Local information disclosure in Android 16 and 17 exposes the device Bluetooth MAC address through a missing permission check in the writeToParcel method of BleRssiRangingCapabilities.java. Any low-privileged local application can invoke this code path without holding the required Bluetooth permission, silently retrieving a hardware identifier that can be used to track a device across networks. No public exploit has been identified at time of analysis, and CISA SSVC assessment places exploitation at none.
Unauthorized access to and modification of device credentials is possible in Android 14 through 17 due to a missing permission check in the `onCreate` method of `ConfirmDeviceCredentialActivity.java`. Any locally installed application running with standard user-level privileges can trigger this flaw without requiring user interaction, gaining read access to - and potentially altering - stored device credential state. No public exploit code exists and EPSS sits at 0.11% (2nd percentile), placing current real-world exploitation risk very low despite the breadth of affected Android versions.
Local information disclosure in Android 14-16 allows any installed app with basic privileges to read wallet contextual location data by calling WalletContextualLocationsService without a working authorization gate. The root cause is a missing permission check in the isCallerAllowed method of WalletContextualLocationsService.kt (CWE-862): the service fails to verify that the caller holds the required wallet-access permission before returning location context. Impact is limited to confidentiality of wallet location data; no code execution, integrity modification, or privilege escalation is possible. No public exploit code has been identified and EPSS is 0.11% (2nd percentile), reflecting negligible current exploitation interest.
Out-of-bounds read in DPDK's lib/vhost virtio-net control-queue handler allows a local low-privileged attacker - such as a guest VM user with access to the virtio-net control virtqueue - to trigger an unchecked read of command_data, crashing the host-side DPDK vhost process. Affected deployments include NFV platforms, cloud hypervisors, and telco packet-processing stacks that use DPDK vhost-user for guest I/O. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS score of 3.3 reflects local access and limited availability impact.
Server-Side Request Forgery in InstantCMS versions prior to 2.18.2 allows authenticated users to probe internal network services by exploiting a redirect-bypass flaw in the 'upload from URL' feature. The uploader validates the initial URL against a private IP blacklist, but when the remote server issues an HTTP redirect, the redirected target URL is followed without re-validation, allowing the blacklist to be bypassed entirely. An attacker with any authenticated account can use this to map and interact with internal services not exposed to the public internet. No public exploit or CISA KEV listing has been identified at time of analysis.
Missing permission check in multiple functions of RangingServiceImpl.java on Android enables a man-in-the-middle attacker to intercept ranging service communications and disclose sensitive information without requiring additional execution privileges. Affected versions span Android 16, Android 16-QPR2, and Android 17, covering current and near-future Android releases. No public exploit has been identified at time of analysis, and EPSS is very low at 0.14%, but the network-reachable attack surface and absence of user interaction required warrant attention in environments handling proximity or location-sensitive data.
Open redirect (CWE-601) in Fortinet FortiSIEM 7.4.1-7.5.1 allows unauthenticated remote attackers to redirect FortiSIEM users to attacker-controlled sites via a crafted URL, enabling phishing or credential-harvesting attacks against security operations personnel. The CVSS temporal score includes E:P (proof of concept exists) and RL:O (official fix available), per Fortiguard advisory FG-IR-26-169. No active exploitation confirmed and no KEV listing; the overall risk is constrained by AC:H and mandatory user interaction, yielding a low base score of 2.8.
Weak password hashing in aircheng-org iWebShop-5 (all documented versions 5.0-5.15) enables an attacker who separately obtains the application's credential store to crack administrator passwords with significantly reduced effort, due to insufficient computational complexity in the Authentication Storage component's hashing routine within controllers/admin.php. A proof-of-concept exploit has been published (CVSS 4.0 E:P, SSVC Exploitation:poc), and the vendor has not responded to coordinated disclosure via GitHub issue #7, leaving all v5.x branch installations unpatched. No CISA KEV listing exists, indicating no confirmed widespread active exploitation at time of analysis.
Authenticated denial of service in Fortinet FortiOS, FortiPAM, and FortiProxy allows a high-privileged network attacker to crash the httpsd daemon by sending specially crafted HTTP requests, exploiting a NULL pointer dereference (CWE-476). The vulnerability spans FortiOS 7.2.x and 7.4.x, FortiProxy 7.2 through 7.6.6, and every FortiPAM release from 1.0.0 through 1.9.0. No active in-the-wild exploitation is confirmed, but the CVSS temporal metric E:P indicates proof-of-concept code exists; Fortinet has released an official fix under advisory FG-IR-26-173.
Terminal escape sequence injection in ash-project/usage_rules (versions 0.1.18 through 1.2.7) allows a malicious Hex package publisher to forge what developers see when running mix usage_rules.search_docs. The Mix task queries search.hexdocs.pm and renders publisher-controlled fields - title, package name, type, doc reference, and highlighted snippets - verbatim to the terminal with no control-character sanitization, only adding ANSI highlighting rather than stripping injected sequences. A package author who embeds ANSI cursor-movement, line-erase, carriage-return, or OSC 52 clipboard-write sequences in their documentation can cause a developer's terminal to display a forged hexdocs URL, conceal output, or silently write an attacker-controlled command to the clipboard; no public exploit has been identified at time of analysis.
Change stream data corruption in MongoDB Server (versions 7.0.0-7.0.40, 8.0.0-8.0.29, and 8.3.0-8.3.8) enables authenticated database users to insert documents with operator-shaped objects as shard key values that bypass insertion validation in sharded collections. When downstream change stream consumers operate in updateLookup full document mode, these stored values are embedded unsanitized into internal post-image lookup queries, causing MongoDB's query engine to interpret them as operator expressions rather than literal equality predicates. The practical result is that change stream consumers either receive incorrect post-image documents from unrelated records or encounter non-resumable fatal errors that break real-time data pipelines; no public exploit has been identified and vendor-released patches are available across all three affected release trains.
Transient CPU exhaustion in SAP Process Integration's SOAP Adapter allows a privileged authenticated user to craft SOAP requests containing deeply nested XML entity definitions (CWE-776, 'XML Bomb' class), temporarily degrading system responsiveness. The vulnerability scores CVSS 2.2, reflecting that exploitation requires high privileges, high attack complexity, and yields only low availability impact with zero confidentiality or integrity consequences. No public exploit code and no CISA KEV listing have been identified, placing this firmly in the low-priority tier despite network reachability.
Session fixation (CWE-384) in ningzichun Student Management System allows a remote attacker to pre-set a victim's session identifier via login.php, then hijack the authenticated session after the victim logs in. The login.php file's use of session_start fails to regenerate the session ID upon successful authentication, making any pre-supplied session ID persist into the authenticated state. Publicly available exploit code exists (E:P per CVSS 4.0 supplemental vector), though no active exploitation has been confirmed in CISA KEV.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /pages/us_edit.php, enabling arbitrary SQL query execution against the underlying database. The affected product is a PHP-based open-source educational web application distributed via itsourcecode.com. Publicly available exploit code exists (CVSS 4.0 E:P), though no active exploitation or KEV listing has been recorded, consistent with the product's limited real-world deployment footprint.
The Armoury Crate kernel-mode driver on ASUS systems exposes an IOCTL interface without adequate caller verification, enabling a locally authenticated low-privilege user to inject arbitrary process identifiers into the driver's trusted-process whitelist via a crafted IOCTL request. Bypassing this verification (CWE-782) allows the attacker's process to assume whitelisted trust status within the driver, gaining access to driver functions ordinarily restricted to ASUS's own software. No public exploit has been identified and the vendor-assigned CVSS 4.0 score of 2.0 reflects the constrained real-world impact: local-only access, high exploitation complexity, and limited integrity gain.
Cross-site request forgery in NETGEAR's XR500, XR1000, and XR1000v2 gaming routers allows an adjacent-network attacker to tamper with router configuration and disrupt operations by tricking a logged-in administrator into visiting a malicious page. The vulnerability stems from absent or insufficient CSRF protections on the router's web management interface, enabling forged requests to be submitted on behalf of an authenticated admin. No confidentiality impact is present; exploitation requires both social engineering success and admin-session timing, but can result in full configuration integrity loss and service disruption. No public exploit or CISA KEV listing is identified at time of analysis.
Stack-based buffer overflow in the NETGEAR RAX series router management UI (RAX30, RAX35, RAX38, RAX40, RAXE300) enables an adjacent-network attacker holding valid WiFi credentials to crash the web management interface. The vendor explicitly bounds the impact to management UI unavailability - core router services including the WiFi network and routing plane continue operating normally with no confidentiality or integrity exposure. CVSS 3.5 reflects this constrained scope; no public exploit code exists and no active exploitation has been identified.
Out-of-bounds memory corruption in Tapdisk, the XAPI toolstack's userspace xen-blkback implementation, allows a malicious guest VM to achieve code execution inside the tapdisk process, which normally runs as root in dom0. CVE-2026-79606 specifically concerns the gcopy_segs[] array: the bounds check incorrectly permits nr_segments values between 12 and 32, causing out-of-bounds writes that corrupt adjacent process memory. All versions of tapdisk are confirmed vulnerable, no mitigations exist, and patches are available via XSA-513.
Out-of-bounds memory corruption in Xen's Tapdisk (userspace xen-blkback) enables a malicious guest VM to achieve code execution within the tapdisk process, which runs as root in Dom0, constituting a full guest-to-host escape. CVE-2026-79605 specifically covers the absent upper bounds check on blkif->last_sect: guest-supplied values greater than 7 trigger reads or writes beyond the mapped grant region. All versions of tapdisk are confirmed vulnerable per XSA-513, no mitigations exist, and patch application is the sole remediation path. No public exploit or CISA KEV listing is identified at time of analysis.
Unbounded memory exhaustion in Xen's OCaml xenstore daemon (oxenstored) allows a malicious or compromised guest VM to trigger a system-wide denial of service by repeatedly sending xenbus reconnect requests without clearing the global watch trie. Each reconnect cycle purges only the per-domain hashtable, leaving stale watch entries to accumulate indefinitely in the global trie. All Xen deployments from 4.6 onwards using the OCaml oxenstored implementation are affected; no public exploit has been identified, but the attack surface is accessible to any guest with standard xenbus connectivity and no mitigations exist.