies modern Unicode codepoint attributes - Unicode 17.0.0 in the fixed version - instead of the Unicode 3.2.0 attributes mandated by RFC 3454, causing incorrect case-folding behavior via in_table_b2() and related functions. Applications using Python's idna codec for domain validation or access control are at risk of domain identity confusion for a subset of IDN labels containing characters whose Unicode properties changed after Unicode 3.2.0. A vendor fix is available via CPython PR #155293; no public exploit has been identified at time of analysis.
Arbitrary file read via path traversal in MobSF prior to 4.5.1 allows authenticated users with scan-upload permissions to exfiltrate server-side files by embedding traversal sequences in the android:icon attribute of a crafted AndroidManifest.xml inside a ZIP or APK upload. The vulnerable find_icon_path_zip() function resolves the attacker-controlled icon path without containment checks, copies the target file to a predictable location in DWD_DIR, and exposes it through the /download/ endpoint. A fully functional proof-of-concept script is publicly available in the GHSA advisory; this issue is not listed in the CISA KEV catalog.
SQL injection in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to unauthenticated remote exploitation via the email parameter. The vulnerable function Operation::select_with_multiple_condition fails to sanitize user input before constructing SQL queries, enabling authentication bypass or database enumeration. A public proof-of-concept exploit is available per VulDB and a linked GitHub issue, materially lowering the skill threshold for exploitation; no confirmed CISA KEV listing exists at time of analysis.
SQL injection in PHPGurukul Complaint Management System 1.0 exposes the user/check_availability.php endpoint to remote unauthenticated database manipulation via a crafted email parameter, enabling unauthorized data read, write, and limited availability disruption against the backend database. A public proof-of-concept exploit is confirmed available on GitHub, lowering the skill bar for opportunistic exploitation. No CISA KEV listing at time of analysis, but the CVSS 4.0 vector includes E:P confirming exploit code exists publicly.
Arbitrary root file read in Linuxfabrik monitoring plugins allows a local attacker controlling the nagios or icinga account to exfiltrate any root-readable file by exploiting the hidden but permanently live --test argument accepted by all sudoers-whitelisted check plugins. Invoking the deb-updates plugin via sudo with --test=/etc/shadow,,0 causes lftest.py to read the supplied path as root with no path confinement and echo its full contents to stdout; approximately 22 additional whitelisted plugins yield filtered leaks or file-existence oracles through the same mechanism. No active exploitation has been confirmed by CISA KEV, but a fully functional proof-of-concept command is publicly disclosed in the vendor's own GitHub security advisory GHSA-rh9c-rqvg-f7pr, and patches are available in linuxfabrik-lib v6.1.0 and monitoring-plugins v7.0.0.
DNS zone-file injection in Froxlor's DomainZones.add API (versions ≤ 2.3.7) enables an authenticated customer with DNS-zone permissions to embed arbitrary BIND resource-record lines into zone files by supplying tab characters, newlines, and semicolons in the `record` or `type` parameter - characters the code processes through IDNA encoding and lowercasing but never rejects. BIND parses the resulting file without error, treating injected control characters as legitimate zone-file syntax and accepting the fabricated RRs as valid DNS entries. No public exploit is in CISA KEV, but the GHSA advisory published by the researcher (Yaohui Wang) includes a working proof-of-concept with confirmed BIND zone load output; exploitation is bounded to domains the attacker already manages within Froxlor.
TLS certificate validation is completely bypassed in the RabbitMQ Java client library (`com.rabbitmq:amqp-client`) prior to version 5.33.0 when applications call `ConnectionFactory.useSslProtocol()` or `useSslProtocol(String)`, because these methods silently install `TrustEverythingTrustManager` and leave hostname verification disabled. A network-positioned attacker can present any certificate - including self-signed or null-chain - to impersonate the RabbitMQ broker and decrypt or modify all AMQP traffic, including plaintext credentials transmitted via PLAIN SASL on default port 5672. A verified proof-of-concept is publicly available in GHSA-5m9f-rphj-c435; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Secret environment variable disclosure in MagicMirror² before 2.37.0 allows adjacent network attackers to recover live SECRET_* credential values by exploiting a logic inversion in the socket dispatcher. The hideConfigSecrets feature is intended to redact environment secrets from browser-facing config responses, but the node_helper socket catch-all unconditionally expands **SECRET_NAME** placeholders in every inbound payload before routing to module helpers. Any unauthenticated client connected to a module namespace (such as the default weather helper) can submit a crafted INIT_WEATHER payload embedding a secret placeholder and receive the expanded real secret value echoed back in the WEATHER_ERROR response. No public exploit has been identified at time of analysis, and a vendor-released patch is available as of version 2.37.0.
Privilege escalation in Malcolm's nginx Lua RBAC layer allows authenticated low-privilege users to access administrator-only endpoints by submitting percent-encoded request URIs that bypass the access control gate. Malcolm versions up to and including 26.07.1 are affected, with restricted paths including /htadmin, /arkime/api/esadmin, NetBox, and file upload endpoints all reachable via this encoding bypass. A proof-of-concept exists per SSVC classification, though this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog at time of analysis.
HTML injection in MailerUp's public subscription form (all versions before 1.1.3) allows unauthenticated remote attackers to embed arbitrary HTML into the double opt-in verification email the application sends, using the form owner's configured sending identity and an attacker-specified recipient address. The root cause is unescaped interpolation of the subscriber-supplied first_name field directly into the HTML email body, confirmed by the patch commit which adds Django's escape() call. No active exploitation is confirmed in CISA KEV, but the Secur0 CNA advisory fully documents the injection point and patch version 1.1.3 is available.
Denial of service in Carbone, a Node.js document generation library, allows remote attackers to crash application servers by supplying a maliciously crafted zip bomb embedded in a .docx template file. The library processed .docx archives (which are ZIP containers) using yazl without enforcing any limit on decompressed entry sizes, enabling an attacker-controlled file to trigger runaway memory allocation that terminates the Node.js process. Fixed in versions 3.8.2, 4.26.3, and 5.4.4 across all distribution types; no public exploit or CISA KEV listing identified at time of analysis.
Missing authorization on four Socket.IO event handlers in FUXA 1.3.2 and earlier exposes SCADA/HMI system-discovery metadata - device topology, node attributes, host network interfaces, and device tags - to any remote unauthenticated or guest user when the platform's security mode (secureEnabled=true) is active. The DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js omit the isSocketAdminAuthorized check that governs other protected events, creating an authorization gap specifically in hardened deployments. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible nature and zero-privilege requirement make passive reconnaissance trivial against exposed instances. A vendor-released patch is available in FUXA v1.3.3.
Blueprint Studio versions prior to 2.5.2 exposed Git usernames and personal access tokens in plaintext on the filesystem by misconfiguring Git's credential.helper store when an admin saved Git credentials through the interface. The resulting .git-credentials file persists beyond Blueprint Studio's intended storage scope and can be read by any user or process sharing the same filesystem context as the Home Assistant instance. No public exploit code has been identified at time of analysis; vendor-released patch v2.5.2 is available and confirmed.
Improper CORS origin validation in Joomla! CMS versions 4.0.0-5.4.7 and 6.0.0-6.1.2 allows remote attackers to bypass the configured origin allowlist and make unauthorized cross-origin requests. The CWE-93 (CRLF Injection) classification indicates the bypass mechanism likely involves injecting carriage-return/line-feed characters into the Origin header to confuse the server's string-comparison logic, rather than a simple misconfiguration of the allowlist itself. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, zero-privilege, low-complexity nature of the flaw makes it exploitable at scale against Joomla sites where CORS is configured.
Full-read SSRF in SiYuan before v3.7.4 allows authenticated attackers to bypass the SafeMode SSRF guard by supplying URLs whose hostnames resolve to IPv6 transition addresses - NAT64 (64:ff9b::/96), 6to4 (2002::/16), or Teredo (2001::/32) - which encode private IPv4 destinations that the isPrivateIP function in kernel/util/net.go fails to classify as internal. Because the affected forward proxy, WebSocket proxy, and SSE proxy endpoints return the full response body, a successful bypass enables exfiltration of cloud instance metadata credentials (e.g., from 169.254.169.254), enumeration of internal services, and port-scanning of internal infrastructure. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVE description provides sufficient technical specificity to serve as an exploit development roadmap.
Memory exhaustion in Wazuh Manager 4.4.0 through 4.14.6 allows authenticated cluster peers to crash the wazuh-clusterd daemon on the master node by submitting a specially crafted zip bomb archive during cluster synchronization. The fdecompress_files() function in cluster.py invoked zlib.decompress() without any decompressed-size limit, enabling an attacker holding a valid cluster Fernet key to force unbounded memory allocation from a tiny compressed payload. No public exploit has been identified and the vulnerability is absent from CISA KEV; Wazuh has released a fix in version 4.14.7 via GitHub pull request #37119.
Cross-site scripting via deliberate CSP header removal in Streambert's Electron API key redemption window affects versions 2.5.0 through 2.5.x, allowing attacker-controlled script content on sub.wyzie.io or any navigated resource to execute without Content-Security-Policy constraints and interact with other windows and persistent session storage. The wyzie-open-redeem IPC handler in index.js unconditionally strips all CSP response headers from a dedicated Electron session partition, and the redemption BrowserWindow omits a setWindowOpenHandler, compounding the attack surface. No public exploit has been identified at time of analysis; the vulnerability is fixed in version 2.6.0 by complete removal of the vulnerable feature.
Login lockout bypass in Zabbix API and Frontend enables brute-force attacks beyond intended limits by exploiting a race condition in the block counter. Simultaneous login requests are not properly synchronized against the lockout mechanism, allowing unauthenticated remote attackers to submit more credential guesses than the lockout policy permits. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, no-authentication-required attack surface lowers the barrier for credential-stuffing campaigns against Zabbix deployments.
Missing rate limiting on the POST /v1/sessions login endpoint in Plainpad through 1.1.1 allows unauthenticated remote attackers to submit unlimited credential attempts with no lockout, enabling both credential stuffing and a CPU exhaustion denial-of-service via repeated bcrypt comparisons. The flaw originates from a Laravel framework version mismatch: the throttle middleware was defined in App\Http\Kernel.php, which is dead code never instantiated by the Laravel 11+ bootstrap model, leaving the API route group entirely unthrottled. No public exploit has been identified at time of analysis, though SSVC classifies this as automatable with partial technical impact.
Unauthorized critical data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a high-privileged, network-based attacker to read all data accessible to the Experience Manager component, with scope change extending impact to additional Oracle Commerce products. The vulnerability is exploitable over HTTP with no user interaction required. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the 'Authentication Bypass' tag warrants attention - it may indicate a privilege escalation pathway that reduces the effective authentication bar. EPSS data was not provided.
Unauthorized confidential data access in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by network-adjacent high-privileged attackers over HTTP, with a scope change that can impact additional Fusion Middleware products beyond the primary target. Affected versions are 14.1.2.0.0 and 12.2.1.4.0. Classified as 'easily exploitable' by Oracle, the flaw carries a CVSS 3.1 score of 6.8 with scope change flagged - though no public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 is achievable by an unauthenticated attacker present on the same physical network segment as the host running the software. The vulnerability resides in the Security and Authentication component of this Oracle Fusion Middleware product, meaning the mechanism meant to enforce access control can be bypassed without credentials. With a CVSS 3.1 score of 8.8, the impact spans complete confidentiality, integrity, and availability compromise; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized access to critical commerce data is achievable against Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via a network-accessible authentication bypass in the Content Acquisition System component. The vulnerability carries a CVSS scope change, meaning successful exploitation can spill over to compromise data accessible by additional integrated Oracle Commerce components beyond the directly attacked service. No public exploit has been identified at time of analysis, but the Authentication Bypass tag and unauthenticated network vector make this a meaningful data-exposure risk for any organization running the affected version.
Unauthenticated network exploitation of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via the Content Acquisition System component enables complete unauthorized read access to all data accessible by the platform, with scope change indicating downstream impact on adjacent Oracle systems. The attack vector is HTTP with high complexity, meaning specific preconditions must be met, but no credentials are required. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog. The tag 'Authentication Bypass' suggests the root cause is a failure in the Content Acquisition System to enforce identity controls on inbound HTTP requests.
Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes all data accessible to the Content Acquisition System component via a network-based authentication bypass over HTTP. Successful exploitation requires no credentials and no user interaction, though high attack complexity limits opportunistic mass exploitation. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog at time of analysis.
Unauthorized data exposure in Oracle Java SE's Networking component allows unauthenticated remote attackers via HTTP to access critical or all data accessible to the affected Java process, with a confirmed scope change that can impact systems and products beyond the JDK's own security boundary. Affected versions span a wide range across Oracle Java SE (8u501 through 26.0.2), Oracle GraalVM for JDK (17.0.20 and 21.0.12), and Oracle GraalVM Enterprise Edition (21.3.19), covering both server-side Java API consumers and client-side Java Web Start or sandboxed applet deployments. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the breadth of affected LTS versions and the ubiquity of Java in enterprise environments make patch prioritization appropriate.
CRLF injection in ePA 3.x Integration's VAU inner HTTP request builder allows an authenticated attacker to inject arbitrary headers into encrypted tunnel requests destined for Germany's electronic patient record (ePA) backend, potentially exposing other patients' medical records or bypassing authorization controls. The flaw exists in the build_inner_header function of app/vau/VAUProtokoll.py, which interpolates user-controlled values - including insurant_id and USER_AGENT - directly into raw HTTP header strings without stripping carriage-return or line-feed characters. No public exploit code has been identified at time of analysis, and the issue is fixed in release 1.3.0.
Unauthorized read and write access to critical financial data in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible via an authentication bypass in the Installation and Configuration component, reachable over HTTP by low-privileged network attackers. Successful exploitation grants complete confidentiality and integrity compromise of all Hyperion-accessible data, though no availability impact is described. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 expose a network-exploitable authentication bypass over LDAP that grants low-privileged attackers full read and write control over directory data. Despite a moderate CVSS base score of 6.8 driven down by high attack complexity (AC:H), successful exploitation yields complete confidentiality and integrity compromise of all OUD-accessible data - a severe outcome for identity and directory infrastructure. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed the issue as part of the Critical Patch Update for August 2026.
Confidential data exposure in Oracle Commerce Guided Search / Experience Manager 11.4.0 enables high-privileged network attackers to read critical platform data over HTTP, with a confirmed scope change extending potential impact to adjacent Oracle Commerce components beyond the primary application. The attack requires no user interaction and is characterized as easily exploitable at low complexity, though the high privilege prerequisite narrows the attacker pool. Oracle has addressed this vulnerability in the Critical Security Patch Update for August 2026; no public exploit code has been identified at time of analysis.
Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes an authentication bypass in its Server component, reachable over HTTP without credentials, that allows full read and write access to sensitive financial data. The attack is tagged as an Authentication Bypass by the reporting source (secalert_us@oracle.com) and yields both C:H and I:H impact, meaning an attacker can exfiltrate all accessible financial data and tamper with or delete critical records. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, though the high-impact outcome against an enterprise financial platform warrants priority patching.
Full takeover of Oracle Autonomous Health Framework is achievable by an unauthenticated attacker positioned on the same physical or logical network segment as the affected host, exploiting a flaw in the Trace File Analyzer (TFA) component. Affected releases span multiple 26.x branches - 26 through 26.1.0, 26.2.0, 26.3.1, 26.5.0, and 26.5.2 - with successful exploitation yielding complete confidentiality, integrity, and availability compromise. No public exploit code has been identified and no CISA KEV listing is present at time of analysis, though the low attack complexity and absence of authentication requirements make exploitation straightforward for any attacker with adjacent network access.
Full compromise of Oracle Reports Developer 12.2.1.19.0 is achievable by an unauthenticated attacker who has access to the same physical or logical network segment as the host running the software. The flaw resides in the Security and Authentication component of this Oracle Fusion Middleware product, and successful exploitation yields complete confidentiality, integrity, and availability impact - effectively a full system takeover. No public exploit or CISA KEV listing exists at time of analysis, but the combination of no required privileges, no user interaction, and a low-complexity attack makes this a credible threat within the adjacent network boundary.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server allows unauthenticated network attackers to bypass authentication over HTTP and gain complete read access to critical data, including data accessible across additional connected products due to a confirmed scope change. The vulnerability is rated CVSS 6.8 with high attack complexity, meaning exploitation requires specific conditions to be met, which limits opportunistic mass exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Authentication Bypass tag and scope-change impact make this a material risk for Oracle Fusion Middleware deployments running the affected version.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 enables an unauthenticated attacker positioned on the same physical network segment to fully compromise confidentiality and integrity of financial data. The vulnerability is tagged as an authentication bypass in the Security component, meaning an adversary can bypass credential checks and gain unauthorized read and write access to all financial data accessible by the application. No public exploit code has been identified at time of analysis, and the adjacent-network vector combined with high attack complexity limits the realistic attacker population to internal network adversaries or those with network proximity to the deployment.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 is achievable by an unauthenticated attacker physically co-located on the same network segment as the affected host. The Security and Authentication component contains an easily exploitable flaw - CVSS AC:L and PR:N confirm no elevated privileges or complexity are required once adjacent network access is established. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the Oracle Reports Developer instance. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Authentication bypass in Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes critical financial data to unauthenticated attackers who can reach the physical network segment hosting the server. The CVSS vector (AV:A/AC:H/PR:N) indicates that while no credentials are required and no user interaction is needed, exploitation is constrained to adjacent-network attackers and involves high attack complexity. Successful compromise yields full read and write access to all financial reporting data - including unauthorized creation, deletion, and modification of critical records. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds memory read in Zabbix's script item and preprocessing JavaScript HttpRequest logic allows an authenticated administrator, operating from an adjacent network position, to read process memory beyond allocated buffer boundaries. Exploitation results in confidentiality loss - sensitive data resident in process memory may be exposed to the attacker. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local exploitation of MySQL Connector/ODBC 26.7.0 on Oracle MySQL allows any user with OS-level logon to the affected infrastructure to crash or hang the connector process and read a subset of accessible data. The attack requires no authentication to MySQL Connectors itself and no user interaction, making it trivially executable by any local user or process on the host. No public exploit code has been identified at time of analysis, and exploitation is bounded by the requirement for local system access.
Race condition in Firefox's JavaScript Engine (CVE-2026-74984) exposes users on all Firefox versions prior to 154 and ESR versions prior to 153.1 to potential confidentiality and integrity compromise. The CWE-362 flaw creates a timing window during concurrent JavaScript execution in which an attacker-controlled script can race against the engine's internal state management, enabling memory read or write access. No public exploit code has been identified and EPSS sits at the 5th percentile, indicating no widespread exploitation at time of analysis.
Certificate chain validation bypass in the openHiTLS cryptographic library (0.2.0 through 0.3.2) lets attackers use a non-CA certificate as an intermediate CA, because basicConstraints/cA-flag checks are applied only to X.509 v3 certificates while v1/v2 intermediate certificates are silently accepted. An attacker able to obtain any leaf/end-entity certificate (or craft a v1/v2 certificate) can forge a trusted chain and impersonate arbitrary servers, enabling man-in-the-middle interception. No public exploit identified at time of analysis; EPSS is low (0.11%), and the fix landed in openHiTLS 0.3.3.
Arbitrary file write in Trivy's plugin manager prior to version 0.72.0 allows a malicious plugin author to escape the confines of ~/.trivy/plugins and write files to any user-writable filesystem path. The flaw exists in pkg/plugin/manager.go, where plugin manifest metadata is used to construct file paths without enforcing directory confinement, enabling a path traversal (CWE-22) attack. No public exploit has been identified and no CISA KEV listing exists, but the attack is mechanically simple and the impact extends to overwriting sensitive user files such as shell profiles or SSH authorized_keys, creating realistic subsequent privilege escalation paths.
Persistent cross-site scripting in Otalio Ship Property Management System (all versions before 2.22.0) enables authenticated high-privileged attackers to escalate privileges by injecting unescaped malicious scripts into the application security page. The stored payload executes in the browser context of other authenticated users who subsequently view the affected page, enabling session hijacking or unauthorized actions under victim credentials. Reported by Mandiant; no public exploit code or CISA KEV listing identified at time of analysis.
Unauthorized data access and modification in Oracle Autonomous Health Framework's Cluster Health Analyzer component allows a low-privileged attacker with adjacency to the physical communication segment to fully compromise confidentiality and integrity of AHF data, with scope change enabling lateral impact on additional Oracle products. Affected versions span the 26.x release line through 26.5.2, disclosed in Oracle's August 2026 Critical Patch Update. No public exploit code has been identified at time of analysis, and the High attack complexity combined with the adjacent-only attack vector materially constrains real-world exploitability despite the 7.7 base score.