Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticated remote attackers to crash and reboot the device by sending a crafted HTTP request containing an oversized URL component. The flaw exists in pre-authentication HTTP message processing, meaning no credentials are required; a single malicious request can trigger a forced device reboot and a sustained denial-of-service condition. No public exploit code or CISA KEV listing has been identified at time of analysis, but the OT/substation deployment context significantly amplifies the operational impact of availability loss.
Privilege escalation to administrative level is possible in the Siemens Reyrolle 7SR5 protection relay (all versions prior to V2.70) via improper enforcement of server-side RBAC controls in its web-based management interface. An authenticated attacker with low-privileged credentials can manipulate HTTP request data to bypass authorization checks, gaining administrative access to the relay's configuration and control functions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate practical risk for any internet- or OT-network-exposed deployment.
Unauthenticated information disclosure in AVideo through 29.0 exposes private live-stream credentials - including stream keys and m3u8 playlist URLs - to any network-accessible attacker who queries the unprotected `plugin/Live/stats.json.php` endpoint. The `hidden_applications` array in the JSON response contains metadata for private, unlisted, and group-restricted live streams that the platform explicitly intends to conceal from unauthorized viewers. No public exploit has been identified at time of analysis, but the vulnerability is trivially reachable given its zero-precondition CVSS 4.0 profile (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.7).
Unvalidated input sizes on the OAuth Dynamic Client Registration endpoint in n8n allow unauthenticated remote attackers to exhaust database storage by repeatedly submitting oversized client_name and grant_types values. Affected versions are all n8n releases prior to 2.37.7 (in the 2.37.x branch) and prior to 2.38.2 (in the 2.38.x branch). Because the endpoint is publicly accessible without authentication and the attack is trivially automatable, a single attacker can render the n8n instance unavailable by filling database disk capacity, taking down all workflow automation for any organization relying on the platform.
Heap-based buffer overflow in the CommServe component of Commvault Cloud allows remote unauthenticated attackers to crash the CommServe service, causing denial of service to backup and recovery operations. Affected version branches span four maintenance tracks - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - all below their respective patched maintenance releases. No public exploit code or active exploitation has been identified at time of analysis, and Commvault has released fixed maintenance releases per advisory CV_2026_08_4.
Stack-based buffer overflow in the CommServe component of Commvault Cloud allows unauthenticated remote attackers to crash the service, causing a denial of service across all affected release trains (11.36.x, 11.40.x, 11.44.x, 11.46.x). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication or special conditions are required to trigger the crash. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, and Commvault has released maintenance updates across all affected branches.
OpenShift access token theft in hawtio-operator's cluster-mode deployment allows a low-privileged tenant to hijack OAuth sessions of any cluster user. The operator creates a cluster-scoped OAuthClient configured as a public client (no secret) with automatic grant approval, and register redirect URIs derived from Routes whose hostnames are fully controlled via the Hawtio CR spec.routeHostName field. A malicious tenant sets an attacker-controlled hostname, causing the operator to register it as a legitimate redirect target; any cluster user social-engineered into clicking the crafted authorization URL loses their OpenShift access token silently, with no consent prompt. No public exploit has been identified at time of analysis, and EPSS is 0.23% (14th percentile), but SSVC rates technical impact as total given downstream cluster access.
Unauthorized subscription upgrades in XenForo before 2.3.13 are achievable by replaying valid PayPal REST webhook payloads, because the platform performs no duplicate transaction ID check before processing incoming events. An attacker who possesses a legitimately captured webhook payload - for instance, from a prior genuine purchase - can retransmit it repeatedly to the XenForo webhook endpoint, triggering repeated subscription activations and elevating account privileges without additional payment. No public exploit has been identified at time of analysis, and a vendor patch (2.3.13) is available.
Path traversal in XenForo's style archive importer on Windows deployments allows authenticated non-super administrators holding style-import permissions to write arbitrary files outside the intended extraction directory. By crafting a ZIP archive with backslash-delimited member names, an attacker bypasses the forward-slash-only traversal validation enforced on Linux/macOS, writing arbitrary bytes to any path writable by the web-server account - including the public web root - resulting in persistent server-side code execution. The flaw is fixed in XenForo 2.3.13; no public exploit or CISA KEV listing has been identified at time of analysis.
Cryptographic signature verification failure in Commvault Cloud's CommServe component enables authenticated low-privileged users to bypass privilege management controls, achieving full confidentiality, integrity, and availability impact against the CommServe system. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) confirms network exploitation at low complexity, requiring only a standard authenticated session - no administrator-level access needed. No public exploit or KEV listing is present at time of analysis, but Commvault has self-reported and released a maintenance patch, indicating vendor-confirmed severity.
Uncontrolled recursion (CWE-674) in Microsoft Exchange Server enables remote unauthenticated attackers to crash or hang the service, resulting in a complete denial of availability across all affected Exchange versions from 2016 CU23 through the current Subscription Edition. The vulnerability requires no authentication, no user interaction, and no special network position - any attacker with TCP access to the Exchange endpoint can trigger the condition. Patch is available from Microsoft; no public exploit or CISA KEV listing has been identified at time of analysis.
Server process termination in gRPC-Go's xDS routing layer allows any network-reachable attacker to crash a server instantiated with `xds.NewGRPCServer()` by sending a single crafted HTTP/2 request. The vulnerability stems from the xDS routing interceptor unconditionally reading index 0 of the authority slice before checking whether the slice is empty - triggered when both `:authority` and `Host` headers are absent from an otherwise valid HTTP/2 stream. Because the per-RPC goroutine provides no panic recovery, the unhandled Go runtime panic terminates the entire server process; vendor-released patches v1.82.2 and v1.83.2 address this by rejecting such requests at the transport layer before they reach the interceptor.
Unauthenticated CPU exhaustion in the MongoDB sharded-cluster router process (mongos) allows any client with network access to a router port to supply crafted connection-monitoring parameters that consume unbounded server CPU, degrading or denying service to legitimate clients. The flaw is restricted to sharded deployments running mongos - standalone or replica-set-only mongod instances are not in scope. No authentication, privileges, or user interaction are required; only availability is affected, with no confidentiality or integrity impact. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial of service in MongoDB Server allows an unauthenticated remote attacker to terminate the mongod process by triggering a reachable assertion (CWE-617) in the read concern processing path. The flaw affects specific replica set member configurations across three MongoDB major release lines - 7.0.x, 8.0.x, and 8.3.x - and requires no credentials to exploit over the network. No public exploit code or active exploitation (CISA KEV) has been identified, but the zero-authentication, low-complexity network attack path makes this a meaningful availability risk for any organization running affected replica set deployments.
Remote code execution in Craft CMS before 5.10.12 is achievable by any authenticated control-panel user through Yii2 behavior injection. The vulnerability arises because string-typed field-layout elements are not properly cleansed before processing, allowing attackers to embed Yii2 behavior attachments and event handlers in JSON-formatted field-layout tab submissions that bypass validation and reach Craft::createObject(), instantiating arbitrary PHP objects and executing attacker-controlled code. No public exploit code is confirmed and this CVE is not listed in CISA KEV, but the low privilege bar - any control-panel account suffices - elevates real-world risk for organizations with multiple editor or author accounts.
Unauthenticated information disclosure in WWBN AVideo through version 29.0 allows any remote attacker to retrieve live-stream keys, private EPG programme schedules, and server identifiers from the exposed `plugin/PlayLists/epg.json.php` endpoint without credentials. The PHP endpoint performs no authentication check (CWE-306), and because the API accepts sequential user and playlist IDs, an attacker can enumerate the full set of sensitive broadcast credentials across all accounts on an instance. No public exploit or CISA KEV listing has been identified at time of analysis, though the issue is trivially exploitable given its network-accessible, zero-prerequisite nature.
Authorization bypass in AVideo's live-streaming endpoint allows unauthenticated remote attackers to publish content to any user's RTMP stream by exploiting a hardcoded session cookie. In saveLive.php and related endpoints, PHP cookie precedence causes a session cookie named 'key' with the constant value 'value' to silently override the legitimate $_REQUEST['key'] stream key parameter check, effectively nullifying per-user stream authentication. Any attacker who reads this disclosure now possesses the exact bypass credential; no public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial nature of exploitation (a known constant) makes it functionally equivalent to a zero-authentication bypass.
Arbitrary code execution in AMI APTIOV BIOS firmware is achievable by a locally-present privileged user exploiting an incomplete input blocklist (CWE-184) in the BIOS implementation. The flaw affects systems running AMI's APTIOV UEFI/BIOS platform - licensed to a wide range of OEM server and workstation vendors - and successful exploitation compromises confidentiality, integrity, and availability at both the firmware and OS layers, with cascading impact on the entire system stack. No public exploit code or CISA KEV listing has been identified at time of analysis.
HTTP/2 thread-exhaustion denial-of-service in Eclipse Jetty allows unauthenticated remote clients to permanently block all server threads by exploiting a race condition in RST_STREAM and GOAWAY frame handling. The race incorrectly resets the `HTTP2Flusher.terminated` field from a non-null terminal state back to null, allowing new write-queue entries to be enqueued in a flusher that will never drain them; the write-blocked threads waiting on those entries hang indefinitely. Across five affected Jetty major branches (9.4, 10.0, 11.0, 12.0, 12.1), any internet-exposed HTTP/2 endpoint is reachable without authentication. No public exploit has been identified at time of analysis.
Remote code execution in SiYuan desktop before 3.8.2 allows an unauthenticated network attacker to achieve full Node.js-level system access by poisoning a victim's clipboard from a malicious web page. The paste handler in app/src/protyle/util/paste.ts treated the custom text/siyuan clipboard MIME type as implicitly trusted internal content and skipped HTML sanitization before rendering, and a secondary code path used a same-origin hidden iframe to parse large HTML blobs, permitting inline script execution. Because SiYuan's Electron desktop build enables Node.js integration in the renderer process, injected scripts escape the browser sandbox entirely and execute with the privileges of the running user. A vendor-released patch is available at v3.8.2; no public exploit has been identified at time of analysis.
Denial-of-service via integer overflow in Microsoft SQL Server allows unauthenticated remote attackers to crash the database service over a network connection. Affected versions span SQL Server 2017 through 2025 across both Cumulative Update and GDR branches. Microsoft has released patches; no public exploit code or active exploitation has been identified at time of analysis.
Unthrottled resource allocation in Microsoft.AspNetCore.OData exposes ASP.NET Core applications to network-based denial of service by unauthenticated remote attackers. The root cause (CWE-770) allows crafted OData protocol requests - such as deeply nested $expand, expensive $filter expressions, or unbounded batch operations - to consume server memory or CPU without limit until the service becomes unavailable. Microsoft has released a patch via the MSRC advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary code execution in MLflow (all versions ≥ 0.0.1) is achievable through a maliciously crafted model artifact that exploits the platform's model-loading pipeline, triggering code execution on the end user's system when the artifact is deserialized. An attacker with the ability to publish or distribute a poisoned model to a shared registry can fully compromise any data scientist or ML engineer who loads it, gaining complete control over their workstation or compute environment. No public exploit has been identified at time of analysis, but SSVC rates technical impact as total; the HiddenLayer SAI advisory (2026-09) covers this class of ML supply-chain attack.
Email two-factor authentication bypass in WWBN AVideo (through commit c3edcc274) allows an attacker who already possesses valid account credentials to skip device-enrollment 2FA entirely. The root cause is a cache invalidation failure in the sqlDAL layer: empty result sets are cached, and writeSql never purges them, so when a new-device login triggers 2FA code generation, the confirmation code hash is computed from a stale empty cache entry rather than a freshly written value - causing the check to silently pass without a valid code. No public exploit code is confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but the bypass is straightforward for any attacker with stolen or leaked passwords.
Uncontrolled search path element (DLL hijacking, CWE-427) in Adobe Photoshop Desktop allows arbitrary code execution when a victim opens a maliciously crafted file. The vulnerability affects Photoshop 2026 versions up to and including 27.6 and Photoshop 2025 versions up to and including 26.11.6, with scope change indicating code execution can escape the Photoshop process boundary. No public exploit identified at time of analysis; Adobe has released patches via APSB26-130.
Client Code Execution in Siemens Desigo CC building management clients allows a low-privileged attacker to execute injected scripts and write arbitrary files to the client operating system by enticing an operator to open a maliciously crafted graphics document. All versions of the ClickOnce, Flex, and Installed Client variants across the V6, V7, V8, and V9 product lines are confirmed affected per Siemens SSA-330084. The subsequent-system impact (SC:H/SI:H/SA:H in the vendor-supplied CVSS 4.0 vector) reflects the documented lateral movement risk within OT environments. No public exploit is identified at time of analysis.
Insufficient protection of stored or transmitted credentials in GitHub Copilot and Visual Studio Code before 1.136.2 allows a network-positioned attacker to disclose sensitive information, including authentication tokens, with a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N). Microsoft (secure@microsoft.com) is the assigning CNA and a vendored patch is available, but CISA SSVC rates exploitation as 'none' and automatable as 'no', and EPSS is only 0.62% (47th percentile), indicating elevated theoretical severity without observed attacker activity. No public exploit code has been identified at time of analysis.
Path traversal in Visual Studio Code versions prior to 1.136.2 enables a remote unauthenticated attacker - contingent on user interaction - to escape the editor's restricted directory boundary and read sensitive files from the host system, effectively bypassing a security feature such as workspace trust or sandbox isolation. The vulnerability carries a CVSS 7.4 with Scope:Changed and C:H, reflecting that the impact crosses from VS Code's own context into broader host file system access. No public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary code execution in Adobe Illustrator Desktop 2025 (≤29.8.10) and 2026 (≤30.7) is achievable when a victim opens a specially crafted malicious file, exploiting improper input validation (CWE-20) in the file-parsing subsystem. The CVSS scope-change indicator (S:C) signals that successful exploitation can affect resources beyond the Illustrator process boundary - i.e., impacts propagate to the broader user session or OS context. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis, though the file-delivery vector makes this a realistic phishing-grade threat against creative and design professionals.
Arbitrary code execution in Adobe Illustrator Desktop 2025 and 2026 is possible when a victim opens a specially crafted malicious file, exploiting an Incorrect Authorization flaw (CWE-863) that allows attacker-controlled file content to bypass authorization checks and trigger code execution in the current user's context. The changed-scope designation in the CVSS vector (S:C with C:H/I:H/A:H) indicates the impact extends beyond the Illustrator process itself, consistent with a sandbox or privilege boundary escape. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' at this time, though SSVC also rates technical impact as 'total', meaning successful exploitation is fully compromising.
Incorrect Authorization (CWE-863) in Adobe Commerce allows unauthenticated remote attackers to bypass security controls and gain unauthorized read access across a changed security scope boundary. Affected products span Adobe Commerce 2.4.4-2.4.9, Adobe Commerce B2B 1.3.3-1.5.3, and Magento Open Source 2.4.6-2.4.9, all prior to the August 2026 security patches released under APSB26-138. No public exploit code has been identified and no active exploitation is confirmed in CISA KEV, but SSVC rates the vulnerability as automatable, making mass scanning a realistic near-term threat once technical details become more widely known.
Incorrect Authorization (CWE-863) in Adobe Commerce and Magento Open Source allows unauthenticated remote attackers to escalate privileges and gain write access to restricted platform resources without user interaction. Scope change is confirmed: successful exploitation crosses privilege boundaries within the Commerce platform, granting access to administrative or otherwise protected functionality. SSVC classifies technical impact as total and the attack as automatable, elevating operational priority despite no active exploitation currently recorded in CISA KEV.
Remote code execution in Snipe-IT before 8.7.0 allows authenticated superadministrators to execute arbitrary OS commands on the server by uploading a crafted backup archive and triggering a restore. The vulnerability stems from Snipe-IT piping SQL backup content directly into the MySQL/MariaDB command-line client without the --binary-mode flag, causing the client to interpret backslash escape sequences (e.g., \!) as local shell commands rather than SQL. Successful exploitation exposes sensitive application secrets including database credentials and APP_KEY, and permits modification of any file writable by the web application process. No public exploit or KEV listing has been identified at time of analysis.
PGP two-factor authentication bypass in AVideo's LoginControl::verifyChallenge() allows a network-accessible attacker holding only a valid account password to completely circumvent the PGP 2FA step and obtain full authenticated session access. The flaw stems from PHP's loose equality operator (==) comparing the submitted challenge against an unset session variable, which evaluates as true when an empty value is submitted - a classic PHP type-juggling weakness. No active exploitation (KEV) or public proof-of-concept code has been identified at time of analysis, but the bypass is trivially reproducible by any credential-holding attacker.
Insecure Direct Object Reference (IDOR) in WWBN AVideo allows authenticated users holding the canStream permission to hijack third-party live restream destinations on YouTube, Facebook, and Twitch by supplying arbitrary live_restreams_id values to resendRestreamer.json.php. The endpoint fails to verify that the requesting user owns the referenced restream configuration, exposing victim stream keys and allowing an attacker to broadcast their own content to victim-controlled channels. No public exploit code or active exploitation has been confirmed at time of analysis, though the impact on streaming operators could be severe and immediately visible.
Reflected Cross-Site Scripting in Adobe ColdFusion 2023 (through Update 23) and ColdFusion 2025 (through Update 12) enables an adjacent-network attacker to inject and execute malicious scripts in a victim's browser, potentially resulting in full session hijacking and administrative account takeover. Exploitation is constrained by an adjacent network attack vector (AV:A) and mandatory victim interaction - the victim must open a specially crafted malicious file. No public exploit code and no CISA KEV listing have been identified at time of analysis; the Adobe PSIRT advisory APSB26-119 governs the fix.
Double-free memory corruption in libxml2's SAX parser Python bindings allows a remote attacker to crash Python applications by supplying XML documents with DTD-defined enumerated attribute values, triggering a use-after-free in the attributeDecl callback. The vulnerability (CWE-763) is confirmed by Red Hat and affects all major RHEL versions (6 through 10) as well as Red Hat OpenShift Container Platform 4 and Hardened Images. While the confirmed impact is a reproducible denial of service, the Red Hat-provided CVSS vector (C:H/I:H/A:H with scope change) signals that Red Hat assesses the double-free as carrying latent code-execution potential beyond the confirmed crash. No public exploit and no KEV listing exist at time of analysis.
XML External Entity (XXE) injection in SAP Integration Suite allows low-privileged remote attackers to read arbitrary server-side files and trigger resource exhaustion via maliciously crafted XML payloads submitted to internal integration components. The vulnerability carries a scope-changed CVSS of 8.5 because the XML parser's external entity resolution crosses trust boundaries, exposing server filesystem contents through monitoring or logging channels. No public exploit code has been identified at time of analysis, but SAP has issued a Security Note (3792978) addressing the flaw.
Reflected XSS in Siemens Teamcenter's authentication redirect endpoint (/auth/) allows an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an already-authenticated user by delivering a crafted URL. Four active Teamcenter release trains are affected across versions prior to V2412.0013, V2506.0010, V2512.2607, and V2606.2607. Successful exploitation enables the attacker to act within the victim's live Teamcenter PLM session - accessing engineering data, modifying records, or pivoting laterally - with no public exploit identified at time of analysis.
Stack-based buffer overflow in the TP-Link RE210 AC750 range extender's httpd component enables authenticated, adjacent-network attackers to achieve remote code execution by uploading a specially crafted configuration file that exceeds bounds in the `splitString` function. Affected firmware spans US builds through 3.14.2 Build 171205 Rel.71984n and EU builds through 3.14.2 Build 141218 Rel.36430n, per EUVD-2026-73942. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-impact triplet (C:H/I:H/A:H) indicates full device compromise upon successful exploitation.
Information disclosure in Visual Studio Code allows an unauthenticated remote attacker to exfiltrate sensitive data via a crafted file or workspace that triggers incorrect name or reference resolution (CWE-706). Affected versions span 1.0.0 through all releases before 1.136.2. The scope change (S:C) in the CVSS vector indicates the confidentiality impact reaches beyond the VS Code process itself - potentially exposing system files, environment variables, or workspace secrets to a remote origin. No public exploit code or KEV listing is identified at time of analysis, but the broad affected version range and VS Code's developer-centric user base make this a meaningful supply-chain adjacent risk.
Path traversal in Commvault Cloud's DataCube component allows a locally authenticated low-privileged attacker to bypass security feature enforcement, resulting in high-impact compromise of confidentiality, integrity, and availability on the affected system. The Content Extractor and Index Store sub-components are specifically identified as requiring remediation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was self-reported by Commvault with a fix available in a maintenance release.
Heap-based buffer overflow in the Windows NTFS kernel driver (ntfs.sys) allows an unprivileged local attacker to execute arbitrary code at kernel privilege level, achieving full system compromise. Nineteen distinct Windows version/build combinations are confirmed affected, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a local, unprivileged attacker to execute arbitrary code with full system impact. The vulnerability (CWE-122) affects an exceptionally wide range of Microsoft Windows and Windows Server releases, from Windows Server 2012 through Windows Server 2025 and Windows 10/11. The CVSS vector (AV:L/PR:N) suggests exploitation is achievable without a Windows account - consistent with a crafted NTFS volume triggering the overflow on mount, such as via removable media. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches.
Local privilege escalation in Maono Link 3.8.13 on Windows enables any standard user account to gain elevated service-level privileges by writing a malicious payload to C:\ProgramData\Maono. The MaonoAiServices Windows service runs with elevated OS privileges while leaving its data directory writable by unprivileged local users - a classic insecure service directory permission pattern (CWE-428). Vendor patch 4.0.80 is available; no public exploit has been identified at time of analysis.
Local privilege escalation in Waves Central for macOS (versions up to 16.6.2) allows any authenticated local user to gain root code execution by abusing a flawed XPC client authorization scheme in the product's privileged helper service. The helper validates connecting XPC clients by performing a certificate-chain equality comparison against itself rather than enforcing a pinned code requirement (application identifier and Apple Team ID), meaning any process carrying the Waves signing certificate can impersonate a legitimate client and instruct the helper to run arbitrary scripts as root. No public exploit has been identified at time of analysis; a vendor-released fix is available in version 17.0.
Remote code execution in Adobe ColdFusion 2025 (≤update 12) and 2023 (≤update 23) allows a low-privileged attacker with adjacent network access to execute arbitrary code in the context of the victim user by delivering a malicious file for the target to open. The vulnerable component is confined to the administrative network zone by default, and the attack requires scope change - meaning successful exploitation can extend impact beyond the ColdFusion process itself. No public exploit or CISA KEV listing has been identified at time of analysis.
Path traversal in Commvault CommServe allows unauthenticated remote attackers with sufficient complexity to read sensitive files outside intended directory boundaries, resulting in high-impact information disclosure. Affected versions span four active release trains of Commvault Cloud (11.36, 11.40, 11.44, 11.46), making this relevant across a broad enterprise backup customer base. No public exploit or active exploitation has been identified at time of analysis; vendor has released patched maintenance releases.
Cross-site scripting in AVEVA PIMBoards (Pipeline Integrity Monitor ≤ 2025 SP1 P1, build 7.1.9580.8513) enables unauthenticated remote attackers to execute arbitrary JavaScript in a targeted user's active browser session by tricking the user into clicking a crafted malicious link. The attack is classified CWE-79 (reflected XSS), requires active user interaction, and is reported by ICS-CERT - indicating relevance to operational technology and industrial pipeline environments. No public exploit code has been identified at time of analysis, and CISA SSVC rates current exploitation as none.
Skype for Business Server's failure to properly verify cryptographic signatures (CWE-347) enables unauthenticated attackers on the same network segment to spoof identities or server endpoints, achieving high confidentiality and integrity impact across three distinct server release lines. All on-premises deployments of SfB Server 2015 CU13, 2019 CU8, and Subscription Edition CU1 below specific cumulative-update thresholds are confirmed affected, with patched releases available from Microsoft. The JWT Attack tag combined with CWE-347 indicates the flaw resides in token signature validation, where the server may accept cryptographically forged or unsigned tokens as legitimate - enabling impersonation without valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis.