Improper access control in Fortinet FortiManager and FortiManager Cloud allows authenticated administrators to bypass the workflow session approval process via crafted HTTP or HTTPS requests (CWE-284). Affected versions span FortiManager 6.4.x through 7.6.4 and FortiManager Cloud 6.4.x through 7.6.4 per EUVD intelligence, a broader range than the base CVE description indicates. An admin who should be subject to a change-management or four-eyes approval policy can circumvent that gate, pushing unapproved configuration changes to managed FortiGate devices. No public exploit code or CISA KEV listing is identified at time of analysis.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition enables an authorized high-privilege attacker to inject malicious script into SharePoint pages, causing spoofing attacks against other users who view the injected content. The CVSS base score of 3.5 reflects the high authentication bar (PR:H) and mandatory victim interaction (UI:R), confining realistic exploitation to insider-threat scenarios or compromised privileged accounts rather than external unauthenticated attackers. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Header injection authentication bypass in Okta Access Gateway (versions prior to 2026.9.1) allows unauthenticated network attackers to impersonate any user identity by supplying a forged HTTP header when the optional pass-through authentication source is enabled without upstream header sanitization. The vulnerability (CWE-287) stems from the gateway's unconditional trust of a client-controlled HTTP header as an identity assertion, with no cryptographic binding or signature verification. No public exploit code has been identified at time of analysis; Okta has released a patched version (2026.9.1) via security advisory.
Use-after-free in the Windows Overlay Filter kernel driver exposes stale freed memory to authenticated low-privilege attackers capable of reaching the target over a network. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through Server 2025, representing virtually the entire supported Microsoft Windows ecosystem. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Sensitive kernel information is exposed to low-privileged local users through a CWE-497 flaw in the Windows Win32K graphics subsystem, confirmed by Microsoft's own security team (secure@microsoft.com). The scope-changed CVSS vector (S:C/C:H) indicates the leaked data originates from the kernel security boundary, making this a classic KASLR-defeat primitive that threat actors chain with separate privilege-escalation exploits to achieve full system compromise. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; vendor patches covering every supported Windows release are available.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode port driver for the Windows Storage Spaces subsystem) allows a locally authenticated, low-privileged attacker to disclose kernel memory contents under high-complexity conditions. The vulnerability spans virtually all supported Windows releases - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - making the patch surface extremely wide. Microsoft has released fixes for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Uninitialized kernel memory in Win32K (win32k.sys) enables local attackers with standard user privileges to read sensitive kernel memory contents on affected Windows systems. The vulnerability spans virtually all currently supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 25H2/26H1. No public exploit identified at time of analysis, though Win32K info-leaks of this class are routinely chained with privilege escalation exploits to defeat kernel address space layout randomization (KASLR).
Buffer over-read (CWE-126) in the Windows Overlay Filter (WofFilter) kernel driver enables local authenticated attackers with standard user privileges to disclose kernel memory contents under high-complexity conditions. The vulnerability spans a broad range of supported Windows 10, Windows 11, and Windows Server releases from build 1607 through 26H1, all patched via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.7 medium score reflects the local, high-complexity exploitation barrier.
Tampering via NTFS link-following in Windows 11 allows a local low-privileged attacker to overwrite or modify files they would not ordinarily have write access to. The vulnerability (CWE-59) is triggered when a privileged Windows component resolves a symlink or junction point created by the attacker, resulting in file access against an unintended target. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected Windows 11 versions.
Out-of-bounds read in the Windows Bluetooth Port Driver (bthport.sys) allows a local, low-privileged authenticated attacker to disclose kernel memory contents under high-complexity conditions. Affected platforms span Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1), Windows Server 2022, and Windows Server 2025 across specific build thresholds confirmed by EUVD version data. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis, constraining real-world risk to post-compromise or insider scenarios.
Security feature bypass in Windows Win32K allows a locally authenticated, low-privileged attacker to exploit a kernel-level race condition and circumvent an OS-enforced integrity control, yielding high integrity impact without any confidentiality or availability effect. The flaw spans virtually every supported Windows SKU from Windows 10 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. Microsoft has released per-SKU patches; no public exploit code has been identified at time of analysis.
Local denial of service in Windows Secure Socket Tunneling Protocol (SSTP) stems from a missing resource release after effective lifetime (CWE-772), allowing an authenticated local attacker to exhaust resources and cause service unavailability. The flaw spans a broad range of Windows and Windows Server releases from Server 2012 through Windows 11 26H1 and Server 2025, confirmed by Microsoft's security response center. No public exploit or active exploitation has been identified; vendor patches are available via the standard Windows Update cycle.
Symlink-following in Windows Container Manager Service allows a local low-privileged authenticated user to bypass a security feature and read files outside the intended access boundary. Affected are Windows 11 versions 23H2, 24H2, 25H2, and 26H1 across specific build ranges, per EUVD. Impact is limited to confidentiality (C:H), with no integrity or availability consequence. No public exploit code and no CISA KEV listing are present at time of analysis.
Out-of-bounds read in Windows Image Acquisition (WIA) allows a local low-privileged attacker to disclose sensitive memory contents on unpatched Windows systems. The vulnerability affects a wide swath of Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, meaning virtually every supported and extended-support Windows environment is potentially in scope. No public exploit or CISA KEV listing has been identified at time of analysis, and the high attack complexity (AC:H) materially constrains opportunistic exploitation despite the breadth of affected versions.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) document processing stack enables a local low-privileged attacker to disclose sensitive memory contents under high-complexity conditions. The flaw spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2012 through Windows 11 25H2 and Server 2025 - making patch deployment across heterogeneous environments operationally significant. Microsoft has released patches via the standard update guide; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Microsoft Windows SCSI Class System File driver (CWE-125) exposes kernel memory contents to an attacker with physical access to the target machine. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases, from build 10.0.17763 through current 25H2 and Server 2025 lines. No active exploitation or public proof-of-concept has been identified; vendor-released patches are available via the July 2026 Microsoft Security Update.
Out-of-bounds read in the Windows CD-ROM kernel-mode driver exposes kernel memory contents to an attacker with physical access across virtually every supported Windows release from Server 2012 through Windows 11 Version 26H1. The flaw (CWE-125) allows kernel memory disclosure - potentially including credentials or cryptographic material - when a crafted disc interaction or malformed IOCTL triggers a read beyond the intended buffer boundary. Microsoft has released patches; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Heap-based buffer overflow in the Windows RNDIS (Remote Network Driver Interface Specification) driver allows a physically present, unauthenticated attacker to disclose heap memory contents. Exploitation requires direct physical access to the target device, as the attacker must connect a malicious USB RNDIS device to trigger the overflow. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, making real-world risk low outside of targeted physical attacks.
Let me synthesize. Product: Halo (halo-dev/halo) — a Java-based blog/CMS platform. Product name: "Halo". Vulnerability: CWE-94 code injection — plugin management allows installing/updating malicious plugins leading to arbitrary command execution with Halo process privileges. CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N = 4.6. Interesting — low privilege, requires user interaction, confidentiality/integrity low, no availability impact. Scope unchanged. EPSS 0.16% percentile 5% — very low. No KEV. No POC explicitly stated (references include a GitHub issue report from a researcher - MyCVE-Report). Tags: RCE, Code Injection. Affected: Halo <= 2.25.4. Prevalence: Halo is a popular open-source blog/CMS in China — medium (common but not everywhere). I'd say "medium" — it's a widely used open-source CMS/ blogging platform, but niche-ish. Let's say medium with basis "popular open-source Java CMS/blog platform, limited enterprise footprint". Assessed CVSS: The description says plugin management allows users to install/update malicious plugins — requires authenticated user with plugin management permission (admin typically), plus user interaction (UI:R from vector). Actually the input vector already says PR:L, UI:R. Hmm, but plugin management typically requires admin. The provided CVSS says PR:L. I might assess PR:L as given but arguably PR:H. I should be honest. Let me use CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N — but the impact of arbitrary command execution should be high. However CVSS given is low impacts. The description says "execute any command with Halo process permissions" — that would be C:H/I:H/A:H arguably. But scope unchanged and Halo process permissions limited. Hmm. I'll assess as AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H? Let me think: to install a plugin you need plugin management privilege — typically administrator. The given vector says PR:L though. Actually maybe Halo allows certain users to manage plugins. I'll go with PR:L per the vendor/NVD-ish
Cross-site request forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to trigger unintended financial actions on the web server on behalf of an authenticated victim. The attacker crafts a malicious link or page; if the authenticated victim interacts with it, their browser submits forged requests that bypass CSRF protection, resulting in low-level confidentiality and integrity impact. No public exploit is identified at time of analysis, and availability is unaffected.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) enables a physically-present unauthenticated attacker to disclose memory contents from an affected system. Exploitation requires direct physical access to the target device, most plausibly via a maliciously crafted or manipulated storage peripheral. The vulnerability spans the entire currently-supported Windows ecosystem - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all active feature releases. No public exploit or CISA KEV listing has been identified at time of analysis.
Windows Secure Boot security feature bypass affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The root cause is a dependency on a vulnerable third-party component embedded within the Secure Boot trust chain, enabling a locally present, high-privileged attacker to bypass boot integrity enforcement. No public exploit or CISA KEV listing is associated with this vulnerability at time of analysis; patch versions are confirmed available across all affected Windows release trains.
Security feature bypass in Windows URL Moniker enables a remote, unauthenticated attacker to circumvent URL-based security controls across virtually all supported Windows versions from Server 2012 through Windows 11 26H1. Rooted in improper resolution of path equivalence (CWE-41), the flaw allows crafted URL representations to evade security filters that would otherwise block access to restricted resources. Exploitation requires user interaction per the CVSS vector (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effects; no public exploit code has been identified at time of analysis.
Buffer over-read (CWE-126) in the Windows Storage component exposes adjacent memory contents to a physically-present attacker across virtually the entire supported Windows product line, from Server 2012 through Windows 11 25H2 and Server 2025. The CVSS vector (AV:P/UI:R) confirms exploitation requires both physical access to the target machine and user interaction to trigger the vulnerable code path, sharply constraining real-world attack surface. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Xbox component on Windows allows a physically-present attacker to disclose sensitive memory contents. Affecting a wide range of Windows 10 and Windows 11 builds (plus Windows Server 2016/2019), the flaw is triggered via a physical interaction, yielding high confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC classifies exploitation as none at time of analysis, making this a lower-urgency but patch-worthy item for any endpoint reachable by an untrusted third party.
Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU kernel drivers allows a local unprivileged process to access already-freed GPU memory through valid GPU memory processing operations, resulting in limited confidentiality and integrity impact against the kernel driver. The flaw spans a wide range of driver versions across all three GPU architectures, affecting the enormous ecosystem of Android and embedded devices powered by Arm Mali GPUs. No public exploit or active exploitation has been identified; SSVC rates technical impact as partial and exploitation as none at time of analysis.
SAPUI5's frame options allowlist feature insufficiently validates parent frame origins, enabling a framing-based social engineering attack against authenticated SAP users. An unauthenticated attacker can host a malicious page that embeds a SAPUI5 application in an iframe while bypassing the configured origin allowlist, then lure an authenticated victim into interacting with it to trigger unintended in-application actions. Impact is limited to low integrity - no confidentiality or availability consequences - and no public exploit or active exploitation (KEV) has been identified.
Insufficient authorization enforcement in SAP S/4HANA's Manage Bank Chains application allows an authenticated low-privileged user to delete bank chain records outside their permitted scope. The impact is strictly limited to availability - deletion of specific configuration entries - with no confidentiality or integrity exposure, yielding a CVSS 4.3 moderate rating. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized configuration data disclosure in SAP NetWeaver and ABAP Platform allows authenticated network attackers to read sensitive system configuration and security-relevant settings without holding the required authorization. The flaw stems from a missing authorization check (CWE-862) in the Application Server ABAP component, meaning any low-privileged authenticated user can query configuration details that should be restricted to privileged roles. Impact is confined to confidentiality at a low level; no public exploit or CISA KEV listing has been identified at time of analysis.
Bluetooth encryption downgrade in Android's `btm_sec_encrypt_change` function (btm_sec.cc) exposes information on Android 17 and Android 16-QPR2 devices by allowing a logic error in encryption change handling to be exploited without user interaction. A Bluetooth-adjacent attacker with a low-privilege connection can trigger the downgrade, reducing encryption strength and enabling passive interception of Bluetooth traffic. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.16%, indicating very low observed exploitation probability.
Integer overflow in Android's HEIF image parsing code causes a temporary remote denial of service against Android 15 through 17. The flaw resides in `convertCleanApertureToRect` within `HeifCleanAperture.cpp`, where malformed HEIF clean-aperture metadata triggers an integer overflow that crashes the media processing component. With PR:L and no user interaction required, an attacker with a low-privilege account can deliver a crafted HEIF file to trigger the crash remotely. No public exploit exists and EPSS sits at 0.16%, consistent with a moderate-severity DoS with no code execution pathway.
Cleartext transmission of administration credentials over HTTP in U-speed WIFI4 N300 T1 Pro v1.0.0 exposes router admin passwords to passive eavesdroppers on the same network segment. Any attacker with adjacent network access - including a co-located wireless client - can capture HTTP session traffic containing unencrypted credentials without any authentication or interaction. No public exploit code has been confirmed and EPSS is minimal (0.15%), but the attack is trivially executable with standard packet capture tools once adjacent network access is established.
Repeated external URL scheme invocations from a malicious webpage can flood Firefox for iOS with system confirmation prompts or trigger cascading external application launches, rendering the browser temporarily unusable. All Firefox for iOS versions prior to 155.1 on Apple iOS devices are affected. No active exploitation has been identified; Mozilla released the fix in Firefox for iOS 155.1, and exploitation requires the user to visit the attacker-controlled page.
Xen hypervisor on x86 PV (paravirtualized) guest configurations contains a race condition in memory page lifecycle management that allows a guest to write to pages already scrubbed by Xen. When a PV guest frees a memory page, Xen defers the TLB flush until the page is re-used - but scrubbing occurs before that flush, creating a window in which the guest's stale TLB entry remains valid for a page now considered clean. This permits the attacking PV guest to inject arbitrary data into a scrubbed page, which may subsequently be allocated to another guest, undermining Xen's inter-VM memory isolation guarantee. No public exploit has been identified at time of analysis, and SSVC assessment rates exploitation as none and non-automatable.
Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture kernel drivers allows an unprivileged local process to access already freed kernel memory, leaking limited sensitive data. The flaw is triggered through valid GPU memory processing operations, requiring no special privileges beyond local code execution - a realistic threat on mobile devices running affected Mali GPU firmware. With EPSS at 0.14% and no public exploit or KEV listing, active exploitation is not currently observed, but the breadth of affected versions across three GPU families and many Android SoC generations elevates overall exposure.
Untrusted Search Path exploitation in Adobe Acrobat and Acrobat Reader allows a local attacker who already holds high privileges to gain unauthorized read access to sensitive confidential data under specific, attacker-uncontrollable environmental conditions. Affected products include Acrobat 2024 (≤24.001.30383), Acrobat Reader, and Adobe Acrobat (both ≤26.002.21900), per EUVD-2026-74105 and Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis; exploitation mandates a victim open a malicious file and requires conditions beyond the attacker's direct control.
Server-side request forgery (SSRF) in Microsoft SharePoint Server Subscription Edition enables a low-privileged authenticated attacker to cause the server to issue outbound network requests, resulting in limited information disclosure. Exploitation requires user interaction in addition to a valid low-level account, constraining real-world impact to authenticated insider or phishing-assisted scenarios. No public exploit code has been identified, and the vulnerability carries a low CVSS base score of 3.5, reflecting its narrow confidentiality-only impact.
Improper input validation in Adobe Experience Manager allows a low-privileged remote attacker to bypass a security feature and gain unauthorized limited write access to the platform. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. Exploitation requires social engineering - a logged-in victim must visit a crafted URL or interact with a compromised web page - constraining real-world reach. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Out-of-bounds read in Android's 802.11be (WiFi 7 / EHT) parsing code exposes kernel or userspace memory to adjacent attackers across all currently supported Android releases (14, 15, 16, 16-QPR2, and 17). The flaw resides in get_eht_operation_channel_width() within ieee802_11_common.c, where an incorrect bounds check allows a crafted EHT Operation element - delivered via a rogue access point - to read past the end of a buffer, leaking memory contents to the attacker. With EPSS at 0.12% and no KEV listing, real-world exploitation is not currently observed, but the adjacency-only prerequisite makes this relevant to targeted or physical-proximity attacks.
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to craft a malicious link or page that, when interacted with by an authenticated victim, triggers unintended server-side actions on their behalf. The impact is limited to low-integrity and low-confidentiality effects with no availability impact, confirmed by SAP as part of Security Patch Day (Note 3371336). No public exploit code or active exploitation has been identified at time of analysis.
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) enables a low-privileged attacker to craft a malicious link or web page that, when visited by an authenticated user, submits unauthorized requests to the SAP web server on that user's behalf. The impact is bounded by the description to low integrity and low confidentiality effects, with no availability impact. No public exploit or KEV listing exists at time of analysis, and CVSS 3.5 correctly reflects the low overall severity.
Local information disclosure affects Android 14 through 17, including the Android 16-QPR2 branch, due to a logic error causing improper data sanitization across multiple code locations. An unprivileged local application can exploit this flaw without any user interaction to read data it should not have access to. No public exploit has been identified at time of analysis, and EPSS at 0.12% (2nd percentile) reflects very low observed exploitation interest.
Local information disclosure in Android's `getAllSessions` function across multiple files allows a low-privileged application to obtain session data it is not authorized to access, exploiting a confused-deputy logic error in the code. Affected versions span Android 15, 16, 16-qpr2, and 17, as documented in the September 2026 Android Security Bulletin. No public exploit or active exploitation has been identified; EPSS sits at 0.12%, reflecting the low real-world threat level consistent with the CVSS 3.3 rating.
Location metadata disclosure in Android 17's MediaProvider component allows a low-privileged local app to bypass permission enforcement in getQueryBuilderInternal of MediaProvider.java and retrieve GPS coordinates embedded as EXIF metadata in media files without holding the ACCESS_MEDIA_LOCATION permission. The root cause is CWE-862 (Missing Authorization) in the query builder logic - the authorization gate that should block location-tagged media queries from unpermissioned callers is absent or incorrectly applied. No public exploit has been identified, and the CVSS 3.3 score reflects both the constrained local attack surface and the limited disclosure scope.
Out-of-bounds heap read in Android's ResourceTypes.cpp `setTo` function exposes local heap memory to low-privileged processes across Android 14 through 17. The missing bounds check requires only standard user-level execution - no elevated privileges and no user interaction - to trigger partial disclosure of heap contents. No active exploitation has been identified; EPSS probability is 0.12% (2nd percentile), consistent with a low-severity local disclosure in a narrow attack surface.
Local information disclosure in Android's AppFuseBridge framework component allows any installed app to read files or data it lacks permission to access. The vulnerability exists in the openFile() method of AppFuseBridge.java, where a missing permission check (CWE-693) permits a low-privileged local process to bypass access controls without user interaction. Affected versions span Android 14 through 17, including the QPR2 interim release, giving this issue a broad footprint across current Android deployments. No public exploit or active exploitation has been identified; EPSS is 0.12% (2nd percentile), consistent with the local-only, low-impact nature of the flaw.
Local information disclosure in Android 15 through 17 exploits a confused deputy flaw in `screenArgsForPermissionCheckIfAny`, allowing a low-privileged local app to bypass permission validation and access data it should not be authorized to read. The flaw stems from a privileged component incorrectly acting on behalf of a less-privileged caller without adequate permission verification, resulting in unauthorized local data exposure. No public exploit has been identified at time of analysis, and with an EPSS of 0.12% this is assessed as low-priority despite Android's broad deployment footprint.
Local information disclosure in Android's MediaProvider component affects Android 14 through 17 via a race condition in `updateInternal` of `MediaProvider.java`. An unprivileged local application can exploit a time-of-check-time-of-use (TOCTOU) window during a media record update operation to read file contents that should not be accessible, without requiring elevated privileges. No public exploit has been identified at time of analysis, and EPSS at 0.12% (2nd percentile) reflects the low probability of widespread automated exploitation.
Local information disclosure in Android 14 through 17 stems from a logic error across multiple functions in XmpDataParser.java that causes improper sanitization of XMP metadata during media file parsing. A local attacker with standard user-level privileges can trigger the flaw without any user interaction, leaking restricted information from the parsing context. No public exploit code or active exploitation has been identified, and the September 2026 Android Security Bulletin provides the authoritative patch.
Tapjacking via malicious UI overlay in Android 17's ContactsPickerActivity allows a locally installed application to present misleading UI over the contacts picker, resulting in local information disclosure of contact data. The attack requires only low-privilege access (a sideloaded or installed app) and no user interaction once the overlay is active. No public exploit code is identified, and EPSS at the 2nd percentile reflects negligible opportunistic exploitation probability.