Improper privilege management in mocknest-serverless 0.9.0 exposes AWS IAM role assumption to unauthorized escalation through a hardcoded default OIDC role name in GitHub Actions workflow dispatch inputs. The affected GitHub Actions workflows defaulted to a predictable IAM role name ('GitHubOIDCAdmin') combined with an overly permissive OIDC trust policy using wildcard StringLike conditions and PowerUserAccess grants, allowing any user with repository dispatch access to assume an admin-level AWS IAM role beyond their intended scope. No public exploit code has been identified and the project is not listed in CISA KEV; the upstream fix is available as commit 6ab3147 and PR #254.
Argument injection in the Okta Privileged Access Client's scaleft:// URL protocol handler allows an unauthenticated remote attacker to manipulate SSH client behavior by supplying hyphen-prefixed values in a crafted link. Versions 1.18.0 through 1.112.x omit the option terminator (--) before appending URL-derived values to SSH command-line arguments, causing the underlying SSH binary to interpret attacker-controlled strings as CLI flags rather than literal targets. A vendor patch is available in version 1.113.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Adobe Photoshop Mobile for Android (≤1.6.0.2294 and ≤1.6.0.2299) enables a low-privileged attacker to cause a security feature bypass, reading unauthorized files or directories outside the app's intended sandbox and producing high availability impact when a victim opens a maliciously crafted Photoshop document. The CVSS 3.1 score of 5.0 captures the meaningful constraints: local attack vector, high complexity, required user interaction, and the fact that exploitation depends on conditions beyond the attacker's control. No active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.
Out-of-bounds read in Microsoft Word across Office 2016, 2019, 2021 LTSC, 2024 LTSC, and Microsoft 365 Apps for Enterprise on both Windows and macOS allows a locally authenticated, low-privileged user to disclose adjacent process memory by opening a specially crafted document. The flaw carries a High confidentiality impact with no integrity or availability effects, and requires user interaction to trigger. No public exploit code or active exploitation has been identified at time of analysis; CISA SSVC rates exploitation status as none and automation as infeasible.
Path traversal in Okta Access Gateway's backup restore function (all versions prior to 2026.9.1) allows an authenticated administrator to supply a crafted encrypted backup payload containing a malicious embedded filename, causing the appliance to write file contents to arbitrary locations on its filesystem. Exploitation requires high-privilege administrative access (CVSS PR:H), materially limiting the attacker population to those who have already compromised gateway admin credentials. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available at version 2026.9.1.
Improper access control in Fortinet FortiManager and FortiManager Cloud allows authenticated administrators to bypass the workflow session approval process via crafted HTTP or HTTPS requests (CWE-284). Affected versions span FortiManager 6.4.x through 7.6.4 and FortiManager Cloud 6.4.x through 7.6.4 per EUVD intelligence, a broader range than the base CVE description indicates. An admin who should be subject to a change-management or four-eyes approval policy can circumvent that gate, pushing unapproved configuration changes to managed FortiGate devices. No public exploit code or CISA KEV listing is identified at time of analysis.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition enables an authorized high-privilege attacker to inject malicious script into SharePoint pages, causing spoofing attacks against other users who view the injected content. The CVSS base score of 3.5 reflects the high authentication bar (PR:H) and mandatory victim interaction (UI:R), confining realistic exploitation to insider-threat scenarios or compromised privileged accounts rather than external unauthenticated attackers. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Header injection authentication bypass in Okta Access Gateway (versions prior to 2026.9.1) allows unauthenticated network attackers to impersonate any user identity by supplying a forged HTTP header when the optional pass-through authentication source is enabled without upstream header sanitization. The vulnerability (CWE-287) stems from the gateway's unconditional trust of a client-controlled HTTP header as an identity assertion, with no cryptographic binding or signature verification. No public exploit code has been identified at time of analysis; Okta has released a patched version (2026.9.1) via security advisory.
Use-after-free in the Windows Overlay Filter kernel driver exposes stale freed memory to authenticated low-privilege attackers capable of reaching the target over a network. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through Server 2025, representing virtually the entire supported Microsoft Windows ecosystem. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Sensitive kernel information is exposed to low-privileged local users through a CWE-497 flaw in the Windows Win32K graphics subsystem, confirmed by Microsoft's own security team (secure@microsoft.com). The scope-changed CVSS vector (S:C/C:H) indicates the leaked data originates from the kernel security boundary, making this a classic KASLR-defeat primitive that threat actors chain with separate privilege-escalation exploits to achieve full system compromise. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; vendor patches covering every supported Windows release are available.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode port driver for the Windows Storage Spaces subsystem) allows a locally authenticated, low-privileged attacker to disclose kernel memory contents under high-complexity conditions. The vulnerability spans virtually all supported Windows releases - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - making the patch surface extremely wide. Microsoft has released fixes for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Uninitialized kernel memory in Win32K (win32k.sys) enables local attackers with standard user privileges to read sensitive kernel memory contents on affected Windows systems. The vulnerability spans virtually all currently supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 25H2/26H1. No public exploit identified at time of analysis, though Win32K info-leaks of this class are routinely chained with privilege escalation exploits to defeat kernel address space layout randomization (KASLR).
Tampering via NTFS link-following in Windows 11 allows a local low-privileged attacker to overwrite or modify files they would not ordinarily have write access to. The vulnerability (CWE-59) is triggered when a privileged Windows component resolves a symlink or junction point created by the attacker, resulting in file access against an unintended target. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected Windows 11 versions.
Out-of-bounds read in the Windows Bluetooth Port Driver (bthport.sys) allows a local, low-privileged authenticated attacker to disclose kernel memory contents under high-complexity conditions. Affected platforms span Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1), Windows Server 2022, and Windows Server 2025 across specific build thresholds confirmed by EUVD version data. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis, constraining real-world risk to post-compromise or insider scenarios.
Security feature bypass in Windows Win32K allows a locally authenticated, low-privileged attacker to exploit a kernel-level race condition and circumvent an OS-enforced integrity control, yielding high integrity impact without any confidentiality or availability effect. The flaw spans virtually every supported Windows SKU from Windows 10 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. Microsoft has released per-SKU patches; no public exploit code has been identified at time of analysis.
Local denial of service in Windows Secure Socket Tunneling Protocol (SSTP) stems from a missing resource release after effective lifetime (CWE-772), allowing an authenticated local attacker to exhaust resources and cause service unavailability. The flaw spans a broad range of Windows and Windows Server releases from Server 2012 through Windows 11 26H1 and Server 2025, confirmed by Microsoft's security response center. No public exploit or active exploitation has been identified; vendor patches are available via the standard Windows Update cycle.
Symlink-following in Windows Container Manager Service allows a local low-privileged authenticated user to bypass a security feature and read files outside the intended access boundary. Affected are Windows 11 versions 23H2, 24H2, 25H2, and 26H1 across specific build ranges, per EUVD. Impact is limited to confidentiality (C:H), with no integrity or availability consequence. No public exploit code and no CISA KEV listing are present at time of analysis.
Out-of-bounds read in Windows Image Acquisition (WIA) allows a local low-privileged attacker to disclose sensitive memory contents on unpatched Windows systems. The vulnerability affects a wide swath of Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, meaning virtually every supported and extended-support Windows environment is potentially in scope. No public exploit or CISA KEV listing has been identified at time of analysis, and the high attack complexity (AC:H) materially constrains opportunistic exploitation despite the breadth of affected versions.
Buffer over-read (CWE-126) in the Windows Overlay Filter (WofFilter) kernel driver enables local authenticated attackers with standard user privileges to disclose kernel memory contents under high-complexity conditions. The vulnerability spans a broad range of supported Windows 10, Windows 11, and Windows Server releases from build 1607 through 26H1, all patched via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.7 medium score reflects the local, high-complexity exploitation barrier.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) document processing stack enables a local low-privileged attacker to disclose sensitive memory contents under high-complexity conditions. The flaw spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2012 through Windows 11 25H2 and Server 2025 - making patch deployment across heterogeneous environments operationally significant. Microsoft has released patches via the standard update guide; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Microsoft Windows SCSI Class System File driver (CWE-125) exposes kernel memory contents to an attacker with physical access to the target machine. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases, from build 10.0.17763 through current 25H2 and Server 2025 lines. No active exploitation or public proof-of-concept has been identified; vendor-released patches are available via the July 2026 Microsoft Security Update.
Out-of-bounds read in the Windows CD-ROM kernel-mode driver exposes kernel memory contents to an attacker with physical access across virtually every supported Windows release from Server 2012 through Windows 11 Version 26H1. The flaw (CWE-125) allows kernel memory disclosure - potentially including credentials or cryptographic material - when a crafted disc interaction or malformed IOCTL triggers a read beyond the intended buffer boundary. Microsoft has released patches; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Heap-based buffer overflow in the Windows RNDIS (Remote Network Driver Interface Specification) driver allows a physically present, unauthenticated attacker to disclose heap memory contents. Exploitation requires direct physical access to the target device, as the attacker must connect a malicious USB RNDIS device to trigger the overflow. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, making real-world risk low outside of targeted physical attacks.
Let me synthesize. Product: Halo (halo-dev/halo) — a Java-based blog/CMS platform. Product name: "Halo". Vulnerability: CWE-94 code injection — plugin management allows installing/updating malicious plugins leading to arbitrary command execution with Halo process privileges. CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N = 4.6. Interesting — low privilege, requires user interaction, confidentiality/integrity low, no availability impact. Scope unchanged. EPSS 0.16% percentile 5% — very low. No KEV. No POC explicitly stated (references include a GitHub issue report from a researcher - MyCVE-Report). Tags: RCE, Code Injection. Affected: Halo <= 2.25.4. Prevalence: Halo is a popular open-source blog/CMS in China — medium (common but not everywhere). I'd say "medium" — it's a widely used open-source CMS/ blogging platform, but niche-ish. Let's say medium with basis "popular open-source Java CMS/blog platform, limited enterprise footprint". Assessed CVSS: The description says plugin management allows users to install/update malicious plugins — requires authenticated user with plugin management permission (admin typically), plus user interaction (UI:R from vector). Actually the input vector already says PR:L, UI:R. Hmm, but plugin management typically requires admin. The provided CVSS says PR:L. I might assess PR:L as given but arguably PR:H. I should be honest. Let me use CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N — but the impact of arbitrary command execution should be high. However CVSS given is low impacts. The description says "execute any command with Halo process permissions" — that would be C:H/I:H/A:H arguably. But scope unchanged and Halo process permissions limited. Hmm. I'll assess as AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H? Let me think: to install a plugin you need plugin management privilege — typically administrator. The given vector says PR:L though. Actually maybe Halo allows certain users to manage plugins. I'll go with PR:L per the vendor/NVD-ish
Cross-site request forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to trigger unintended financial actions on the web server on behalf of an authenticated victim. The attacker crafts a malicious link or page; if the authenticated victim interacts with it, their browser submits forged requests that bypass CSRF protection, resulting in low-level confidentiality and integrity impact. No public exploit is identified at time of analysis, and availability is unaffected.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) enables a physically-present unauthenticated attacker to disclose memory contents from an affected system. Exploitation requires direct physical access to the target device, most plausibly via a maliciously crafted or manipulated storage peripheral. The vulnerability spans the entire currently-supported Windows ecosystem - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all active feature releases. No public exploit or CISA KEV listing has been identified at time of analysis.
Windows Secure Boot security feature bypass affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The root cause is a dependency on a vulnerable third-party component embedded within the Secure Boot trust chain, enabling a locally present, high-privileged attacker to bypass boot integrity enforcement. No public exploit or CISA KEV listing is associated with this vulnerability at time of analysis; patch versions are confirmed available across all affected Windows release trains.
Windows Hello on a broad range of Windows 10, Windows 11, and Windows Server releases contains an uncontrolled search path element (CWE-427) that allows a locally authenticated attacker with administrative privileges to substitute a malicious component in the search path, bypassing the Windows Hello security feature and exposing confidential information. The vulnerability is strictly local and requires high privileges (CVSS PR:H, AV:L), placing it at CVSS 4.4. Vendor-released patches are available via the Microsoft Security Response Center advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Security feature bypass in Windows URL Moniker enables a remote, unauthenticated attacker to circumvent URL-based security controls across virtually all supported Windows versions from Server 2012 through Windows 11 26H1. Rooted in improper resolution of path equivalence (CWE-41), the flaw allows crafted URL representations to evade security filters that would otherwise block access to restricted resources. Exploitation requires user interaction per the CVSS vector (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effects; no public exploit code has been identified at time of analysis.
Buffer over-read (CWE-126) in the Windows Storage component exposes adjacent memory contents to a physically-present attacker across virtually the entire supported Windows product line, from Server 2012 through Windows 11 25H2 and Server 2025. The CVSS vector (AV:P/UI:R) confirms exploitation requires both physical access to the target machine and user interaction to trigger the vulnerable code path, sharply constraining real-world attack surface. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Xbox component on Windows allows a physically-present attacker to disclose sensitive memory contents. Affecting a wide range of Windows 10 and Windows 11 builds (plus Windows Server 2016/2019), the flaw is triggered via a physical interaction, yielding high confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC classifies exploitation as none at time of analysis, making this a lower-urgency but patch-worthy item for any endpoint reachable by an untrusted third party.
Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU kernel drivers allows a local unprivileged process to access already-freed GPU memory through valid GPU memory processing operations, resulting in limited confidentiality and integrity impact against the kernel driver. The flaw spans a wide range of driver versions across all three GPU architectures, affecting the enormous ecosystem of Android and embedded devices powered by Arm Mali GPUs. No public exploit or active exploitation has been identified; SSVC rates technical impact as partial and exploitation as none at time of analysis.
SAPUI5's frame options allowlist feature insufficiently validates parent frame origins, enabling a framing-based social engineering attack against authenticated SAP users. An unauthenticated attacker can host a malicious page that embeds a SAPUI5 application in an iframe while bypassing the configured origin allowlist, then lure an authenticated victim into interacting with it to trigger unintended in-application actions. Impact is limited to low integrity - no confidentiality or availability consequences - and no public exploit or active exploitation (KEV) has been identified.
Insufficient authorization enforcement in SAP S/4HANA's Manage Bank Chains application allows an authenticated low-privileged user to delete bank chain records outside their permitted scope. The impact is strictly limited to availability - deletion of specific configuration entries - with no confidentiality or integrity exposure, yielding a CVSS 4.3 moderate rating. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized configuration data disclosure in SAP NetWeaver and ABAP Platform allows authenticated network attackers to read sensitive system configuration and security-relevant settings without holding the required authorization. The flaw stems from a missing authorization check (CWE-862) in the Application Server ABAP component, meaning any low-privileged authenticated user can query configuration details that should be restricted to privileged roles. Impact is confined to confidentiality at a low level; no public exploit or CISA KEV listing has been identified at time of analysis.
Bluetooth encryption downgrade in Android's `btm_sec_encrypt_change` function (btm_sec.cc) exposes information on Android 17 and Android 16-QPR2 devices by allowing a logic error in encryption change handling to be exploited without user interaction. A Bluetooth-adjacent attacker with a low-privilege connection can trigger the downgrade, reducing encryption strength and enabling passive interception of Bluetooth traffic. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.16%, indicating very low observed exploitation probability.
Integer overflow in Android's HEIF image parsing code causes a temporary remote denial of service against Android 15 through 17. The flaw resides in `convertCleanApertureToRect` within `HeifCleanAperture.cpp`, where malformed HEIF clean-aperture metadata triggers an integer overflow that crashes the media processing component. With PR:L and no user interaction required, an attacker with a low-privilege account can deliver a crafted HEIF file to trigger the crash remotely. No public exploit exists and EPSS sits at 0.16%, consistent with a moderate-severity DoS with no code execution pathway.
Cleartext transmission of administration credentials over HTTP in U-speed WIFI4 N300 T1 Pro v1.0.0 exposes router admin passwords to passive eavesdroppers on the same network segment. Any attacker with adjacent network access - including a co-located wireless client - can capture HTTP session traffic containing unencrypted credentials without any authentication or interaction. No public exploit code has been confirmed and EPSS is minimal (0.15%), but the attack is trivially executable with standard packet capture tools once adjacent network access is established.
Repeated external URL scheme invocations from a malicious webpage can flood Firefox for iOS with system confirmation prompts or trigger cascading external application launches, rendering the browser temporarily unusable. All Firefox for iOS versions prior to 155.1 on Apple iOS devices are affected. No active exploitation has been identified; Mozilla released the fix in Firefox for iOS 155.1, and exploitation requires the user to visit the attacker-controlled page.
Xen hypervisor on x86 PV (paravirtualized) guest configurations contains a race condition in memory page lifecycle management that allows a guest to write to pages already scrubbed by Xen. When a PV guest frees a memory page, Xen defers the TLB flush until the page is re-used - but scrubbing occurs before that flush, creating a window in which the guest's stale TLB entry remains valid for a page now considered clean. This permits the attacking PV guest to inject arbitrary data into a scrubbed page, which may subsequently be allocated to another guest, undermining Xen's inter-VM memory isolation guarantee. No public exploit has been identified at time of analysis, and SSVC assessment rates exploitation as none and non-automatable.
Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture kernel drivers allows an unprivileged local process to access already freed kernel memory, leaking limited sensitive data. The flaw is triggered through valid GPU memory processing operations, requiring no special privileges beyond local code execution - a realistic threat on mobile devices running affected Mali GPU firmware. With EPSS at 0.14% and no public exploit or KEV listing, active exploitation is not currently observed, but the breadth of affected versions across three GPU families and many Android SoC generations elevates overall exposure.
Untrusted Search Path exploitation in Adobe Acrobat and Acrobat Reader allows a local attacker who already holds high privileges to gain unauthorized read access to sensitive confidential data under specific, attacker-uncontrollable environmental conditions. Affected products include Acrobat 2024 (≤24.001.30383), Acrobat Reader, and Adobe Acrobat (both ≤26.002.21900), per EUVD-2026-74105 and Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis; exploitation mandates a victim open a malicious file and requires conditions beyond the attacker's direct control.