Unauthenticated network attackers can elicit Java stack traces from Red Hat IdM's Dogtag CA REST enrollment endpoint (POST /ca/rest/certrequests) by submitting malformed requests, causing HTTP 500 responses that expose internal implementation details under CWE-209. The same error path simultaneously amplifies the CA debug log with large multi-line stack traces, creating a log-fill resource exhaustion vector that drives disk growth and I/O contention on affected RHEL 6 through 10 deployments. No public exploit has been identified at time of analysis, but the attack requires no authentication and low complexity, making it accessible to unskilled opportunistic attackers targeting IdM infrastructure.
Stored Cross-Site Scripting in the Live Composer - Free WordPress Website Builder plugin (all versions through 2.1.19) lets authenticated contributors inject persistent JavaScript payloads via the dslc_module_projects_output shortcode, with those payloads executing in the browser of every subsequent page visitor including site administrators. The root mechanism is WordPress's shortcode-aware kses processing, which serializes and preserves shortcode bodies as opaque placeholders before content filtering runs, allowing attacker-controlled attributes - view_all_link, main_heading_link_title, main_filter_title_all, and button_text - to reach multiple render-time output sinks in the plugin's projects module entirely unescaped. No public exploit has been identified at time of analysis, but the scope change to victim browsers creates a realistic session-hijacking path to full administrative takeover on multi-author sites.
Stored cross-site scripting in the Live Composer Free WordPress Website Builder plugin (all versions up to and including 2.1.19) allows authenticated attackers with contributor-level access to embed persistent JavaScript payloads via the dslc_module_testimonials_output shortcode. The vulnerability exploits a two-phase rendering gap: WordPress's native wp_kses_post filter sanitizes content at save time but treats shortcode markup as opaque, so attacker-controlled values in fields such as main_heading_title, view_all_link, main_heading_link_title, and main_filter_title_all are never escaped - they reach the DOM unfiltered when do_shortcode() executes at page-view time. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence confirmed the flaw through direct code-level review of the testimonials module.
Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (versions up to and including 2.1.51) allows authenticated attackers with author-level access to inject persistent malicious JavaScript via the unsanitized tagName attribute of the blocksy/dynamic-data Gutenberg block. Any visitor who loads a page containing the injected content will have the script execute in their browser context, enabling session theft, credential harvesting, or further site-level compromise. No active exploitation has been confirmed and a patched release (2.1.52) is available per the plugin Trac changeset; no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in WPBakery Page Builder for WordPress (versions through 8.7.4) allows authenticated attackers with subscriber-level access to persistently inject arbitrary JavaScript into pages viewed by any site visitor. The vulnerability stems from a sanitization bypass: the wp_kses_post function strips HTML tags but cannot neutralize base64-encoded payloads - which appear as plain alphanumeric text - and the vc_raw_html shortcode template subsequently decodes and echoes that content without escaping at render time. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the subscriber-level access barrier is low on many WordPress sites that permit open registration.
Execution-placement isolation bypass in Ansible Automation Platform's automation-controller (AWX) allows authenticated principals to route bulk jobs to instance groups they lack use-level authorization for. The Bulk Job Launch API endpoint (POST /api/v2/bulk/job_launch/) enforces only a read-level permission check on the instance_groups field, whereas the standard single-job launch path correctly requires use-level permission on the same field. A principal holding the built-in System Auditor role-or any role granting read but not use rights on instance groups-combined with execute permission on a job template can silently route automation workloads onto restricted infrastructure segments; no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in Live Composer Free WordPress Website Builder (versions ≤ 2.1.19) allows authenticated contributors to permanently embed arbitrary JavaScript into WordPress pages via the unsanitized 'custom_id' shortcode attribute. The payload is rendered verbatim into the HTML id="" attribute of div elements by dslc_modules_section_front() and dslc_modules_area_front() due to absent esc_attr() output escaping, then executes in the browser of every subsequent visitor - including administrators. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but sites permitting open contributor registration face realistic risk of admin session theft or persistent malicious redirects.
Server-side request forgery in the HPE AOS-CX web-based management interface allows an authenticated attacker with low-privilege credentials to force the switch to issue arbitrary internal HTTP requests, exposing the internal network topology and enabling limited modification of sensitive information. The vulnerability carries a Scope:Changed CVSS designation because the forged requests cross the trust boundary from the management plane into internal infrastructure the attacker cannot otherwise reach. This is the fifth CVE bundled in HPE advisory hpesbnw05134en_us alongside more severe issues including unauthenticated RCE (CVE-2026-73749, CVSS 9.8) and format-string RCE (CVE-2026-73782, CVSS 8.8). No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis.
Stored cross-site scripting in the BetterDocs WordPress plugin (versions through 4.8.1) allows contributor-level authenticated attackers to inject persistent JavaScript that executes in any visitor's browser context. The flaw exploits a two-stage processing gap: entity-encoded quotes in a heading id attribute pass WordPress's wp_kses_post sanitization at save time, but are later decoded by html_entity_decode() inside process_content_for_toc(), after which a lazy regex extracts the now-unescaped value and echoes it directly into the Table of Contents HTML output. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.11) allows authenticated contributors to inject persistent malicious scripts via the 'tag' shortcode attribute, executing in the browser of any user who subsequently visits the compromised page. The scope change (S:C in CVSS) reflects the cross-context impact: scripts run under victims' browser sessions, enabling session hijacking, credential harvesting, or unauthorized actions on behalf of administrators. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in the Live Composer WordPress page builder plugin (all versions through 2.1.19) allows authenticated contributors to inject persistent JavaScript payloads via the dslc_custom_field shortcode, executing in any visitor's browser session. Wordfence identified insufficient input sanitization and output escaping in shortcodes.php at multiple code paths (lines 84, 88, 89). No public exploit has been identified at time of analysis, but the vulnerable code is publicly browsable in the plugin's SVN repository and a remediation changeset has been published.
Stored Cross-Site Scripting in the User Profile Builder WordPress plugin (versions up to and including 4.0.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'date' shortcode attribute, executing in victims' browsers whenever they visit an affected page. The vulnerability stems from insufficient input sanitization and output escaping in the format-date shortcode handler (format-date.php), identified in the plugin Trac source at lines 7 and 16. No active exploitation has been confirmed at time of analysis, and a fix appears committed upstream per changeset 3666521 on the WordPress plugin repository.
Stored Cross-Site Scripting in WP Recipe Maker Premium for WordPress (all versions ≤ 10.5.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'wprm-call-to-action' shortcode's unsanitized attributes. Every subsequent visitor to an injected page executes the attacker's script in their browser, enabling session hijacking, credential harvesting, or privilege escalation to administrator. No public exploit code or CISA KEV listing has been identified at time of analysis.
CPU exhaustion in Erlang/OTP's eldap library allows a malicious or compromised LDAP server to degrade availability by returning referral URLs containing port components composed of up to ~1.26 million digits. The function `eldap:parse_port/2` passes the port substring unbounded to Erlang's `list_to_integer/1`, which performs arbitrary-precision bignum arithmetic - consuming hundreds of milliseconds of CPU time per crafted referral. Exposure is limited to applications that explicitly pass server-supplied LDAP referrals to `eldap:parse_ldap_url/1`, as eldap itself never calls this function; no public exploit or CISA KEV listing exists at time of analysis.
Algorithmic complexity denial-of-service in Erlang/OTP's SNMP library allows remote, unauthenticated attackers on SNMPv1/v2c deployments to exhaust CPU by sending a single crafted PDU containing a BER INTEGER whose length field is set arbitrarily large. The unbounded function `snmp_pdus:dec_integer_notag/1` performs recursive bignum accumulation across every declared byte before any PDU validation or community string enforcement occurs, so work grows superlinearly with the declared length value and a single UDP packet can lock the SNMP agent indefinitely. Affected OTP releases span 17.0 through the unpatched branches of 27.x, 28.x, and 29.x; no public exploit code or CISA KEV listing has been identified at time of analysis.
Constraint bypass in ash_typescript typed-controller routes allows remote attackers to submit argument values outside declared allowlists or bounds by exploiting a missing validation step in the Ash type pipeline. Affected versions 0.15.0 through 0.17.x call Ash.Type.cast_input/3 but never invoke Ash.Type.apply_constraints/3, leaving constraints such as one_of, max_length, min, max, and match silently unenforced at runtime. Where these constraints gate role membership, status transitions, or other security-relevant decisions in the route handler, the bypass enables privilege escalation or state-machine abuse; a vendor-released patch is available in 0.18.0. No public exploit identified at time of analysis.
CPU exhaustion in Erlang/OTP's `inets httpc` HTTP client allows a malicious or compromised HTTP server to degrade the availability of any OTP process making outbound HTTP calls by returning numeric headers - specifically Content-Length or Retry-After - containing strings of up to approximately 1.26 million digits. Erlang/OTP versions 17.0 through 29.x are affected across three release lines, covering inets 5.10 through 9.7.2. The attack costs the requesting process hundreds of milliseconds of arbitrary-precision arithmetic per response, and the existing `max_body_size` guard offers no protection because integer conversion occurs before the bound check; the option also defaults to `nolimit`. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Sensitive application data leaks from HTTP 500 responses in ash_typescript versions 0.15.0 through 0.17.x due to an ungated code path that serializes handler return values verbatim using Elixir's inspect/2. Any unauthenticated caller who can trigger a typed-controller route whose handler falls through with a non-conn term - such as {:error, %User{}} - receives the full Elixir struct inspection, potentially including hashed passwords, session tokens, and tenant identifiers, in the JSON error body. No public exploit identified at time of analysis, but the disclosure is trivially reproducible with a standard HTTP client given the right application-layer condition.
Sensitive internal error data - including runtime secrets potentially carried in Ash error vars fields - leaks to unauthenticated network clients in ash_typescript 0.8.0 through 0.17.x when a configured error handler raises a FunctionClauseError on an unmatched error shape. The rescue clause in apply_error_handler/3 was intended as a safety net but fell back to returning the original, unredacted error map rather than a safe generic response, inverting the intended suppress-on-failure semantics. No public exploit code has been identified and there is no CISA KEV listing; a patched release (0.18.0) is available from the Ash Project.
Authorization bypass in gRPC-Go's xDS RBAC HTTP filter prior to v1.83.1 allows network attackers to evade DENY policies when header matcher names use mixed case. Because gRPC metadata keys are always lowercased at the protocol layer, a DENY rule configured with canonical HTTP capitalization (e.g., `X-Role`, `User-Agent`) never fires, causing the policy to fail open and permit requests it should block. The same case mismatch also enables bypass of gRFC A41 pseudo-header validation (`:Scheme`, `Grpc-Status`) and prevents `Host` from being rewritten to `:authority`. No public exploit is identified at time of analysis; a vendor-confirmed fix ships in v1.83.1.
Cross-site scripting in SVGO's opt-in removeScripts plugin allows XSS payloads embedded inside SVG foreignObject elements to survive optimization unchanged. Applications that process attacker-supplied SVG through SVGO with this plugin enabled and then serve the output in a browser context are exposed: event-handler attributes, srcdoc iframe payloads, and executable URL schemes (javascript:, vbscript:, data:text/html) in action/data/formaction/href/src attributes all pass through unmodified. No public exploit is identified at time of analysis; fixed in SVGO 2.8.4, 3.3.5, and 4.1.0.
Stored XSS in the Apache Spark History Server (versions 3.0.0 through 3.5.7) allows a user with Spark job submission rights to inject unsanitized HTML/JavaScript into the History Server web UI via the application name field (spark.app.name), which executes in the browser of any higher-privileged user who subsequently views that job's history page. Apache rates this low severity due to layered prerequisites - the attacker must hold job submission rights and socially engineer an administrator into visiting the History Server. No public exploit has been identified at time of analysis; the vendor-released fix is Spark 3.5.8.
Stored XSS in the User Profile Builder WordPress plugin (all versions through 4.0.0) allows unauthenticated attackers to inject malicious JavaScript via the email parameter submitted during user registration. The payload persists in the unconfirmed email addresses database and executes in the browser of any administrator with manage_options capability who visits the Users > Unconfirmed Email Addresses list table and interacts with row-action links, because the row_actions() function renders the stored email value verbatim as a javascript: href. No public exploit has been identified at time of analysis, and an upstream fix is available via SVN changeset 3666521.
Reflected cross-site scripting in the HPE Networking Fabric Composer web management interface allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim administrator's browser by tricking them into following a crafted URL. The CVSS Scope:Changed metric confirms the injected script executes across the browser security boundary, enabling session token theft, credential harvesting, or unauthorized administrative actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis.
Clickjacking in Firefox's DOM Events component allows an unauthenticated remote attacker to redirect a victim's browser interactions from an overlaid or framed context, resulting in limited confidentiality and integrity impact across an origin boundary. All Firefox versions prior to 155 and Firefox ESR versions prior to 153.2 are affected, per multiple Mozilla security advisories (mfsa2026-82, mfsa2026-85, mfsa2026-86, mfsa2026-88). No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) reflects very low observed exploitation probability.
Cross-site scripting in Firefox's DOM Navigation component allows a remote unauthenticated attacker to inject and execute script content across security origins when a victim visits a specially crafted webpage. The vulnerability is classified CWE-79 with scope change (S:C), indicating potential cross-origin impact beyond the attacked page. Mozilla patched this in Firefox 155 and Firefox ESR 153.2, with coverage across multiple advisory tracks (mfsa2026-82, -85, -86, -88). No public exploit code or active exploitation has been identified at time of analysis.
Directory namespace isolation failure in Erlang/OTP's inets httpd mod_auth module allows an authenticated low-privilege user to bypass access controls on protected directories they were never granted access to. Servers using dets or mnesia persistence backends with multiple directory configuration blocks across OTP 17.x through 29.x are affected, with patched releases available for all three supported branches. No active exploitation has been confirmed and no public exploit code exists at time of analysis, but the horizontal privilege escalation within a running inets instance poses a meaningful risk to any deployment using per-directory access tiering.
Path traversal in Sage Employee Self Service's custom logo functionality exposes arbitrary server-side files to unauthenticated remote attackers. The flaw stems from insufficient sanitization of file path parameters, allowing directory traversal sequences and their URL-encoded equivalents to escape the application's intended filesystem scope and read sensitive data such as configuration files, environment settings, and logs. No public exploit or CISA KEV listing is present; Sage has remediated the issue via enhanced path validation shipped in the Q2 2026 HRMS product update.
Path traversal in Vitest's interceptorPlugin exposes local files on any development server with a network-accessible HMR WebSocket. The `vitest:interceptor:register` handler in `packages/mocker/src/node/interceptorPlugin.ts` accepts redirect mock registrations over Vite's unauthenticated HMR socket without calling `isFileLoadingAllowed()`, allowing a remote unauthenticated attacker who can reach the dev server to submit opaque-scheme URLs (e.g., `traversal:../../../etc/passwd`) whose `..` segments survive `URL.pathname` parsing and resolve outside the project root via `path.join()`. The plugin's `load` hook then returns `readFile(mock.redirect, 'utf-8')` as JavaScript module source, disclosing any file readable by the dev-server process. No public exploit or CISA KEV listing has been identified, but the GitHub fix PR includes a complete, working e2e test that serves as a functional PoC.
Cache poisoning and stored XSS in Hono (all versions before 4.13.5) stem from the framework's query helpers treating a literal `#?` sequence as a query string, creating a parser discrepancy between the application and every other layer - browsers, reverse proxies, WAFs, access logs, and validation middleware - that correctly ignores fragments. The Cache Middleware compounded this by stripping fragments when building cache keys, so a response shaped by fragment-injected parameters gets stored and served to subsequent users under a key that omits those parameters entirely. No public exploit code has been identified at time of analysis, and exploitation is gated by the requirement that the runtime and intermediary pass raw `#` characters through to the application.
Information disclosure in HPE AOS-CX exposes sensitive API endpoint data to a remote unauthenticated attacker who can achieve a man-in-the-middle position on the network path. Intercepted data could include credentials, session tokens, or configuration material usable to further compromise the affected switch or pivot into managed network infrastructure. This CVE is part of a broader HPE advisory (hpesbnw05134) covering at least four additional AOS-CX vulnerabilities; no public exploit code and no CISA KEV listing have been identified.
HTTP Request Smuggling in Elasticsearch allows a network attacker to intercept confidential HTTP responses intended for other authenticated users when Elasticsearch is deployed behind certain proxy configurations. The vulnerability (CWE-444, CAPEC-33) arises from inconsistent HTTP request boundary interpretation between the intermediary proxy and Elasticsearch, enabling response queue poisoning that leaks data across user sessions. Vendor-released patches 8.19.20, 9.4.5, and 9.5.1 are available per ESA-2026-141; no public exploit code or CISA KEV listing has been identified at time of analysis.
Persistent record-level denial of service in the ash Elixir resource framework (versions 3.6.3-3.32.1) lets any actor who can write a non-version-7 UUID into an Ash.Type.UUIDv7 attribute permanently break all subsequent reads of that database row. The root cause is a validation asymmetry introduced in v3.6.3: cast_input/2 was tightened to reject non-v7 16-byte binaries, but cast_stored/2 continued delegating to cast_input/2, so a stored non-v7 binary now returns :error on every read. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; vendor-released patch v3.32.2 is available.
Integer overflow in Ash Framework's vector encoding corrupts stored vectors in any Elixir application using Ash versions 2.14.13 through 3.32.1, enabling persistent denial of service against affected database records. The dimension count for a vector submitted with more than 65,535 elements silently wraps modulo 65,536 in a 16-bit header field, causing every subsequent read of the corrupted record to raise an exception. Applications that expose vector ingestion to untrusted users are at risk of permanent per-record data loss; no public exploit has been identified at time of analysis.
CPU exhaustion in Ash Framework's string type constraint handler allows denial of service against Elixir applications that use Ash string attribute validation with both length and regex match constraints. The `Ash.Type.String.apply_constraints/2` function evaluated the `:match` regex unconditionally, even when a length constraint had already failed, allowing attacker-controlled input of arbitrary size to reach the regex engine directly. Against backtracking patterns this produces catastrophic exponential evaluation time; against linear patterns, CPU cost scales with input size, enabling sustained per-request service degradation. No public exploit has been identified at time of analysis.
Memory exhaustion in Ash Framework's runtime filter engine allows an attacker controlling filter inputs to crash an Elixir node by submitting a query that spans multiple to-many relationships against large in-memory datasets. The vulnerable `flatten_relationships/2` function in `lib/ash/filter/runtime.ex` (versions 1.29.0-rc0 through 3.32.2) eagerly materializes the full Cartesian product of related rows before evaluating any predicate, producing O(M^K) intermediate records for K relationships with M rows each. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 3.32.2.
Silent record overwrite in Ash's ETS and Mnesia data layers allows any actor who can supply a primary key on a create action to replace an existing record without triggering update action authorization policies. Versions 0.4.0 through 3.32.1 are affected; only deployments using the ETS or Mnesia data layer - not SQL-backed layers - are vulnerable. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the integrity impact is high for applications that expose user-controlled primary key creation.
Record-level authorization bypass in Ash (ash-project) versions 3.4.44 through 3.32.1 silently leaks denied records to any actor when resources use access_type :runtime read policies. A logic error in Ash.Policy.Authorizer.check_result/1 causes the empty-scenario branch - reached when all policy paths for a record are impossible and the record must be forbidden - to instead keep and return the record as authorized. No public exploit has been identified at time of analysis; the vendor confirmed the issue and released a fix in version 3.32.2.
Incorrect authorization in ash-project/ash (Elixir data framework) versions 3.13.2 through 3.32.1 causes relationship scoping filters that reference parent() expressions to silently widen when the parent field cannot be resolved. The function resolve_parent_in_filter/3 defaulted the unresolvable expression to nil rather than failing, converting a guard such as org_id == parent(org_id) into an org_id IS NULL match, or activating the unrestricted branch of is_nil(parent(org_id)) or org_id == parent(org_id), thereby returning records the scope was designed to exclude. No public exploit has been identified at time of analysis; a vendor-released patch is available in ash 3.32.2.
Authorization policy bypass in Ash (Elixir framework) versions 3.29.0-3.32.1 permits any application actor to modify records protected by resource policies when using the atomic update path. The root cause is that `Ash.Actions.Update.UpdateMany` selected the atomic strategy under `authorize?: true` without invoking the authorization layer, causing the resulting SQL MERGE to update all primary-key-matched rows without applying policy filters. No public exploit code has been identified at time of analysis, but the published patch commit and GHSA advisory provide sufficient detail to reconstruct the bypass; the fix is vendor-confirmed in version 3.32.2.
Unauthenticated remote exploitation of the discoverWan function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes WAN configuration data through a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The CWE-284 (Improper Access Control) root cause means the CGI handler performs no authentication check before executing WAN discovery logic, returning configuration details to any network-reachable caller. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network exposure on consumer router hardware makes this a meaningful reconnaissance risk.
Unauthenticated firmware-flash triggering in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows network-accessible attackers to initiate a firmware re-flash cycle by sending crafted MQTT messages to the cs_broker component targeting the meshSlaveUpgfw handler, without any credentials. The root cause is a missing access-control check in the mesh slave upgrade function, enabling any caller on the MQTT network segment to invoke privileged firmware operations. No public exploit code has been identified and CISA SSVC rates exploitation as none with no current KEV listing, but the unauthenticated network vector represents a meaningful operational risk.
Unauthenticated integrity manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to overwrite the master device's stored slave inventory records by sending crafted MQTT messages to the cs_broker component. The sendStaticInfoToMaster function performs no authentication or authorization check before processing incoming updates, exposing the internal device-management protocol to arbitrary writes. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in LibreNMS through 26.2.0 enables attackers to inject persistent malicious JavaScript via SNMP-sourced data fields - including BGP peer descriptions, VRF names, process data, and SLA tags - that execute in the context of authenticated administrators browsing legacy PHP routing and device pages. The dual attack path (device management access within LibreNMS, or network-level enrollment of a rogue SNMP device) means exploitation is not strictly confined to privileged insider accounts. Successful exploitation yields session credential theft and CSRF token exfiltration, giving the attacker effective administrative control over the monitoring platform. No public exploit has been identified at time of analysis.
Privilege escalation in HPE AOS-CX's API endpoint allows an authenticated low-privilege operator to access sensitive system information that should be restricted to higher-privilege roles, provided a required user action is completed. The CVSS vector (PR:L/UI:R/C:H/I:N/A:N) confirms this manifests as an information disclosure escalation rather than full privilege takeover - a low-privilege operator reads confidential data normally gated behind elevated roles. This CVE is part of the same HPE advisory (hpesbnw05134) as CVE-2026-73749 (unauthenticated RCE, CVSS 9.8), CVE-2026-73766 (admin command injection, CVSS 7.2), CVE-2026-73778 (default-credential auth bypass, CVSS 8.1), and CVE-2026-73782 (adjacent format-string RCE, CVSS 8.8); no public exploit has been identified at time of analysis.
Incomplete denylist in jackson-databind's DefaultBaseTypeLimitingValidator allows attacker-controlled object instantiation when an application annotates a field or class with @JsonTypeInfo using java.lang.Comparable as the declared base type and no custom PolymorphicTypeValidator is registered. Because Comparable is implemented by an enormous fraction of JDK classes, an attacker supplying crafted JSON can force the deserializer to instantiate essentially any Comparable-implementing class, with java.io.File construction for an arbitrary path demonstrated as the primary primitive. No public exploit achieving code execution has been identified, no CISA KEV entry exists, and the vulnerability is not confirmed as actively exploited.
Local information disclosure in HPE Networking Fabric Composer exposes sensitive operating-system-level data to authenticated low-privilege operator users with local system access. The CVSS Scope:Changed metric reflects that the leaked data crosses from the Fabric Composer application boundary into the underlying host OS, and HPE warns the recovered information could enable further unauthorized access to the affected system and interconnected infrastructure. No public exploit is identified at time of analysis; exploitation requires both a valid low-privilege credential and local system access, materially constraining the realistic threat population.
Improper privilege management in Cleo Harmony's JWT Refresh Token Handler allows remote unauthenticated attackers to manipulate the Bearer argument on the /api/connections API endpoint, resulting in unauthorized access to connection data and potential privilege escalation. Affected versions span all releases up to and including 5.8.1.10, with a public exploit already available (E:P per CVSS 4.0 supplemental). No active exploitation confirmed in CISA KEV, but the combination of network accessibility, zero-privilege requirement, and public proof-of-concept materially elevates real-world risk.
Pointer validation routines were systematically commented out across multiple TEE syscall handlers in Samsung's mTower open-source TEE implementation, leaving Trusted Application-supplied pointer arguments entirely unvalidated before dereference in the secure world. All mTower deployments on ARMv8-M hardware prior to commit 102d3dc75cf8e58e68e4bea54ae3c803992c91be are exposed to a denial-of-service condition whereby a malicious or buggy Trusted Application can crash the TEE by supplying address-space-wrapping pointer ranges to service calls in tee_svc.c and tee_svc_cryp.c. No public exploit has been identified at time of analysis and no CISA KEV listing exists.
Untrusted pointer dereference in Samsung mTower's Secure world entry point allows a Non-Secure world caller to supply pointer values referencing Secure RAM, causing the TEE kernel to dereference those addresses on behalf of the attacker and potentially exposing or corrupting cryptographic material and other Secure world state. All mTower deployments before commit 06994e303637512e39062f3e037c222e8448e57e on ARM Cortex-M TrustZone hardware are affected, spanning both the session-open and invoke-command paths. No public exploit code has been identified and the vulnerability is absent from CISA KEV; however, the security boundary violated - Normal World to Secure World - represents a fundamental TrustZone integrity failure with real confidentiality and integrity consequences that the provided CVSS score significantly understates.