Stack-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the logged-in user. Exploitation is triggered by opening a specially crafted file, making this a file-parsing attack delivered through phishing or malicious asset distribution targeting 3D artists and designers. No public exploit code or active exploitation has been identified at time of analysis, though full confidentiality, integrity, and availability impact makes this a meaningful risk for affected users.
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution under the privileges of the current user when a victim opens a crafted malicious file. The vulnerability is rooted in CWE-122 (Heap-based Buffer Overflow), a memory corruption class that reliably yields code execution primitives in native applications. No public exploit code or active exploitation has been identified at time of analysis; however, the high CVSS score (7.8) and confirmed arbitrary code execution impact make this a meaningful risk for users in creative and 3D content production pipelines.
Heap-based buffer overflow in Adobe Substance 3D Designer enables arbitrary code execution at the privilege level of the logged-in user when a victim opens a specially crafted malicious file. The flaw (CWE-122) resides in the application's file parsing subsystem, where insufficient bounds validation permits heap memory corruption that an attacker can leverage to redirect execution flow. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the full confidentiality, integrity, and availability impact paired with low attack complexity post-file-open reflects meaningful severity for creative professionals operating in shared-asset workflows.
Heap-based buffer overflow in Adobe Substance 3D Designer enables arbitrary code execution in the context of the current user when a malicious file is opened. The flaw (CWE-122) resides in the application's file parsing logic, allowing an attacker who can deliver a crafted Designer file to achieve full code execution without requiring any elevated privileges on the target system. No public exploit has been identified at time of analysis, and Adobe has issued a remediation advisory under APSB26-115.
Heap-based buffer overflow in Adobe Substance 3D Designer allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. The vulnerability, tracked under CWE-122, resides in the application's file-parsing logic and affects all versions per Adobe's advisory APSB26-115. No public exploit or KEV listing has been identified at time of analysis, but the file-delivery vector makes this highly suitable for spear-phishing campaigns targeting creative professionals.
Heap-based buffer overflow in Adobe Substance 3D Designer enables arbitrary code execution in the context of the victim user when a malicious project or asset file is opened. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms local file-based exploitation with no privileges required on the attacker side, but requiring the victim to actively open a crafted file. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor has issued advisory APSB26-115 addressing this issue.
Heap-based buffer overflow in Adobe Substance 3D Designer enables arbitrary code execution scoped to the victim's user account when a crafted file is opened. The CWE-122 flaw carries a CVSS 7.8 (High) rating with full confidentiality, integrity, and availability impact, making successful exploitation highly damaging despite the required file-open interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity once file delivery is achieved keeps this a credible threat to creative professionals.
Adobe XD's file parser contains a classic buffer overflow (CWE-120) that enables arbitrary code execution at the privilege level of the current user when a victim opens a maliciously crafted XD file. The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact offset by a local attack vector and mandatory user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of a serious but not imminently weaponized code-execution vulnerability.
Buffer overflow in GPAC's SVG parsing function `svgNameToImplementationName()` allows a local attacker with low privileges to execute arbitrary code with full confidentiality, integrity, and availability impact. The vulnerability is tied to a specific upstream commit (31becc9e08b88e525a4a62013a4000de1c0f8fd9) and is consistent with CWE-120 (classic buffer overflow, no bounds checking). EPSS is very low at 0.19% (8th percentile), no KEV listing exists, and no public exploit is confirmed at time of analysis, though a GitHub gist referenced in the NVD entry may contain reproduction details.
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution under the logged-in user's context when a victim opens a specially crafted malicious file. The vulnerability (CWE-122) affects all tracked versions per the wildcard CPE, with Adobe acknowledging the issue via advisory APSB26-129. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution within the context of the current user when a victim opens a specially crafted malicious file. The CVSS 7.8 (High) score reflects local attack vector with no required privileges but mandatory user interaction, making social engineering the primary delivery mechanism for exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the high-impact C:H/I:H/A:H triad and RCE potential make patching a priority for affected creative industry environments.
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution in the context of the current user when a victim opens a specially crafted file. The flaw (CWE-122) arises during malicious file parsing, covering all versions per the wildcard CPE. Adobe has published advisory APSB26-129. No public exploit or CISA KEV listing has been identified at time of analysis, but the High CVSS score and full CIA triad impact make this a meaningful risk for creative and game-development environments.
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution at the privilege level of the victim user when a maliciously crafted file is opened. All versions are affected per the wildcard CPE, and Adobe has published advisory APSB26-129 addressing this issue. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the file-open attack vector makes this highly amenable to phishing and supply-chain-style delivery.
Untrusted Search Path exploitation in Adobe Substance 3D Painter allows an attacker to achieve arbitrary code execution under the current user's account by planting a malicious DLL or executable alongside a crafted project file. The root cause (CWE-426) is the application's failure to validate the library search path when loading dependencies at runtime, enabling full compromise of confidentiality, integrity, and availability on the victim host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity, well-understood exploitation technique, and complete C/H/I/A/A impact triad make this a meaningful patching priority for teams whose users open externally sourced project files.
Out-of-bounds write in Adobe Substance 3D Painter enables arbitrary code execution under the privileges of the current user when a victim opens a specially crafted malicious file. The flaw (CWE-787) resides in file-parsing logic and delivers full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing is identified at time of analysis, but the file-delivery vector makes this a credible threat for spear-phishing campaigns targeting creative and game-development professionals.
Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution within the context of the current user when a victim opens a specially crafted file. All versions are listed as affected per the wildcard CPE string, and the CVSS 7.8 High score reflects low-complexity exploitation once the file is opened, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution at the privilege level of the logged-in user when a victim opens a specially crafted file. All versions covered by CPE cpe:2.3:a:adobe:adobe_substance_3d_sampler:*:*:*:*:*:*:*:* are listed as affected, with Adobe addressing the issue via advisory APSB26-121. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog, though the file-open delivery mechanism fits common phishing and supply-chain vectors targeting creative professionals.
Out-of-bounds write (CWE-787) in Adobe Substance 3D Sampler enables arbitrary code execution within the context of the authenticated local user when a victim opens a specially crafted file. All versions of the product are flagged as potentially affected per the CPE string cpe:2.3:a:adobe:adobe_substance_3d_sampler:*:*:*:*:*:*:*:*, with exact version ranges detailed in Adobe advisory APSB26-121. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept exploit code has been identified in the provided intelligence data.
Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution in the current user's context when a victim opens a specially crafted malicious file. The vulnerability is rooted in CWE-787 memory corruption during file parsing, a classic attack surface in creative content tools where complex format parsers frequently handle untrusted input. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the full CIA triad impact and straightforward delivery mechanism (malicious asset file) make this a credible risk for creative professionals targeted via spearphishing or poisoned asset repositories.
Out-of-bounds write in Adobe Substance 3D Designer enables arbitrary code execution at the privilege level of the logged-in user when a victim opens a specially crafted project or material file. The vulnerability carries a CVSS 7.8 score with high confidentiality, integrity, and availability impact, and the CPE wildcard indicates all tracked versions may be affected. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds write in Adobe Substance 3D Designer enables arbitrary code execution in the context of the authenticated local user when a malicious file is opened. The vulnerability is rooted in a memory corruption flaw (CWE-787) triggered during file parsing, giving an attacker full control over code flow within the victim's user session. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Code injection in NVIDIA NemoClaw's migration command (Linux, versions up to 0.0.17) allows a local attacker with low-privilege access to inject and execute arbitrary code within the process context, yielding full confidentiality, integrity, and availability impact on the vulnerable system. SSVC rates technical impact as total, consistent with the CVSS 7.8 rating, though EPSS remains very low at 0.16% (5th percentile) and no active exploitation has been observed. No public exploit has been identified at time of analysis.
Out-of-bounds write in Adobe Substance 3D Sampler (all versions per CPE) enables arbitrary code execution under the victim's user account. Exploitation is contingent on a victim opening a specially crafted malicious file, introducing a mandatory social engineering dependency. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Out-of-bounds write in Adobe Substance 3D Designer enables arbitrary code execution in the context of the current user when a specially crafted file is opened. The flaw is a CWE-787 memory corruption in the application's file-parsing pipeline - a class that reliably yields code execution primitives when exploited. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the file-delivery attack surface makes it a credible vector for spear-phishing campaigns targeting game developers, VFX artists, and product designers who routinely exchange project files.
Out-of-bounds write in Adobe Substance 3D Painter enables arbitrary code execution within the current user's security context via a maliciously crafted file. The flaw (CWE-787) is triggered during file parsing, and the CVSS vector confirms full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Arbitrary file write via path traversal in the sos clean utility allows a local attacker to overwrite or create files at any location on the system by supplying a crafted tar archive to a privileged operator. The vulnerability exists across all supported Red Hat Enterprise Linux versions (6 through 10) and stems from sos clean's use of Python's fully_trusted_filter (or its legacy equivalent) during tar extraction, which performs no validation of symlink or hardlink targets - permitting escape from the intended extraction directory. Because sos clean commonly runs as root, successful exploitation yields full system compromise. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Arbitrary code execution in Emacs TRAMP affects Red Hat Enterprise Linux 6 through 10 via a local command injection flaw in the TRAMP remote file access subsystem. TRAMP concatenates user-influenced login arguments - including filenames - without sanitization before passing them to a local shell, enabling a low-privileged local attacker to inject shell commands that execute with the victim process's privileges. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and no-user-interaction requirement make this a credible local privilege escalation vector on multi-user RHEL systems.
Remote unauthenticated denial of service in OpenSSL's QUIC server stack (versions 3.5.x before 3.5.8, 3.6.x before 3.6.4, and 4.0.x before 4.0.2) allows an attacker to crash the QUIC server process by sending a single malformed INITIAL packet with a destination connection ID shorter than 8 bytes. The crafted packet triggers a double-free of the QUIC record layer RX (QRX) object, causing heap corruption and process termination. No public exploit has been identified; remote code execution is explicitly assessed as highly improbable by the vendor, and no public exploit or active exploitation has been confirmed.
Remote denial of service in OpenSSL's CMP subsystem affects versions 3.0.x through 4.0.x when password-based MAC (PBM)-protected messages are processed, caused by a missing ASN.1 type check that allows a crafted message to trigger an invalid pointer dereference before any MAC computation occurs. Unauthenticated remote attackers (CVSS PR:N) can crash applications acting as CMP servers via OSSL_CMP_SRV_process_request(), or crash CMP clients communicating with a malicious or intercepted CMP server. No public exploit has been identified at time of analysis; SSVC rates current exploitation as none, though the attack is rated automatable and requires no knowledge of the PBM shared secret.
PHP Object Injection in the Apache Solr for TYPO3 enterprise search extension allows authenticated low-privileged users to achieve arbitrary code execution on the server when user-generated content can reach indexed fields configured with SOLR_CLASSIFICATION, SOLR_MULTIVALUE, or SOLR_RELATION content object types. The extension's indexer passes multi-value field values rendered by the content object renderer directly to PHP's unserialize() function rather than a safe serialization format, creating a CWE-502 attack surface exploitable via PHP gadget chains. No public exploit code has been identified at time of analysis, though the vulnerability class is well-understood and commonly weaponized; the CVSS 4.0 score of 7.7 reflects the severe potential impact tempered by meaningful exploitation preconditions.
Server-Side Template Injection in TYPO3's Event Management and Registration extension allows authenticated backend editors to disclose sensitive application data or execute TypoScript content objects by supplying Fluid ViewHelper syntax in the email subject field. The flaw affects backend users with edit access to the event registration plugin or backend module - an insider-level privilege boundary that limits but does not eliminate risk, particularly in multi-tenant or agency-managed TYPO3 installations. No public exploit code or CISA KEV listing exists at time of analysis, though the CVSS 4.0 score of 7.7 reflects the high potential impact if the precondition is met.
SQL injection in the TYPO3 'Forms Export' backend extension allows a low-privileged authenticated backend user to inject arbitrary SQL through a URL parameter, yielding high-impact access to the underlying database (confidentiality, integrity, and availability). Exploitation is constrained to users with at least read access to the Forms Export backend module, limiting the attack surface to the TYPO3 administrative backend. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 7.7 reflects the high potential database impact.
The XML import feature in Tuleap Enterprise Edition versions 17.0 through 17.5 assigns default passwords to user accounts created during XML import operations (CWE-1393), exposing those accounts to network-accessible credential guessing with no authentication or user interaction required. Successful exploitation grants an attacker full control of an affected user account, resulting in high confidentiality and integrity impact per the CVSS 7.7 score. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the unauthenticated network vector makes this a realistic threat for any organization that has used XML import for bulk user migration.
Use-after-free in Chrome's UI layer allows a local attacker who has already achieved code execution inside the renderer process to escape the Chrome sandbox and execute arbitrary code on the underlying host system. All Google Chrome desktop releases prior to 152.0.7977.65 are affected per CPE cpe:2.3:a:google:chrome. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at 0.12% (2nd percentile), consistent with a sophisticated chained exploit rather than mass exploitation; however, the Scope:Changed CVSS vector confirms this is a full sandbox escape with critical C/I/A impact once the preconditions are met.
Project scope bypass in OpenStack Keystone before 29.0.3 allows authenticated users holding delegated credentials - OAuth1 access tokens, application credentials, or trusts - to escape their intended project authorization boundary by submitting these tokens to the standard token-method authentication endpoint for reauthentication. When an application credential token is presented without an explicit scope parameter, Keystone incorrectly resolves scope to the credential owner's default project rather than the project for which the credential was originally issued, granting unintended cross-project access. No public exploit has been identified and the flaw is absent from CISA KEV, but the CVSS 4.0 score of 7.6 with high confidentiality and integrity impact makes this a priority for any multi-tenant OpenStack operator issuing delegated credentials across project boundaries.
Privilege escalation in OpenStack Keystone before 29.0.3 allows authenticated users holding delegated tokens - issued via OAuth1 access tokens, application credentials, or trust-scoped authentication - to create new long-lived credentials or authorize additional delegations that outlive the original parent credential. The core security contract of delegation scoping is broken: a derived token can exceed and survive the authority of the credential used to obtain it, because delegation restriction checks were not applied uniformly across all delegated token types. All Keystone deployments that have enabled OAuth1, application credentials, or trusts are affected; no public exploit code or CISA KEV listing has been identified at time of analysis.
NULL pointer dereference in OpenSSL's RFC7250 Raw Public Key (RPK) TLS extension handling crashes any server or client configured in key-only RPK mode when a remote peer sends the typically omitted `signature_algorithms_cert` extension. Affected versions span OpenSSL 3.4.x through 4.0.x; impact is strictly limited to a process-aborting Denial of Service - no data disclosure or code execution is possible. No public exploit exists and CISA SSVC rates active exploitation as none, but the attack is automatable against any reachable endpoint in this non-default configuration.
Stack-based buffer overflow in BlueZ, the Linux Bluetooth protocol stack, allows any unauthenticated attacker within Bluetooth radio range to crash the bluetoothd service and potentially execute arbitrary code. The flaw is triggered when a target device with Bluetooth discovery enabled processes a malicious Extended Inquiry Response (EIR) packet. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept is identified at time of analysis.
JWT token replay in AshAuthentication exposes any application using the stateless bearer-token path to full account takeover using purpose-scoped tokens. The `retrieve_from_bearer/3` helper in versions 3.10.5-4.14.2 and 5.0.0-rc.0-5.0.0-rc.13 verifies JWT signatures and rejects tokens with an `act` claim, but never validates that the token's `purpose` claim equals "user", allowing sign-in, remember-me, and TOTP-setup tokens to be silently accepted as full bearer credentials. No public exploit has been identified at time of analysis, but the attack requires only obtaining a still-valid, not-yet-exchanged sign-in token - a realistic threat surface via log leakage, referrer exposure, or intercepted magic-link delivery.
Cache-poisoning-based access control bypass in the Apache Solr for TYPO3 Enterprise Search extension allows anonymous visitors to read pages that should be protected by extendToSubpages-inherited frontend-group restrictions. The extension fails to isolate its forged access-restriction state during indexer sub-requests, writing empty frontend-group and subpage-inheritance flags into the shared TYPO3 rootline cache, where they persist and serve subsequent user requests without the original restrictions applied. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 7.6 with combined high confidentiality and integrity impact reflects meaningful severity for any TYPO3 deployment relying on page-level inherited access controls.
Repository migration operations in JFrog Artifactory expose a missing authorization check (CWE-862) that allows any authenticated low-privileged user to initiate migrations against repositories they do not have permission to access or control. Affected instances across all Artifactory versions per the CPE wildcard are subject to information disclosure of restricted artifact contents, unauthorized state changes via migration side-effects, and high-impact service disruption to artifact delivery pipelines. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, though the CVSS 7.6 High rating and PR:L attack vector make it a realistic insider or compromised-credential threat.
Heap corruption in OpenSSL's CMS decryption path allows a remote unauthenticated attacker to crash any application invoking CMS_decrypt() on attacker-supplied ciphertext. The AES-WRAP-PAD unwrap primitive writes and cleanses up to the full input length on its integrity-failure path, while the CMS layer allocates a buffer sized only for the expected output - producing a fixed-size, fixed-value (zero) 8-byte overwrite immediately past the heap allocation. No public exploit has been identified at time of analysis, but the CVSS 7.5 rating and SSVC automatable classification indicate this can be reliably triggered at scale against any service that processes externally sourced CMS messages.
DTLS memory exhaustion in OpenSSL allows unauthenticated remote peers to consume disproportionate server memory during handshake processing. Sending small forged records that claim a future epoch triggers OpenSSL to buffer the entire ~16 KB read buffer rather than just the actual record bytes, yielding an amplification factor of approximately 1,200× per record; up to 100 such records may be queued per connection, exposing roughly 1.7 MB of server memory per association from a negligible volume of transmitted data. No public exploit has been identified at time of analysis and SSVC rates exploitation status as none, but the attack is rated automatable and can be multiplied across many concurrent DTLS connections.
Improper input validation in Adobe's CAI Content Credentials tooling - spanning both the C2PA Tool and the Content Credentials Rust SDK - enables a remote unauthenticated attacker to crash the application and cause a denial-of-service condition. Both library and CLI components are affected per CPE strings, meaning downstream applications that embed or invoke this SDK to validate content provenance may also be disrupted. No public exploit has been identified at time of analysis, but the zero-complexity, no-authentication, no-interaction attack surface makes the vulnerability straightforwardly reachable wherever the affected component processes untrusted input.
Integer underflow in Adobe's Content Credentials Rust SDK and C2PA Tool allows unauthenticated remote attackers to crash affected applications, producing a denial-of-service condition. The flaw (CWE-191) is triggered without user interaction and is reachable over the network with low attack complexity, making it straightforward to exploit against any service that processes C2PA content credential data using Adobe's SDK. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the zero-prerequisite attack surface warrants prompt patching.
Uncontrolled resource consumption in Adobe's Content Credentials ecosystem - specifically the c2pa_tool and Content Credentials Rust SDK - allows unauthenticated remote attackers to exhaust system resources and trigger application denial-of-service with no user interaction required. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a straightforward network-exploitable path requiring neither authentication nor privilege. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is confined to availability.
Memory exhaustion in OpenSSL's QUIC stack allows any remote peer that completes a QUIC handshake to cause unbounded connection-scoped memory growth by sending repeated PING frames while withholding acknowledgments for ack-eliciting packets. Affected versions span OpenSSL 3.4.0 through early 4.0.x; TLS-only deployments and the FIPS module are unaffected. No public exploit code exists and SSVC confirms no active exploitation at time of analysis, though the attack is rated automatable (CVSS AV:N/AC:L/PR:N/UI:N), making concurrent-connection amplification straightforward.
CPU exhaustion denial-of-service in eml_parser (Python pip package, versions prior to 3.0.2) stems from a quadratic-time regex fix-point loop in the `noparenthesis` function used to strip parenthesized CFWS comments from `Received:` email headers. Remote, unauthenticated attackers can submit small, specially crafted EML files containing deeply nested parentheses that consume multiple seconds of CPU time per parsed message, degrading throughput and causing queue backpressure or service-level outages in synchronous email gateways, sandboxes, and real-time triage pipelines. No public exploit has been identified at time of analysis, but the attack is trivially reproducible from first principles using only the published advisory description.
SQL Injection in the Readabler WordPress plugin affects all versions prior to 2.0.18, allowing unauthenticated remote attackers to append malicious SQL clauses to existing database queries and exfiltrate sensitive data from the WordPress database. The flaw stems from insufficient escaping of user-supplied input combined with unprepared SQL queries inside the plugin. No active exploitation is confirmed at time of analysis, but the zero-authentication, low-complexity, network-accessible attack path makes this a practical target for automated mass scanning campaigns.
Unauthenticated user data enumeration in Maccms v10 v2026.1000.4055 allows any remote attacker to retrieve the complete registered user database through the /api.php/user/get_list endpoint, which performs no authentication or authorization checks whatsoever. Attackers craft HTTP GET requests with limit and offset parameters to paginate through all user records, exposing usernames, email addresses, and any other stored profile data. EPSS at 0.32% (24th percentile) and absence from CISA KEV indicate no current widespread exploitation, though the trivial single-request attack mechanic makes this a viable data-harvesting vector if the application gains attacker attention.