NULL pointer dereference in Samsung mTower's TEE kernel allows a Non-Secure caller to crash the secure world by supplying an invalid, zero, or stale session ID to the ioctl invoke path. The flaw exists in tee_ioctl_invoke() (entry_std.c) and tee_ta_invoke_command() (tee_ta_manager.c), where find_session() returns NULL without a guard before dereferencing sess->ctx, causing a secure-world fault. All mTower versions prior to commit afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a are affected; no public exploit has been identified at time of analysis.
Open redirect in the HPE Networking Fabric Composer web management interface allows unauthenticated remote attackers to craft URLs that transparently forward authenticated users to attacker-controlled destinations. The flaw targets network administrators who interact with the management console, creating a reliable phishing vector for credential harvesting against privileged accounts. No public exploit has been identified at time of analysis, and neither EPSS data nor KEV listing was provided, but the absence of authentication requirements and low attack complexity make opportunistic delivery of crafted links straightforward.
Use-after-free in Firefox's Audio/Video component exposes users running Firefox prior to version 155 and affected ESR branches to potential heap memory disclosure and limited data modification when processing attacker-controlled media. The vulnerability is network-reachable but requires user interaction - visiting a malicious or compromised page that triggers media playback - and carries a CVSS score of 5.4 reflecting bounded C:L/I:L impact with no availability loss. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation status as none and the vulnerability as non-automatable.
Use-after-free in Firefox's Audio/Video media pipeline allows unauthenticated remote attackers - requiring only user interaction - to read or modify limited browser memory content. Affected releases span Firefox stable prior to 155 and both ESR tracks prior to 140.15 and 153.2, covered by three separate Mozilla security advisories (MFSA2026-82, MFSA2026-84, MFSA2026-85). No public exploit code exists at time of analysis and SSVC exploitation status is 'none,' though the CWE-416 class carries inherent escalation risk beyond the partial impact Mozilla scored.
Use-after-free in Firefox's JavaScript garbage collector (GC) component exposes users to partial memory disclosure and corruption when visiting attacker-controlled web pages. Both the standard release line (Firefox 155) and the extended support release (Firefox ESR 153.2) are patched. No public exploit or active exploitation is confirmed; SSVC exploitation status is none and the vulnerability is absent from CISA KEV.
HPE Networking Fabric Composer's API authentication controls can be circumvented by an already-authenticated low-privilege operator, allowing that user to retain access even after administrative revocation. This is an access-persistence flaw rather than an initial-access bypass - a direct insider-threat concern in environments that rely on Fabric Composer's own revocation mechanisms for offboarding or role changes. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Use-after-free memory corruption in Firefox's DOM Core and HTML component allows a remote attacker to achieve limited confidentiality and integrity impact against users running unpatched Firefox versions by directing them to a crafted webpage. All Firefox releases prior to version 155, ESR 140.15, and ESR 153.2 are affected; Mozilla has shipped fixes across all three release channels. No public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in Firefox's DOM Core & HTML component allows network-reachable attackers to achieve limited memory disclosure and DOM integrity impact against users running Firefox below version 155 or Firefox ESR below 153.2. Exploitation requires user interaction - a victim must visit or be redirected to attacker-controlled content - but no authentication or elevated privileges are needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Mozilla has released patched versions addressing the flaw.
Authenticated privilege escalation in HPE Networking Fabric Composer's API allows low-privilege operator users to read limited information and make limited configuration changes beyond their authorized scope. The flaw affects all tracked versions per CPE data and requires only a valid low-privilege account to exploit - no special configuration or user interaction is needed. No public exploit code and no CISA KEV listing are present at time of analysis, keeping real-world risk moderate despite network accessibility.
Incorrect authorization in Kibana's Security Solution allows a low-privileged authenticated user to exceed their read-only role by enumerating and modifying Entity Store maintainer task states, silently disabling Entity Analytics upkeep for the affected space. The affected user requires only Security Solution read access-no write or admin privileges-yet can manipulate internal scheduling tasks that keep entity data current for threat detection. No public exploit has been identified and this is not in CISA KEV; the CVSS 5.4 (Medium) score reflects real-world scope: no data confidentiality impact, but integrity and availability of analytics maintenance are undermined.
Stored cross-site scripting in pulpcore's content serving layer allows authenticated users with file upload permissions to execute arbitrary JavaScript in the browsers of other users. When pulpcore uses local filesystem storage, uploaded files are served with their original MIME types (e.g., text/html, image/svg+xml) and without a Content-Disposition: attachment header, causing browsers to render the files inline within the host application's origin instead of prompting a download. This flaw affects Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, and Red Hat Update Infrastructure 4 and 5; no public exploit code or confirmed active exploitation is identified at time of analysis.
jackson-databind's NioPathDeserializer passes attacker-controlled URI strings from untrusted JSON through an unrestricted URI scheme resolution pipeline, allowing selection and invocation of arbitrary registered FileSystemProvider implementations at deserialization time. Affected versions span com.fasterxml.jackson.core:jackson-databind 2.8.0 through the pre-2.18.10/2.21.6/2.22.2 ranges and tools.jackson.core:jackson-databind 3.0.0 through the pre-3.1.6/3.2.2 ranges. With only JDK built-in providers present the immediate impact is a limited availability concern; with third-party FileSystemProviders such as S3 or HDFS adapters on the classpath, attackers can trigger side-effecting provider operations via crafted JSON fields. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV.
Authorization bypass in the Cozy Blocks WordPress plugin (all versions through 2.2.17) exposes WooCommerce product metadata intentionally hidden from the public - including names, prices, stock status, and image URLs of draft, pending, private, and catalog-hidden products - to unauthenticated visitors. The root cause is that multiple block renderers unconditionally emit a sidebarNonce into public page HTML regardless of visitor authentication state, allowing anyone to harvest a valid nonce and satisfy the AJAX handler's sole authorization check. No public exploit code or CISA KEV listing has been identified at time of analysis, though exploitation mechanics are trivially simple given that the credential is embedded in publicly readable HTML.
Heap-exhaustion denial-of-service in Hono web framework before 4.13.5 allows unauthenticated network attackers to crash the JavaScript server process by submitting form requests with deeply nested or numerous dot-separated field names when dot-notation parsing is explicitly enabled. The `parseBody()` function expands dot-separated keys into nested JavaScript objects without any bound on nesting depth or total intermediate object count, allowing a normal-sized request body to produce an object graph orders of magnitude larger and exhaust the runtime heap. Exploitation causes server process termination and service outage until manual restart; no public exploit is identified at time of analysis.
Denial-of-service conditions in HPE AOS-CX's command line interface allow a low-privileged authenticated user with network access to disrupt normal system operation. Part of the broader HPE advisory hpesbnw05134 addressing multiple AOS-CX vulnerabilities, this issue targets the CLI layer - accessible over SSH - but requires high attack complexity to successfully trigger. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed.
Unauthenticated file read in HPE Networking Fabric Composer's web-based management interface exposes a subset of system files to remote attackers without requiring any credentials. The vulnerability is confined to files within a specific affected directory rather than offering arbitrary filesystem access, yielding a limited confidentiality impact consistent with the CVSS 5.3 (C:L) score. No active exploitation (KEV) or public proof-of-concept has been identified at time of analysis, and no EPSS signal is provided in available intelligence.
Broken access control in Snipe-IT before v8.7.0 allows authenticated users holding only the `assets.edit` permission to restore soft-deleted assets via the bulk restore endpoint, directly reversing administrator deletions they are not authorized to undo. The `POST /hardware/bulkrestore` handler in `BulkAssetsController` incorrectly gated on `authorize('update', Asset::class)` rather than `authorize('delete', Asset::class)`, the check used by every other restore path in the codebase. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified, but the attack surface is any authenticated edit-permission holder in an affected deployment.
Authenticated SSRF in the Heym workflow engine before v0.0.98 allows any workflow author to reach internal network services by crafting WebSocket Send or WebSocket Trigger nodes with arbitrary target URLs - bypassing the egress guard that was implemented only for HTTP nodes. Attackers can exfiltrate responses from internal services (including cloud-metadata at 169.254.169.254) and transmit crafted payloads to internal WebSocket-capable services. No public exploit has been identified and this vulnerability is not listed in CISA KEV; a vendor-released patch is available as v0.0.98.
Stored cross-site scripting in LibreNMS before 26.5.0 allows an attacker who controls any SNMP-monitored network device to inject persistent JavaScript into the LibreNMS web interface via poisoned VRF-related SNMP fields. The injected payload executes in the browser of any LibreNMS user who views VRF display pages, enabling session hijacking, credential theft, or UI redressing. No public exploit has been identified at time of analysis, though the attack surface (SNMP-fed stored XSS with network-facing ingestion) is straightforwardly exploitable for anyone with access to a monitored device.
Unauthenticated access control bypass in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to manipulate the router's primary station list by sending a crafted MQTT message directly to the cs_broker component. The updatePriStaList function performs no authentication check before processing requests, enabling arbitrary refresh or overwrite of station associations. A proof-of-concept exists per SSVC assessment; the attack is automatable with no user interaction required.
Unauthenticated enumeration of internal PKI topology is possible in Red Hat Certificate System 9 through an unprotected REST endpoint. Any network-accessible client can issue GET /ca/rest/securityDomain/hosts and receive a structured inventory of all participating CA subsystem hosts, their roles, and security domain membership - without presenting credentials, a client certificate, or a session token. While the direct CVSS impact is rated medium (5.3), the real-world significance lies in enabling precise reconnaissance of internal PKI infrastructure that could facilitate targeted follow-on attacks against specific subsystems. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
SQL injection in zhongyu09 OpenChatBI allows authenticated remote attackers to manipulate queries processed by the incomplete `_validate_sql_safety` function within the text2sql pipeline. Versions 0.2.0 through 0.2.2 ship with zero SQL validation; version 0.3.0 introduced a bypassable validator, and v1.0.0b1/main retains the same incomplete logic with an optional - but non-default - stricter mode. The vendor did not respond to coordinated disclosure, leaving no official patch guidance; no public exploit code or CISA KEV listing has been identified at time of analysis.
Administrator account takeover in the Simple Membership plugin for WordPress (versions up to and including 4.8.0) is achievable by unauthenticated remote attackers targeting WordPress Multisite networks with public registration enabled. The plugin's registration flow binds new membership records to existing global WordPress users using only username and email matching - no password or ownership proof - and fails to detect Administrator roles on child sites, allowing attackers to subsequently overwrite the victim's global WordPress password via the profile-edit feature. No public exploit has been identified at time of analysis, but the attack mechanics are low-complexity and the CVSS score of 5.3 severely understates the actual Administrator-level impact.
Unauthenticated access control bypass in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to trigger the staticInfoSend function by sending a crafted MQTT message to the cs_broker component, causing the device to report its static configuration data to the configured master server. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated access control bypass in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the updateLanIp function to arbitrary invocation by any attacker who can reach the router's MQTT broker. By publishing a crafted MQTT message to the cs_broker component, a remote unauthenticated attacker can force the device to refresh its LAN address state, enabling network disruption without any credentials. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the zero-authentication requirement materially lowers the exploitation bar.
Cross-site scripting in Cypht webmail's contacts module (all versions before 2.12.2) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious FROM email header. The contacts module's sanitizer strips only the first occurrence of each angle bracket character, so embedding redundant brackets around a script payload bypasses the filter entirely. Exploitation requires two deliberate user actions - opening the crafted email and invoking the Add Local Contacts function - limiting opportunistic mass exploitation; no public exploit has been identified at time of analysis.
Stored cross-site scripting in WWBN AVideo's Live_schedule module allows a low-privileged attacker with streaming permission to persist unsanitized JavaScript via the setTitle() and setDescription() POST endpoints. The injected payload is served to any user - including unauthenticated visitors - who loads remindMe.php, giving the stored payload a wider execution surface than the injection privilege level implies. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects this split: low-privilege write, passive-interaction trigger, and limited per-browser impact.
HQL injection in Schneider Electric NetBotz 5 models 750 and 755 allows an authenticated attacker on the same adjacent network segment to inject malicious Hibernate Query Language statements through the appliance's web service interface or web UI, gaining limited unauthorized read and write access to the NetBotz database. The CVSS 4.0 score of 5.1 reflects a constrained attack surface - both network adjacency and a valid low-privilege account are prerequisites. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in the LearnPress WordPress LMS plugin (versions ≤ 4.4.4) allows authenticated administrators to extract arbitrary data from the WordPress database by injecting into the ORDER BY clause of the export_order_csv AJAX action. The flaw exists because the 'orderby' parameter is only partially normalized - only the literal strings 'date' and 'title' are whitelisted - and all other attacker-controlled values are concatenated directly into a raw SQL query inside DataBase::execute() without $wpdb->prepare() or an identifier allowlist. No public exploit has been identified at time of analysis, and the CVSS score of 4.9 (Medium) reflects the high privilege barrier as the primary risk limiter.
SQL injection in Photo Gallery by Ays - Responsive Image Gallery (all versions through 6.8.2) allows authenticated administrators to extract arbitrary data from the WordPress database by appending malicious SQL to the 's' search parameter. The vulnerability spans two distinct code paths in the plugin's category list table class - record_count() via $wpdb->get_var() and prepare_items()/get_image_categories() via $wpdb->get_results() - supporting both blind and UNION-based exfiltration techniques. No public exploit has been identified at time of analysis; the high privilege requirement significantly constrains realistic attack scenarios.
Denial of service in Elasticsearch allows an authenticated user with elevated cluster privileges to submit a specially crafted API request that causes unbounded memory consumption, potentially crashing the targeted node and disrupting cluster availability. The flaw is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) with CAPEC-130 attack pattern, and is confirmed by Elastic via advisory ESA-2026-47. No public exploit code or CISA KEV listing has been identified at time of analysis; the elevated-privilege requirement (PR:H) meaningfully constrains realistic attackers to insiders or compromised admin accounts.
Second-order SQL injection in the WP EasyCart (Shopping Cart & eCommerce Store) WordPress plugin through version 5.9.2 allows authenticated administrators to extract arbitrary data from the WordPress database. The attack is a two-stage operation: a malicious payload is first written to the ec_pageoption table via the ec_ajax_save_page_options handler without any sanitization, then on subsequent store page renders the value is retrieved and processed through stripslashes() - which strips WordPress's magic-quote escaping - before being concatenated directly into a live SQL query in ec_filter.php. No public exploit has been identified at time of analysis, and the PR:H requirement substantially constrains the realistic attacker population.
Stack overflow vulnerabilities in an HPE AOS-CX API endpoint allow an authenticated, high-privileged attacker to crash the affected system via a crafted request, resulting in a denial-of-service condition. The vulnerability is network-exploitable but requires prior administrative authentication, substantially limiting the attacker pool. This CVE is part of the same HPE advisory (hpesbnw05134) covering multiple AOS-CX weaknesses, including higher-severity unauthenticated and adjacent-network issues; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in LibreNMS 26.4.0 and below allows an authenticated administrator to inject arbitrary HTML/JavaScript into graph description configuration keys, which then execute in the browsers of every authenticated user who views the affected graph type. The vulnerable sink is `includes/html/pages/graphs.inc.php:194`, where `LibrenmsConfig::get()` output is echoed without `htmlspecialchars()`. A public proof-of-concept is documented in the GHSA advisory; no active exploitation is confirmed via CISA KEV. The vendor released a fix in version 26.7.0.
Path traversal in HPE Networking Fabric Composer's API endpoint allows an unauthenticated adjacent attacker to manipulate user-generated files and potentially alter critical system configurations. Exploitation is constrained by the AV:A vector (attacker must be on the same network segment), high attack complexity requiring preconditions outside the attacker's control, and mandatory user interaction - factors that collectively reduce the practical risk below the I:H integrity impact might suggest. No public exploit code has been identified and the vulnerability is not listed in CISA KEV. The CVSS base score of 4.8 reflects these limiting conditions accurately.
Exponential traversal denial-of-service in pypdf before 6.16.1 allows an attacker who can supply a crafted PDF to cause severe CPU stalls and memory exhaustion in any application invoking `PageObject._extract_text` or `PageObject.extract_xform_text`. The text extraction routines previously detected only direct cycles via a `known_ids` set, but failed to bound the total number of XForm invocations across a directed acyclic graph where each parent node reuses the same child XObject multiple times, producing O(2^n) traversal paths for n levels. No active exploitation or public exploit code has been identified; the fix is confirmed available in version 6.16.1.
Denial-of-service vulnerability in Rockwell Automation FactoryTalk® Historian Machine Edition allows a network-adjacent, high-privilege authenticated attacker to crash the device by sending crafted requests to its web interface, triggering a stack-based buffer overflow (CWE-121) that renders the historian unresponsive. All versions appear affected per the CPE wildcard, and the impact is limited to availability - no confidentiality or integrity compromise is possible. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Local information disclosure in HPE Networking Fabric Composer allows an authenticated low-privileged operator user with local system access to read sensitive OS-level data, potentially enabling privilege escalation on the affected host. The vulnerability resides in the underlying operating system layer exposed through Fabric Composer's operator access model, and is constrained by both a local attack vector and high complexity requirement. No public exploit code has been identified and this entry does not appear in the CISA KEV catalog.
Cleartext exposure of sensitive information in the HPE Networking Fabric Composer API allows a local attacker holding administrative credentials to retrieve secrets that the system is expected to protect in encrypted form. The vulnerability is constrained to local access with high privileges already obtained, yielding a CVSS 3.1 score of 4.4 (Medium). No public exploit code or active exploitation has been identified at time of analysis; the advisory originates from HPE itself, suggesting proactive disclosure rather than incident response.
Local privilege escalation in HPE Networking Fabric Composer enables an authenticated, highly privileged operator on the underlying host to elevate their role within the Fabric Composer management hierarchy, gaining access to higher-privileged administrative functions. The impact is bounded to integrity - specifically the ability to alter certain system configuration settings - with no confidentiality or availability consequence reported. No public exploit code and no CISA KEV listing exist at time of analysis, consistent with the low CVSS score of 4.4 and the stringent local, high-privilege prerequisite.
Incorrect boundary conditions in Firefox's CSS Grid layout engine expose limited browser process memory to remote attackers who deliver crafted web content. All Firefox versions prior to 155 are affected; exploitation requires a victim to visit or render attacker-controlled content, producing low-level confidentiality disclosure with no integrity or availability impact. Mozilla issued the fix in Firefox 155 via MFSA2026-82; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Incorrect Authorization (CWE-863) in Kibana's Entity Analytics module allows an authenticated low-privilege user to silently halt the Privilege Monitoring engine for an entire Kibana space. A user holding only read-level Security feature access - and no Elasticsearch privileges - can invoke the task-stop action, causing privileged user activity tracking to cease while the engine continues to falsely report a healthy operational state to administrators. No public exploit has been identified at time of analysis, but the deceptive healthy-status behavior creates a detection blind spot directly useful for insider threat operations or post-compromise privilege escalation concealment. Fixed in Kibana 9.4.6 and 9.5.2 per Elastic advisory ESA-2026-130.
Kibana's Entity Store feature permits a low-privilege authenticated Security user to invoke an administrative initialization operation that creates and persists Elasticsearch API keys without holding the elevated cluster and Kibana privileges the documented setup flow mandates. The root cause is CWE-862 Missing Authorization - the endpoint does not verify the caller meets the required permission tier before executing the privileged action. Elastic has released fixes in versions 8.19.21 and 9.4.6 per ESA-2026-155; no public exploit has been identified at time of analysis.
Kibana's missing server-side authorization check (CWE-862) allows any authenticated user holding only minimal Elasticsearch privileges to bypass Kibana feature authorization and Space access controls, reading Fleet deployment metadata from the default Kibana space without having been granted that permission. The flaw is rooted in an absent authorization gate on Fleet API paths rather than a misconfiguration, meaning the control is simply not enforced rather than configured incorrectly. Elastic has self-reported the issue and released fixes in versions 9.4.6 and 9.5.1 per advisory ESA-2026-149; no public exploit code or active exploitation (CISA KEV) has been identified.
Authenticated low-privilege information disclosure in HPE Networking Fabric Composer's API permits operator-level users to read system files outside their authorized scope. The CVSS 4.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a bounded, post-authentication flaw with limited confidentiality impact. No public exploit code exists and the vulnerability is not listed in CISA KEV, placing real-world risk at low priority absent privileged insider threat scenarios.
Information disclosure in Firefox for Android's WebExtensions component exposes sensitive browser or cross-origin data to remote attackers who can induce user interaction. Affecting all Firefox for Android versions prior to 155, the flaw is accessible over the network with low complexity but requires a user to interact with attacker-controlled content, gating mass exploitation. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Source address spoofing in HPE Networking Fabric Composer allows an authenticated low-privilege operator to forge the origin address recorded for their API requests, corrupting the audit trail for affected system actions. The attacker cannot read sensitive data or disrupt availability; the sole impact is integrity of attribution records, confirmed by the CVSS vector (C:N/I:L/A:N). No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.
Spoofing via origin validation failure in Firefox's DOM Core & HTML component allows a remote unauthenticated attacker to misrepresent content origin within the browser, achieving low-integrity impact against users of all Firefox versions before 155 and Firefox ESR before 153.2. The vulnerability class (CWE-346, Origin Validation Error) indicates the browser fails to correctly enforce the origin of DOM operations or HTML content, enabling cross-origin content spoofing. Multiple Mozilla Security Advisories (mfsa2026-82, -85, -86, -88) confirm the fix; EPSS of 0.14% (4th percentile) and absence from CISA KEV indicate no active exploitation at this time.
Crash of the gvfsd-mtp daemon in gvfs is achievable by anyone who can connect a malicious USB MTP device to a target Linux system. The do_read() function in gvfsbackendmtp.c accepts the byte-count reported by the device at face value and passes it uncapped to memcpy(), causing an out-of-bounds read that triggers a segmentation fault when the device deliberately over-reports its response length. The vulnerability affects gvfs as packaged across Red Hat Enterprise Linux 6 through 10; no public exploit has been identified and exploitation is constrained by physical proximity.
Uninitialized heap memory disclosure in gvfs's SFTP backend enables a malicious SFTP server to deterministically defeat ASLR on client systems running RHEL 6 through 10. When a user mounts a crafted SFTP share, the read_string() parser allocates a buffer for the FXP_HANDLE response but does not verify that the buffer is fully populated; the client subsequently echoes the uninitialized remainder - containing heap base pointers and the libgio load address - back to the attacker on every subsequent file-handle request. No public exploit has been identified at time of analysis, and the issue does not appear in CISA KEV, but the ASLR bypass it achieves is a high-value precursor for chained memory-corruption attacks against gvfsd-sftp.