Unauthorized remote access to Dell Secure Connect Gateway (SCG) 5.0 is possible through a logic flaw rooted in CWE-480 (Use of Incorrect Operator), affecting both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00). The incorrect operator in a security-relevant conditional-likely an authentication or authorization check-produces a logic outcome that permits access without valid credentials, consistent with the CVSS PR:N vector and the 'Authentication Bypass' classification. Real-world impact spans limited confidentiality, integrity, and availability loss per the CVSS L/L/L impact ratings; no public exploit code or CISA KEV entry has been identified at time of analysis.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 exposes both Appliance and Application variants to protection mechanism bypass by unauthenticated remote attackers. The flaw (CWE-295) allows an adversary in a network-interception position to present an invalid or attacker-controlled TLS certificate that the SCG accepts without proper verification, potentially enabling interception or manipulation of communications between the gateway and backend or managed systems. Patch availability is confirmed via Dell advisory DSA-2026-382; no public exploit or CISA KEV listing is present at time of analysis.
Path traversal in the knowns MCP server's handleCodeReplace() function allows unauthenticated network attackers to overwrite arbitrary files outside the project root, including shell startup scripts (~/.bashrc, ~/.zshrc) and SSH configuration files (~/.ssh/authorized_keys). All knowns releases before v0.30.0 are affected; the root cause is the absence of path sanitization - the original code unconditionally joined caller-supplied paths onto the project root without verifying the resolved path remained within that boundary. No active exploitation confirmed in CISA KEV; no public exploit identified at time of analysis, though the GitHub security advisory and VulnCheck report provide sufficient technical detail for exploit construction.
Authorization bypass in knowns before v0.30.0 allows low-privileged users holding read-restricted sessions to escalate privileges by exploiting the permission guard's misclassification of code mutation operations as read-only. Specifically, the `code.replace`, `code.rename`, `code.insert`, and `code.delete` MCP handlers failed to enforce write-access checks, enabling a low-privilege session to overwrite `.knowns/` permission configuration files and elevate to administrative access on subsequent calls. No public exploit has been identified at the time of analysis; a vendor-confirmed patch is available as v0.30.0.
Stored cross-site scripting in the User Profile Builder WordPress plugin (Cozmoslabs, versions ≤3.15.7) permits unauthenticated attackers to inject persistent JavaScript payloads via the 'Biographical Info' registration field, which execute in any visitor's browser upon viewing the affected profile page. The vulnerability is rooted in missing input sanitization and output escaping in class-formbuilder.php and class-email-confirmation.php, enabling session hijacking, credential theft, or malicious redirects targeting administrators and other authenticated users. A patch is confirmed via WordPress.org SVN changeset 3511465; no public exploit code or active exploitation has been identified at time of analysis.
Tunneled EAP authentication in strongSwan before 6.1.0 can be bypassed when the IKEv2 responder fails to properly enforce inner EAP method authentication details, enabling a network attacker with a low-privilege outer-tunnel identity to obtain an authorized VPN session without completing the inner credential exchange. The flaw (CWE-863, Incorrect Authorization) is limited to deployments using tunneled EAP methods such as EAP-TTLS or EAP-PEAP; certificate-only or non-tunneled EAP configurations are not affected. Vendor-released patch strongSwan 6.1.0 is available; no public exploit identified at time of analysis.
Disk-exhaustion denial of service in MISP ≤2.5.45 is exploitable by any authenticated user, including read-only accounts, due to a wildcard ACL entry ('*') on the TemplatesController::uploadFile() endpoint. The handler writes uploaded content to app/tmp/files/ without verifying that the caller holds the perm_add or perm_template role, allowing repeated uploads to consume server disk space. The fix commit explicitly rules out escalation to RCE, stored XSS, or path traversal - impact is availability-only. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization in MISP versions 2.5.45 and earlier exposes cryptographic signing key material - including raw key data, key type, and fingerprint - to any authenticated user on the platform, regardless of whether they are permitted to view the associated parent event. The CryptographicKeysController::view() handler fetched CryptographicKey records directly by supplied ID without resolving or authorizing the parent event, enabling cross-event key exfiltration within shared MISP instances. No public exploit has been identified at time of analysis; a patch is available in upstream commit 2edde619b.
OS Command Injection (CWE-78) in Dell Secure Connect Gateway 5.0 permits low-privileged remote attackers to execute arbitrary operating system commands against both the Appliance and Application deployment variants. Affected versions are SCG 5.0 Appliance prior to 5.36.00.16 and SCG 5.0 Application prior to 5.36.00.00; Dell has released fixes under advisory DSA-2026-382. No public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in MISP ≤2.5.45 allows high-privileged users who configure threat intelligence feeds or TAXII discovery endpoints to cause MISP to make outbound HTTP requests to internal network resources and to exfiltrate configured feed authentication credentials to attacker-controlled hosts via unsanitized redirect following. A secondary incomplete SSRF defense in the TAXII discovery path failed to block IPv6 loopback (::1), hex-encoded addresses (0x7f000001), and multi-record DNS responses because it relied on gethostbyname() against a short literal blocklist. No public exploit code or active exploitation (CISA KEV) has been identified; patch commits are available upstream.
Unauthenticated remote denial-of-service in llama.cpp's RPC server allows a remote attacker to crash the server process by sending a crafted tensor descriptor with a manipulated `ne` (number-of-elements) argument to `rpc_server::deserialize_tensor`, triggering a reachable assertion (CWE-617) and aborting the process. Affected versions span llama.cpp up to 0.4.0 when the optional RPC server component is compiled and active. No patch has been released; the upstream GitHub issue was closed automatically due to inactivity, and no public exploit or CISA KEV listing exists at time of analysis.
IP address spoofing via X-Forwarded-For header manipulation in PrestaShop's Tools::getRemoteAddr() function allows unauthenticated remote attackers to impersonate arbitrary IP addresses when the application runs behind a reverse proxy, load balancer, or CDN. Affected versions include PrestaShop branches prior to 9.1.5 and prior to 8.2.8. Exploitation enables bypassing IP-based access controls such as maintenance mode allowlists, forging security and audit log entries, and evading third-party mechanisms like geolocation restrictions, fraud detection systems, and request throttling. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker to exploit a path-traversal flaw and execute code on the appliance. Both the Appliance edition (before 5.36.00.16) and the Application edition (before 5.36.00.00) of the SCG 5.0 virtual-edition telemetry/remote-support gateway are affected. There is no public exploit identified at time of analysis; EPSS estimates a modest 0.35% (28th percentile) exploitation probability and CISA's SSVC framework lists exploitation status as none.
Quadratic memory and output amplification in league/commonmark's XmlRenderer affects all 2.x releases from 2.0.0 through at least 2.8.x, enabling remote unauthenticated denial of service against PHP applications that convert untrusted Markdown to XML. The renderer emits depth-proportional indentation for every XML tag, causing O(n²) byte growth in both output size and memory allocation for deeply nested structures - reachable with as little as a single line of nested blockquotes. No public exploit has been identified at time of analysis, and exploitation is limited to applications using the opt-in XmlRenderer or MarkdownToXmlConverter code path.
Cross-site scripting in league/commonmark 2.7.0-2.9.0 allows unauthenticated attackers to inject arbitrary JavaScript into rendered HTML output by prefixing an attribute name with a U+000C form feed byte, bypassing the AttributesExtension's event-handler filter and the allow_unsafe_links safeguard. The bypass exploits a mismatch between what PHP's built-in trim() considers whitespace (excluding U+000C) and what PCRE \s matches (including U+000C), leaving the byte embedded in the attribute name where PHP's string comparison logic fails to recognize it but browsers' HTML parsers strip it and treat the remainder as a genuine event handler. Exploitation requires the AttributesExtension to be enabled and untrusted Markdown to be fed to the converter; no public exploit has been identified at time of analysis, though the GHSA advisory provides a precise technical breakdown sufficient to reproduce the issue.
Server-side request forgery in Knowns ≤0.33.0 enables unauthenticated remote attackers to make the server issue outbound HTTP requests to arbitrary caller-supplied destinations via the POST /api/embedding-models/test endpoint. The application leaks network reachability information through transport-layer error messages, allowing attackers to enumerate internal hosts, cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), and adjacent services. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score is 6.9 (Medium), reflecting real but bounded impact.
Cross-site scripting in Standard Notes for Android's Evernote (.enex) and Google Keep HTML note importers allows an attacker who socially engineers a victim into importing a crafted file to execute arbitrary JavaScript inside the app's WebView, stealing in-memory encryption keys and plaintext note data and invoking native Android device APIs. The impact is especially severe given Standard Notes' core value proposition is end-to-end encrypted note storage - key theft directly undermines that guarantee. Proof-of-concept exploit code exists per CVSS 4.0 E:P supplemental metric; no active exploitation (CISA KEV) identified at time of analysis.
Out-of-bounds read in the 92181 markdown C library's lds() function allows remote unauthenticated attackers to read memory beyond the intended buffer by supplying crafted markdown input. The flaw exists in md.c prior to commit c000d2f9cf390c315378d3717cf20911cf3e80a6, where the lds() function iterated over space characters without enforcing an end-of-buffer boundary. The CVSS 4.0 vector (6.9) reflects low confidentiality, integrity, and availability impact; no public exploit or CISA KEV listing exists at time of analysis.
Credential exfiltration in JetBrains YouTrack before 2026.2.18769 allows a project administrator to redirect stored mailbox credentials to an attacker-controlled server by modifying the mailbox host setting without triggering re-authentication. The missing re-authentication gate means any project admin who has been compromised, is malicious, or has temporarily elevated access can silently capture email account credentials (username and password) already stored in YouTrack. No public exploit has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Uncontrolled memory allocation in Eclipse Ankaios 0.1.0-1.0.1 allows a workload with granted Control Interface access to abort the agent process by declaring an arbitrarily large protobuf message length over the Control Interface FIFO, causing unbounded heap allocation and an OOM-triggered process crash. The impact is complete loss of orchestration services for all workloads managed by the affected agent instance. No public exploit has been identified and no active exploitation is confirmed; patch v1.0.2 is available.
Use-after-free (CWE-415/416) in the OpenVPN ovpn-dco-win Windows kernel Data Channel Offload driver versions 2.5.0 through 2.8.6 enables a local authenticated user to trigger a system crash by sending crafted control messages to the driver. Because the flaw resides in a kernel-mode driver, successful exploitation causes a full system crash (BSOD), affecting availability of the entire host. No public exploit code or active exploitation has been identified at time of analysis.
The nRF5340 SoC's on-the-fly QSPI flash decryption scheme for Execute-in-Place (XIP) contains a cryptographic architectural weakness that allows a physically-present attacker to undermine the confidentiality and integrity of externally stored encrypted firmware. Applications built on the nRF5340 that use external QSPI flash for encrypted XIP and rely on that encryption for firmware IP protection or tamper resistance are affected regardless of nRF Connect SDK version, as the root cause is in the SoC's hardware decryption block. No public exploit is identified at time of analysis; the weakness is intrinsic to the hardware architecture and cannot be fully resolved through a software-only patch.
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants, allowing an attacker who has already gained System-level privilege to escalate further to higher privilege tiers without any user interaction. The flaw is confirmed by MediaTek in their September 2026 Product Security Bulletin under Patch ID ALPS11134622 and Issue ID MSV-8894. No public exploit code or active exploitation is confirmed; SSVC designates this as non-automatable with no current exploitation activity.
Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to escalate further - potentially to root or kernel - via a stack-based out-of-bounds write caused by a missing bounds check. The vulnerability affects approximately 40 distinct MediaTek SoC models spanning multiple Android device generations. No public exploit has been identified at time of analysis, and SSVC assessment indicates exploitation is currently none, though technical impact is rated total given full C/I/A compromise post-exploitation.
Local privilege escalation in MediaTek's geniezone Trusted Execution Environment component affects 17 Android chipsets through a use-after-free memory corruption flaw. Exploitation requires an attacker who has already obtained System-level privilege on the device, allowing them to escalate further - potentially to kernel or TEE privilege - with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; the September 2026 MediaTek security bulletin addresses this with Patch ID ALPS10900510.
Memory corruption via use-after-free in the Android SurfaceFlinger graphics compositor, present on specific MediaTek chipsets (MT6881, MT6993, MT6858, MT8668), enables a local attacker who has already obtained System-level privilege to escalate to higher privileges - potentially root or kernel - without any user interaction. Reported by MediaTek in the September 2026 Security Bulletin under Patch ID ALPS11123860 and Issue ID MSV-8890. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none and automatable as no, consistent with the high-privilege prerequisite.
Privilege escalation in MediaTek's Power Hardware Abstraction Layer (Power HAL) allows an attacker who has already obtained System-level privilege on an Android device to further escalate to higher privilege through a type confusion vulnerability (CWE-843). The flaw spans a broad range of MediaTek chipsets - over 40 SoC variants - meaning it affects a wide swath of Android smartphones, tablets, and embedded devices. No public exploit has been identified and SSVC exploitation status is confirmed as 'none' at time of analysis, though the technical impact is rated 'total' by CISA's decision framework.
Local privilege escalation in the MediaTek Audio Hardware Abstraction Layer (HAL) allows an attacker who has already obtained System-level privilege to further escalate to higher privileges via a use-after-free condition (CWE-416). The vulnerability affects over 65 MediaTek chipset models spanning Android smartphones, tablets, IoT, and connected-device SoCs. No public exploit code or CISA KEV listing exists at time of analysis; however, the broad chipset surface across Android device families makes this relevant for any organization managing large Android fleets.
Privilege escalation via use-after-free in MediaTek's Android Audio Hardware Abstraction Layer (Audio HAL) affects over 65 distinct chipset families spanning mobile, tablet, and IoT SoCs. An attacker who has already obtained System-level privilege on a device running an affected MediaTek chipset can trigger the UAF condition to escalate further - gaining full control over confidentiality, integrity, and availability without any user interaction. No public exploit or active exploitation has been identified at time of analysis; the patch is available through MediaTek's September 2026 product security bulletin.
Local privilege escalation in MediaTek's Audio Hardware Abstraction Layer (HAL) on Android devices allows an attacker who already holds System-level privilege to further escalate access through improper input validation, achieving full confidentiality, integrity, and availability compromise of the affected device. The vulnerability spans 57 distinct MediaTek chipsets across the MT6xxx and MT8xxx families and is addressed in MediaTek's September 2026 security bulletin under Patch ID ALPS11087540 (Issue ID: MSV-8246). No public exploit code or active exploitation has been identified at time of analysis, and EPSS places exploitation probability at 0.13%.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 enable remote attackers to bypass authentication and access protected system functions. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are confirmed affected per Dell advisory DSA-2026-382. Exploitation exposes sensitive information with high confidentiality impact, and no active exploitation or public proof-of-concept has been identified at time of analysis.
Unauthenticated-read path exposure in the odh-dashboard component of Red Hat OpenShift AI allows any valid dashboard user to retrieve full Kubernetes Secret objects - including the cluster NVIDIA NGC API key (apiKeySecret) and NIM image pull secret (nimPullSecret) - via GET /api/nim-serving/:nimResource without an authorization check. The route uses the dashboard's elevated service account to proxy Kubernetes API calls, bypassing the admin-gating that protects the equivalent create and delete operations on the same NIM credentials. Affected organizations risk unauthorized access to NVIDIA NGC cloud services and private container registries under their accounts. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Insecure Direct Object Reference (IDOR) in JetBrains YouTrack before 2026.2.18634 allows authenticated low-privileged users to enumerate and read private issues and starred folder contents belonging to other users across organizational boundaries by manipulating user profile API identifiers. The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/C:H) reflects straightforward network exploitation requiring only a valid session. No public exploit or KEV listing is present, but the low attack complexity and high confidentiality impact make this a meaningful data-exposure risk in multi-tenant or multi-organization YouTrack deployments.
Insecure Direct Object Reference in JetBrains YouTrack before version 2026.2.18634 permits authenticated users to access other users' private saved searches through the watchRules and issueListConfig API endpoints. The endpoints fail to enforce authorization checks on user-controlled object identifiers, allowing horizontal privilege escalation without elevated permissions. No active exploitation or public proof-of-concept code has been identified at time of analysis.
Improper Authentication (CWE-287) in Dell Secure Connect Gateway (SCG) 5.0 enables a remote, low-privileged attacker to bypass protection mechanisms, potentially gaining access to sensitive telemetry or support data beyond their authorized scope. Both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are affected, as confirmed in Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible attack vector and low authentication bar make patching a clear priority.
Improper locking in Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application allows a low-privileged remote attacker to exploit a synchronization race condition, resulting in unauthorized filesystem access on the affected system. The vendor CVSS vector rates the primary impact as A:H (Availability), yet the description specifically references attacker filesystem access - a tension that suggests possible confidentiality or integrity impact beyond what the official score reflects. Dell has released fixed versions and published advisory DSA-2026-382; no public exploit or active CISA KEV listing exists at time of analysis.
Missing server-side permission checks in JetBrains YouTrack before 2026.2.18687 allow any authenticated user to create knowledge base articles inside projects they are not authorized to access. The flaw is rooted in CWE-862 (Missing Authorization), where the article-creation endpoint omits the necessary access control validation against the caller's project permissions. No public exploit or active exploitation has been identified; the CVSS PR:L metric confirms exploitation is limited to users who already hold a valid YouTrack account.
Improper authorization in JetBrains YouTrack before 2026.2.18634 allows authenticated read-only users to create and modify whiteboard cards, exceeding their intended permissions. The flaw (CWE-863) bypasses YouTrack's role-based access controls for the whiteboard feature, enabling low-privileged users to perform write operations they should be denied. No public exploit code or active exploitation has been identified, and a vendor-confirmed fix is available. EPSS data was not provided; real-world risk is moderate given the authentication prerequisite.
Insufficient permission checks on the app import endpoint in JetBrains YouTrack before version 2026.2.18634 allow an authenticated low-privileged user to overwrite bundled applications, achieving high-integrity impact across all unpatched deployments. The flaw is rooted in CWE-863 (Incorrect Authorization), meaning the server fails to validate that the requesting account holds sufficient privileges for a destructive write operation against pre-installed components. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Arbitrary shortcode execution in the Icegram Email Subscribers & Newsletters WordPress plugin (all versions through 5.9.27) allows unauthenticated network attackers to invoke registered WordPress shortcodes without authentication. The flaw originates in the plugin's email workflow and subscription handling code, which passes user-controlled input to `do_shortcode()` without adequate validation - enabling attackers to trigger any shortcode registered on the target site. Depending on the shortcodes available, impact ranges from information disclosure and content manipulation to potential code execution; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Powerkit WordPress plugin (all versions up to and including 3.0.4) allows authenticated Contributors to permanently embed malicious JavaScript into published pages via a flawed regex-based HTML attribute parser in the Lazy Load module's `content_process_images` function. Any site visitor who subsequently loads an injected page triggers script execution in their browser context, enabling session hijacking, credential theft, or malicious redirects. A fix is confirmed available via WordPress plugin Trac changeset 3604146; no active exploitation or public exploit code has been identified at time of analysis.
OAuth2 state-changing protocol endpoints in ash_authentication_oauth2_server (versions 0.1.0 through 0.3.0) are silently reachable under a second, unintended URL prefix (`/.well-known`) due to Phoenix's `forward` macro stripping the matched prefix before dispatch, leaving both `/oauth` and `/.well-known` mounts backed by the same ProtocolRouter route table. POST requests to `/register`, `/token`, and `/revoke` therefore answer under `/.well-known/register`, `/.well-known/token`, and `/.well-known/revoke`, bypassing any WAF rules, rate-limiting policies, or authentication exemptions scoped exclusively to the canonical `/oauth` prefix. No public exploit has been identified and the vulnerability is absent from CISA KEV; vendor patch version 0.3.1 is available.
Dynamic Client Registration (DCR) bypass in ash_authentication_oauth2_server versions 0.1.0 through 0.3.0 allows unauthenticated network attackers to register OAuth clients on servers that were configured to require an initial access token. The root cause is a fail-open pattern in resolve_secret/3: when a configured secret provider returned nil, false, or an empty string instead of a structured :error tuple, the function wrapped the value as {:ok, value} and passed it to the bearer-token comparison, causing that comparison to succeed against any request. No public exploit code has been identified, and the vendor has released a patched version (0.3.1).
WWW-Authenticate header parameter injection in ash_authentication_oauth2_server (versions 0.1.3 through 0.3.0) allows unauthenticated network attackers to smuggle arbitrary OAuth2 auth-params into Bearer challenge headers by supplying a tenant value containing a double-quote character. In multi-tenant Elixir/Phoenix applications that derive the Ash tenant from request-controlled data such as subdomains, Host headers, or path segments, an attacker can inject a second resource_metadata URL pointing to an attacker-controlled authorization server. Spec-compliant OAuth2 clients that follow the resource_metadata discovery URL will then contact the attacker's server instead of the legitimate one, enabling token theft or credential harvesting. No public exploit has been identified at time of analysis; a vendor-released patch is available at version 0.3.1.
SSRF in ash_authentication_oauth2_server 0.3.0 allows an attacker who controls both an OAuth2 client's metadata URL and the associated DNS resolution to route the server's outbound CIMD metadata fetches to loopback, link-local, or internal addresses. The `public_ip?/1` guard in `AshAuthentication.Oauth2Server.CIMD.ReqFetcher` failed to classify three IPv6 address families as private - IPv4-compatible ::/96 (e.g., ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10 - so a crafted DNS AAAA response in any of these ranges bypassed the policy. No public exploit has been identified at time of analysis; vendor patch released in version 0.3.1.
Multi-tenant OAuth2 metadata cross-tenant leakage in ash_authentication_oauth2_server (versions 0.1.3 through before 0.3.1) causes shared HTTP caches to serve one tenant's RFC 8414/RFC 9728 discovery metadata - including issuer, authorization_endpoint, token_endpoint, and jwks_uri - to another tenant's clients for up to one hour. The vulnerability arises because the Phoenix ProtocolRouter sent all metadata responses with Cache-Control: public, max-age=3600 and no Vary header; when tenant identity is derived from a request header or Host (not the URL), shared caches key on URL alone, making cross-tenant cache poisoning trivially repeatable. Downstream impact extends beyond disclosure: affected clients may direct authorization codes and client secrets to the wrong tenant's token endpoint and validate tokens against the wrong JWKS keys. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Memory exhaustion in ImageMagick's MSL image decoder affects versions before 7.1.2-30 (v7 branch) and 6.9.13-55 (v6 branch), enabling unauthenticated network attackers to degrade or crash image-processing services by submitting crafted MSL files that trigger unbounded heap allocation without deallocation. The root cause (CWE-400, Uncontrolled Resource Consumption) lies in the MSL decoder's failure to free allocated memory on certain code paths, allowing cumulative heap exhaustion across repeated requests. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 6.3 (Medium) reflects limited availability-only impact with elevated attack complexity.
Memory budget exhaustion in ImageMagick's OpenPixelCache allows remote unauthenticated attackers to cause a process-level denial of service by repeatedly triggering internal cache operation failures. Affected versions span both the 7.x branch (before 7.1.2-30) and the legacy 6.x branch (before 6.9.13-55), covering a large installed base of web services that process user-supplied images. The vulnerability stems from improper cleanup of memory accounting state on error paths, making the failure accumulative rather than self-correcting. No public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.4.2540.23 allows a local low-privileged user to gain elevated access via a path-traversal or symlink-following flaw during JAR archive extraction. The Endpoint Central service, which typically runs under a high-privileged system account, unsafely extracts attacker-influenced JAR contents, permitting file writes outside the intended extraction directory and into privileged locations. No public exploit has been identified at time of analysis, and a vendor patch is available.
Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.5.2600.15 permits a locally authenticated low-privilege user to gain elevated access by exploiting an outdated bundled third-party component (CWE-269). The CVSS scope change (S:C) indicates impacts extend beyond the vulnerable component itself, potentially reaching OS-level resources or other managed endpoints under the platform's control. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.