Integer overflow in Samsung Walrus WebAssembly runtime's Memory::init() source-bounds check allows an attacker who supplies a crafted WebAssembly module to trigger a 32-bit unsigned wrap-around that bypasses source-bounds validation, causing an out-of-bounds heap read and process crash (denial of service). The affected product is Samsung Walrus at commit ff3bf5ff5c4878f8e5572c9593d303f6bc997443 across all platforms. Publicly available exploit code exists in the form of a proof-of-concept .wast module (stream-read-oob-poc.wast) included in the upstream fix PR #482.
Out-of-bounds write in Samsung's Escargot JavaScript engine on Linux x86-64 allows process crash when a crafted class definition is supplied for execution. Numeric truncation (CWE-197) occurs when an instance initialization entry count exceeding UINT16_MAX is stored in a uint16_t field, producing a corrupted count that drives subsequent out-of-bounds memory writes and host process termination. Impact is limited to availability (denial of service); no confidentiality or integrity exploitation is indicated, and no public exploit or CISA KEV listing has been identified at time of analysis.
Cookie validation key forgery in liufee FeehiCMS up to 2.1.1 allows unauthenticated remote attackers to craft arbitrary signed cookies by exploiting a hardcoded (or empty) `cookieValidationKey` in the production backend configuration file `environments/prod/backend/config/main-local.php`. Because FeehiCMS is built on the Yii2 framework, this key is used for HMAC-based cookie integrity verification; a known or empty key trivially breaks that guarantee, enabling session/cookie forgery that can lead to authentication bypass and backend access. A public proof-of-concept exploit exists (FEHI-003-Empty-cookieValidationKey), and no vendor patch has been issued despite responsible disclosure through a GitHub issue.
Cross-site scripting in SourceCodester Simple Traffic Offense System 1.0 allows remote attackers to inject arbitrary JavaScript via the site_name and site_desc parameters of the save-settings.php Settings Update Endpoint. The injected payload is stored server-side and executes in the browser of any user who subsequently loads the affected page. A public proof-of-concept exploit has been disclosed on GitHub (issue #3 in tan1540684326-QAQ/cve), confirming the vulnerability is reproducible.
Reflected cross-site scripting in projectworlds Online Examination System 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the Name and Subject parameters of feedback.php. Exploitation delivers malicious script payload to any user whose browser renders the tampered response, enabling session hijacking, credential theft, or defacement within the application context. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing has been identified at time of analysis.
Integer overflow vulnerabilities in Ollama's GGUF model decoder (versions 0.31.0-0.31.1) allow a remote attacker to crash the decoder by supplying a crafted GGUF model file containing malformed string lengths, tensor dimension counts, or array sizes. The overflow triggers in readGGUFV1String and related parsing functions in fs/ggml/gguf.go, causing Ollama to abort model loading and become temporarily unavailable. A public proof-of-concept exists (GitHub issue #17033) and a patch is available in v0.31.2-rc1; exploitation requires the target to load the malicious model file.
Out-of-bounds read in ModelCloud GPTQModel ≤7.2.0 allows an attacker who controls a GPTQ checkpoint file to trigger unauthorized GPU device memory reads during model inference. The Triton dequantization kernel in `tritonv2.py` indexes `scales`/`qzeros` buffers using the checkpoint-supplied `g_idx` tensor without any upper-bound guard, so a crafted entry ≥ `num_groups` reads past the allocated buffer on the device. A public proof-of-concept exists (GitHub issue #2949), and vendor-released fix v7.3.0 is available.
Cross-site scripting in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the msg, title, or content parameters in manage_subjects.php. A public proof-of-concept on GitHub documents both reflected and stored XSS variants, confirming the vulnerability is exploitable and the details are widely available. No vendor-released patch has been identified, and no active exploitation has been confirmed via CISA KEV.
Cross-site scripting in FastAdmin's User Controller (versions up to 1.2.0.20210401_beta) allows remote unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious `url` redirect parameter on the login or register endpoint. The commit diff confirms the `$url` variable was echoed unescaped into HTML attribute contexts and a JavaScript `location.href` assignment in three template files, enabling `javascript:` URI injection in addition to classic reflected XSS. A public proof-of-concept exploit exists; the vendor-released patch in version 1.2.1.20210731_beta resolves all three injection points.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the unsanitized `ID` parameter in `/pages/us_edit1.php`, enabling unauthorized database reads, data modification, and potential privilege escalation within the application. A public proof-of-concept exploit has been disclosed on GitHub, confirming the issue is both reproducible and accessible to low-skilled attackers. No vendor patch has been identified; the product is a PHP-based educational/demo application with limited enterprise deployment footprint.
Session fixation in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows unauthenticated remote attackers to pre-plant a session identifier via the auth_process.php login endpoint, then hijack the authenticated session after a victim logs in. The auth_process.php component fails to regenerate the session ID upon successful authentication, enabling full account takeover of any user who can be socially engineered into authenticating through a crafted link. A public exploit PoC exists on GitHub; no vendor patch has been released.
Improper access control in BookStack ≤26.05.2 allows authenticated low-privileged users to retrieve attachment edit form data for attachments on pages they are not authorized to access, by manipulating the ID parameter in requests to AttachmentController::getUpdateForm. The missing authorization check constitutes an Insecure Direct Object Reference (IDOR), leaking attachment metadata across permission boundaries. A public proof-of-concept blog post documents the attack path, and a vendor patch commit is available.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries through the `ID` parameter of `/pages/cust_edit1.php`. Exploitation requires low-privilege authentication and can result in unauthorized data read, modification, and limited availability impact against the underlying database. A public proof-of-concept exploit has been disclosed via GitHub, lowering the bar for opportunistic exploitation of any deployed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/settings_edit.php endpoint to database manipulation via the unsanitized ID parameter. Authenticated attackers with low-privilege access can read, modify, or partially disrupt database contents. A public proof-of-concept has been disclosed on GitHub, materially lowering the exploitation skill threshold for any system running this application.
SQL injection in itsourcecode Information System Society Membership System 1.0 exposes the database to read and write operations by authenticated remote attackers who manipulate the `student_id` parameter in `/society/check_student.php`. A public proof-of-concept exploit has been disclosed on GitHub. The CVSS 4.0 base score of 5.3 with low-impact ratings across C/I/A appears conservative for a CWE-89 flaw, which typically permits full database extraction and modification via UNION or stacked-query techniques.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the Username parameter in /pages/us_transac.php. The CVSS 4.0 vector (PR:L) confirms a login is required, limiting the unauthenticated attack surface, but the impact spans confidentiality, integrity, and availability of the underlying database. A public proof-of-concept exploit has been disclosed via a GitHub issue, raising the likelihood of opportunistic exploitation against any exposed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/sup_transac.php` endpoint to database manipulation via the unsanitized `companyname` parameter. Authenticated remote attackers can inject arbitrary SQL, achieving partial read and write access to the underlying database. A public proof-of-concept exploit exists per GitHub issue reference; no CISA KEV listing has been observed.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the Name parameter in /pages/pro_transac.php?action=add. The vulnerability stems from unsanitized user input passed directly to SQL queries in a PHP backend, enabling data extraction, modification, or denial of service against the underlying database. A public exploit has been disclosed on GitHub, lowering the bar for exploitation.
Cross-site request forgery in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows a remote unauthenticated attacker to perform unauthorized state-changing actions on behalf of an authenticated victim by tricking them into visiting a malicious page. The vulnerability stems from missing CSRF tokens on one or more application functions, as documented in a public exploit report filed under VULN-08-CSRF-Missing-Tokens. A proof-of-concept exploit is publicly available on GitHub, though no active exploitation has been confirmed by CISA KEV.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries by injecting arbitrary SQL via the `ID` parameter in `/pages/pro_searchfrm.php`. The CVSS 4.0 vector (PR:L) confirms that low-privilege authenticated access is required, limiting the exposure compared to fully unauthenticated SQLi. A publicly available proof-of-concept exists on GitHub (referenced as an issue in the yunfan668/cve repository), though no active exploitation has been confirmed by CISA KEV. The affected product is a free PHP educational source-code project distributed by itsourcecode.com, constraining real-world impact to deployments of this niche academic software.
Cross-site request forgery in light0011 cms (rolling-release, at minimum through commits c774dce3 and f72cf46f) allows a remote attacker to perform unauthorized state-changing operations on behalf of an authenticated CMS user by inducing that user to visit a malicious page. A public proof-of-concept is documented in GitHub issue #12, and the project maintainer has not responded to the disclosure, leaving the vulnerability unpatched. The CVSS 4.0 score of 5.3 reflects the moderate but real-world risk: low integrity impact, no confidentiality exposure, and a mandatory passive user-interaction requirement.
Server-side request forgery in FeehiCMS up to version 2.1.1 allows authenticated high-privilege users to make the backend server issue arbitrary HTTP requests by manipulating the source[] parameter in the UEditor catchImage function. The CVSS 4.0 vector confirms network-reachable exploitation requiring high privileges (PR:H), limiting the attack surface to authenticated backend administrators. A public proof-of-concept writeup has been published on GitHub and the vendor has not responded to the responsible disclosure issue filed against the repository.
Missing authorization in FluentCMS's permission-management layer allows network-accessible, high-privileged users to bypass access controls enforced by the `GetAccessible` function in `PermissionManager.cs`. Versions up to and including 0.0.5 are affected. A publicly available proof-of-concept exists via a GitHub issue report, and the project had not responded to the disclosure at time of analysis; no vendor-released patch is available.
Reflected cross-site scripting (XSS) in code-projects Hospital Information System 1.0 allows a remote authenticated attacker to inject arbitrary JavaScript into victim browsers via the unsanitized `id` parameter in `/HIS/src/patients/editPatient.php`. An attacker who can craft a malicious URL and induce an authenticated user to click it can execute scripts in the victim's browser session, enabling session hijacking, credential theft, or UI redress. A public proof-of-concept exploit is available on GitHub; no KEV listing exists, and the CVSS 4.0 score of 2.0 reflects the limited real-world impact given authentication and user-interaction prerequisites.
Unbounded iteration during PKCS#7 container decryption exposes affected systems to a denial-of-service condition where a crafted cryptographic payload causes a parsing loop to run without termination bounds. The specific library or package is not identified in the available intelligence - Ubuntu is the reporting source, suggesting this affects a cryptographic library they distribute (candidates include OpenSSL, GnuTLS, NSS, or similar). An attacker able to supply a malformed PKCS#7 container to a vulnerable parsing routine can exhaust CPU resources and halt service availability. No public exploit has been identified at time of analysis, and no CVSS score or severity rating has been assigned.
NULL-pointer dereference in code handling Authentication and Key Agreement (AKA) Synchronization-Failure messages causes a process crash when a malformed or unexpected AKA-Synchronization-Failure response is processed. The vulnerability affects software that implements 3GPP AKA authentication - a protocol used in mobile network authentication (3G/4G/5G) and EAP-AKA for Wi-Fi/IMS - as packaged by Ubuntu. No public exploit or CISA KEV listing has been identified at time of analysis, and the primary real-world impact is denial of service via crash of the authentication handling daemon.
Undefined memory access in PKCS#7 container parsing affects an Ubuntu-packaged cryptographic library, potentially enabling denial of service or information disclosure when processing malformed PKCS#7 input. The specific library (OpenSSL, GnuTLS, NSS, or Linux kernel PKCS#7 module) is not identified in available data. No patch version, CVSS score, or CWE classification was provided, leaving severity and exploitability largely unquantified at time of analysis.
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1, where the IDE injects a pprof HTTP server into profiled processes without any access control. An attacker with network connectivity to the developer workstation during an active profiling session can retrieve heap dumps, goroutine stacks, CPU traces, and in-memory data structures that may contain credentials, tokens, or sensitive application state. No public exploit code exists and this is not listed in CISA KEV; however, the attack requires only standard HTTP requests against an unauthenticated endpoint, making it trivially simple when the prerequisite conditions are met.
Improper certificate validation in Dell Secure Connect Gateway 5.0 (both Appliance and Application editions) exposes encrypted communications to interception by remote, unauthenticated attackers positioned on the network path. The vulnerability stems from CWE-295 failure to properly verify TLS/SSL certificates, enabling a MITM attacker to present a fraudulent certificate that the product accepts, thereby gaining access to traffic that should be protected. CVSS 5.9 (AC:H) reflects that exploitation requires the attacker to occupy an adversarial network position; no public exploit or KEV listing has been identified at time of analysis.
Local privilege escalation in Zohocorp ManageEngine Endpoint Central before version 11.5.2605.01 allows a low-privileged local user to gain elevated access by exploiting improper privilege management (CWE-269) during the agent upgrade process. The CVSS scope change (S:C) confirms that exploitation crosses privilege boundaries beyond the initially compromised context, affecting higher-privileged system components. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available.
Pre-authentication Child SA creation in an IKEv2/IPsec implementation reported via Ubuntu allows a network attacker to establish a Child Security Association before the IKE authentication phase completes. In the IKEv2 protocol (RFC 7296), Child SAs should only be negotiated after mutual authentication of the IKE SA; bypassing this ordering can undermine the confidentiality and integrity guarantees of the protected traffic tunnels. No public exploit has been identified at time of analysis, and the exact affected Ubuntu package and versions are not confirmed from the available data.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance (prior to 5.36.00.16) and Application/Virtual Edition (prior to 5.36.00.00) - allows an unauthenticated remote attacker with a network man-in-the-middle position to intercept or tamper with TLS-protected communications between the SCG and remote endpoints. The CVSS 5.6 score with AC:H reflects that exploitation is constrained by the requirement for network-level interception capability rather than direct remote access. No public exploit code and no CISA KEV listing have been identified at time of analysis.
The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint by exploiting incorrect file path validation logic (CWE-73), causing the privileged service to load attacker-controlled VPN configurations. The impact is integrity-focused: a successful bypass enables substitution of legitimate VPN configuration with a malicious one, potentially redirecting traffic, disabling certificate validation, or weakening encryption enforced by an administrator. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is limited to the local Windows context.
Authentication bypass in the light0011 CMS Cookie Helper allows remote unauthenticated attackers to manipulate the Username argument in App/Home/Model/UserModel.class.php and impersonate arbitrary users without valid credentials. The vulnerability (CWE-287, Improper Authentication) affects all commits through at least c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930 of this PHP CMS. Publicly available exploit code exists; the project maintainer has not yet responded to disclosure, and no patch has been released.
SQL identifier injection in jaychouchannel's Tourism-Management-System allows remote unauthenticated attackers to enumerate arbitrary database tables and columns by manipulating the `tableName` and `columnName` URL path parameters accepted by multiple endpoints in `CommonController.java`. All commits up to 8122bf020d91199eddfff3ee02d1632a70a9a132 are affected, and exploit code has been publicly disclosed via VulDB. A fix commit (d44ec3aa) is available, introducing a dedicated `SqlIdentifierValidator` to whitelist valid SQL identifiers across the affected controller.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to manipulate the `id` parameter in `/delete_subject.php` to execute arbitrary SQL queries against the backend database. The vulnerability requires no authentication or user interaction, and a public exploit has been released via a GitHub vulnerability report. Internet-exposed deployments face immediate risk of database enumeration, credential theft, and academic record manipulation.
Privilege escalation in JetBrains YouTrack before version 2026.1.14047 allows an authenticated user holding project update permissions to grant themselves the Project Admin role without proper authorization. The vulnerability stems from a missing escalation check (CWE-266: Incorrect Privilege Assignment) in the project permissions workflow, enabling a project contributor to cross a privilege boundary and assume administrative control over a project. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is known at time of analysis.
Use-after-free in the MediaTek GPU kernel driver on chipsets MT6991 and MT8799 allows a local attacker with standard user privileges to read freed kernel or GPU memory, potentially exposing sensitive data such as pointers, credentials, or cryptographic material. The same condition may cause a full system crash, consistent with the Denial of Service tag and the 'system crash' language in the description. No public exploit has been identified and SSVC rates exploitation status as none, placing this in a lower real-world priority bracket despite the C:H rating.
Improper input validation in the modem firmware component of 22 MediaTek chipsets allows a local user-privileged process to trigger a system crash, resulting in a denial of service. The flaw, tracked as patch ID MOLY01810811 / MSV-9232, requires user interaction to trigger and is confined to an unprivileged local context, limiting its practical impact to availability disruption rather than data exposure or code execution. No public exploit has been identified and SSVC rates exploitation as none at this time.
MiracastService on MediaTek Smart TV and DTV chipsets exposes a confused deputy condition (CWE-926) that allows a local app running with user-level privileges to trigger a denial-of-service against the Wi-Fi Display subsystem. The flaw stems from an improperly exported Android application component that lets an unprivileged caller invoke MiracastService capabilities without holding the necessary permissions, crashing or disabling the service. No public exploit code exists and SSVC rates exploitation as none, placing this firmly in the routine patch tier with a vendor-confirmed CVSS 5.5.
Incorrect permission assignment on critical resources in Dell Secure Connect Gateway 5.0 (both Appliance and Application variants) enables a locally authenticated low-privileged user to read sensitive data they are not authorized to access. Affected are Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00, as confirmed in Dell advisory DSA-2026-382. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the high confidentiality impact from a CWE-732 flaw in a remote-support gateway warrants prioritized patching for insider-threat scenarios.
Sensitive information exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged local attacker to read sensitive data written to application log files without sanitization. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected across all platforms. No public exploit code or active exploitation has been identified; Dell has released fixes via advisory DSA-2026-382.
Hard-coded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a local low-privileged attacker to decrypt protected data, leading to high-severity information disclosure. Both the Appliance form factor (prior to 5.36.00.16) and the Application form factor (prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis, and the local access requirement significantly constrains the attack surface.
Hardcoded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance and Application variants - allows a low-privileged local attacker to access protected data encrypted with the embedded key, leading to information disclosure. Affected versions include SCG 5.0 Appliance prior to 5.36.00.16 and SCG 5.0 Application prior to 5.36.00.00. Dell has released patched versions via DSA-2026-382; no public exploit or KEV listing has been identified at time of analysis.
Hard-coded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a local low-privileged attacker to decrypt data that was intended to be cryptographically protected, resulting in high-severity information disclosure. Both the Appliance form factor (versions prior to 5.36.00.16) and the Application form factor (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; Dell has released patches via advisory DSA-2026-382.
Cleartext storage of sensitive information in Dell Secure Connect Gateway 5.0 exposes credentials or configuration secrets to any low-privileged local user on the host. Both the hardware Appliance (versions prior to 5.36.00.16) and the virtual Application (versions prior to 5.36.00.00) are affected, as confirmed by Dell Security Advisory DSA-2026-382. No public exploit identified at time of analysis, but the CVSS C:H rating indicates that successful exploitation yields full confidentiality compromise of the stored sensitive material.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows a locally authenticated low-privileged attacker to conduct server-side request forgery, resulting in high confidentiality impact with no integrity or availability loss. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected, as confirmed by Dell Security Advisory DSA-2026-382. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in routine patch-cycle priority rather than emergency response.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privileged users to inject persistent malicious scripts through custom field values displayed on Agile board cards. When a victim with an active YouTrack session views the affected Agile board, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code has been identified at time of analysis, and JetBrains has released a patched version.
Authorization bypass in the Flamingo WordPress plugin (all versions ≤2.6.2) allows authenticated contributor-level users to enumerate sensitive internal metadata via unprotected WordPress core API endpoints. The plugin's capability filter `flamingo_map_meta_cap()` secures the admin UI but leaves XML-RPC `wp.getTerms` and admin-ajax `ajax-tag-search` without equivalent checks, exposing Contact Form 7 channel names, department identifiers, workflow names, submission counts per channel, and contact tag names. No public exploit is identified at time of analysis; the fix is available via plugin changeset 3611179.
Remote unauthenticated denial-of-service in Dell Secure Connect Gateway (SCG) 5.0 allows network-adjacent attackers to crash or disable the gateway's protection mechanisms by sending crafted input that triggers an unhandled exceptional condition (CWE-703). Both the physical Appliance variant (prior to 5.36.00.16) and the virtual Application variant (prior to 5.36.00.00) are affected. The primary impact is loss of availability of the SCG service, meaning the gateway's security inspection or remote-support connectivity function is disrupted; no public exploit or active exploitation has been identified at time of analysis.