Proxy functionality in Google Chrome on Windows prior to 152.0.7977.65 incorrectly implements specified behavior, enabling an adjacent-network attacker to intercept or infer sensitive information by sending crafted network traffic. The flaw is Windows-platform-specific and is classified by the Chromium security team as Low severity, consistent with the high attack complexity and adjacency requirement that constrain realistic exploitation. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability is 0.13%, placing this in the 3rd percentile of exploitability.
Stack-based buffer overflow in SKYSEA Client View and SKYMEC IT Manager (SKY Co., Ltd.) enables an authenticated attacker to remotely execute arbitrary code on other Windows hosts running the same software via crafted UDP packets. The vulnerability functions as a lateral movement primitive: an attacker who has already obtained a login on one managed endpoint can exploit the product's UDP listener on any other reachable managed host, without requiring further interaction from the target. Reported by JPCERT/CC via JVN#JVN33423625, no public exploit or CISA KEV listing has been identified at the time of analysis.
Type confusion in BlueZ's SDP XML parser (sdp-xml.c) allows a low-privileged local caller to crash the bluetoothd daemon by submitting a crafted nested ServiceRecord via the RegisterProfile() D-Bus API. The parser stack is corrupted so scalar union data is misread as a sequence pointer, causing an invalid dereference and process termination - a local denial-of-service with no confidentiality or integrity impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Missing authentication on a critical function in the Drupal PanKM contributed module allows a network-accessible, high-privilege attacker-given required user interaction-to bypass module authorization controls and achieve high confidentiality and integrity impact against all currently released versions. All known PanKM releases are affected (CPE wildcard cpe:2.3:a:drupal:pankm:*:*:*:*:*:*:*:*), with the Drupal security team (sa-contrib-2026-083) confirming the issue. No public exploit code has been identified at time of analysis, and SSVC confirms exploitation status as none.
Improper input validation in the Drupal contributed module Email Login OTP (all released versions) exposes sites to high confidentiality and integrity impacts under specific conditions involving high-privilege access and user interaction. The vulnerability, tracked under CWE-20, could allow a privileged actor to manipulate OTP-related input handling in ways that compromise authentication integrity or expose sensitive login-flow data. No active exploitation has been confirmed (EPSS 0.14%, 4th percentile; SSVC exploitation status: none), and the Drupal security team has published advisory SA-CONTRIB-2026-085 addressing the issue.
Improper input validation in the Drupal Lunr Exposed Filters contributed module (all versions) can yield high confidentiality and integrity impact under a restrictive set of preconditions. The CVSS vector (AV:N/AC:H/PR:H/UI:R) constrains exploitation to attackers already holding high-privilege Drupal access who can also induce user interaction, making opportunistic or mass exploitation implausible. No public exploit code exists and EPSS sits at 0.14% (4th percentile), consistent with no observed exploitation pressure at time of analysis.
Improper input validation in the Drupal Development Environment contributed module (all versions, CPE cpe:2.3:a:drupal:development_environment) allows a highly privileged, authenticated network attacker - with user interaction - to compromise both confidentiality and integrity of the affected system. The CVSS vector (AV:N/AC:H/PR:H/UI:R) constrains real-world impact significantly: exploitation requires administrative credentials, a complex attack scenario, and victim interaction. EPSS stands at 0.14% (4th percentile), no public exploit code has been identified, and no CISA KEV listing exists at time of analysis.
Improper input validation in the Drupal 'Disable Login Page' contrib module (all versions) enables a network-delivered attack that can achieve high confidentiality and integrity compromise within a Drupal site. Exploitation is substantially constrained by the requirement for high-privilege (administrator-level) access, high attack complexity, and mandatory user interaction - making this a meaningful internal-threat or privilege-abuse scenario rather than an opportunistic remote attack. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.14% (4th percentile) confirms negligible observed exploitation activity at time of analysis.
Improper input validation in the Powerful Surveys contributed module for Drupal exposes all published versions to confidentiality and integrity compromise under a constrained set of conditions requiring high privileges and user interaction. The flaw, classified under CWE-20, allows a high-privileged authenticated attacker - under high-complexity conditions with mandatory user interaction - to bypass input validation controls and potentially disclose or manipulate survey data. No public exploit exists and EPSS stands at 0.14% (4th percentile), indicating negligible observed exploitation pressure despite the High C and I impact ratings.
SQL injection in SililaWijesinghe's PHP-based Food Ordering System allows unauthenticated remote attackers to manipulate the search_box parameter in /search.php, causing the backend database to execute attacker-controlled SQL queries. A public proof-of-concept exploit has been disclosed via GitHub, and the vendor did not respond to coordinated disclosure, leaving no official patch available. The CVSS 4.0 vector confirms low-complexity, no-authentication remote exploitability with a confirmed proof-of-concept modifier (E:P).
SQL injection in code-projects Simple Inventory System 1.0 exposes the /InventoryManagement/edit.php endpoint to unauthenticated remote exploitation via the unsanitized ID parameter. An attacker with network access can inject arbitrary SQL into backend database queries, enabling unauthorized extraction and modification of all inventory records. Publicly available exploit code exists (CVSS 4.0 E:P), though no CISA KEV listing has been issued, suggesting opportunistic rather than targeted active exploitation at this time.
Heap buffer overflow in PyOpenEXR Python bindings versions 3.3.0-3.3.12 and 3.4.0-3.4.13 causes memory corruption and process crash when opening a crafted deep scanline EXR file. A specific channel naming collision - a literal channel 'left' coexisting with layer-prefixed 'left.R', 'left.G', 'left.B' - causes the wrapper to allocate scalar-shaped deep sample storage and then write into it at RGB stride (three lanes), overflowing the heap allocation. No public exploit or CISA KEV listing exists at time of analysis; vendor-confirmed fixes are available in versions 3.3.13 and 3.4.14.
Heap out-of-bounds read in OpenEXR's RLE decompression path crashes the decoding process on ILP32 (32-bit) builds across versions 3.2.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13. A crafted .exr file with a malicious RLE-compressed payload causes the 64-bit unpacked size to truncate before buffer allocation in OpenEXRCore decoding.c, after which unpack_32bit() reads past the allocated buffer boundary, resulting in denial of service. Exploitation requires a victim or automated pipeline to open the malicious file; no public exploit identified at time of analysis, and the vulnerability is constrained to ILP32 build environments.
Out-of-bounds write in OpenEXR's B44 decompression path on ILP32 (32-bit) builds allows an attacker to corrupt heap memory and crash any application that opens a crafted EXR file, affecting the C++ libraries, CLI tools, and PyOpenEXR bindings across versions 3.1.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13. When a malformed B44-compressed scanline image triggers integer truncation in the scratch buffer size calculation before allocation, uncompress_b44_impl() subsequently writes using the full attacker-controlled channel width into the undersized buffer, producing a heap out-of-bounds write. Patches are confirmed available in 3.2.11, 3.3.13, and 3.4.14; no public exploit is identified at time of analysis.
Out-of-bounds read in OpenEXR's ILP32 builds enables denial of service via crafted uncompressed deep-tile EXR files across three active release branches (before 3.2.11, 3.3.0-3.3.12, and 3.4.0-3.4.13). The root cause is a 32-bit integer overflow in OpenEXRCore's sample-count table size calculation that causes unpack_sample_table() to iterate beyond an undersized allocation. No public exploit or active exploitation has been identified; vendor-released patches are available for all three affected branches.
Crash-inducing out-of-bounds read in OpenEXR's multipart file processing allows an attacker to cause a denial of service by supplying a crafted EXR file with an empty multiView header attribute. Affected are OpenEXR releases before 3.2.11, within the 3.3.x branch before 3.3.13, and within the 3.4.x branch before 3.4.14 - all maintained by the Academy Software Foundation. Exploitation requires user interaction to open the malicious file, limiting impact to availability only; no public exploit code or active exploitation has been identified at time of analysis.
Integer overflow in OpenEXR's deep tiled image decoder crashes any application that opens a crafted EXR file, affecting versions 3.1.0 through 3.4.13 across all three maintained release branches. The overflow occurs in OpenEXRCore's unpack_sample_table() function during the standard exr_decoding_run path, meaning no non-default configuration is required - only that the file uses the deep tiled variant of the format. Impact is denial of service via crash (no code execution demonstrated); no public exploit code exists and this vulnerability is not listed in CISA KEV.
Out-of-bounds read in Adobe Substance 3D Painter exposes sensitive process memory when a victim opens a specially crafted malicious file. The flaw, classified as CWE-125, causes the application to read beyond allocated buffer boundaries during file parsing, potentially leaking in-memory data such as credentials or session tokens accessible to the attacker. Adobe has published security advisory APSB26-129 addressing the issue; no public exploit code has been identified at time of analysis.
Out-of-bounds read in Adobe Illustrator Desktop 2025 and 2026 exposes sensitive process memory to disclosure when a victim opens a specially crafted file. The vulnerability carries a CVSS 3.1 score of 5.5 (Medium) with a local attack vector and required user interaction, limiting opportunistic exploitation but making it viable in targeted social-engineering campaigns. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Arbitrary file system read in Adobe's Content Credentials (C2PA Tool and Content Credentials Rust SDK) exposes sensitive files and directories outside the intended access scope through improper input validation during file parsing. The attack requires a victim to open a malicious file crafted by the attacker, making this a local, user-interaction-dependent vulnerability with high confidentiality impact but no integrity or availability consequence. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.
Substance3D - Designer crashes on availability when a victim opens a specially crafted malicious file, triggering a NULL Pointer Dereference that terminates the application. Adobe Substance 3D Designer users across all tracked versions (CPE wildcard) are affected, with impact limited to application-level denial of service - no code execution, data disclosure, or integrity compromise is possible. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, consistent with its low exploitability ceiling (requires local victim interaction).
Information disclosure in Google Chrome's Mobile component on iOS (all versions prior to 152.0.7977.65) allows a local attacker to read sensitive information by inducing the user to open a crafted file. Exploitation requires physical or logical local access to the device and user interaction, limiting the practical attack surface significantly. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with only partial technical impact.
Cross-origin data leakage through the CustomTabs component in Google Chrome for Android (versions prior to 152.0.7977.65) enables a local attacker to extract sensitive browsing data belonging to other origins via a co-installed application. The flaw is classified CWE-200 and carries a CVSS Medium score of 5.5, reflecting meaningful confidentiality impact constrained by a local-only attack vector and required user interaction. No public exploit code or active exploitation via CISA KEV has been identified; the vendor-released patch is available in Chrome 152.0.7977.65.
Sensitive information disclosure in NVIDIA NemoClaw arises from process invocation that exposes secrets - such as API keys or authentication tokens - through visible command-line arguments or environment variables, observable by other local users via standard tools like `ps`. All versions are affected per the wildcard CPE (`cpe:2.3:a:nvidia:nemoclaw:*:*:*:*:*:*:*:*`), and exploitation requires only a low-privileged local account on the same system. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept exploit code has been identified at time of analysis.
Buffer overflow in Apple macOS allows a locally-running app with standard user privileges to cause unexpected system termination or write arbitrary data into kernel memory. Affected versions include macOS Sequoia before 15.7.7 and macOS Sonoma before 14.8.7. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.11% (1st percentile), consistent with SSVC's assessment of no current exploitation.
Out-of-bounds read in the Zephyr ext2 filesystem driver crashes any device that mounts a crafted ext2 image. The superblock fields s_blocks_count and s_first_data_block are consumed verbatim without being bounded against the single-group bitmap capacity, allowing a malicious image to drive ext2_bitmap_count_set() roughly 512 MB past the allocated bitmap block. The resulting memory access crosses an unmapped or MPU-protected region and faults, producing a denial-of-service crash. No public exploit exists and the vulnerability is not in CISA KEV; real-world risk is bounded by the requirement to supply untrusted ext2 media to a target device.
Null pointer dereference in iOS and iPadOS allows a locally installed app to trigger unexpected system termination (device crash/reboot) by supplying crafted input that bypasses input validation. Affected versions span the legacy 18.x branch (prior to 18.7.9) and the current 26.x branch (prior to 26.5), covering a broad swath of Apple mobile devices. No active exploitation has been identified - CISA KEV status is absent, SSVC rates exploitation as none, and EPSS sits at the 1st percentile - placing this squarely as a patch-cycle priority rather than an emergency response item.
Incorrect authorization in the Downloads component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass system-level file access restrictions through a crafted HTML page delivered via social engineering. The flaw (CWE-863) requires user interaction to trigger, limiting opportunistic mass exploitation; however, Chrome's ubiquitous install base makes even low-probability attack paths operationally significant. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits low at 0.32% (24th percentile).
UI misrepresentation in Google Chrome's Linux Toolkit Theming component enables remote attackers to bypass system access restrictions through a crafted HTML page, relying on social engineering to complete the attack. All Chrome versions prior to 152.0.7977.65 on Linux are affected; Google shipped the fix in stable channel release 152.0.7977.65. No active exploitation has been confirmed (absent from CISA KEV), and an EPSS of 0.30% at the 23rd percentile reflects low automated exploitation probability.
Stored cross-site scripting in GazellePW's torrent remaster custom title feature allows authenticated tracker members to inject persistent JavaScript that executes in every subsequent visitor's browser. The unsanitized `remaster_custom_title` parameter is written to the database through both upload and edit code paths (Upload.php, takeedit.php, torrents.class.php) and rendered without encoding, with CVSS Scope Changed confirming cross-user impact. A publicly referenced blog post at snaacky.com describes a 1-click exploit chain leveraging this flaw for complete GazellePW database compromise, meaningfully elevating the practical risk above the base CVSS 5.4 score. No public exploit has been confirmed by CISA KEV, and EPSS sits at 0.30% (22nd percentile), consistent with a niche deployment target.
Broken access control in GazellePW's IP lock manager allows any authenticated user to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock, bypassing per-account authorization checks. A public write-up at snaacky.com describes this flaw as part of a 1-click exploit chain enabling complete GazellePW database compromise, substantially elevating its effective impact beyond the standalone CVSS 5.4 score. No CISA KEV listing exists, but the public chain write-up makes this an urgent remediation priority for any GazellePW operator.
Stored XSS in GazellePW (GazellePosterWall) allows authenticated low-privilege users to inject persistent JavaScript via a crafted subtitle filename, which is stored during upload and rendered unsanitized in the subtitle deletion page. A public exploit writeup (snaacky.com) documents a 1-click chain leveraging this flaw to achieve complete GazellePW database compromise, substantially elevating the practical impact beyond the CVSS 5.4 Medium base score. No public exploit confirmation via CISA KEV exists, but the availability of a detailed public exploit chain warrants prioritized remediation on any instance where untrusted authenticated users can upload subtitles.
Stored cross-site scripting in GazellePW's custom bonus title feature allows authenticated users with low privileges to inject persistent JavaScript payloads that execute in the browsers of other users - including administrators - who view bonus management pages. Affected is a specific commit (86c4bedf) of the GazellePosterWall PHP application. A public exploit writeup at snaacky.com describes a 1-click chain leveraging this and related issues to achieve complete database compromise, significantly elevating real-world impact beyond the base CVSS score of 5.4. No public KEV listing; EPSS is low at 0.29%, but the published exploit chain warrants elevated attention for any operator of this software.
Stored XSS in GazellePW (GazellePosterWall) commit 86c4bedf allows low-privileged authenticated users to inject arbitrary JavaScript through the avatar_mouse_over_text parameter in the donor feature, with the payload persisting in storage and executing in victims' browsers when they hover over the attacker's avatar tooltip. CVSS 5.4 (Scope: Changed) reflects cross-user impact, meaning the stored payload can target administrators or other members of the tracker platform. A public exploit chain writeup at snaacky.com describes a 1-click exploit leveraging GazellePW vulnerabilities to achieve complete database compromise, elevating the practical severity beyond the base CVSS score alone.
SQL injection in GazellePW's tags manager endpoint allows remote authenticated users holding moderator-level (users_mod) privileges to execute arbitrary SQL commands against the underlying database. The vulnerability resides in the tagid and type parameters passed via POST to tools.php?action=manage_tags at a specific commit (86c4bedf). A publicly documented exploit chain exists at snaacky.com that claims full database compromise, suggesting the official CVSS impact metrics (C:L/I:L) materially understate real-world severity. No public KEV listing; EPSS is low at 0.28% (20th percentile), consistent with the privilege barrier limiting opportunistic exploitation.
CustomTabs UI spoofing in Google Chrome for Android (prior to 152.0.7977.65) allows a remote attacker using social engineering to misrepresent browser UI elements through a crafted HTML page, enabling phishing-grade deception of users who believe they are interacting with a trusted interface. The flaw is classified under CWE-451 (UI Misrepresentation of Critical Information) and is limited to the Android platform's CustomTabs feature. No active exploitation is confirmed via CISA KEV, and EPSS sits at 0.22% (13th percentile), indicating negligible current exploitation activity.
UI misrepresentation in Chrome's WebAppInstalls component allows remote attackers to spoof browser UI elements by serving a crafted HTML page to a user who visits it. All Chrome releases prior to 152.0.7977.65 are affected across desktop platforms. Exploitation requires user interaction (visiting a malicious page) but no authentication, and could be used to deceive users into believing they are interacting with a trusted installation prompt - for example, tricking a user into approving a Progressive Web App install from an attacker-controlled origin. No public exploit code has been identified and EPSS is low (0.22%, 13th percentile), placing this firmly in the 'patch on schedule' tier rather than emergency response.
UI misrepresentation in Google Chrome prior to 152.0.7977.65 enables remote attackers to spoof browser interface elements via a crafted HTML page, potentially deceiving users about the identity or security state of a site they are visiting. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) confirms network delivery with no attacker authentication required, though user interaction is a hard prerequisite. No public exploit code and no active exploitation have been identified; the EPSS score of 0.22% at the 13th percentile reflects very low near-term exploitation probability.
UI spoofing in Google Chrome on macOS prior to version 152.0.7977.65 enables a remote attacker to misrepresent input UI elements by serving a crafted HTML page, classified under CWE-451 (UI Misrepresentation of Critical Information). Victims who visit the malicious page may be deceived by falsified browser UI elements - such as address bar content, form fields, or security indicators - potentially leading to credential theft or other social engineering outcomes. No active exploitation is confirmed (not in CISA KEV), and EPSS is very low at 0.22%; a vendor patch is available at 152.0.7977.65.
Address bar spoofing in Google Chrome prior to version 152.0.7977.65 enables remote attackers to deceive users about the true origin of a page they are visiting via a crafted HTML page, exploiting CWE-451 (UI Misrepresentation of Critical Information) in the browser's navigation subsystem. The practical impact is phishing amplification: a victim visiting the attacker's page may see a trusted domain displayed in the address bar and submit credentials or sensitive information to an attacker-controlled site. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS at 0.22% (13th percentile) confirms low automated exploitation probability, though the social-engineering utility of address bar spoofing makes targeted abuse plausible.
UI misrepresentation in Google Chrome's Geometry rendering component allows remote attackers to spoof browser interface elements by delivering a crafted HTML page to an unaware user. Versions prior to 152.0.7977.65 are affected across all desktop platforms where Chrome is installed. With CVSS 5.4, a low EPSS of 0.17% (7th percentile), and no CISA KEV listing, this is a moderate-severity phishing and social-engineering amplifier rather than a code-execution vector - but Chrome's near-ubiquitous deployment means the aggregate exposure is broad.
Stored XSS in Drupal Core allows authenticated low-privileged users to inject persistent malicious scripts that execute in the browsers of other site visitors, including administrators. The vulnerability spans multiple Drupal release trains - 10.x through 10.6.x, and all 11.0.*, 11.1.*, and 11.2.* branches - and is addressed in patched releases 10.6.13, 11.3.14, and 11.4.4 per the vendor advisory SA-core-2026-012. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation as none with non-automatable attack paths, placing this at moderate real-world priority despite scope change in the CVSS vector.
Missing HttpOnly cookie flags in HCL Hive expose session tokens and sensitive credentials to client-side script access, enabling session hijacking when combined with cross-site scripting. The CVE description cites broader infrastructure weaknesses - lateral movement, container breakout, and internal communications exposure - suggesting CWE-1004 is one root cause within a cluster of related configuration flaws. No public exploit has been identified at time of analysis, and no KEV listing exists, but the network-accessible attack surface with no privilege requirement (beyond user interaction) makes this relevant for any internet-exposed Hive deployment.
Missing authorization in the WebAppInstalls component of Google Chrome for Android (prior to 152.0.7977.65) enables an attacker who has already achieved renderer process compromise to extract sensitive information by issuing crafted IPC requests that bypass browser-process authorization checks. This is a chained exploit primitive rather than a standalone attack - it elevates a pre-existing renderer compromise into an unauthorized data disclosure. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.38% at the 30th percentile reflects the high practical barrier imposed by the required renderer prerequisite.
CPU exhaustion in libsoup's HTTP Range header processing affects any SoupServer deployment carrying the CVE-2025-32907 fix but not MR !550. Supplying a Range header with approximately 25,000 repeated satisfiable byte ranges triggers an O(N²) coalescing loop - each g_array_remove_index() call induces an O(N) memmove on GArray - blocking the server's event loop for roughly 90 ms per request from a single unauthenticated client. The description explicitly rules out memory corruption and information disclosure; this is a pure availability issue with no public exploit identified at time of analysis.
Authorization bypass in the Events Manager WordPress plugin (versions up to and including 7.4.0) exposes restricted event metadata to unauthenticated remote attackers. The plugin fails to verify user authorization before returning event and location data, allowing any internet user to retrieve titles, dates, descriptions, and location details that administrators have explicitly restricted as draft, pending, trashed, or private. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; a patched version (7.4.1) is confirmed available via the WordPress plugin repository changeset.
Observable discrepancy (CWE-203) in Google Chrome's network stack prior to version 152.0.7977.65 enables remote attackers to extract sensitive information by exploiting behavioral differences observable from a crafted HTML page. Exploitation requires high attack complexity and user interaction - the victim must visit a malicious page - constraining real-world impact despite the high confidentiality rating in the CVSS vector. No public exploit code exists and no active exploitation has been reported; Google has released a patch in Chrome 152.0.7977.65.
Observable discrepancy in Chrome's Autofill subsystem allows remote information disclosure via a crafted HTML page, affecting all desktop Chrome versions before 152.0.7977.65. The flaw (CWE-203) enables a network-reachable attacker to infer sensitive stored autofill data - such as addresses or payment fields - by measuring behavioral or timing differences triggered by form elements on a malicious page. Google has issued a patch in stable channel version 152.0.7977.65; no public exploit code exists and no CISA KEV listing has been recorded at time of analysis.
Denial of service in GOVCERT-LU's eml_parser Python library (versions prior to 3.0.2) allows a network-reachable attacker to abort SOC pipeline email parsing by submitting a crafted EML file containing deeply nested CFWS (Comment/Folding White Space) constructs in address-bearing headers such as To, From, Cc, or Bcc. The RecursionError raised internally by Python's email.utils.getaddresses() propagates uncaught through eml_parser, halting analysis of the entire message rather than just the offending header. No public exploit or active exploitation has been identified at time of analysis; the vendor notes partial mitigation because callers already need to handle exceptions from other pathological EML inputs.
WebProtect race condition in Google Chrome prior to 152.0.7977.65 exposes sensitive information to attackers who have already achieved renderer process compromise. The flaw (CWE-367 TOCTOU) enables a second-stage information disclosure step within a broader browser exploitation chain, requiring a victim to interact with a crafted HTML page. No public exploit code has been identified and EPSS sits at 0.29% (22nd percentile), indicating limited real-world exploitation pressure at this time; a vendor patch is available.