Unauthenticated sensitive data exposure in WP Cafe Pro WordPress plugin versions prior to 3.0.15 allows any remote attacker without credentials to retrieve sensitive information directly from affected WordPress installations. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw is network-exploitable with no authentication or user interaction required, yielding a CVSS 3.1 score of 7.5 (High). No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in version 3.0.15.
Unauthenticated arbitrary file download in the Super Forms WordPress plugin (versions up to and including 6.3.315) exposes any file readable by the web server process to remote attackers without any credentials. The root cause is a path traversal flaw (CWE-22) in a file download endpoint that fails to sanitize user-supplied path parameters, enabling directory traversal sequences to escape the intended file root. No public exploit or CISA KEV listing is confirmed at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial, unauthenticated remote exploitation with no special conditions required on default plugin installations.
Broken access control in the Notification Master WordPress plugin (versions ≤ 1.7.1) exposes restricted functionality to unauthenticated remote attackers, resulting in high confidentiality impact with no authentication required. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that any network-accessible attacker can trigger the flaw with low complexity, likely exposing sensitive notification configuration data such as subscriber email addresses, phone numbers, or webhook endpoints stored by the plugin. No public exploit identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Path traversal in AWX's project_archive action plugin allows arbitrary file writes to execution node filesystems outside the intended project directory. Red Hat Ansible Automation Platform 2 is affected when processing zip or tar archives whose member filenames contain directory traversal sequences. An attacker who controls archive content - via admin-level project configuration, a compromised upstream archive source, or a man-in-the-middle attack on an unencrypted HTTP fetch - can write files as the extraction user and escalate to remote code execution through cron entries, SSH authorized_keys injection, or playbook content poisoning. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
HCL Hive employs a risky cryptographic primitive (CWE-1240) that creates systemic trust failure across the platform: if any single internal component is compromised, an attacker can exploit the weak cryptographic construction to achieve unauthorized lateral movement or harvest credentials at scale. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates the flaw is reachable over the network without authentication, though high attack complexity caps opportunistic risk. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated broken authentication in the WPLegalPages WordPress plugin (versions ≤ 3.7.0) allows remote attackers to bypass access controls on one or more plugin endpoints without any credentials or user interaction, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The vulnerability is classified under CWE-288, meaning an alternate path or channel exists that circumvents the intended authentication gate. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, but the low attack complexity means opportunistic scanning is a realistic threat.
Hardware fault injection via voltage and clock glitching in the Microchip SAMA5D4 ARM Cortex-A5 microprocessor enables a physically proximate attacker to subvert security-critical operations such as secure boot, cryptographic key protection, and privilege enforcement. All versions of the SAMA5D4 are affected per the vendor's CPE entry, and Microchip self-reported this vulnerability. No public exploit code has been identified and CISA has not added this to the KEV catalog, but the all-high impact scores in the CVSS 4.0 vector (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflect that successful exploitation grants total control over the affected system and any downstream components it secures.
Broken access control in HCL Hive 1.0 allows a high-privileged network attacker to bypass code verification gates and introduce unverified, malicious, or broken code directly into production environments. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact against the vulnerable system, contingent on high-privilege access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Improper authorization in TIM Flow before 26.0.6 exposes a privileged dashboard Excel export endpoint to exploitation by any authenticated user, enabling arbitrary SQL query execution against the application database. The missing server-side authorization check (CWE-862) allows non-administrative accounts to craft SQL SELECT statements, submit them to the export endpoint, and receive full query results as a downloadable spreadsheet, effectively granting unrestricted read access to the database. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity makes this immediately actionable by any account holder.
Cross-client template disclosure in Ghostwriter before 7.1.2 allows authenticated users to exfiltrate proprietary report templates belonging to other clients managed within the same platform instance. The report template swap endpoint failed to enforce ownership validation, accepting user-controlled template primary keys without verifying client-scope alignment. Because template PKs are sequential integers, an attacker with any authenticated access can enumerate foreign template IDs, attach them to their own reports, and trigger report generation to read sensitive client deliverable content - including letterhead, boilerplate legal text, and pentest methodology. No public exploit identified at time of analysis, though VulnCheck has published an advisory and a researcher (geo-chen) has documented the issue in a public repository.
Process-aborting denial of service in OpenEXR 3.4.0 through 3.4.12 allows an unauthenticated remote attacker to crash any application that calls exr_start_read() on a crafted HTJ2K-compressed EXR file. The crash originates in the vendored OpenJPH library, which invokes abort() unconditionally when a QCD marker's lower five bits are zero - an assertion failure that OpenEXR's partial error handling cannot intercept because codestream read and construction calls are left unprotected. No public exploit has been identified at time of analysis; the vulnerability is patched in version 3.4.13.
Unauthenticated information disclosure in KAON PG5298A and PG5298B router firmware exposes the administrative portal password to any attacker on the same local network segment. An adjacent-network attacker can query a specific firmware endpoint without credentials and retrieve sensitive authentication material, enabling full device takeover. Vendor-released patches are available in firmware versions 3.0.82 (PG5298A) and 4.0.82 (PG5298B); no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated XSS in the Stripe Payments WordPress plugin (versions ≤ 2.1.2) allows remote attackers to inject malicious scripts into victim browsers with no attacker-side authentication required, as disclosed by Patchstack (EUVD-2026-65176). The CVSS Scope:Changed metric reflects that injected scripts execute within the victim's browser security context, enabling session hijacking, credential theft, or malicious content injection against WordPress site visitors or administrators. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Unauthenticated XSS in the Toolset Blocks WordPress plugin (versions through 1.6.26) allows remote attackers to inject malicious scripts into pages rendered by the plugin without any prior authentication. The CVSS vector's scope-change indicator (S:C) signals that injected code executes in the victim's browser context outside the vulnerable component itself, making administrator session hijacking a realistic secondary impact. Reported by Patchstack and tracked under EUVD-2026-65171; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin (versions ≤ 5.29.2.1) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by delivering a crafted link or triggering stored output. The scope-changed CVSS vector (S:C) indicates the injected script can operate outside the plugin's own execution boundary, enabling session theft, credential harvesting, or defacement against authenticated WordPress users who interact with affected pages. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated cross-site scripting in the Boost WordPress plugin (versions ≤ 2.0.4) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser context of any user who visits or interacts with the affected page, confirmed by PR:N in the CVSS vector. The scope change metric (S:C) reflects that impact crosses from the plugin/server boundary into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Out-of-bounds read in SpaceDot AcubeSAT On-Board Computer software exposes the spacecraft's CAN bus message handler to denial-of-service attacks. An attacker with access to the CAN bus network can send a crafted PerformFunction message to the OBC, triggering an out-of-bounds read in the CAN::Application::parsePerformFunctionMessage component that crashes the on-board computer. No public exploit identified at time of analysis, and EPSS exploitation probability sits at 0.14% (4th percentile), consistent with a highly specialized embedded aerospace target.
Token exfiltration in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows any actor with code execution inside a scanned project's build to read the Black Duck API token from the process environment inherited by scanning subprocesses. The token - when supplied via BLACKDUCK_API_TOKEN or BD_HUB_TOKEN - is passed in plaintext to child processes spawned during build capture and signature scanning, where it is observable by co-located code. No public exploit has been identified at time of analysis; however, the vendor explicitly warns that upgrading does not remediate prior exposure, making token rotation a mandatory incident-response step for all affected deployments.
Incomplete remediation of CVE-2025-9615 in NetworkManager exposes WPA-Enterprise (802.1X) connections to server certificate validation bypass on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. An unprivileged local user can set the 802-1x.ca-path or phase2-ca-path properties of a private connection profile to an attacker-controlled directory because the private_user restriction was never applied to these directory-valued fields. When the victim system subsequently connects to a wireless network, the bypassed CA validation enables credential theft via a rogue access point presenting a certificate signed by the attacker-supplied CA. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis; however, SSVC rates the attack as automatable with total technical impact once local access exists.
Authenticated path traversal in rConfig before 8.2.13 allows any logged-in user to read arbitrary files accessible by the application process by supplying crafted filenames containing directory traversal sequences to the export download endpoint. The fix is confirmed in rConfig V8 Core 8.2.13, released as a dedicated security update and documented in GitHub advisory GHSA-m5rw-jcrm-mmwc. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the release notes reveal that 8.2.13 simultaneously patched multiple related path-containment deficiencies across the application, indicating a systemic pattern rather than an isolated flaw.
Unauthenticated cross-site scripting in the Urna WordPress theme (by Thembay) affects all versions up to and including 2.6.2, allowing a remote attacker to inject malicious scripts into pages viewed by other users. The scope-changed CVSS vector (S:C) confirms the payload executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack path lowers the barrier for opportunistic exploitation against sites running the vulnerable theme.
Cross-site scripting in Brave Conversion Engine (PRO), a WordPress plugin by Amplebyte Pvt Limited, is exploitable by unauthenticated remote attackers against all versions through 0.8.6. The CVSS scope-change indicator (S:C) confirms that successful injection executes attacker-controlled JavaScript within a victim user's browser context - separate from the vulnerable server component - enabling session hijacking, credential theft, or malicious redirects. No active exploitation has been confirmed via CISA KEV, and no EPSS score was included in available intelligence; however, the PR:N/AC:L attack profile means any internet-accessible WordPress installation running this plugin is trivially reachable.
Broken access control in the ProLancer Element WordPress plugin (themebing) affects all versions up to and including 1.4.8, allowing any authenticated subscriber-level user to invoke privileged plugin functionality without proper authorization. The flaw stems from missing authorization checks (CWE-862), yielding high integrity impact and low availability impact against affected WordPress installations. No active exploitation or public exploit code has been identified at time of analysis; Patchstack has published the disclosing advisory.
Unauthenticated XSS in the Goodlayers Tourmaster WordPress plugin (versions ≤ 5.4.9) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages served to victims, with a scope change that can affect the broader WordPress session context. Exploitation requires victim interaction - typically clicking a crafted link - but carries no authentication prerequisite, keeping the barrier to attempt low. No CISA KEV listing and no public exploit code have been identified at the time of analysis, placing this in a 'patch promptly but not emergency' risk tier.
Unauthenticated cross-site scripting in the Events Made Easy WordPress plugin (versions up to and including 3.2.5) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser upon interaction with attacker-controlled content. The CVSS scope change (S:C) indicates the injected script operates outside the plugin's own security context, enabling actions such as session hijacking, credential theft, or admin account takeover. No public exploit code or active exploitation has been identified at time of analysis; however, the unauthenticated attack vector and low attack complexity lower the barrier for abuse.
Unauthenticated cross-site scripting in the Social Media & Share Icons WordPress plugin (by Inisev, versions ≤ 2.9.9) allows remote attackers to inject arbitrary JavaScript that executes in the context of a victim's browser when they visit an affected page. The CVSS scope change (S:C) indicates injected scripts can breach the plugin's own security boundary, enabling session hijacking, credential theft, or page defacement against site visitors and administrators. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the zero-authentication requirement substantially lowers the exploitation bar.
Unauthenticated cross-site scripting in the WPComplete WordPress plugin (versions up to and including 2.9.5.6) allows remote attackers to inject and execute arbitrary JavaScript in the context of another user's browser session, with scope change indicating the payload crosses the plugin's security boundary to affect authenticated users such as site administrators. The CVSS vector (PR:N/UI:R/S:C) is consistent with a stored or reflected XSS pattern where an unauthenticated attacker plants a payload that is later triggered when a privileged user visits an affected page. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in the 12 Step Meeting List WordPress plugin (versions ≤ 3.19.16) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in the browsers of visitors or administrators who interact with affected pages. Carrying a CVSS 7.1 score with a Scope:Changed flag, the vulnerability crosses from the plugin context into the victim's browser session, enabling session hijacking, credential theft, or page defacement. No active exploitation or public POC code has been identified at time of analysis.
Directory traversal in DrayTek VigorSwitch's getSyslogFile web management function exposes arbitrary device filesystem files to authenticated administrators who supply crafted path traversal sequences in the option parameter. Twenty-eight VigorSwitch managed-switch models across the G, P, Q, PQ, FX, and PX product lines are confirmed affected, with firmware versions fixed at 2.9.10, 2.10.6, 2.10.7, 3.9.10, and 3.10.6 depending on the model. No public exploit code has been identified at time of analysis and this CVE is absent from the CISA KEV catalog, but vendor-released patches are available and should be prioritized given the breadth of affected hardware.
Macro injection in rpmbuild's tarball mode allows arbitrary code execution on systems running Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. When rpmbuild processes a tarball in tarball mode, specially crafted tar member names are interpreted as RPM macros, enabling an attacker who can distribute a malicious tarball to achieve full RCE in the context of the user running the build. No public exploit or active exploitation has been identified at time of analysis, but the social-engineering requirement is realistic in open-source build pipeline contexts where developers routinely fetch and build third-party source tarballs.
Integer overflow in GIMP's file-pcx plugin on 32-bit builds enables a heap-based buffer overflow when a user opens a specially crafted PCX image, potentially leading to arbitrary code execution or denial of service. The flaw is architecturally constrained to 32-bit builds - 64-bit installations are unaffected - and exploitation additionally requires user interaction to open the malicious file. No active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis.
Insecure file creation in RansomLook (≤ 2.0.0) exposes the Flask session-signing secret to any local OS user with read access to the application home directory, enabling complete authentication bypass. The secret key governs Flask session cookie signing and the legacy API-key derivation function; possession of it allows an attacker to forge valid session cookies and impersonate any user, including administrators. In LDAP-configured deployments, exploitation is especially direct because the session user loader accepts arbitrary usernames without verifying their existence against any user store. No public exploit has been identified at time of analysis.
Prototype pollution in alibaba-fusion/next (all versions through 1.27.34) allows remote unauthenticated attackers to inject arbitrary properties into Object.prototype by supplying crafted values to the locale argument processed by the deepMerge function inside ConfigProvider.getContextProps within the Dialog component. The attack is network-reachable with no authentication or user interaction required per the CVSS 4.0 vector, though real-world exploitation depends on attacker-controlled data reaching the locale prop. No patch has been released and the upstream GitHub issue was closed due to inactivity; no public exploit code or CISA KEV listing has been identified at time of analysis.
Prototype pollution in jQWidgets up to version 24.0.1 allows remote unauthenticated attackers to manipulate JavaScript object prototypes via the `JQXLite.extend` and `jqxBaseFramework.extend` functions in `jqwidgets/jqx-all.js`. Successful exploitation can affect the confidentiality, integrity, and availability of any web application embedding this library. Critically, the vendor closed the tracking GitHub issue as 'not planned,' meaning no official patch exists or is expected, leaving all consumers permanently exposed without mitigation.
Missing authentication on the public invitation-code redemption endpoint in open-wearables (versions up to and including 0.6.2) allows any unauthenticated remote attacker to call the `redeem_invitation_code` function and redeem invitation codes without authorization. The flaw exists in `backend/app/api/routes/v1/user_invitation_code.py` and requires only network access with no credentials, no user interaction, and no special configuration. No patch is available at time of analysis; the maintainers have not responded to the responsible disclosure filed via GitHub issue #1274.
Null pointer dereference in DrayTek VigorSwitch's formlogout web management function allows authenticated remote administrators to crash the management service, causing a denial of service across 28+ switch models spanning the G, P, Q, FX, and PX product lines. The flaw stems from absent validation of an empty or missing Cookie header before string handling in the formlogout handler, and is patched in firmware versions released under DrayTek's August 2026 security advisory. No public exploit code or CISA KEV listing is referenced in the available data.
Missing authentication in NewSiteServer (NSS) by CyberTutor exposes an email-dispatch function to unauthenticated remote attackers, allowing them to send arbitrary emails to any recipient while impersonating the school. All versions of the product are affected per EUVD-2026-64705, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no privileges and no user interaction from any network position. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the low exploitation barrier makes this a realistic phishing and brand-abuse vector against school communities.
Server-Side Request Forgery in BentoML versions 1.4.19 through 1.4.39 exposes internal CGNAT infrastructure by failing to block RFC 6598 shared address space (100.64.0.0/10) in the `make_safe_connect` safeguard. Unauthenticated remote attackers can supply crafted URLs via multipart file uploads or JSON request bodies, causing the BentoML server to make outbound requests to CGNAT-addressed internal hosts - a class of targets increasingly common in cloud-native and ISP environments. This is an incomplete fix for CVE-2025-54381; no public exploit has been identified at time of analysis, but the known patch gap and zero-prerequisite attack surface warrant prompt remediation.
Redis glob pattern injection in Ransomlook versions up to and including 2.0.0 allows unauthenticated remote attackers to enumerate health data for all tracked groups and markets - including those flagged as private - by supplying glob metacharacters to the /api/health/<name> and /api/crypto/chain/<chain> endpoints. The vulnerability stems from unsanitized caller-supplied values being interpolated directly into Redis SCAN MATCH patterns, expanding scan scope beyond the intended target entity. No public exploit has been identified at time of analysis; a vendor-released fix is available via an upstream GitHub commit that introduces centralized glob escaping across all affected code paths.
Arbitrary file write via path traversal in the Apache Camel camel-azure-storage-blob component lets an attacker who can influence blob names in a consumed Azure Storage container force Camel to create or overwrite files outside the configured download directory, with the privileges of the Camel process. It affects Apache Camel 4.0.0 before 4.14.9, 4.15.0 before 4.18.4, and 4.19.0 before 4.22.0, where BlobOperations.downloadBlobToFile joined the fileDir option with the raw remote blob name without normalization or containment checks. No public exploit has been identified at time of analysis and the CVSS is 9.1, but EPSS is low (0.18%, 7th percentile), indicating no observed exploitation activity yet.
Stored cross-site scripting in Grafana OSS allows an authenticated Editor-level attacker to hijack the browser session of any user who clicks a crafted alert link, executing attacker-controlled JavaScript in the Grafana origin with the victim's permissions. The attack exploits unsanitized rendering of the external Alertmanager alert generatorURL field as an href in the Alert Details 'See source' LinkButton, combined with a bypass of Grafana's click-interceptor heuristic by embedding :// inside a JavaScript comment within a javascript: URI. No public exploit code or CISA KEV listing has been identified at time of analysis, but the bypass technique is fully disclosed in the CVE description, lowering the bar for weaponization.
Privilege escalation in HashiCorp Vault allows authenticated low-privileged users to traverse outside their authorized secret paths by injecting forward-slash characters into identity values referenced by templated ACL policy paths. Both Vault Community and Enterprise editions from version 0.11.0 through 2.0.3 are affected across all platforms. No public exploit code or active exploitation is confirmed at time of analysis; however, the high confidentiality and integrity impact make this a priority for any organization using identity-based templated ACL policies.
Symlink-following during ZIP extraction in adm-zip 0.5.9 through 0.6.0 allows a local attacker who can plant a symlink inside the extraction directory to overwrite arbitrary files accessible by the extracting process. Utils.writeFileTo calls fs.openSync without O_NOFOLLOW and performs no pre-write lstat check, so a pre-positioned symlink transparently redirects the write - and a subsequent chmod - to any target outside the extraction root without any path-traversal sequence appearing in the archive. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, but the impact is high in shared or predictable extraction environments such as CI pipelines and multi-tenant temp directories.
Arbitrary file write in Dell Client BIOS affects multiple Alienware, Inspiron, and XPS systems through a link-following flaw (CWE-379) exploitable by a low-privileged local attacker. The vulnerability allows the BIOS update or management process to follow attacker-planted symlinks in temporary directories, redirecting privileged file writes to arbitrary filesystem locations - enabling integrity compromise or availability impact at the OS level. No public exploit identified at time of analysis and no CISA KEV listing; however, patch versions are confirmed via Dell advisory DSA-2026-280.
Stack-based out-of-bounds write in OpenEXR's HTJ2K decode path allows remote attackers to crash applications that process crafted EXR image files. Affected are OpenEXR versions 3.4.0 through 3.4.13, where the vendored OpenJPH AVX2 decoder fails to reject JPEG 2000 SIZ marker geometries in which the first tile does not intersect the visible image, leading to invalid codeblock computation and a stack memory corruption that terminates the process. No public exploit identified at time of analysis; a vendor-released patch is available in version 3.4.14.
Broken access control in AutomatorWP WordPress plugin (versions ≤ 5.8.3) allows authenticated subscriber-level users to perform privileged operations without authorization. Subscribers - the lowest authenticated role in WordPress - can invoke plugin functionality reserved for editors or administrators, resulting in high integrity impact against affected sites. No public exploit code or active exploitation has been identified at time of analysis; CVSS scores this at 6.5 Medium, reflecting meaningful but constrained impact bounded by the requirement for a valid account.
Broken access control in the Style Kits WordPress plugin (versions ≤ 2.6.5) allows subscriber-level authenticated users to perform privileged actions due to missing authorization checks (CWE-862). The integrity impact is rated High by the vendor CVSS, meaning a low-privilege WordPress account holder can manipulate site content or plugin settings beyond their intended role. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, but the low attack complexity and purely network-based vector make this straightforward to abuse on any affected site with open user registration.
MIME header injection in Apache Camel's camel-mail MimeMultipart data format allows unauthenticated network senders to plant Camel-internal namespace headers onto the Camel Exchange when headersInline is set to true, potentially redirecting what downstream route components - such as camel-sql - execute. Versions 2.17.0 through 4.14.8, 4.15.0 through 4.18.3, and 4.19.0 through 4.21.x are affected across all release lines until the current fixes. No public exploit code or active exploitation has been identified; EPSS sits at 0.16% and SSVC rates exploitation status as none, making this a patch-priority rather than emergency-response item for most organizations.
Out-of-bounds memory corruption in SpaceDot AcubeSAT On-Board Computer software's CAN message parsing crashes the system when processing malformed ECSS telecommand packet headers. The vulnerable component MessageParser::parseECSSTCHeader at commit eaf90ec performs insufficient bounds checking, enabling denial-of-service against the spacecraft's onboard computer via a crafted CAN message. No active exploitation has been confirmed; an EPSS of 0.15% (4th percentile) is consistent with the highly specialized and niche deployment context of this aerospace platform.
Improper certificate validation in JSS (Java Security Services) allows the JSSTrustManager class to accept CA certificates from the NSS database that lack TRUSTED_CA trust flags, meaning certificates never explicitly designated as trust anchors can still be used to anchor TLS chains. In non-default deployments where certificate revocation checking has been disabled, this creates a viable path for a man-in-the-middle attacker to forge certificates accepted by PKI client connections, with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and the AC:H CVSS rating reflects the meaningful attack complexity - MITM positioning plus a specific non-default configuration must both be present.