Out-of-bounds write in Adobe Substance 3D Painter enables arbitrary code execution under the privileges of the current user when a victim opens a specially crafted malicious file. The flaw (CWE-787) resides in file-parsing logic and delivers full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing is identified at time of analysis, but the file-delivery vector makes this a credible threat for spear-phishing campaigns targeting creative and game-development professionals.
Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution within the context of the current user when a victim opens a specially crafted file. All versions are listed as affected per the wildcard CPE string, and the CVSS 7.8 High score reflects low-complexity exploitation once the file is opened, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution at the privilege level of the logged-in user when a victim opens a specially crafted file. All versions covered by CPE cpe:2.3:a:adobe:adobe_substance_3d_sampler:*:*:*:*:*:*:*:* are listed as affected, with Adobe addressing the issue via advisory APSB26-121. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog, though the file-open delivery mechanism fits common phishing and supply-chain vectors targeting creative professionals.
Out-of-bounds write (CWE-787) in Adobe Substance 3D Sampler enables arbitrary code execution within the context of the authenticated local user when a victim opens a specially crafted file. All versions of the product are flagged as potentially affected per the CPE string cpe:2.3:a:adobe:adobe_substance_3d_sampler:*:*:*:*:*:*:*:*, with exact version ranges detailed in Adobe advisory APSB26-121. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept exploit code has been identified in the provided intelligence data.
Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution in the current user's context when a victim opens a specially crafted malicious file. The vulnerability is rooted in CWE-787 memory corruption during file parsing, a classic attack surface in creative content tools where complex format parsers frequently handle untrusted input. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the full CIA triad impact and straightforward delivery mechanism (malicious asset file) make this a credible risk for creative professionals targeted via spearphishing or poisoned asset repositories.
Out-of-bounds write in Adobe Substance 3D Designer enables arbitrary code execution at the privilege level of the logged-in user when a victim opens a specially crafted project or material file. The vulnerability carries a CVSS 7.8 score with high confidentiality, integrity, and availability impact, and the CPE wildcard indicates all tracked versions may be affected. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds write in Adobe Substance 3D Designer enables arbitrary code execution in the context of the authenticated local user when a malicious file is opened. The vulnerability is rooted in a memory corruption flaw (CWE-787) triggered during file parsing, giving an attacker full control over code flow within the victim's user session. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Code injection in NVIDIA NemoClaw's migration command (Linux, versions up to 0.0.17) allows a local attacker with low-privilege access to inject and execute arbitrary code within the process context, yielding full confidentiality, integrity, and availability impact on the vulnerable system. SSVC rates technical impact as total, consistent with the CVSS 7.8 rating, though EPSS remains very low at 0.16% (5th percentile) and no active exploitation has been observed. No public exploit has been identified at time of analysis.
Out-of-bounds write in Adobe Substance 3D Sampler (all versions per CPE) enables arbitrary code execution under the victim's user account. Exploitation is contingent on a victim opening a specially crafted malicious file, introducing a mandatory social engineering dependency. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Out-of-bounds write in Adobe Substance 3D Designer enables arbitrary code execution in the context of the current user when a specially crafted file is opened. The flaw is a CWE-787 memory corruption in the application's file-parsing pipeline - a class that reliably yields code execution primitives when exploited. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the file-delivery attack surface makes it a credible vector for spear-phishing campaigns targeting game developers, VFX artists, and product designers who routinely exchange project files.
Out-of-bounds write in Adobe Substance 3D Painter enables arbitrary code execution within the current user's security context via a maliciously crafted file. The flaw (CWE-787) is triggered during file parsing, and the CVSS vector confirms full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Arbitrary file write via path traversal in the sos clean utility allows a local attacker to overwrite or create files at any location on the system by supplying a crafted tar archive to a privileged operator. The vulnerability exists across all supported Red Hat Enterprise Linux versions (6 through 10) and stems from sos clean's use of Python's fully_trusted_filter (or its legacy equivalent) during tar extraction, which performs no validation of symlink or hardlink targets - permitting escape from the intended extraction directory. Because sos clean commonly runs as root, successful exploitation yields full system compromise. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Arbitrary code execution in Emacs TRAMP affects Red Hat Enterprise Linux 6 through 10 via a local command injection flaw in the TRAMP remote file access subsystem. TRAMP concatenates user-influenced login arguments - including filenames - without sanitization before passing them to a local shell, enabling a low-privileged local attacker to inject shell commands that execute with the victim process's privileges. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and no-user-interaction requirement make this a credible local privilege escalation vector on multi-user RHEL systems.
Remote unauthenticated denial of service in OpenSSL's QUIC server stack (versions 3.5.x before 3.5.8, 3.6.x before 3.6.4, and 4.0.x before 4.0.2) allows an attacker to crash the QUIC server process by sending a single malformed INITIAL packet with a destination connection ID shorter than 8 bytes. The crafted packet triggers a double-free of the QUIC record layer RX (QRX) object, causing heap corruption and process termination. No public exploit has been identified; remote code execution is explicitly assessed as highly improbable by the vendor, and no public exploit or active exploitation has been confirmed.
Remote denial of service in OpenSSL's CMP subsystem affects versions 3.0.x through 4.0.x when password-based MAC (PBM)-protected messages are processed, caused by a missing ASN.1 type check that allows a crafted message to trigger an invalid pointer dereference before any MAC computation occurs. Unauthenticated remote attackers (CVSS PR:N) can crash applications acting as CMP servers via OSSL_CMP_SRV_process_request(), or crash CMP clients communicating with a malicious or intercepted CMP server. No public exploit has been identified at time of analysis; SSVC rates current exploitation as none, though the attack is rated automatable and requires no knowledge of the PBM shared secret.
PHP Object Injection in the Apache Solr for TYPO3 enterprise search extension allows authenticated low-privileged users to achieve arbitrary code execution on the server when user-generated content can reach indexed fields configured with SOLR_CLASSIFICATION, SOLR_MULTIVALUE, or SOLR_RELATION content object types. The extension's indexer passes multi-value field values rendered by the content object renderer directly to PHP's unserialize() function rather than a safe serialization format, creating a CWE-502 attack surface exploitable via PHP gadget chains. No public exploit code has been identified at time of analysis, though the vulnerability class is well-understood and commonly weaponized; the CVSS 4.0 score of 7.7 reflects the severe potential impact tempered by meaningful exploitation preconditions.
Server-Side Template Injection in TYPO3's Event Management and Registration extension allows authenticated backend editors to disclose sensitive application data or execute TypoScript content objects by supplying Fluid ViewHelper syntax in the email subject field. The flaw affects backend users with edit access to the event registration plugin or backend module - an insider-level privilege boundary that limits but does not eliminate risk, particularly in multi-tenant or agency-managed TYPO3 installations. No public exploit code or CISA KEV listing exists at time of analysis, though the CVSS 4.0 score of 7.7 reflects the high potential impact if the precondition is met.
SQL injection in the TYPO3 'Forms Export' backend extension allows a low-privileged authenticated backend user to inject arbitrary SQL through a URL parameter, yielding high-impact access to the underlying database (confidentiality, integrity, and availability). Exploitation is constrained to users with at least read access to the Forms Export backend module, limiting the attack surface to the TYPO3 administrative backend. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 7.7 reflects the high potential database impact.
The XML import feature in Tuleap Enterprise Edition versions 17.0 through 17.5 assigns default passwords to user accounts created during XML import operations (CWE-1393), exposing those accounts to network-accessible credential guessing with no authentication or user interaction required. Successful exploitation grants an attacker full control of an affected user account, resulting in high confidentiality and integrity impact per the CVSS 7.7 score. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the unauthenticated network vector makes this a realistic threat for any organization that has used XML import for bulk user migration.
Use-after-free in Chrome's UI layer allows a local attacker who has already achieved code execution inside the renderer process to escape the Chrome sandbox and execute arbitrary code on the underlying host system. All Google Chrome desktop releases prior to 152.0.7977.65 are affected per CPE cpe:2.3:a:google:chrome. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at 0.12% (2nd percentile), consistent with a sophisticated chained exploit rather than mass exploitation; however, the Scope:Changed CVSS vector confirms this is a full sandbox escape with critical C/I/A impact once the preconditions are met.
Project scope bypass in OpenStack Keystone before 29.0.3 allows authenticated users holding delegated credentials - OAuth1 access tokens, application credentials, or trusts - to escape their intended project authorization boundary by submitting these tokens to the standard token-method authentication endpoint for reauthentication. When an application credential token is presented without an explicit scope parameter, Keystone incorrectly resolves scope to the credential owner's default project rather than the project for which the credential was originally issued, granting unintended cross-project access. No public exploit has been identified and the flaw is absent from CISA KEV, but the CVSS 4.0 score of 7.6 with high confidentiality and integrity impact makes this a priority for any multi-tenant OpenStack operator issuing delegated credentials across project boundaries.
Privilege escalation in OpenStack Keystone before 29.0.3 allows authenticated users holding delegated tokens - issued via OAuth1 access tokens, application credentials, or trust-scoped authentication - to create new long-lived credentials or authorize additional delegations that outlive the original parent credential. The core security contract of delegation scoping is broken: a derived token can exceed and survive the authority of the credential used to obtain it, because delegation restriction checks were not applied uniformly across all delegated token types. All Keystone deployments that have enabled OAuth1, application credentials, or trusts are affected; no public exploit code or CISA KEV listing has been identified at time of analysis.
NULL pointer dereference in OpenSSL's RFC7250 Raw Public Key (RPK) TLS extension handling crashes any server or client configured in key-only RPK mode when a remote peer sends the typically omitted `signature_algorithms_cert` extension. Affected versions span OpenSSL 3.4.x through 4.0.x; impact is strictly limited to a process-aborting Denial of Service - no data disclosure or code execution is possible. No public exploit exists and CISA SSVC rates active exploitation as none, but the attack is automatable against any reachable endpoint in this non-default configuration.
Stack-based buffer overflow in BlueZ, the Linux Bluetooth protocol stack, allows any unauthenticated attacker within Bluetooth radio range to crash the bluetoothd service and potentially execute arbitrary code. The flaw is triggered when a target device with Bluetooth discovery enabled processes a malicious Extended Inquiry Response (EIR) packet. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept is identified at time of analysis.
JWT token replay in AshAuthentication exposes any application using the stateless bearer-token path to full account takeover using purpose-scoped tokens. The `retrieve_from_bearer/3` helper in versions 3.10.5-4.14.2 and 5.0.0-rc.0-5.0.0-rc.13 verifies JWT signatures and rejects tokens with an `act` claim, but never validates that the token's `purpose` claim equals "user", allowing sign-in, remember-me, and TOTP-setup tokens to be silently accepted as full bearer credentials. No public exploit has been identified at time of analysis, but the attack requires only obtaining a still-valid, not-yet-exchanged sign-in token - a realistic threat surface via log leakage, referrer exposure, or intercepted magic-link delivery.
Cache-poisoning-based access control bypass in the Apache Solr for TYPO3 Enterprise Search extension allows anonymous visitors to read pages that should be protected by extendToSubpages-inherited frontend-group restrictions. The extension fails to isolate its forged access-restriction state during indexer sub-requests, writing empty frontend-group and subpage-inheritance flags into the shared TYPO3 rootline cache, where they persist and serve subsequent user requests without the original restrictions applied. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 7.6 with combined high confidentiality and integrity impact reflects meaningful severity for any TYPO3 deployment relying on page-level inherited access controls.
Repository migration operations in JFrog Artifactory expose a missing authorization check (CWE-862) that allows any authenticated low-privileged user to initiate migrations against repositories they do not have permission to access or control. Affected instances across all Artifactory versions per the CPE wildcard are subject to information disclosure of restricted artifact contents, unauthorized state changes via migration side-effects, and high-impact service disruption to artifact delivery pipelines. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, though the CVSS 7.6 High rating and PR:L attack vector make it a realistic insider or compromised-credential threat.
Heap corruption in OpenSSL's CMS decryption path allows a remote unauthenticated attacker to crash any application invoking CMS_decrypt() on attacker-supplied ciphertext. The AES-WRAP-PAD unwrap primitive writes and cleanses up to the full input length on its integrity-failure path, while the CMS layer allocates a buffer sized only for the expected output - producing a fixed-size, fixed-value (zero) 8-byte overwrite immediately past the heap allocation. No public exploit has been identified at time of analysis, but the CVSS 7.5 rating and SSVC automatable classification indicate this can be reliably triggered at scale against any service that processes externally sourced CMS messages.
DTLS memory exhaustion in OpenSSL allows unauthenticated remote peers to consume disproportionate server memory during handshake processing. Sending small forged records that claim a future epoch triggers OpenSSL to buffer the entire ~16 KB read buffer rather than just the actual record bytes, yielding an amplification factor of approximately 1,200× per record; up to 100 such records may be queued per connection, exposing roughly 1.7 MB of server memory per association from a negligible volume of transmitted data. No public exploit has been identified at time of analysis and SSVC rates exploitation status as none, but the attack is rated automatable and can be multiplied across many concurrent DTLS connections.
Improper input validation in Adobe's CAI Content Credentials tooling - spanning both the C2PA Tool and the Content Credentials Rust SDK - enables a remote unauthenticated attacker to crash the application and cause a denial-of-service condition. Both library and CLI components are affected per CPE strings, meaning downstream applications that embed or invoke this SDK to validate content provenance may also be disrupted. No public exploit has been identified at time of analysis, but the zero-complexity, no-authentication, no-interaction attack surface makes the vulnerability straightforwardly reachable wherever the affected component processes untrusted input.
Integer underflow in Adobe's Content Credentials Rust SDK and C2PA Tool allows unauthenticated remote attackers to crash affected applications, producing a denial-of-service condition. The flaw (CWE-191) is triggered without user interaction and is reachable over the network with low attack complexity, making it straightforward to exploit against any service that processes C2PA content credential data using Adobe's SDK. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the zero-prerequisite attack surface warrants prompt patching.
Uncontrolled resource consumption in Adobe's Content Credentials ecosystem - specifically the c2pa_tool and Content Credentials Rust SDK - allows unauthenticated remote attackers to exhaust system resources and trigger application denial-of-service with no user interaction required. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a straightforward network-exploitable path requiring neither authentication nor privilege. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is confined to availability.
Memory exhaustion in OpenSSL's QUIC stack allows any remote peer that completes a QUIC handshake to cause unbounded connection-scoped memory growth by sending repeated PING frames while withholding acknowledgments for ack-eliciting packets. Affected versions span OpenSSL 3.4.0 through early 4.0.x; TLS-only deployments and the FIPS module are unaffected. No public exploit code exists and SSVC confirms no active exploitation at time of analysis, though the attack is rated automatable (CVSS AV:N/AC:L/PR:N/UI:N), making concurrent-connection amplification straightforward.
CPU exhaustion denial-of-service in eml_parser (Python pip package, versions prior to 3.0.2) stems from a quadratic-time regex fix-point loop in the `noparenthesis` function used to strip parenthesized CFWS comments from `Received:` email headers. Remote, unauthenticated attackers can submit small, specially crafted EML files containing deeply nested parentheses that consume multiple seconds of CPU time per parsed message, degrading throughput and causing queue backpressure or service-level outages in synchronous email gateways, sandboxes, and real-time triage pipelines. No public exploit has been identified at time of analysis, but the attack is trivially reproducible from first principles using only the published advisory description.
SQL Injection in the Readabler WordPress plugin affects all versions prior to 2.0.18, allowing unauthenticated remote attackers to append malicious SQL clauses to existing database queries and exfiltrate sensitive data from the WordPress database. The flaw stems from insufficient escaping of user-supplied input combined with unprepared SQL queries inside the plugin. No active exploitation is confirmed at time of analysis, but the zero-authentication, low-complexity, network-accessible attack path makes this a practical target for automated mass scanning campaigns.
Unauthenticated user data enumeration in Maccms v10 v2026.1000.4055 allows any remote attacker to retrieve the complete registered user database through the /api.php/user/get_list endpoint, which performs no authentication or authorization checks whatsoever. Attackers craft HTTP GET requests with limit and offset parameters to paginate through all user records, exposing usernames, email addresses, and any other stored profile data. EPSS at 0.32% (24th percentile) and absence from CISA KEV indicate no current widespread exploitation, though the trivial single-request attack mechanic makes this a viable data-harvesting vector if the application gains attacker attention.
Regular Expression Denial of Service in SAP S/4HANA (Private Cloud) allows unauthenticated remote attackers to exhaust server resources by supplying specially crafted input to a network-accessible endpoint that invokes a vulnerable third-party regex component (CWE-1333). Successful exploitation causes high availability impact with no confidentiality or integrity exposure, making this a targeted disruption risk against a critical ERP platform. No active exploitation has been confirmed - the vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis.
Remote code execution outside the browser sandbox is achievable in Google Chrome prior to 152.0.7977.65 via a race condition in ANGLE, the graphics API translation layer. Exploitation requires a victim to visit a crafted HTML page (UI:R), and the high attack complexity (AC:H) reflects the timing-sensitive, probabilistic nature of race condition exploitation. No public exploit code has been identified and CISA KEV does not list this CVE, though SSVC rates technical impact as total if exploitation succeeds.
Heap-based buffer overflow (CWE-122) in Blink, Chrome's rendering engine, grants native code execution within the renderer sandbox to attackers who have already achieved renderer process compromise, affecting all Chrome versions prior to 152.0.7977.65 across all platforms. The fix is confirmed in stable channel release 152.0.7977.65. No public exploit identified at time of analysis; EPSS at 0.28% (20th percentile) and Chromium's own Medium severity rating both reflect the high attack complexity imposed by the mandatory prior-renderer-compromise precondition.
Sandbox escape in Google Chrome's Media component on Windows allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside Chrome's sandbox via a crafted HTML page. Affected versions are all Chrome releases on Windows prior to 152.0.7977.65. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment confirms exploitation status as none, and EPSS probability is low at 0.26% (17th percentile), though SSVC technical impact is rated total given full sandbox bypass capability.
Stored cross-site scripting in YOOtheme Pro Extension for Joomla versions 1.0.0 through 5.0.41 allows authenticated, privileged users to inject persistent malicious scripts via the location custom field, which lacks HTML output escaping before rendering user-supplied content in the browser. Any site visitor who subsequently loads a page rendering the tainted field will execute the attacker-controlled script in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis, and the requirement for a high-privilege Joomla account substantially limits the threat surface.
Remote code execution within the Chrome sandbox is achievable via a race condition in the V8 JavaScript engine, affecting all Google Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker (per CVSS PR:N) can trigger the vulnerability by luring a user to a crafted HTML page, exploiting a timing window in V8's memory management to execute arbitrary code. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.24th percentile and CISA SSVC records exploitation status as none, classifying this as a theoretical-but-patched risk for organizations that deploy promptly.
Uncontrolled resource consumption in Apache Tomcat's HTTP/2 implementation allows remote unauthenticated attackers to exhaust server memory by repeatedly opening and resetting HTTP/2 streams, exploiting an allocation leak in the backlog tracking mechanism that fails to release memory on stream reset. Affected branches span Tomcat 9.0.39-9.0.120, 10.1.0-M1-10.1.57, and 11.0.0-M1-11.0.24, with EOL branch 8.5.59-8.5.100 also confirmed vulnerable but unpatchable. No public exploit has been identified at time of analysis; EPSS stands at a low 0.22%, but the unauthenticated network vector and high availability impact make this operationally significant for any HTTP/2-enabled Tomcat deployment.
Cache poisoning via Host header injection in WP Fastest Cache before version 1.5.1 exposes every WordPress site visitor to unauthenticated JavaScript execution from attacker-controlled servers. The plugin incorporates the client-supplied HTTP Host header into asset file URLs baked into cached pages while omitting that header from the cache key, meaning a single forged request can persist malicious script references across all subsequent page serves. No public exploit code has been identified at time of analysis, but the technique - HTTP Host header injection leading to web cache poisoning - is well-documented and the attack carries a CVSS 3.1 score of 7.5.
Sandbox escape in Google Chrome's Media component (prior to 152.0.7977.65) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Google has released a patched stable channel build (152.0.7977.65), with no public exploit code or active exploitation confirmed at time of analysis. EPSS sits at 0.21% (12th percentile) and SSVC rates the exploitation status as none with automatable: no, indicating this is a low-immediacy but technically severe sandbox escape requiring a two-stage attack chain.
Rewrite valve processing in Apache Tomcat contains an off-by-one error (CWE-193) in the handling of the [N] (Next) flag, causing rule iteration to restart from the second rewrite rule instead of the first, which can produce unintended looping behavior and result in a denial-of-service condition. Affected supported versions span Tomcat 9.0.0.M1 through 9.0.120, 10.1.0-M1 through 10.1.57, and 11.0.0-M1 through 11.0.24; the EOL 8.5.x branch is also affected but will not receive a fix. No active exploitation is confirmed (not in CISA KEV), EPSS stands at 0.20% (10th percentile), and no public exploit code has been identified at time of analysis.
Local file disclosure in the Kaltura HTML5 player's mwEmbedLoader.php endpoint allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. The root cause is that the ServiceUrl parameter - used as a base URL for backend requests - accepts non-HTTP URI schemes including file://, which the server then fetches; when an exception is raised, the raw deserialized response is reflected back to the client in the error message, leaking file contents. Affected releases span html5lib v2.45, v2.103, and earlier v2.x versions; no public exploit or KEV listing has been identified at time of analysis, though the attack path is straightforward for any attacker with access to the exposed endpoint.
Race condition in Google Chrome Enterprise on Windows prior to version 152.0.7977.65 enables an adjacent network attacker to potentially escape the browser sandbox and execute arbitrary code on the host system via crafted network traffic. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog. Despite a CVSS base score of 7.5, Google's Chromium team assigned an internal severity of Low, and SSVC analysis independently rates exploitation as none with non-automatable attack conditions - together suggesting constrained real-world impact relative to raw score.
Observable timing discrepancy in the Drupal Token Content Access module exposes token-protected content to brute-force enumeration via side-channel analysis. All module versions from 0.0.0 through 3.1.2 are affected; unauthenticated remote attackers (PR:N, AV:N per CVSS) can measure differential response times during token validation to reconstruct valid access tokens character-by-character, ultimately bypassing content access restrictions. No active exploitation has been confirmed (SSVC exploitation: none, EPSS 0.14%, no KEV listing), and a vendor patch is available per Drupal SA-CONTRIB-2026-090.
DPoP proof replay attack in Spring Security's DPoPProofJwtDecoderFactory allows unauthenticated network attackers to bypass token binding protections by evicting cached JWT ID entries through request flooding, then replaying captured valid DPoP proofs to impersonate legitimate users. Affected versions span Spring Security 6.5.0-6.5.11, 7.0.0-7.0.6, and 7.1.0, impacting any Java application using Spring Security's DPoP-based OAuth 2.0 validation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS C:H/I:H ratings reflect full token-holder impersonation upon successful exploitation.