Input data manipulation in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module versions 9.0.0 through 9.0.2 allows unauthenticated remote attackers to submit improperly validated quantity values during the payment flow, per CVSS PR:N/AV:N/UI:N. CWE-1284 (Improper Validation of Specified Quantity in Input) in a payment gateway context typically enables transaction amount tampering - yet the vendor-assigned CVSS vector scores I:N/A:H, characterizing the impact as primarily availability disruption rather than integrity compromise, a direct contradiction with the 'Input Data Manipulation' label applied to the finding. Reported by TR-CERT; no public exploit or KEV listing identified at time of analysis.
Arbitrary OS command execution in electerm before 5.3.15 is achievable through a completely unvalidated Electron IPC bridge that exposes 40+ main-process functions - including openFileWithEditor and runGlobalAsync - to any renderer-side script without allowlisting function names or validating the sender's identity. An attacker who achieves renderer-side script execution (e.g., via XSS through malicious SSH server output or a compromised webview) can pivot directly into the main process and invoke system-level operations with no further authentication. No public exploit is identified at time of analysis, but the patch commit (b1f880534b8ae066c5d25bbf291ca7437e052750) is publicly available and makes the exploitation surface trivially reconstructible.
Unauthenticated HTTP Denial of Service in WooCommerce (all versions before 11.1.0) allows remote attackers to exhaust server resources without any credentials, rendering affected storefronts and admin panels unavailable. The root cause is CWE-770 - missing throttling or resource allocation limits on one or more HTTP-accessible endpoints within the plugin. Patchstack reported the issue and a patched release (11.1.0) is available; no active exploitation or public proof-of-concept code has been identified at time of analysis.
Missing authorization in the Hungarian WooCommerce pickup-points and shipping-labels plugin (versions before 4.2.8) allows unauthenticated remote attackers to perform actions that should be restricted to authorized users, resulting in high-integrity impact against affected WooCommerce stores. The flaw, classified as CWE-862 (Missing Authorization), means the plugin fails to verify whether the requesting party has the right to perform privileged operations - distinct from authentication failure. No public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass via capture-replay in Microsoft Authentication Library (MSAL) for Node.js versions 1.0.0 through 5.5.x allows an unauthenticated network-adjacent attacker to spoof authenticated identity by replaying captured tokens. The CWE-294 root cause means a previously captured authentication artifact can be reused to impersonate a legitimate user, yielding high confidentiality and integrity impact consistent with the CVSS C:H/I:H scores. No public exploit or active exploitation is known at time of analysis, but Microsoft has released a patch at version 5.6.0.
Authorization bypass in IBM Enterprise Build of Quarkus 3.27.1-3.27.5 and 3.33.1-3.33.3 allows unauthenticated network attackers to access or modify resources belonging to other users or roles by manipulating URL query parameters. The root cause (CWE-639) is incorrect mapping of user-controlled query string values to authorization decisions, enabling an attacker to substitute an arbitrary object key and have the application honor the substituted identity without re-validating access rights. No public exploit code has been identified at time of analysis, but the C:H/I:H CVSS impact and network attack vector make this a meaningful risk for exposed deployments.
Session fixation in Adobe Photoshop Mobile for Android (versions ≤1.6.0.2294 and ≤1.6.0.2299) enables privilege escalation by allowing an attacker to pre-establish or predict a victim's session token before authentication completes. When a victim interacts with an attacker-controlled malicious webpage, the fixed session identifier persists into the authenticated state, granting the attacker access to sensitive Adobe resources with elevated privileges. The S:C scope change in the vendor's CVSS vector indicates the compromised session likely extends beyond the app itself to Adobe backend services such as Creative Cloud. No public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Fast FAT filesystem driver (fastfat.sys) enables local code execution across a wide range of Windows client and server versions. The vulnerability is reachable without elevated privileges (PR:N, AV:L) under high-complexity conditions, suggesting a crafted FAT volume - such as a malicious USB drive or mounted disk image - can trigger the overflow in kernel space. No public exploit or active exploitation has been identified at time of analysis, but the combination of full C:H/I:H/A:H impact and breadth of affected versions (Windows 10 through Windows 11 26H1 and Server 2012 through Server 2025) makes patching a priority for environments with physical or removable-media exposure.
XML External Entity (XXE) injection in Hitachi Cosminexus Component Container allows unauthenticated remote attackers to disclose sensitive local files or cause a denial of service through maliciously crafted XML input. The vulnerability spans an extensive range of versions across the 09-xx through 11-xx release trains, indicating a long-lived parser misconfiguration in the middleware's XML processing subsystem. No public exploit code or active exploitation has been confirmed; Hitachi has released patches for the actively maintained branches.
Heap-based buffer overflow in Microsoft Office Access enables local code execution with full system impact when a low-privileged user opens a specially crafted database file. Affected products span Access 2016 through Microsoft 365 Apps for Enterprise, covering the majority of Microsoft Office deployments. Microsoft has released patches across all affected product lines; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Local privilege escalation in Microsoft .NET Runtime and Visual Studio exploits a code injection weakness (CWE-94) allowing a low-privileged authenticated local user to gain full system-level control over confidentiality, integrity, and availability. Affected versions span .NET 9.0, 10.0, and the pre-release 11.0 RC1, plus Visual Studio 2022 (17.14.x) and the pre-release Visual Studio 2026 (18.9.x). No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected release branches.
Privilege escalation in Windows IP Address Management (IPAM) allows an authenticated local user on any of a broad range of unpatched Windows 10, 11, and Windows Server releases to obtain full system-level control by supplying a crafted serialized payload to the IPAM service. The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data) and carries a CVSS 3.1 base score of 7.0 under a local, high-complexity attack vector with full C:H/I:H/A:H impact. No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified at time of analysis, but the complete impact triad makes successful exploitation severely damaging on any affected host.
Deserialization of untrusted data in Commvault Cloud's Content Extractor component enables privilege escalation, producing high impact across confidentiality, integrity, and availability of affected systems. The flaw targets the privilege management subsystem and requires local access with low-level credentials under specific environmental conditions (CVSS 4.0 AV:L/AC:H/AT:P/PR:L). Commvault has released a maintenance update resolving the issue; no public exploit code or active exploitation has been identified at the time of analysis.
Local privilege escalation in Android's StorageManagerService (Android 14 through 17) stems from an unsafe PendingIntent in getManageSpaceActivityIntent that enables a LaunchAnyWhere attack chain, allowing a malicious low-privilege app to intercept and redirect activity launches into privileged system contexts. The vulnerability requires user interaction - specifically navigating the storage management UI - but once triggered, yields full compromise of confidentiality, integrity, and availability on the device. No public exploit has been identified at time of analysis; Google's September 2026 Android Security Bulletin documents the fix.
Tapjacking vulnerability in Android's DeviceAdminAdd.java enables a locally-installed malicious application to render a transparent overlay over the device administrator enrollment screen, coercing users into unknowingly granting device admin privileges. Affected versions span Android 14, 15, 16, and 16-QPR2, covering a broad swath of current Android devices. Successful exploitation grants the attacker app full device administrator rights, enabling complete confidentiality, integrity, and availability compromise of the victim device. No public exploit exists and EPSS is at the 2nd percentile; SSVC rates technical impact as total but exploitation as none.
Intent redirection in Android's SetupPassthroughActivity allows a locally present, low-privilege attacker to launch arbitrary activities and escalate privileges to a higher-trust system level. Affecting Android 14 through 17 (including 16-qpr2), the flaw resides in the onCreate method of SetupPassthroughActivity.java and requires user interaction to trigger. No public exploit is identified at time of analysis, and an EPSS of 0.11% (2nd percentile) indicates minimal current exploitation probability, consistent with the SSVC exploitation-none signal.
Local privilege escalation in Android's ChannelImpl.java allows a low-privileged installed application to launch arbitrary intents by exploiting improper input validation in the initAppLinkTypeAndIntent method. Affected versions span Android 14 through 17, including 16-QPR2. Exploitation requires user interaction, limiting automated attack at scale - SSVC confirms no observed exploitation and EPSS sits at 0.11% (2nd percentile), consistent with the local-access, user-interaction gating.
Credential leakage in the Okta Hyperdrive Integration installer (versions 1.2.0 through 1.5.1) exposes the OAuth client secret in plaintext across three Windows logging surfaces - the MSI installer log, the Windows Application Event Log, and the process command line - whenever the secret is supplied as an MSI property at install time. An authenticated local user on the workstation can read any of these surfaces and extract the credential without elevated privileges. The leaked OAuth client secret can then be used to authenticate against Okta services outside the local machine, explaining the scope change in the CVSS vector and elevating the effective impact beyond a simple local information disclosure. No public exploit has been identified and the vulnerability is not listed in CISA KEV; Okta has released a patch at version 1.5.2.
Authenticated OS command injection in Dogtag PKI's certificate profile import mechanism allows a CA Administrator to achieve code execution as the pkiuser account on RHEL 6-10 and Red Hat Certificate System 9. By uploading a crafted certificate profile that exploits the ExternalProcessConstraint mechanism with attacker-controlled environment variables, a privileged attacker can bypass the limited profile ID validation and execute arbitrary system commands. No public exploit or active exploitation is known at time of analysis, but the CVSS 7.2 / PR:H rating reflects that CA Administrator access is a prerequisite.
Out-of-bounds memory write in MongoDB Server 8.3.x allows authenticated users with write privileges to crash the mongod server process or potentially achieve arbitrary code execution by supplying crafted storage engine configuration parameters at collection creation time. Versions 8.3.0 through 8.3.8 are affected; a vendor-released fix is available in 8.3.9. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Use-after-free in MongoDB Server 8.3.x (versions 8.3.0 through 8.3.8) allows authenticated users holding read-only privileges to write to freed heap memory by issuing a specific sequence of standard database commands against the query execution memory tracking subsystem. The immediate consequence is a server process crash (denial of service); heap memory corruption may also enable more sophisticated follow-on exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available in 8.3.9.
Use-after-free in Windows Management Instrumentation (WMI) enables an authenticated low-privilege attacker operating over a network to escalate privileges on affected systems, with full confidentiality, integrity, and availability impact when successfully exploited. The CVSS vector (AC:H/UI:R) reflects meaningful exploitation complexity - a specific race condition must be won and some form of user interaction is required, constraining opportunistic mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions - from Server 2012 to Server 2025 and Windows 10/11 across all current branches - makes patch prioritization important for enterprise environments.
Privilege escalation via use-after-free (CWE-416) in the Windows Kernel enables a network-accessible, low-privileged authenticated user to elevate to SYSTEM privileges across a broad range of Windows client and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has confirmed and released fixed builds for all affected versions via the MSRC advisory. No public exploit code or CISA KEV listing has been identified at time of analysis; the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce the near-term risk of automated mass exploitation despite the full C:H/I:H/A:H impact triad.
Use-after-free in the Windows Search Component enables an authenticated low-privileged network attacker to elevate privileges, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the unpatched population extremely large. Microsoft has released specific patch builds for each affected platform; no public exploit code or CISA KEV listing has been identified at time of analysis, but AC:H and UI:R constrain opportunistic mass exploitation.
Privilege escalation via use-after-free in the Windows Kernel exposes an enormous swath of the Microsoft ecosystem - spanning Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - to network-reachable elevation of privilege by an authenticated attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation is constrained by high complexity and a required victim interaction, but a successful attack yields full kernel-level confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Encrypting File System (EFS) service enables a low-privileged authenticated attacker to elevate privileges to a higher level over a network connection. The vulnerability (CWE-122) spans virtually the entire supported Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - making it a broad enterprise patching obligation. Microsoft has released cumulative updates addressing the issue; no public exploit or CISA KEV entry has been identified at time of analysis.
Privilege escalation via use-after-free in the Windows Device Association Broker service affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 1607/1809 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated network attacker who can induce a user to interact with the vulnerable service can exploit the freed memory reference to gain full C:H/I:H/A:H impact - effectively achieving elevated privileges over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the widespread prevalence of affected Windows versions makes patch prioritization important.
Privilege escalation via use-after-free in Windows Desktop Window Manager (DWM) Core Library affects Windows Server 2025 and Windows 11 23H2, allowing an authenticated attacker with low privileges to gain elevated system access over a network. The vulnerability stems from improper memory management (CWE-416) in the DWM graphics subsystem, and successful exploitation delivers high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and Microsoft has released patches via the MSRC update guide.
Use-after-free in Windows Modern Device Management (MDM) enables a low-privileged authenticated attacker to escalate to SYSTEM-level privileges across a broad swath of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:N/AC:H/PR:L/UI:R) indicates the attack is network-reachable but constrained by high exploitation complexity and required user interaction, limiting opportunistic mass exploitation. Microsoft has released patched builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows NDIS (Network Driver Interface Specification) allows a low-privileged authenticated attacker to gain full control of the target system through a kernel-level use-after-free condition. The flaw spans an exceptionally wide range of Microsoft platforms, from end-of-life Windows Server 2012 through current Windows 11 25H2 and Server 2025 builds. Exploitation is constrained by high attack complexity and required user interaction per the CVSS vector; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges via a network attack vector, affecting Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Exploitation requires user interaction and high attack complexity (AC:H), tempering the otherwise severe C:H/I:H/A:H impact profile. Microsoft has released patches across all affected build lines; no public exploit or CISA KEV confirmation is present at time of analysis.
Heap-based buffer overflow in the Microsoft Windows XPS (XML Paper Specification) document processing component allows a low-privileged authenticated attacker to elevate privileges over a network. The vulnerability spans virtually all supported Windows client and server releases, from Windows 10 Version 1607 through Windows 11 Version 26H1 and Windows Server 2012 through Server 2025. Exploitation requires high complexity and active user interaction, preventing opportunistic mass exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) subsystem allows a low-privileged authenticated attacker to escalate to full system-level privileges across a broad range of Windows versions. The flaw (CWE-122) requires high attack complexity and user interaction, making opportunistic mass exploitation less likely, but the full C:H/I:H/A:H impact on successful exploitation is severe. Patch versions have been released by Microsoft for all affected Windows builds; no public exploit or CISA KEV listing identified at time of analysis.
Use after free in the Windows Device Association Service enables network-based privilege escalation by low-privilege authenticated attackers across Windows 10, Windows 11, and Windows Server 2012 through 2025. The CVSS 3.1 score of 7.1 accurately reflects meaningful exploitation constraints - high attack complexity, required user interaction, and prior authentication - despite the maximal CIA impact if exploitation succeeds. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free memory corruption in the Windows Remote Desktop Licensing Service allows an authenticated, low-privileged network attacker to elevate privileges to a higher-privileged context. Affected systems span Windows Server 2012 through Server 2025, as well as Windows 10 versions 1607 and 1809. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches across all affected build lines.
Use-after-free in Windows Print Spooler Components enables a low-privileged authenticated attacker to elevate privileges to SYSTEM or higher over a network connection. Affecting every supported Windows desktop and server release from Server 2012 through Windows 11 26H1 and Server 2025, the vulnerability is reached via the Spooler's RPC interface, which historically has been a prolific attack surface (PrintNightmare, SpoolFool). No public exploit code has been identified at time of analysis and it does not appear in CISA KEV, but the breadth of affected versions and ubiquitous deployment make rapid patching critical.
OS command injection in Azure HDInsight allows a network-accessible, high-privileged attacker to escalate privileges on the underlying cluster infrastructure. The vulnerability (CWE-78) arises from insufficient neutralization of special characters passed to OS-level commands within the HDInsight control plane or management interface, enabling an authorized administrator to break out of their intended permission scope and execute arbitrary OS commands. Reported via Microsoft MSRC (secure@microsoft.com), a vendor patch has been released; no public exploit code or CISA KEV listing is present at time of analysis.
Command injection in Fortinet FortiSandbox allows a remote, highly privileged attacker to execute arbitrary OS commands on the underlying system, achieving full confidentiality, integrity, and availability compromise. Affected versions span FortiSandbox 4.2.1-4.2.8, 4.4.0-4.4.9, 5.0.0-5.0.6, and 5.2.0, covering a wide release range across multiple major branches. The temporal CVSS metrics (E:F/RL:O/RC:C) confirm that a functional exploit exists and an official patch has been released, making prompt patching the priority action.
Server-Side Request Forgery in the Hide My WP Ghost WordPress plugin (all versions through 7.0.09) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external hosts. Reported by Patchstack under EUVD-2026-72652, the vulnerability carries a CVSS 7.2 with scope change (S:C), meaning successful exploitation can affect infrastructure beyond the WordPress host itself - including cloud metadata endpoints or internal network services. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Windows Remote Desktop Services (RDS) is possible through a use-after-free memory condition exploitable by a network-authenticated, low-privilege attacker. Affected platforms span Windows Server 2025 and Windows 11 versions 23H2 through 26H1, with fixed builds specified per-release in the MSRC advisory. The CVSS 7.1 score reflects genuine barriers - high attack complexity (AC:H) and required user interaction (UI:R) - despite full C/I/A impact potential; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Windows Network Driver Interface Specification (NDIS) subsystem enables an authenticated network attacker to elevate privileges on affected Windows systems. The vulnerability spans a wide range of Windows client and server releases - from Server 2012 through Windows 11 and Server 2025 - and requires both low-privilege authentication and user interaction to exploit, substantially tempering the real-world risk relative to the high CIA impact scores. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through the July 2026 update cycle.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) document processing component enables an authenticated, low-privileged attacker to escalate privileges across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. Exploitation requires user interaction and high attack complexity, limiting automated or opportunistic attacks despite the network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches with confirmed fixed build numbers.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) component across Windows 10, Windows 11, and Windows Server versions from 2012 through 2025 enables a low-privileged authenticated attacker to escalate to full system control. Exploitation requires high attack complexity and active user interaction - consistent with a scenario where a specially crafted XPS document must be opened by the target. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available via Microsoft's update infrastructure.
Persistent denial-of-service in XenForo's BBCode parser allows any authenticated forum member to crash PHP-FPM workers for all visitors by submitting a single post with sufficiently deep BBCode nesting. The recursive parser exhausts PHP's call stack, generating fatal errors that terminate worker processes - and because the malicious post persists in the database, every subsequent render of the affected thread repeats the crash, sustaining the outage until the post is removed or the forum is patched. Fixed in XenForo 2.3.13; no public exploit code has been identified at time of analysis.
MongoDB Server's $regexFindAll aggregation expression contains a reachable assertion (CWE-617) that any authenticated user with aggregation pipeline execution rights can trigger to crash the mongod process. When a regex match operation begins at a byte offset falling inside a multi-code-unit character - such as a multi-byte UTF-8 sequence or a Unicode surrogate pair - the internal invariant check fires and the database process terminates, causing a full denial of service for all connected clients. No public exploit code and no CISA KEV listing exist at time of analysis, but the triggering condition is deterministic and reproducible by any authenticated attacker who can submit crafted aggregation input.
ReDoS (regular expression denial of service) in n8n's Git node clone operation allows an authenticated workflow editor to freeze the entire n8n instance with a single workflow execution. The vulnerability stems from catastrophic backtracking in the default N8N_BLOCK_FILE_PATTERNS regex (`^(./).git(/.)$`), which runs synchronously in the main process against an attacker-controlled destination path. Fixed versions 1.123.76, 2.37.7, and 2.38.2 are available; no public exploit or KEV listing identified at time of analysis.
Windows Error Reporting (WER) across a broad range of Windows 10, Windows 11, and Windows Server releases creates temporary files in directories with insecure permissions, enabling a local attacker with standard user privileges to tamper with those files and read their contents. The vulnerability is classified as CWE-379 and carries a CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact achievable without elevated rights. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.
MongoDB Server's query planning component harbors a CWE-190 integer overflow that enables an authenticated database user with ordinary read/write privileges to crash the entire server node via a specially crafted query. The overflow bypasses an internal resource limit during query planning, triggering unbounded memory consumption that terminates the server process and denies service to all databases hosted on that node. Affected release lines are 7.0.x (below 7.0.41), 8.0.x (below 8.0.30), and 8.3.x (below 8.3.9); MongoDB has released patches for all three; no public exploit or CISA KEV listing was identified at time of analysis.
Stack exhaustion via uncontrolled recursion in Qt's QDomDocument XML serialization allows a remote attacker to crash any Qt application that processes untrusted XML input, resulting in a denial-of-service condition. Affected applications using the QtXml module parse attacker-supplied deeply nested XML documents, triggering recursive descent without a depth guard until the call stack is exhausted. No code execution is possible; impact is limited to application availability. No public exploit or CISA KEV listing has been identified at time of analysis.
Client-side authentication bypass in Microsoft Skype for Business Server enables a low-privileged network attacker to perform identity spoofing against other users on the platform. The flaw stems from CWE-603 (Use of Client-Side Authentication), where the server delegates trust to client-controlled data, allowing an authenticated user to forge session identity and corrupt integrity of communications. Three supported server product lines are affected with vendor patches now available; no public exploit or active exploitation has been identified at time of analysis.