Remote denial-of-service in MediaTek Modem firmware affects 19 chipset variants spanning the MT6xxx and MT8xxx families - when a device embedding an affected chipset connects to an attacker-controlled rogue base station, a missing bounds check (CWE-617: Reachable Assertion) in the modem subsystem triggers a system crash, causing loss of connectivity. The CVSS score of 5.3 (AV:A/AC:H) reflects the elevated operational complexity of deploying rogue cellular infrastructure to exploit this flaw. No public exploit has been identified at time of analysis, and no CISA KEV listing exists.
Remote denial of service against MediaTek modem firmware affects 57+ chipset variants spanning the MT6xxx and MT8xxx series when a user equipment (UE) connects to an attacker-controlled rogue base station, triggering a missing bounds check (CWE-617 reachable assertion) that crashes the modem subsystem. The attack requires no privileges or user interaction on the victim device, though the adjacent network vector (AV:A/AC:H) demands the attacker operate specialized RF equipment in physical proximity. No public exploit code has been identified, CISA KEV is not listed, and SSVC rates exploitation as none and automatable as no - consistent with a moderate real-world risk despite the broad chipset deployment footprint.
Symlink-following race condition in GLib2's g_file_replace() allows a local attacker with write access to the destination directory to redirect privileged file writes to arbitrary files. When the G_FILE_CREATE_REPLACE_DESTINATION flag is set and creation of the .goutputstream-XXXXXX temporary file fails, GLib2 unlinks the destination and then recreates it without O_EXCL (exclusive creation) or symlink-safe open semantics, opening a TOCTOU race window. An attacker who wins this race by placing a symlink at the destination path can cause any process using this code path - potentially running with elevated privileges - to overwrite files the attacker cannot directly modify. No public exploit has been identified at time of analysis.
Insecure Direct Object Reference in Otter Blocks (WordPress plugin by Themeisle) through version 3.1.7 enables unauthenticated attackers to decouple the `product_id` and `price_id` parameters in a Stripe checkout URL, paying the price of a cheaper product while the `watch_checkout` function grants entitlement for the premium product whose ID was substituted. The flaw is exploitable against any WordPress site running the plugin with a Stripe checkout block configured. No public exploit has been identified at time of analysis, and a patch commit (changeset 3496611) has been applied to the plugin repository.
Open redirect in MISP ≤2.5.45 allows authenticated users to store a protocol-relative URL (e.g., //attacker.example) as a custom homepage setting, bypassing a path validation check that only required a leading /. On login, the post-login routing logic in UsersController and NewsController emits the stored value verbatim to the browser's Location header, redirecting victims to attacker-controlled external origins. No public exploit or active exploitation (CISA KEV) is identified; a vendor patch is confirmed in commit bd454f65a.
Stored XSS in MISP's dashboard Button widget (≤2.5.45) allows an authenticated low-privilege user to embed javascript: URLs or WHATWG-normalized backslash authority forms into widget configuration, which execute in the browser of any analyst who subsequently interacts with that widget. The root cause is a parser differential between PHP's URL handling and the WHATWG URL Standard implemented by browsers: forms such as \\evil.com or /\evil.com appear relative or host-matching under PHP's parse_url() but resolve to an off-origin authority in modern browsers. The upstream fix, confirmed via commit adf704e94 authored by the MISP maintainers at CIRCL, introduces a shared DashboardURLValidator that explicitly rejects raw backslashes, javascript: and other dangerous schemes, control characters, and unauthorized absolute origins. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 allows a low-privileged local user to escalate privileges by planting a malicious DLL in an untrusted path from which the application loads libraries. The flaw (CWE-269, Improper Privilege Management) requires local access, user interaction, and high attack complexity to exploit, and carries a scope change indicating impact beyond the vulnerable component itself. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch version 11.5.2605.01 is confirmed.
Heap-use-after-free in ImageMagick's PerlMagick Layer method allows an attacker supplying a crafted list of images to trigger memory access after deallocation, causing a crash. Affected versions include ImageMagick before 7.1.2-30 and the 6.9.x branch before 6.9.13-55. Impact is limited to denial of service (crash); no confidentiality or integrity compromise is possible from this flaw. No public exploit code or active exploitation has been identified at time of analysis.
Heap-use-after-free in ImageMagick's PerlMagick Perl binding crashes the host process via a crafted call to the GetList method. Affected versions span the 6.9.x branch before 6.9.13-55 and the 7.x branch before 7.1.2-30. Impact is limited to denial of service (process crash); no confidentiality or integrity compromise has been demonstrated. No public exploit code or active exploitation is identified at time of analysis.
Certificate hostname validation bypass in Dell Secure Connect Gateway (SCG) 5.0 enables unauthenticated remote attackers positioned on the network path to perform man-in-the-middle attacks against TLS-protected communications. The flaw (CWE-297) means SCG accepts certificates whose hostname does not match the server being contacted, allowing an adversary to impersonate backend endpoints and intercept or manipulate encrypted traffic. No public exploit code has been identified, and the vulnerability has not been added to the CISA KEV catalog; however, the network-accessible attack vector and absence of required privileges make opportunistic interception feasible for network-adjacent adversaries.
Plaintext credential storage in Dell Secure Connect Gateway 5.0 exposes passwords to local low-privileged attackers, leading to information disclosure. Both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified; the CVSS score of 4.7 Medium reflects the local-only, high-complexity attack path.
Stored XSS in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privilege users to inject AngularJS template expressions through issue assignee name fields, which are then evaluated as client-side JavaScript in the browsers of any user who views the affected issue or project board. The attack persists server-side, meaning every subsequent viewer triggers execution without further attacker interaction. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Local information disclosure in MediaTek's Audio Hardware Abstraction Layer (HAL) exposes sensitive data to an attacker who has already escalated to System privilege on an affected Android device. Improper input validation (CWE-35 path-traversal class) in the audio subsystem allows a System-level process to read confidentiality-critical data it should not have access to, with no user interaction required. No public exploit code and no CISA KEV listing exist at time of analysis; SSVC assigns exploitation status 'none' and technical impact 'partial', positioning this as a post-compromise data-harvesting primitive rather than a primary attack vector.
Local information disclosure in MediaTek's GeniZone trusted execution environment component allows a System-privileged attacker to read out-of-bounds memory due to a missing bounds check (CWE-125), potentially leaking confidential data from the TEE. The flaw affects seventeen MediaTek chipsets documented in the September 2026 security bulletin, and patches are available under IDs ALPS10867524 and ALPS10876355. No public exploit code or active exploitation has been identified at time of analysis, and SSVC assessment rates exploitation status as none.
Local information disclosure in MediaTek's Audio Hardware Abstraction Layer affects 63 distinct chipsets, from MT6761 to MT8910, allowing a process already operating at Android System privilege to bypass an absent permission check and extract audio HAL data without authorization. Patch ID ALPS11087632 (Issue MSV-8244) addresses the missing authorization gate, and MediaTek published remediation through the September 2026 security bulletin. SSVC assessment confirms no known exploitation and non-automatable attack path; no public exploit code identified at time of analysis.
Signed URL reuse in JetBrains YouTrack before 2026.2.18634 permits authenticated users to access restricted project icons they are not authorized to view. The flaw arises because signed URLs generated for project icon assets are not properly scoped or invalidated, allowing the same URL to be reused beyond its intended access context. No public exploit code has been identified and the vendor has issued a patch, making this a low-urgency but straightforward authorization control deficiency in a widely used issue tracker.
Authenticated users in JetBrains YouTrack before 2026.1.14047 can enumerate all group names via predefined search fields, bypassing group visibility permissions enforced elsewhere in the product. The flaw (CWE-862 Missing Authorization) means the access-control check applied to group visibility was not consistently applied to the predefined search field code path, leaking organizational structure to any logged-in user. No active exploitation has been identified and no public exploit code exists; CVSS 4.3 reflects the limited confidentiality impact.
Missing authorization (CWE-862) in JetBrains YouTrack before 2026.2.18769 allows any low-privileged authenticated user to read the email addresses of Helpdesk authorized reporters, who are external contacts registered to submit issues. The flaw bypasses the intended access control on the Helpdesk reporter roster, exposing personally identifiable contact data to users who should have no visibility into it. No public exploit is identified at time of analysis, and the vulnerability has been patched by JetBrains in version 2026.2.18769.
CVE-2026-71223 is reported via Ubuntu's security channels, but no description, CVSS score, CWE classification, or affected product detail is available in the current dataset. The vulnerability cannot be characterized beyond its Ubuntu vendor attribution. Security teams should consult Ubuntu Security Notices (USN) or the Ubuntu CVE tracker directly for authoritative details before assessing exposure or priority.
Stack buffer underflow in polkit's read_cookie() function, introduced as a regression by the fix for CVE-2026-4897, exposes Linux systems to potential memory corruption and privilege escalation via polkit's D-Bus authentication path. Systems that applied the CVE-2026-4897 patch are specifically affected, meaning the remediation for a prior vulnerability created new exposure. No public exploit code has been identified at time of analysis, but the target (polkit, a setuid/privileged authorization daemon) makes this class of memory corruption high-consequence.
CVE-2026-85218 is attributed to Ubuntu per the vendor intelligence source, but no public description, CVSS score, CWE classification, or technical detail has been released at the time of this analysis. The vulnerability type, affected component, attack vector, and impact are all unknown. No meaningful synthesis of exploitation conditions or attacker capability is possible from available data alone.