Arbitrary PHP file overwrite in Veno File Manager 4.4.9 allows an authenticated super administrator to replace any PHP file in the application by exploiting a path traversal flaw in the translations update endpoint. Sending a crafted POST request to /vfm-admin/index.php?section=translations&action=update with a manipulated file path parameter causes the application to write attacker-controlled content to arbitrary PHP files, effectively enabling remote code execution via web shell deployment. A public proof-of-concept repository exists at github.com/jfs-jfs/CVE-2026-37068, though EPSS sits at 0.16% and no active exploitation is confirmed.
Spring for GraphQL's bundled GraphiQL developer IDE loads third-party JavaScript libraries from a public CDN without Subresource Integrity (SRI) verification, allowing any attacker capable of tampering with CDN responses to inject and execute arbitrary JavaScript in any browser that loads the GraphiQL page. All four maintained release lines are affected (1.0.x through 2.0.4), as confirmed by the VMware/Spring security advisory and EUVD-2026-67175. No public exploit code has been identified at time of analysis, and EPSS at 0.11% (2nd percentile) reflects currently minimal exploitation activity.
JdbcMessageStore deserialization allowlist protection in Spring Integration silently fails when the store is configured as a Spring-managed bean, rendering the security control entirely ineffective. Operators who call addAllowedPatterns() to restrict which Java classes can be deserialized from the JDBC message store receive no actual protection - any class remains deserializable despite the configured allowlist - leaving applications exposed to unsafe Java deserialization attacks while operators believe they have hardened the component. Affected across Spring Integration 6.4.x through 7.1.0; no public exploit identified at time of analysis.
Improper access control on the Synergis Softwire installation folder exposes sensitive files to any low-privileged local user on Windows Server deployments and Genetec Streamvault SV-100E and SV-300E all-in-one appliances. The CVSS scope change (S:C) is particularly consequential in this context: Synergis Softwire is a physical access control server, meaning credentials or configuration material extracted from the installation directory could allow an attacker to manipulate physical security decisions or pivot into backend systems. No public exploit has been identified at time of analysis, and Genetec has released remediated versions in the 12.0.2 and 12.2.0 branches.
Heap-based buffer overflow in Adobe Substance 3D Sampler versions 5.1.3 and earlier enables arbitrary code execution at the privilege level of the current user when a crafted file is opened. The vulnerability stems from improper bounds checking during file parsing (CWE-122), allowing a heap memory region to be overwritten with attacker-controlled data. No public exploit code has been identified at time of analysis and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, but the file-based delivery vector makes it well-suited to phishing or watering-hole campaigns targeting 3D content creators.
Local privilege escalation in Wibu-Systems CodeMeter Runtime allows a low-privileged local attacker to delete arbitrary files with SYSTEM privileges via an NTFS junction attack, potentially cascading to full system compromise. The cmu.exe utility creates predictable temporary files under C:\CM-Stick without validating NTFS reparse points before performing file operations; because the CodeMeter Runtime service runs as SYSTEM, any redirected file operation executes at the highest privilege level. A detailed public research writeup is available from shelltrail.com, substantially lowering the exploitation barrier; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Session handle confidentiality in Wibu-Systems CodeMeter Runtime is undermined when the software operates in server mode: versions before 8.41a and 9.10 assign cryptographically weak Session IDs (SIDs) as the sole per-connection authenticator, enabling an attacker with a low-privilege connection to brute-force SID values belonging to concurrent sessions. Successfully guessing a valid SID allows the attacker to recover another client's handle number and read the license information associated with that handle, constituting unauthorized cross-tenant license data disclosure. No public exploit has been identified at time of analysis, but the low attack complexity and network accessibility make this a realistic threat wherever CodeMeter is deployed in server mode.
Grafana Alloy's prometheus.operator.servicemonitors component exposes an arbitrary local file read path that leads to credential theft and potential Kubernetes privilege escalation. Any Kubernetes user with ServiceMonitor create or modify rights in a namespace watched by Alloy can point the bearerTokenFile field at any file accessible to the Alloy process - most critically Alloy's own projected Kubernetes service account token - and receive that file's contents exfiltrated via HTTP Bearer token to an attacker-controlled scrape endpoint. The CVSS 7.7 Scope:Changed rating correctly reflects that successful exploitation transcends the compromised namespace, potentially granting the attacker cluster-level API access commensurate with Alloy's own RBAC permissions. No public exploit has been identified at time of analysis.
Arbitrary file read in the Workeera WordPress plugin (before 1.0.6) allows authenticated users with subscriber-level access to exfiltrate sensitive server files, including wp-config.php and authentication secrets. The plugin's candidate profile submission endpoint neither validates which fields a subscriber may populate nor confines file-serving operations to an approved directory, creating a path-traversal-adjacent disclosure path. No active exploitation has been identified (SSVC exploitation: none; EPSS 0.17%), but successful exploitation can fully compromise WordPress credentials and database connection strings, making the effective risk substantially higher than the low EPSS suggests for sites with open subscriber registration.
CVE-2026-19499 has been reported by Ubuntu but contains no available description, CVSS score, vector, or CWE data at time of analysis. The vulnerability's nature, affected component, and impact are entirely unknown from the provided intelligence. No meaningful characterization of this CVE is possible without additional data from the vendor advisory or NVD.
Unrestricted property key injection via Spring Cloud Commons' writable /actuator/env endpoint allows authenticated administrators to POST arbitrary environment properties with no allow-list enforcement, affecting all currently maintained release lines (3.1.10 and earlier through 5.0.2). With CVSS PR:H and a scope change (S:C), exploitation requires admin-level access to the actuator endpoint but can cascade integrity impacts across the entire Spring application context. No public exploit has been identified at time of analysis, and exploitation is gated on a non-default configuration requiring deliberate enablement of write access to the actuator endpoint.
DNS rebinding in mcp-go before 0.56.0 allows a malicious webpage to bypass localhost isolation and invoke tools or read resources on a victim's locally-running MCP server. Both StreamableHTTPServer and SSEServer accepted loopback connections without validating the Host header, and the SSE transport's permissive default CORS policy removed an additional browser-level barrier. No public exploit has been identified and no CISA KEV listing exists, but the attack is practical for any developer running an affected server while browsing the web.
DNS rebinding in Timescale's tiger-gh-mcp-server allows an attacker-controlled web page to drive the victim's locally-bound GitHub MCP HTTP endpoint by exploiting the server's failure to validate Host headers. The src/httpServer.ts file called the shared httpServerFactory helper without passing the SDK's host allow-list option, meaning the server accepted any Host value - a prerequisite for classic DNS rebinding. An attacker who lures a developer running the server in HTTP mode to visit a malicious page can then invoke arbitrary GitHub MCP tools under the victim's authenticated session, including reading private repositories or issuing write operations. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
DNS rebinding against pg-aiguide's MCP HTTP transport (versions through 0.5.0) allows a remote unauthenticated attacker to access and control the locally-bound MCP server by exploiting the disabled host header allow-list in src/httpServer.ts. The underlying MCP SDK already provided DNS rebinding protection via a host allow-list option, but pg-aiguide's httpServerFactory call never enabled it, meaning every inbound Host header was accepted regardless of origin. No public exploit identified at time of analysis, though DNS rebinding is a well-documented attack class with readily available tooling.
Heap buffer overflow in rsyslog's RainerScript `replace()` function allows unauthenticated remote attackers to crash affected systems by sending crafted syslog messages. The root cause is an incorrect buffer size calculation (CWE-131) during string replacement, leading to heap memory corruption and reliable denial of service. This affects rsyslog as shipped across Red Hat Enterprise Linux versions 6 through 10; no public exploit or CISA KEV confirmation exists at time of analysis.
DNS rebinding in tiger-slack's MCP HTTP transport exposes the locally running Slack MCP server to attacker-controlled browser requests. The root cause is that `mcp/src/httpServer.ts` invoked `httpServerFactory` without enabling the SDK's host allow-list option, leaving the server willing to honor any Host header value and making it trivially reachable via a DNS rebinding attack. Exploitation requires user interaction and a locally running tiger-slack instance; no public exploit code and no CISA KEV listing exist at time of analysis.
Unbounded memory exhaustion in Ruby's resolv gem (before 0.7.2) allows an attacker controlling DNS responses to permanently grow a target process's memory without limit, eventually crashing the service. The root cause is that Resolv::DNS::Resource.get_class and related methods register a new Ruby class as a constant for each unknown DNS resource record type/class pair encountered, preventing garbage collection for the lifetime of the process. Because resolv is a default Ruby gem requiring no installation step, any plain Ruby installation performing DNS resolution - web services, workers, CLI tools - is exposed without opt-in configuration, and no public exploit has been identified at time of analysis.
CodeMeter Runtime in server mode crashes when processing crafted network requests using opcode 0x5e with a malformed data length field, allowing remote unauthenticated attackers to trigger an out-of-bounds read and segmentation fault. Wibu-Systems versions before 8.41a and 9.10 are confirmed affected. The impact is a full service crash, denying access to any software whose licensing depends on the CodeMeter Runtime server - no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to exhaust server memory by sending specially crafted compressed WebSocket messages. The root cause is exponential buffer doubling in the PerMessageDeflateFunction.largerBuffer() method (CWE-770), which triggers unbounded memory allocation with no confirmation of active exploitation at time of analysis. Affected deployments span a broad Red Hat ecosystem including JBoss EAP 7/8, Red Hat Data Grid 8, Apache Camel for Spring Boot 4, and RHEL 8/9/10 packages that bundle Undertow.
Unauthenticated sensitive data exposure in the SureFeedback Client Site WordPress plugin (≤1.2.12) permits remote attackers to retrieve subscriber-level confidential data without any credentials. The root cause is CWE-862 (Missing Authorization), meaning the plugin exposes data endpoints that fail to enforce access control checks before returning sensitive subscriber information. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the CVSS:3.1 score of 7.5 with PR:N and AV:N reflects that the attack surface is fully accessible to unauthenticated internet-facing requests.
Denial of service in free5gc v4.1.0's CreateUEContext handler allows unauthenticated remote attackers to crash or exhaust the 5G core network service by sending crafted UE context creation requests. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) - the handler performs no rate limiting or resource bounding when processing incoming context requests. No active exploitation is confirmed (not in CISA KEV), though SSVC flags the attack as automatable, meaning a single host could sustain a disruptive flood without manual repetition.
Denial of Service in Open5GS v2.7.6 targets the NUDM-UECM (Network Unified Data Management - UE Context Management) interface, where a crafted HTTP DELETE request triggers a reachable assertion failure that crashes the UDM process. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and SSVC 'Automatable: yes' rating indicate this is trivially scriptable over the network. No active exploitation or public proof-of-concept code has been identified at time of analysis.
Denial-of-service in free5gc v4.0.1 allows remote unauthenticated attackers to crash the 5G core network's AMF component by sending a specially crafted NAS PDU to the NGAP handler. The vulnerability stems from improper resource allocation (CWE-770) in the NGAP message processing path, which when triggered drops all active 5G sessions handled by that AMF instance. No public exploit code has been identified and CISA KEV confirms no active exploitation, but SSVC rates the attack as automatable, meaning it can be scripted without manual interaction.
Reachable assertion in Open5GS v2.7.6 SMF crashes the Session Management Function via a crafted DELETE request to the /nsmf-pdusession/v1/sm-contexts endpoint, enabling unauthenticated remote denial of service against the 5G core. Per CVSS PR:N, no authentication is required, though network access to the internal Service Based Interface (SBI) is a practical prerequisite in standard deployments. No active exploitation has been confirmed (not in CISA KEV), no public exploit code is known, and SSVC rates this as non-automatable with partial technical impact - suggesting real-world risk is lower than the 7.5 CVSS score implies.
Denial of service in free5GC v4.1.0 allows remote unauthenticated attackers to crash the Access and Mobility Management Function (AMF) by sending a crafted PATCH request to the event subscription endpoint processed by ModifyAMFEventSubscriptionProcedure in processor/event_exposure.go. The root cause is CWE-770 - uncontrolled resource allocation - meaning the handler does not bound consumption triggered by attacker-supplied input. SSVC classifies this as automatable, making scripted mass exploitation feasible, though no active exploitation or public proof-of-concept code is confirmed at time of analysis.
NULL pointer dereference in the AMF NGAP Dispatcher of free5GC v4.0.1 allows an unauthenticated remote attacker to crash the Access and Mobility Management Function by sending crafted NGAP messages during the initialization of a new RAN connection, resulting in complete availability loss for the 5G core control plane. The AMF is a central 5G core component responsible for registration and mobility management for all connected user equipment, so a successful crash severs control-plane service for all gNBs attached to that AMF instance. No public exploit code has been confirmed and no CISA KEV listing exists at time of analysis, though SSVC rates the attack as Automatable given the no-authentication, low-complexity network exposure.
Remote code execution via log path traversal in Flowintel 3.3.0 and later is achievable by an authenticated administrator who redirects the LOG_FILE configuration setting to an arbitrary filesystem path and injects server-side template syntax through attacker-controlled logged content. The upstream commit explicitly documents this multi-step exploitation chain - redirecting log output to a template file and triggering application rendering to execute injected code - making weaponization technically straightforward for any attacker holding admin credentials. No public exploit or CISA KEV listing is identified at time of analysis; upstream fix is available as a GitHub commit from the Flowintel maintainer CIRCL.
Path traversal in Spring Cloud Config Server's native environment repository allows unauthenticated remote attackers to read arbitrary files outside the configured search-locations directory on the server filesystem. Affected deployments span four release lines - 3.1.14 and earlier, 4.0.0-4.2.8, 4.3.0-4.3.4, and 5.0.0-5.0.4 - and are limited to the native filesystem backend mode. No public exploit code has been identified and CISA KEV does not list this vulnerability, though the centralized role of Config Server as a secrets store elevates real-world impact beyond the raw EPSS percentile.
Uncontrolled resource consumption in Spring Batch's FlatFileItemReader allows denial-of-service against batch jobs that process externally-supplied flat files containing multi-line records. When a specially crafted file is fed to the reader - exploiting its logic for assembling logical records spread across multiple physical lines (e.g., quoted CSV fields with embedded newlines) - the job stalls or exhausts memory, disrupting batch processing pipelines. Affected are all actively maintained Spring Batch branches: 4.3.0-4.3.13, 5.2.0-5.2.6, and 6.0.0-6.0.4. No public exploit or active exploitation has been identified at time of analysis.
Unauthenticated content exfiltration in Trilium up to 0.103.0 is possible through the public share-search endpoint, which applies authorization only to the ancestor note supplied in the request rather than to each result it returns. Any visitor with HTTP access to the instance can query `/share/api/notes` to enumerate titles, tree paths, and share identifiers of notes protected by `shareCredentials` passwords or hidden via `shareHiddenFromTree`, and can use the endpoint as a boolean substring oracle to iteratively reconstruct the full plaintext of password-gated notes. No public exploit has been identified at time of analysis, and the issue is patched in version 0.104.0.
Hardcoded Langfuse API credentials embedded in PentestGPT 1.0.0's core telemetry module expose all user session telemetry to unauthorized third parties. Any actor who reads the public GitHub repository can extract the literal API key pair from pentestgpt/core/langfuse.py:114 and authenticate directly to the Langfuse observability backend, gaining read access to pentest session traces that may contain targets, findings, and full AI prompt-response histories. No public exploit or CISA KEV listing exists, though the source reference functionally serves as exploit documentation; EPSS is 0.22% at the 12th percentile.
Price manipulation in the StoreGrowth WordPress plugin (versions before 2.1.2) enables unauthenticated attackers to add products to a WooCommerce cart at arbitrary, attacker-chosen prices that carry through to checkout totals - directly enabling financial fraud against affected merchants. The flaw exists across two unauthenticated AJAX actions that accept browser-supplied price values without any server-side validation, and is conditional on the BOGO (Buy One Get One) promotional feature being active. No public exploit code has been identified, and EPSS is low at 0.18% (8th percentile), though SSVC rates the attack as automatable - making mass scanning of vulnerable stores feasible.
Denial of Service in free5gc v4.0.1 allows unauthenticated remote attackers to crash the NSSF (Network Slice Selection Function) by sending a crafted POST request to the NssaiAvailabilitySubscriptionCreate endpoint. The affected component handles 5G network slice subscription lifecycle management, and resource exhaustion causes the NSSF to become unresponsive, disrupting slice selection for all connected 5G devices on that core instance. No active exploitation is confirmed (no CISA KEV listing) and EPSS is very low at 0.18% (8th percentile), indicating minimal real-world exploitation at time of analysis.
Remote unauthenticated denial-of-service in the NRF Discovery service of free5gc v4.0.1 can be triggered by sending crafted input to the complexQueryFilterSubprocess function, crashing the service without any authentication or user interaction. The NRF (Network Repository Function) is a critical 5G core component responsible for service discovery; its disruption can cascade to affect the entire 5G core network's ability to register and locate network functions. No public exploit has been identified and EPSS sits at 0.18% (8th percentile), suggesting low observed exploitation activity despite the high CVSS base score.
NULL pointer dereference in free5gc v4.0.1's CDR processing path enables unauthenticated remote attackers to crash the 5G core network service by sending a crafted payload, causing a complete denial of service against the affected network function. The CVSS 7.5 score reflects a straightforward, credential-free network attack path requiring no complexity; however, EPSS places real-world exploitation probability at 0.18% (8th percentile), indicating limited threat actor interest at time of analysis. No public exploit code and no CISA KEV listing have been identified.
Integer overflow in the open5gs 2.7.6 NRF (Network Repository Function) discovery endpoint enables remote unauthenticated denial of service. Sending a crafted HTTP/2 GET request to /nnrf-disc/v1/nf-instances triggers arithmetic overflow that crashes the NRF service, disrupting 5G network function discovery for all dependent core network components. No public exploit has been identified and EPSS at 0.18% (7th percentile) reflects low current exploitation interest, though the unauthenticated network vector lowers the bar for any attacker with access to the SBI interface.
Null pointer dereference in ccoap (commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5) allows remote unauthenticated attackers to crash the CoAP server by submitting requests that trigger a race condition between the session dispatch and cleanup threads. The impact is confined to availability - the server process crashes, producing a denial-of-service condition with no confidentiality or integrity consequences. No active exploitation is confirmed (not in CISA KEV), and an EPSS score of 0.17% (7th percentile) places this in the lowest tier of current exploitation likelihood.
Denial-of-service via segmentation fault in ccoap's option parsing logic allows unauthenticated remote attackers to crash any service built on the library by sending a single malformed CoAP message. The vulnerability exists at commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 of the ipflavors/ccoap C library, where the option parser does not adequately validate that sufficient data is present before accessing option fields, triggering an out-of-bounds write (CWE-787). No public exploit code or CISA KEV listing is present, and EPSS probability is very low at 0.17%, though the trivial trigger condition - a single malformed UDP packet - makes opportunistic scanning straightforward against any exposed CoAP endpoint.
Denial of service in ccoap's option parsing logic allows unauthenticated remote attackers to crash any service built on commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 by sending a single CoAP message carrying an invalid option number, triggering a segmentation fault. The impact is strictly availability - confidentiality and integrity are unaffected (CVSS C:N/I:N). No public exploit code and no CISA KEV listing have been identified; EPSS at 0.17% (7th percentile) reflects minimal current exploitation interest.
Integer overflow in Open5GS v2.7.6's Session Management Function (SMF) allows remote unauthenticated attackers to crash the service via a crafted GTP packet, causing Denial of Service against 5G core network infrastructure. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms zero-authentication network exploitation requiring no user interaction. Researcher-published proof-of-concept code exists in a public GitHub repository and gist, though no CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Spring for GraphQL's Spring Data pagination integration blindly forwards client-supplied Connection field arguments to the underlying repository without enforcing resource limits, enabling an unauthenticated remote attacker to exhaust JVM heap memory or impose sustained load on the backing datastore via crafted GraphQL pagination queries. Three release branches are affected: 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.2.0-1.3.9, as confirmed by EUVD-2026-67178 and the VMware/Spring security advisory. No public exploit has been identified and the EPSS probability is very low (0.16%, 5th percentile), though the unauthenticated, network-accessible attack path makes any openly exposed endpoint a viable denial-of-service target.
Null pointer dereference in ccoap's CoAP server (commit 77f55c4b) allows unauthenticated remote attackers to crash the server process by sending a crafted CoAP message. The vulnerability exists in coap_server_handle_session(), which calls strncmp() on a URI_PATH option's data pointer without first validating that the pointer is non-NULL, triggering a segmentation fault on receipt of a malformed packet. With CVSS A:H and no authentication required (PR:N/AC:L), this is a straightforward remote denial-of-service; no public exploit or KEV listing has been identified at time of analysis.
Null pointer dereference in ccoap's coap_dump_msg() function causes remote denial of service when processing CoAP messages that carry options with zero-length values. The flaw is pinned to commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 of the ipflavors/ccoap library. An unauthenticated remote attacker reachable by the CoAP service can crash any process that links this library by sending a single crafted packet. No public exploit has been identified at time of analysis, and EPSS is 0.15% (5th percentile), reflecting low real-world exploitation activity.
Heap-based buffer overflow in FFmpeg's libswscale library enables unauthenticated remote attackers to crash media-processing applications via a crafted input file. The vulnerable function ff_sws_alphablendaway, invoked during alpha channel compositing in git-master commit 722a217, mishandles attacker-controlled input and corrupts heap memory, producing a Denial of Service. No active exploitation is confirmed - EPSS stands at 0.15% (5th percentile) with no CISA KEV listing - indicating this is currently a crash risk rather than a weaponized threat.
Memory exhaustion in Spring Framework's RSocket server implementation allows unauthenticated remote attackers to crash or degrade affected applications by sending malformed SETUP frames that trigger unreclaimed heap allocations. All actively maintained Spring Framework branches are affected - 5.2.x through 7.0.x - with the condition that the application must explicitly expose an RSocket endpoint. No public exploit code has been identified at time of analysis, and CISA SSVC confirms no current exploitation activity, though the attack is classified as automatable.
Uncontrolled resource consumption in Spring Framework's SpEL evaluator allows unauthenticated remote attackers to trigger a Denial of Service by submitting expressions using the power operator (^) with BigDecimal or BigInteger operands and arbitrarily large exponents, causing unbounded CPU and memory exhaustion in the JVM. All maintained Spring Framework release lines from 5.2.x through 7.0.x are affected, covering a large portion of the enterprise Java ecosystem. No public exploit has been identified and exploitation probability is very low (EPSS 0.15%, 4th percentile), though SSVC flags the attack class as automatable.
Spring WebFlux's PartEventHttpMessageReader fails to enforce the configured maxPartSize limit when maxInMemorySize is explicitly set to -1, allowing remote unauthenticated attackers to upload multipart request parts of arbitrary size in violation of application-defined policy. Affected are Spring Framework 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. No public exploit code has been identified at time of analysis and EPSS is very low at 0.15% (4th percentile), but the SSVC automatable flag means scanning and exploitation can be automated at scale against exposed endpoints.
Denial of Service exposure in Spring Framework's data binding infrastructure allows unauthenticated remote attackers to exhaust application resources by submitting crafted property path expressions to any endpoint that binds user-supplied paths onto Java target objects. Affected versions span the entire actively maintained Spring Framework lineage - 5.2.x through 7.0.x - making the aggregate exposure footprint very large. No public exploit is referenced and EPSS sits at 0.15% (4th percentile), indicating low current exploitation activity despite the high CVSS score of 7.5.
Denial of service in free5gc v4.0.1's NAS decoder allows unauthenticated remote attackers to crash the AMF (Access and Mobility Management Function) by sending a crafted Registration Request message, disrupting 5G core network availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) confirms zero-prerequisite network exploitability - any host able to reach the N1 interface can trigger the fault. No public exploit or active exploitation has been identified at time of analysis; EPSS at 0.15% (4th percentile) reflects low observed exploitation probability, consistent with free5gc's predominantly research-oriented deployment footprint.
Integer overflow in FFmpeg's libswscale/utils.c component, present in development snapshot N-122528-gdd2976b9e1, allows unauthenticated remote attackers to crash any application relying on that component for image scaling by supplying a specially crafted image file. The CVSS 7.5 High rating reflects a network-reachable, zero-authentication denial-of-service path, but the EPSS score of 0.15% at the 4th percentile indicates negligible observed exploitation activity. No public exploit code and no CISA KEV listing are confirmed at time of analysis.