Use after free in the Windows Device Association Service enables network-based privilege escalation by low-privilege authenticated attackers across Windows 10, Windows 11, and Windows Server 2012 through 2025. The CVSS 3.1 score of 7.1 accurately reflects meaningful exploitation constraints - high attack complexity, required user interaction, and prior authentication - despite the maximal CIA impact if exploitation succeeds. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free memory corruption in the Windows Remote Desktop Licensing Service allows an authenticated, low-privileged network attacker to elevate privileges to a higher-privileged context. Affected systems span Windows Server 2012 through Server 2025, as well as Windows 10 versions 1607 and 1809. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches across all affected build lines.
OS command injection in Azure HDInsight allows a network-accessible, high-privileged attacker to escalate privileges on the underlying cluster infrastructure. The vulnerability (CWE-78) arises from insufficient neutralization of special characters passed to OS-level commands within the HDInsight control plane or management interface, enabling an authorized administrator to break out of their intended permission scope and execute arbitrary OS commands. Reported via Microsoft MSRC (secure@microsoft.com), a vendor patch has been released; no public exploit code or CISA KEV listing is present at time of analysis.
Command injection in Fortinet FortiSandbox allows a remote, highly privileged attacker to execute arbitrary OS commands on the underlying system, achieving full confidentiality, integrity, and availability compromise. Affected versions span FortiSandbox 4.2.1-4.2.8, 4.4.0-4.4.9, 5.0.0-5.0.6, and 5.2.0, covering a wide release range across multiple major branches. The temporal CVSS metrics (E:F/RL:O/RC:C) confirm that a functional exploit exists and an official patch has been released, making prompt patching the priority action.
Server-Side Request Forgery in the Hide My WP Ghost WordPress plugin (all versions through 7.0.09) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external hosts. Reported by Patchstack under EUVD-2026-72652, the vulnerability carries a CVSS 7.2 with scope change (S:C), meaning successful exploitation can affect infrastructure beyond the WordPress host itself - including cloud metadata endpoints or internal network services. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Windows Remote Desktop Services (RDS) is possible through a use-after-free memory condition exploitable by a network-authenticated, low-privilege attacker. Affected platforms span Windows Server 2025 and Windows 11 versions 23H2 through 26H1, with fixed builds specified per-release in the MSRC advisory. The CVSS 7.1 score reflects genuine barriers - high attack complexity (AC:H) and required user interaction (UI:R) - despite full C/I/A impact potential; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Windows Network Driver Interface Specification (NDIS) subsystem enables an authenticated network attacker to elevate privileges on affected Windows systems. The vulnerability spans a wide range of Windows client and server releases - from Server 2012 through Windows 11 and Server 2025 - and requires both low-privilege authentication and user interaction to exploit, substantially tempering the real-world risk relative to the high CIA impact scores. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through the July 2026 update cycle.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) document processing component enables an authenticated, low-privileged attacker to escalate privileges across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. Exploitation requires user interaction and high attack complexity, limiting automated or opportunistic attacks despite the network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches with confirmed fixed build numbers.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) component across Windows 10, Windows 11, and Windows Server versions from 2012 through 2025 enables a low-privileged authenticated attacker to escalate to full system control. Exploitation requires high attack complexity and active user interaction - consistent with a scenario where a specially crafted XPS document must be opened by the target. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available via Microsoft's update infrastructure.
Persistent denial-of-service in XenForo's BBCode parser allows any authenticated forum member to crash PHP-FPM workers for all visitors by submitting a single post with sufficiently deep BBCode nesting. The recursive parser exhausts PHP's call stack, generating fatal errors that terminate worker processes - and because the malicious post persists in the database, every subsequent render of the affected thread repeats the crash, sustaining the outage until the post is removed or the forum is patched. Fixed in XenForo 2.3.13; no public exploit code has been identified at time of analysis.
MongoDB Server's $regexFindAll aggregation expression contains a reachable assertion (CWE-617) that any authenticated user with aggregation pipeline execution rights can trigger to crash the mongod process. When a regex match operation begins at a byte offset falling inside a multi-code-unit character - such as a multi-byte UTF-8 sequence or a Unicode surrogate pair - the internal invariant check fires and the database process terminates, causing a full denial of service for all connected clients. No public exploit code and no CISA KEV listing exist at time of analysis, but the triggering condition is deterministic and reproducible by any authenticated attacker who can submit crafted aggregation input.
ReDoS (regular expression denial of service) in n8n's Git node clone operation allows an authenticated workflow editor to freeze the entire n8n instance with a single workflow execution. The vulnerability stems from catastrophic backtracking in the default N8N_BLOCK_FILE_PATTERNS regex (`^(./).git(/.)$`), which runs synchronously in the main process against an attacker-controlled destination path. Fixed versions 1.123.76, 2.37.7, and 2.38.2 are available; no public exploit or KEV listing identified at time of analysis.
Windows Error Reporting (WER) across a broad range of Windows 10, Windows 11, and Windows Server releases creates temporary files in directories with insecure permissions, enabling a local attacker with standard user privileges to tamper with those files and read their contents. The vulnerability is classified as CWE-379 and carries a CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact achievable without elevated rights. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.
MongoDB Server's query planning component harbors a CWE-190 integer overflow that enables an authenticated database user with ordinary read/write privileges to crash the entire server node via a specially crafted query. The overflow bypasses an internal resource limit during query planning, triggering unbounded memory consumption that terminates the server process and denies service to all databases hosted on that node. Affected release lines are 7.0.x (below 7.0.41), 8.0.x (below 8.0.30), and 8.3.x (below 8.3.9); MongoDB has released patches for all three; no public exploit or CISA KEV listing was identified at time of analysis.
Stack exhaustion via uncontrolled recursion in Qt's QDomDocument XML serialization allows a remote attacker to crash any Qt application that processes untrusted XML input, resulting in a denial-of-service condition. Affected applications using the QtXml module parse attacker-supplied deeply nested XML documents, triggering recursive descent without a depth guard until the call stack is exhausted. No code execution is possible; impact is limited to application availability. No public exploit or CISA KEV listing has been identified at time of analysis.
Client-side authentication bypass in Microsoft Skype for Business Server enables a low-privileged network attacker to perform identity spoofing against other users on the platform. The flaw stems from CWE-603 (Use of Client-Side Authentication), where the server delegates trust to client-controlled data, allowing an authenticated user to forge session identity and corrupt integrity of communications. Three supported server product lines are affected with vendor patches now available; no public exploit or active exploitation has been identified at time of analysis.
Denial of service in Snipe-IT before 8.7.1 allows authenticated users to exhaust PHP worker CPU by submitting arbitrarily large values in the note field of the POST /account/accept/{acceptance} endpoint. The unbounded input is passed directly to synchronous CommonMark markdown rendering during acceptance notification email generation, consuming worker CPU proportional to input size on every request. No public exploit code has been identified at time of analysis, but the attack is straightforward for any authenticated user and requires no special privileges beyond a valid account.
Persistent denial-of-service in MongoDB Server allows any authenticated user with write privileges to trigger a fatal assertion crash via specially crafted retryable write commands, with the crash state durably written to disk so it survives server restarts. Affected releases span MongoDB 7.0.x through 7.0.40, 8.0.x through 8.0.29, and 8.3.x through 8.3.8; in sharded clusters the corrupted state can propagate across shard nodes, requiring manual DBA intervention to restore service. No public exploit has been identified and the vulnerability is not in CISA KEV, but the persistent, cluster-wide availability impact significantly elevates real-world risk beyond a transient service crash.
Persistent denial-of-service in MongoDB Server (versions 7.0.x, 8.0.x, and 8.3.x) allows an authenticated user with collection creation privileges to corrupt durable storage metadata by supplying invalid storage configuration options that bypass validation in the storage engine integration layer. The malformed values are written to disk and trigger a fatal CWE-617 assertion failure when subsequent diagnostic operations attempt to read them back, crashing the server process. Because the corrupted metadata survives server restarts and is replicated to all replica set members via the oplog, a single attack can produce a cluster-wide outage requiring manual DBA intervention at the filesystem level on every affected node. No public exploit code or CISA KEV listing exists at time of analysis.
Authenticated users holding readWrite privileges in MongoDB Server 7.0.x, 8.0.x, and 8.3.x can remotely crash the mongod server process by inserting a crafted BSON document. The vulnerability resides in the JSON Schema validation error generation path, which performs an unsafe numeric conversion on user-controlled BSON array field names without exception handling (CWE-248), causing an uncaught exception that terminates the server. No public exploit has been identified at time of analysis, though the attack path is explicitly described in the upstream advisory, lowering the bar for independent reproduction.
MongoDB Server 8.3.x exposes a type confusion (CWE-843) in its WiredTiger storage engine layer, allowing any authenticated user with readWrite privileges to crash the mongod process and keep it in a crash-loop. By creating a collection with a crafted, incompatible WiredTiger storage configuration option, the attacker causes the storage engine to misinterpret memory layout when subsequent reads are issued against that collection. Because the malicious collection configuration persists across server restarts, the denial-of-service condition is self-sustaining until an operator manually identifies and drops the offending collection. No public exploit or KEV listing has been identified at time of analysis.
Null pointer dereference in MongoDB Server 8.3.x crashes the mongod process when a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index. An authenticated user with write access can trigger an inconsistency in geometry parsing that leaves an internal object in a partially initialized state; subsequent index key generation then dereferences a null pointer and terminates the server. The net effect is a targeted denial of service requiring only a valid database account with write privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
MongoDB Server's JSON Pointer parser, invoked during $jsonSchema query filter processing, fails to enforce limits on iteration count or total allocation size, enabling authenticated remote attackers to cause significant memory amplification. Sending specially crafted find commands with malicious $jsonSchema filters - particularly under concurrent load - causes cumulative heap exhaustion that triggers MongoDB's out-of-memory handler, terminating the mongod process and denying service to all connected clients simultaneously. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
MongoDB Server 8.3.0-8.3.8 exposes an authorization bypass in the aggregation framework that allows a low-privilege authenticated user to read data from collections they are not authorized to access. The bypass is reachable only when Atlas Search features are active and works by manipulating an internal command parameter that the server failed to guard from external client input, causing a view-level security check to be skipped. No public exploit code has been identified at time of analysis, and exploitation requires an authenticated account.
Incorrect authorization in MongoDB Server's aggregation framework allows an authenticated low-privilege user to craft a specially formatted aggregation request that causes the authorization subsystem to evaluate a different operation than what the execution engine actually runs, resulting in unauthorized read access to collection data within the target database. Affected versions span MongoDB Server 7.0.0-7.0.40 and 8.0.0-8.0.29; vendor-released patches are available at 7.0.41 and 8.0.30 respectively. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low privilege requirement and network accessibility elevate the realistic threat in multi-tenant or role-segregated MongoDB deployments.
MongoDB Server's diagnostic reporting interface exposes cleartext credentials from in-flight administrative operations to any authenticated user holding monitoring-level privileges, creating a lateral-movement and privilege-escalation path via impersonation of higher-privileged accounts. Affected versions span the 7.0.x branch (before 7.0.41), 8.0.x branch (before 8.0.30), and 8.3.x branch (before 8.3.9). The server's log subsystem correctly redacts credential material, but an equivalent sanitization pass is absent from the diagnostic interface's serialization path, producing an inconsistent security boundary across two observability outputs for the same underlying data.
Credential exfiltration in n8n's OpenAI Chat Model node allows an authenticated workflow editor to redirect the model-search dropdown request - including the attached OpenAI API key - to an arbitrary attacker-controlled host by overriding `options.baseURL`. Affected versions span the v1 branch prior to 1.123.76 and the v2 branch prior to 2.37.7 and 2.38.2; the root cause is the omission of `assertOpenAiCredentialAllowsUrl` in `loadModels.ts`, the same domain-restriction guard applied elsewhere in the node. No active exploitation or public exploit code has been identified at time of analysis; vendor-released patches are available across all three branches.
UEFI Secure Boot bypass in Cisco UCS Servers and UCS-based appliances allows authenticated users with 'user' or 'admin' role credentials - or unauthenticated attackers with physical device access - to disable Secure Boot protections and execute unauthorized software at boot time. The flaw stems from UEFI Shell memory-write commands remaining accessible while Secure Boot is active, enabling direct manipulation of Secure Boot validation variables in UEFI memory. A successful exploit undermines firmware integrity controls, potentially allowing persistent pre-OS implants or untrusted bootloaders on enterprise server infrastructure. No public exploit code or CISA KEV entry has been identified at time of analysis.
Cross-site request forgery in AVideo's YPTWallet plugin enables unauthenticated attackers to set arbitrary wallet balances for any user by tricking an authenticated administrator into loading a malicious webpage. The vulnerable endpoint `plugin/YPTWallet/view/saveBalance.php` relies exclusively on session cookies for request authorization with no CSRF token validation, meaning a forged POST request is accepted as legitimate whenever an admin's browser submits it. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the attack is trivially constructable from the public advisory.
Use-after-free (CWE-416) in the Windows TCP/IP networking stack enables an authenticated, low-privileged attacker to escalate privileges to a higher trust level via a network-based attack path. The vulnerability affects a broad surface - Windows 10 through Windows 11 and Windows Server 2012 through 2025 - making the potential impact wide despite the elevated attack complexity (AC:H) and required user interaction (UI:R) constraints in the CVSS vector. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Use-after-free in the Windows TCP/IP driver allows a network-adjacent low-privileged authenticated attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server 2019-2025 installations. The CVSS:3.1 vector (AV:N/AC:H/PR:L/UI:R) indicates exploitation requires high attack complexity and user interaction, consistent with a race-condition-triggered UAF in the kernel networking stack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the broad affected product surface and the Microsoft-origin report make this a priority for enterprise patch cycles.
Privilege escalation via use-after-free in the Windows Win32K kernel graphics subsystem affects every supported Windows 10/11 release and Windows Server 2012 through 2025, allowing a low-privileged authenticated attacker who can induce user interaction with crafted content to achieve full kernel-level compromise (C:H/I:H/A:H). The network attack vector reflects delivery through browser rendering or document processing pipelines that invoke Win32K GDI syscalls, rather than direct remote exploitation. No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
Privilege escalation in Windows PrintWorkflowUserSvc affects a broad range of Windows 10, 11, and Server editions through a use-after-free memory corruption condition reachable over a network. A low-privileged authenticated attacker can exploit the vulnerability under high-complexity conditions that require user interaction, ultimately achieving C:H/I:H/A:H impact at an elevated privilege level. Microsoft has released patches across all affected product lines; no public exploit code has been identified at time of analysis.
Privilege escalation via use-after-free in the Windows HTTP.sys kernel-mode driver allows a low-privileged authenticated attacker to gain full SYSTEM-level control over affected Windows 11 and Windows Server 2025 hosts via a network attack path. The vulnerability (CWE-416) carries CVSS 7.1 with AC:H and UI:R, indicating a race-condition-dependent exploit requiring specific concurrent conditions rather than a simple reliable trigger. No public exploit identified at time of analysis; Microsoft has released cumulative update patches for all affected builds.
Privilege escalation in Windows Hyper-V allows a network-adjacent low-privileged attacker to gain full system control (C:H/I:H/A:H) by exploiting a missing authorization check. The flaw, rooted in CWE-862 (Missing Authorization), requires the attacker to already hold a low-privilege account and to trigger user interaction, placing it at CVSS 7.1 with high complexity. Microsoft has released patches across the full range of affected Windows 10, Windows 11, and Windows Server builds; no public exploit or CISA KEV listing has been identified at time of analysis.
Local denial of service in the Windows Virtual Hard Disk (VHD) Miniport Driver enables unprivileged attackers to crash the host operating system across every supported Windows release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025. A malformed VHD operation submitted by a local user with no elevated privileges triggers a null pointer dereference (CWE-476) in the kernel-mode driver, producing an unhandled exception that results in a Blue Screen of Death and complete system outage. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Privilege escalation in Windows Print Spooler Components affects virtually all supported Windows client and server releases, enabling an authenticated low-privileged attacker operating over the network to achieve full system compromise by winning a race condition on an improperly synchronized shared resource. The CVSS vector (AC:H/UI:R) reflects that exploitation is non-trivial - the attacker must both time the race window precisely and depend on victim interaction - making opportunistic mass exploitation unlikely compared to targeted attacks. Microsoft has released patches across all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Remote Desktop Client allows an authorized network attacker to fully compromise a victim's client machine by exploiting use of an uninitialized resource (CWE-908) during an RDP session with a malicious server. Every major Windows client and server release - Windows 10/11 in all currently-supported feature versions and Windows Server 2016 through 2025 including Server Core - is affected below specific cumulative update build thresholds. Microsoft has issued patches via the MSRC update guide; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Use-after-free in Windows Remote Desktop Gateway Service enables an authorized network attacker to escalate privileges, with full confidentiality, integrity, and availability impact on affected Windows Server hosts. The vulnerability spans Windows Server 2012 through 2025 and specific Windows 10 builds, all addressed by patched builds released by Microsoft. No public exploit code has been identified at time of analysis and CISA KEV listing is absent; however, RD Gateway is a frequently internet-exposed service, making prompt patching operationally significant.
Privilege escalation via double-free memory corruption in the Windows Registry subsystem allows a low-privileged, network-connected authenticated attacker - with required user interaction - to elevate to higher privilege levels, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually every supported Windows release from Server 2012 R2 through Windows 11 26H1 and Server 2025, representing an enormous aggregate attack surface. Microsoft has released patches via its standard update channel; no public exploit has been identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Privilege escalation via use-after-free in the Windows Device Association Broker service affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 1607/1809 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated network attacker who can induce a user to interact with the vulnerable service can exploit the freed memory reference to gain full C:H/I:H/A:H impact - effectively achieving elevated privileges over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the widespread prevalence of affected Windows versions makes patch prioritization important.
Use-after-free in the Windows Win32K kernel subsystem allows an authenticated low-privileged attacker to escalate privileges to a higher level on affected Windows systems. Win32K is the kernel-mode graphics and windowing component; UAF memory corruption in this subsystem is a well-established privilege escalation class. The attack carries high complexity (AC:H) and requires user interaction (UI:R), and Microsoft has released patched builds across a wide range of Windows client and server versions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in Windows Print Spooler Components enables a low-privileged authenticated attacker to elevate privileges to SYSTEM or higher over a network connection. Affecting every supported Windows desktop and server release from Server 2012 through Windows 11 26H1 and Server 2025, the vulnerability is reached via the Spooler's RPC interface, which historically has been a prolific attack surface (PrintNightmare, SpoolFool). No public exploit code has been identified at time of analysis and it does not appear in CISA KEV, but the breadth of affected versions and ubiquitous deployment make rapid patching critical.
Denial of service in Silicon Labs RS9116W/SiWx917 wireless modules running WiSeConnect 2.x allows an adjacent unauthenticated attacker to crash or disable the wireless stack by sending a crafted, unencrypted 'pause encryption request' management frame. The device incorrectly accepts and acts on this unauthenticated control message without verifying that it is protected by the session encryption, violating the expected security contract (CWE-440). This vulnerability was documented as finding B-E10 in a published academic research paper (arXiv:2409.02905), indicating it was discovered through systematic protocol-level analysis of Wi-Fi chipset behavior. No public exploit code or KEV listing is known at time of analysis.
Craft CMS 5.0.0-RC1 through 5.10.11 allows an authenticated control panel user with the `administrateUsers` permission - but without administrator status - to activate pending or deliberately deactivated administrator accounts via the `users/activate-user` action. The `actionActivateUser` method in `UsersController` correctly gates itself behind `administrateUsers` but omits the `requireAdmin()` call that the mirror `actionDeactivateUser` action uses when the target is an administrator, creating an asymmetric authorization implementation. When chained with a password-reset request on the newly activated admin account, a non-admin operator can achieve full administrator control of the CMS. No public exploit identified at time of analysis; the issue is fixed in Craft CMS 5.10.12.
Authenticated streamers on AVideo through version 29.0 can harvest source stream keys and identity information belonging to all other active streamers by querying the restreamsActive.json.php endpoint, which applies no per-user ownership filtering. The exposed stream keys are live transmission credentials that can be used to impersonate affected streamers on third-party platforms such as YouTube Live or Twitch, enabling broadcast hijacking or session disruption. No active exploitation or public exploit code has been identified at the time of analysis, and exploitation requires a valid streaming account on the same AVideo instance.
Missing authorization in AVideo's SocialMediaPublisher plugin allows any authenticated user to overwrite another account's OAuth token records via an IDOR flaw in the add.json.php endpoint. By supplying arbitrary database row IDs, an attacker can corrupt a victim's stored access_token and refresh_token, then delete the record to permanently destroy the victim's social media provider linkage. No public exploit has been identified at time of analysis; exploitation requires a valid AVideo account (PR:L).
Cross-site request forgery in WWBN AVideo through commit c3edcc274c allows unauthenticated remote attackers to manipulate live streaming state by inducing administrative users to visit attacker-controlled pages. The affected endpoints - deleteHistory.json.php and finishAll.json.php - accept state-changing GET requests without CSRF token validation, meaning a simple embedded image or link is sufficient to trigger destructive operations. An attacker can silently erase all live transmission history or mark active streams as finished with only passive administrator interaction, with no public exploit identified at time of analysis.
Use-after-free in PX4 Autopilot through 1.17.0 allows an adjacent unauthenticated attacker to corrupt flight-stack heap memory by issuing a single `load_mon stop` command over a MAVLink or PXH shell. The bug in `exit_and_cleanup()` frees the LoadMon object and its performance counter before `perf_end()` consumes it, producing a dangling-pointer dereference that corrupts heap objects and destabilizes the autopilot flight stack - in a UAV context, a plausible pathway to loss of vehicle control mid-flight. An upstream fix has been merged as PR #28544; no public exploit code is identified and the CVE is not listed in CISA KEV.
The wpeddpcf_delete_feed AJAX handler in EDD Product Catalog Feed by PixelYourSite (WordPress plugin, all versions ≤1.0.2) omits a capability check, allowing any authenticated subscriber-level user to invoke the function and delete arbitrary entries from the WordPress options table. An attacker who deletes a critical option-such as active_plugins, siteurl, or the active theme-can render the entire WordPress installation non-functional, denying service to all legitimate users. No public exploit code or CISA KEV listing exists at time of analysis; Wordfence reported and disclosed the vulnerability.