Unauthenticated account takeover in WWBN AVideo (through commit e01e41ecc) stems from get_api_preauthorize in plugin/API/API.php, a second, undocumented login path that performs the same credential check as get_api_signIn but omits the 10-attempts-per-5-minutes throttle enforced by checkRateLimit(). This lets remote attackers brute-force any account - including admin - without rate limiting, and the endpoint doubles as a credential oracle whose users_id field (1 vs 0) discloses password validity even though the message always reads 'Invalid credentials'. No public exploit identified at time of analysis, and no vendor-released patch is available.
Path traversal in Apache FreeMarker's template loading (versions 2.2.0 through 2.3.34) lets remote attackers who can influence the locale identifier passed to FreeMarker read templates outside the intended path when the default-enabled localized lookup feature is active. The actual reach is bounded by the configured TemplateLoader - FileTemplateLoader still blocks escape from its baseDir, while classloader- or servlet-context-backed loaders are limited to resources those mechanisms can reach. EPSS is low (0.21%, 11th percentile), no public exploit is identified at time of analysis, and it is not in CISA KEV.
Missing authorization in the Apache Nutch Server (Nutch REST API) lets remote unauthenticated attackers read crawl data and interrupt or shut down running crawl jobs and their backing resources across Nutch 1.10 through 1.22. Because the REST API ships without access control, anyone able to reach the service can invoke management operations. No public exploit identified at time of analysis and EPSS is low (0.20%), but the fix is drastic: version 1.23 removes the Nutch Server component entirely.
Broken access control in springboot-project v1.0.0 lets remote unauthenticated attackers reach every seller-management interface through a flaw in the SellerAuthorizeAspect authorization component. Attackers can enumerate all products and orders, toggle products on/off sale, finish or cancel orders, and modify categories with no credentials. No public exploit identified at time of analysis beyond the reporter's write-up; EPSS is low at 0.18% (7th percentile).
Improper authorization in Bifrost's vtoken-minting and slpx Substrate pallets lets any signed on-chain account attribute its mint volume to an arbitrary registered channel_id it does not control. Because the mint path never verifies that the caller is authorized to mint on behalf of the supplied channel, an attacker can inflate a target (or attacker-owned) channel's recorded mint volume and skew protocol commission settlement so payouts are disproportionately routed to that channel. There is no public exploit identified at time of analysis and EPSS is very low (0.14%), but the flaw directly enables financial value redirection within a live DeFi parachain.
Arbitrary code execution in Adobe ColdFusion 2023 (through Update 23) and ColdFusion 2025 (through Update 12) is possible through an SQL injection flaw (CWE-89) that a high-privileged authenticated attacker can escalate into code execution in the context of the current user. The CVSS vector marks the scope as changed, reflecting that database-layer injection pivots into broader application/OS impact. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting in the Auth0 AD/LDAP Connector (versions up to and including 6.5.0) lets an attacker persist malicious script into directory-attribute search results or updater log content that later renders unencoded in the connector's admin panel, executing in an administrator's browser session. The payload can be planted either by an authenticated user permitted to modify directory attributes or by a low-privileged local user on the connector host, and fires when an admin views the affected search results or update logs. No public exploit identified at time of analysis; disclosure originates from Okta PSIRT.
Remote code execution in Microsoft Office Publisher allows a network-based attacker to execute arbitrary code on a victim's machine by exploiting unsafe deserialization of untrusted data in Publisher file parsing. Affected products span the full Office ecosystem including Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021, Publisher 2016, and Office 2019. Exploitation requires user interaction - the victim must open a crafted Publisher file - but no authentication or elevated privileges are needed from the attacker's side. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary file write as root in OPNsense's NTP configuration module (opnsense/core before 26.1.9 and BE/opnsense/core before 26.4_20) lets an administrator-level attacker escape the intended directory via a crafted GPS or PPS serial-port parameter and overwrite any file on the FreeBSD-based firewall. Because writes occur as root, this path traversal is a strong primitive for full device compromise. Fixes are released; there is no public exploit identified at time of analysis.
SQL injection in Microsoft SharePoint Server Subscription Edition enables an authenticated low-privileged network attacker to escalate privileges, yielding full confidentiality, integrity, and availability compromise of the affected instance. The flaw (CWE-89) resides in insufficient neutralization of SQL special characters within SharePoint's server-side processing, allowing injected commands to reach the underlying SQL Server backend. A vendor patch is available at version 16.0.20326.20094; no public exploit has been identified at time of analysis.
Remote code execution in Windows DNS Server allows a network-authenticated attacker to trigger a use-after-free condition in the DNS service, resulting in full system compromise with high confidentiality, integrity, and availability impact. The vulnerability affects Windows Server versions spanning 2012 through 2025 as well as select Windows 10 builds, making it broadly relevant across enterprise Active Directory environments. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all listed versions.
Heap-based buffer overflow in Windows DHCP Server allows a network-authenticated attacker with low privileges to achieve remote code execution across all major Windows Server releases. The vulnerability (CWE-122) is triggered via crafted DHCP protocol input to the server service, with CVSS 8.8 reflecting the high-impact, network-reachable, low-complexity exploitation path. Microsoft has released patches across a wide range of affected builds. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Privilege escalation in Microsoft SharePoint Server Subscription Edition enables any authenticated network user to gain elevated privileges with full confidentiality, integrity, and availability impact. The root cause is CWE-250 (Execution with Unnecessary Privileges), where a SharePoint service or component operates with more privilege than its function requires, allowing a low-privileged account to cross privilege boundaries. No active exploitation has been confirmed and no public exploit code has been identified; a vendor patch is available targeting build 16.0.20326.20090.
Stack-based buffer overflow in Microsoft Access enables remote code execution when a user opens a specially crafted database file, delivering full confidentiality, integrity, and availability compromise on the vulnerable host. Affected products span all current Microsoft Office release trains - Access 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise - representing a broad enterprise attack surface. Microsoft has released patches via its standard update channel; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Credential Providers enables a low-privileged authenticated attacker to execute arbitrary code over the network on affected Windows 11 and Windows Server 2025 systems. The flaw (CWE-122) is reachable via network with low complexity and no user interaction required, making it exploitable by any account holder with minimal privileges. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor patch is available.
Out-of-bounds write (CWE-787) in multiple Microsoft Office versions enables remote code execution when a victim opens a specially crafted Office document. The vulnerability affects a broad matrix of products spanning Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2016/2019, and their Mac counterparts, covering virtually the entire modern Office product line. Vendor patches have been released via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis, but the network-deliverable, low-complexity nature and full C/I/A impact make this a high-priority patching target.
Heap-based buffer overflow (CWE-122) in Microsoft Office Access enables network-delivered remote code execution across six Microsoft Office product lines. When a victim opens a maliciously crafted Access database file delivered over a network, the overflow corrupts heap memory and allows an attacker to execute arbitrary code with the privileges of the logged-in user. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Remote code execution is possible in Microsoft Office Publisher across multiple Office suite versions when a victim opens a maliciously crafted Publisher document. The root cause is an integer overflow or wraparound (CWE-190) in the file-parsing subsystem, which typically produces an understated buffer allocation that an attacker can exploit to corrupt heap memory and redirect execution. Affected releases span Publisher 2016 through Microsoft 365 Apps for Enterprise; vendor-released patches are available for all affected versions, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Outlook enables remote unauthenticated attackers to execute arbitrary code on the victim's system across multiple current Office product lines. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects network-accessible exploitation requiring no privilege, with the sole limiting gate being user interaction-likely opening or previewing a crafted message. No active exploitation is confirmed via CISA KEV and no public exploit code is known at time of analysis; Microsoft has released patched builds across all affected product lines.
Remote code execution in Windows iSCSI is possible due to incorrect buffer size calculation (CWE-131), affecting a broad swath of Windows releases from Server 2012 through Server 2025 and Windows 10/11 across multiple feature versions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates a network-reachable, unauthenticated attack path requiring some user interaction - consistent with a scenario where a victim system initiates an iSCSI connection to a malicious target. Microsoft has released patches addressing specific build thresholds across all affected Windows versions. No public exploit code or CISA KEV listing is present at time of analysis.
Remote code execution in Microsoft Office exposes unauthenticated network attackers to full system compromise when a target user opens a specially crafted document. The root cause is a heap-based buffer overflow (CWE-122) in Office's document parsing logic, affecting Office 2016 through Microsoft 365 Apps for Enterprise across a defined range of 16.x builds confirmed by EUVD-2026-73711. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score with a network attack vector and no required attacker privileges - beyond inducing user file-open interaction - reflects a credible, high-impact threat against the world's most widely deployed office productivity suite.
Remote code execution in Microsoft SharePoint Server Subscription Edition is reachable by authenticated network users due to missing authorization checks (CWE-862). An attacker holding any valid SharePoint credentials can invoke privileged server-side functionality without proper authz enforcement, achieving full compromise of confidentiality, integrity, and availability. No active exploitation is confirmed in CISA KEV at time of analysis, and no public exploit code has been identified.
Heap-based buffer overflow in Windows Remote Desktop Protocol (RDP) affects virtually every supported Windows version, from Server 2012 R2 through Windows 11 26H1 and Server 2025, enabling unauthenticated remote code execution when a victim initiates an RDP connection. The CWE-122 flaw corrupts heap memory during RDP protocol processing, allowing an attacker to hijack execution flow and achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit has been identified at time of analysis; a vendor-released patch is available across all affected Windows release tracks.
Remote code execution via use-after-free (CWE-416) in Microsoft Office Outlook allows a network-based attacker to execute arbitrary code on a victim's system when the user opens or previews malicious content. The vulnerability affects a broad range of Microsoft Office versions across Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and Word 2016. No public exploit identified at time of analysis, but a vendor patch is available; the CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R) reflects the high severity, tempered only by the requirement for user interaction.
Stack-based buffer overflow in the Windows Graphics Component enables unauthenticated remote attackers to achieve arbitrary code execution on affected systems when a victim interacts with specially crafted graphical content. The vulnerability spans all currently supported Windows 10, Windows 11, and Windows Server editions from 2016 through 2025, making the attack surface exceptionally broad. Microsoft has released patches as part of the monthly security update cycle; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Heap-based buffer overflow in Microsoft WebP Image Extension versions prior to 1.2.31.0 enables remote code execution when a victim opens a specially crafted WebP image file. The root trigger is an integer overflow (CWE-190) that corrupts heap allocation sizing, producing a classic CWE-122 heap overflow; the CVSS vector confirms full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high CVSS score (8.8) and complete code-execution impact make patching urgent for any Windows environment where the extension is installed.
Remote code execution via use-after-free in Microsoft Office PowerPoint enables a network-positioned, unauthenticated attacker to execute arbitrary code on a victim's system when the victim opens a crafted PowerPoint file. The flaw spans the entire current Office product family including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, PowerPoint 2016, Office 2019, and their Mac counterparts. No public exploit code or active CISA KEV listing has been identified at time of analysis, but the broad product coverage and lack of privilege requirements make this a high-priority patch target.
Use-after-free in Microsoft Office PowerPoint enables remote code execution when a victim opens a specially crafted PowerPoint document. The vulnerability affects PowerPoint 2016, 2019, Office LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Office for Mac across multiple build versions, spanning virtually the entire active Office install base. Vendor patches have been released; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Office PowerPoint stems from a use-after-free memory corruption flaw (CWE-416) that enables network-based attackers to execute arbitrary code when a victim opens a crafted presentation file. All major Office editions are affected - Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, PowerPoint 2016, and multiple macOS variants - spanning a broad enterprise and consumer installed base. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected Windows product lines.
Remote code execution in Microsoft Office via a use-after-free (CWE-416) memory corruption flaw allows a network-adjacent or remote attacker to execute arbitrary code on the victim's machine. The attack is client-side: the attacker delivers a maliciously crafted Office document, which when opened by the user triggers the UAF condition. Affected products span the full Office family including LTSC 2021, LTSC 2024, Office 2019, Microsoft 365 Apps for Enterprise, and Mac variants; a vendor patch is available.
Remote code execution in Windows Imaging Component (WIC) is possible via an integer overflow (CWE-190) triggered when processing a maliciously crafted image file, affecting virtually every supported and legacy Windows release from Server 2012 through Windows 11 26H1. An unauthenticated network-based attacker can deliver a specially crafted image that causes an integer wraparound in WIC's parsing logic, leading to arbitrary code execution in the context of the target user. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and low attack complexity make this a high-priority patching target.
Unauthenticated network access to read-only PIMBoards endpoints in AVEVA Pipeline Integrity Monitor exposes operational data intended exclusively for authenticated PIMBoards users. The root cause is CWE-862 Missing Authorization - read paths lack access control enforcement, allowing any network-reachable attacker to retrieve restricted information without credentials. Write operations are explicitly unaffected, bounding the impact to confidentiality. No public exploit code or active exploitation has been identified at time of analysis; CISA SSVC rates exploitation as none and technical impact as partial.
Remote code execution in Microsoft SharePoint Server Subscription Edition allows an authenticated low-privileged network attacker to execute arbitrary code by exploiting a missing authorization check (CWE-862). The CVSS 8.8 score reflects network accessibility, low complexity, and full confidentiality, integrity, and availability impact against the affected server. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available targeting builds prior to 16.0.20326.20090.
Remote code execution is achievable in Windows Schannel - Microsoft's built-in TLS/SSL security package - through a heap-based buffer overflow triggered over a network connection. Affected builds span Windows 11 versions 23H2 through 26H1 and Windows Server 2022 and 2025, all prior to Microsoft's patched releases. No public exploit has been identified at time of analysis, but the network-reachable attack surface, low complexity, and fully high-impact CVSS score of 8.8 make this a high-priority patch for any Windows environment relying on Schannel-backed services.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables remote code execution across a broad range of Microsoft Windows desktop and server editions. An unauthenticated network attacker can trigger the overflow with user interaction, achieving full compromise of confidentiality, integrity, and availability on the target system. The vendor-confirmed patch is available via Microsoft's update channel; no active exploitation or public exploit code has been identified at time of analysis.
Heap-based buffer overflow in Windows URL Moniker (urlmon.dll) enables remote code execution across nearly every supported Windows release when a user interacts with attacker-controlled content. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all major feature updates, making the attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but vendor patch availability and the network-accessible, user-interaction-triggered attack vector place this firmly in the urgent-patching tier.
Remote code execution in Windows Media Foundation enables a network-based attacker to trigger a heap-based buffer overflow by luring a user into opening a maliciously crafted media file, yielding full confidentiality, integrity, and availability compromise of the affected session. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1 as well as Windows Server 2025 (including Server Core). Microsoft has released patches addressing all listed build ranges; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Visual Studio 2026 (versions 18.9.0 through 18.9.2) is achievable by unauthenticated network-reachable attackers via a heap-based buffer overflow in the IDE, though user interaction is required to trigger the flaw. The CVSS score of 8.8 reflects the high impact potential - full compromise of confidentiality, integrity, and availability - moderated only by the need for a developer to open or process a crafted file. A vendor patch has been released; no public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Remote code execution in the Windows Volume Manager Extension Driver, a kernel-mode storage component, affects virtually every supported-and several end-of-life-Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The CWE-122 heap-based buffer overflow is reachable over the network when a user interacts with attacker-controlled volume or share data, and successful exploitation yields full confidentiality, integrity, and availability compromise consistent with SYSTEM-level kernel execution. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches covering all affected build lines.
Heap-based buffer overflow in Windows' Graphic Fonts component (CWE-122) enables unauthenticated remote attackers to achieve arbitrary code execution on a wide range of Windows client and server editions by inducing a user to open or preview maliciously crafted font data. Affecting 19 distinct Windows product lines from Server 2012 through Windows 11 26H1, the vulnerability carries a CVSS 3.1 score of 8.8 with full C:H/I:H/A:H impact. A vendor-released patch is available via Microsoft's Update Guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Graphic Fonts font-processing component enables remote code execution across virtually the entire Windows ecosystem, from Server 2012 to Windows 11 26H1 and Server 2025. The attack vector is network-based with user interaction required (CVSS AV:N/UI:R), consistent with a font delivered via a malicious document or webpage that triggers the vulnerable parser. Microsoft has released patches across all affected platform versions; no public exploit code or active exploitation via CISA KEV has been identified at the time of analysis.
Remote code execution in Microsoft SharePoint Server Subscription Edition (below 16.0.20326.20090) allows a low-privileged authenticated attacker to execute arbitrary code over the network by exploiting improper access control. The flaw, rooted in CWE-284, permits an authorized user to exceed their intended permissions and trigger server-side code execution without any user interaction. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Privilege escalation via out-of-bounds read in Windows Remote Desktop Services affects authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. An attacker holding valid low-privileged credentials can exploit the CWE-125 memory flaw over the network to achieve full system compromise, with the vendor-assessed impact reaching C:H/I:H/A:H. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches across all affected build lines.
Unrestricted file upload via the OIS web module in Siemens Siveillance Control and Siveillance Control Pro enables an adjacent, low-privileged attacker to upload and execute malicious server-side content, achieving root access on the OIS host. Both V3.0 and V4.0 product lines across the Control and Control Pro variants are affected, covering four separate CPE entries. Siemens has released patched builds for all affected branches per advisory SSA-254516; no public exploit or active exploitation has been identified at time of analysis.
Remote code execution in Microsoft Dynamics 365 Customer Engagement V9.1 (versions below 9.1.0048.0004) is achievable by authenticated network attackers through a code injection vulnerability (CWE-94). An attacker holding a low-privilege account can submit a crafted request that causes the server to generate and execute attacker-controlled code, resulting in full confidentiality, integrity, and availability compromise of the affected instance. Microsoft has released a patch via the MSRC update guide, and no public exploit code has been identified at time of analysis.
Remote code execution in Microsoft Outlook stems from CWE-908 (use of uninitialized resource), enabling a network-based attacker to execute arbitrary code on a victim's machine without requiring authentication. The CVSS vector (PR:N/UI:R) indicates the attack requires no attacker credentials but does require user interaction - consistent with a malicious email or attachment that triggers uninitialized memory access when opened or previewed. All major Outlook perpetual and subscription editions from 2016 through Microsoft 365 Apps for Enterprise are affected, making the attack surface extremely broad across enterprise environments. No public exploit or KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote code execution across a wide range of Microsoft Windows desktop and server editions. Exploitation requires a user to open or preview a maliciously crafted image file - consistent with the UI:R CVSS metric - which triggers CWE-122 heap corruption that can be leveraged for arbitrary code execution with full confidentiality, integrity, and availability impact. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all current servicing branches; Microsoft has issued patches for all affected release lines, and no public exploit or CISA KEV entry has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Graphics Component enables remote code execution across a broad range of Windows client and server editions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated network-based attacker can exploit this flaw by inducing a user to interact with maliciously crafted graphical content, triggering a CWE-122 heap overflow that yields full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing is identified at time of analysis; vendor patch is available via Microsoft's August 2026 Patch Tuesday.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables network-delivered code execution on any Windows system where a user opens a crafted image file. The flaw affects an extremely broad surface spanning Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, making it relevant to virtually every Windows-based enterprise environment. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, though the low-complexity, no-privileges-required vector is conducive to phishing-style mass targeting.
Remote code execution is possible in Windows Imaging Component (WIC) across a broad range of Microsoft Windows desktop and server releases via a heap-based buffer overflow triggered when a user opens or previews a specially crafted image file. The flaw is reachable over the network with no privileges required, making phishing or drive-by delivery viable attack vectors. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via Windows Update.