Resource exhaustion in vgmstream up to revision r2117 allows a remote attacker to trigger application unresponsiveness or crash by supplying a crafted TXTP playlist file containing adversarial range_start/range_end values to the add_entry parser function in src/meta/txtp_parser.c. A public proof-of-concept exists (GitHub issue #1973) and an upstream patch has been merged (commit 4b6a02dd1aff6428255db912563d77d4cb0a143e). The CVSS 4.0 score of 2.1 and low availability impact rating reflect that no public exploit indicates active exploitation, user interaction is required, and there is no confidentiality or integrity impact.
Cross-site scripting in aircheng-org iWebShop-5 through version 5.15 allows unauthenticated remote attackers to inject malicious JavaScript via the outerSrc and selectPhoto parameters of the uploadFile function in controllers/pic.php. Victim interaction is required to trigger script execution in the target's browser, resulting in limited integrity impact such as session hijacking or page defacement. A public proof-of-concept exists via a GitHub issue report; the project maintainer has not responded to the disclosure.
Stack-based buffer overflow in vgmstream up to r2117 allows a remote attacker to crash or potentially execute arbitrary code by delivering a specially crafted TXTH or TXTP audio metadata file to a user. The root cause is an unbounded sscanf invocation in src/meta/txth.c that writes attacker-controlled content from a text metadata file into a fixed-size stack buffer without field-width constraints (CWE-121). Publicly available exploit code exists (GitHub issue #1972), and an upstream patch commit is available (4669d37a6af94866f6f0628678f9f90d46954e8b via PR #1956), though no formally tagged patched release has been independently confirmed.
Improper access controls in java-json-tools json-patch (versions up to 1.13) allow low-privileged, network-accessible attackers to abuse the CopyOperation.apply and MoveOperation.apply methods to reference JSON document paths outside their permitted scope, enabling unauthorized data reads or writes within the processed JSON structure. The flaw resides in src/main/java/com/github/fge/jsonpatch/CopyOperation.java and affects any application that exposes JSON Patch processing to partially-trusted callers without additional server-side path validation. A public proof-of-concept exists via GitHub issue #170; no CISA KEV listing has been recorded, and the CVSS 4.0 score of 5.3 reflects the limited C/I impact and mandatory low-privilege prerequisite.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote authenticated attackers with low-privilege accounts to manipulate the ID argument passed to mysqli_query() in /pages/us_searchfrm.php, enabling database enumeration, data exfiltration, and potential data modification. A public exploit has been published on GitHub, corroborated by VulDB reporting. The CVSS 4.0 vector (PR:L, E:P) confirms authentication is required but that exploit code is in circulation, lowering the bar for opportunistic abuse.
Time-based blind SQL injection in code-projects Student Crud Operation 1.0 allows low-privileged remote attackers to extract database contents by manipulating the `id` parameter in `/edit.php`. A public proof-of-concept exploit documenting the exact technique has been published on GitHub, making exploitation straightforward with automated tooling. No vendor patch has been identified, and the product shows no evidence of active maintenance.
SQL injection in iWebShop-5 (versions 5.0-5.15) allows authenticated high-privilege users to manipulate database queries via the Search argument of the member_list function in controllers/member.php. The CVSS 4.0 vector (PR:H) confirms that administrative credentials are required, constraining the realistic attacker pool but not eliminating risk in multi-tenant or compromised-admin scenarios. A public exploit has been disclosed via a GitHub issue report, and the vendor has not responded to the responsible disclosure.
Stored cross-site scripting in ShowDoc 3.9.0 and 3.9.1 allows an authenticated low-privileged user to inject malicious JavaScript via a crafted Mermaid diagram block saved through the API Page Save Endpoint, which then executes in the browser of any user who views the poisoned documentation page. The root cause is the Mermaid rendering library operating in its permissive default mode - with `htmlLabels` enabled and `securityLevel` not set to `strict` - combined with the absence of DOMPurify sanitization on rendered SVG output. A public proof-of-concept exploit is available; vendor-confirmed patch v3.9.2 resolves the issue.
Server-side request forgery (SSRF) in Microsoft SharePoint Server Subscription Edition enables a low-privileged authenticated attacker to cause the server to issue outbound network requests, resulting in limited information disclosure. Exploitation requires user interaction in addition to a valid low-level account, constraining real-world impact to authenticated insider or phishing-assisted scenarios. No public exploit code has been identified, and the vulnerability carries a low CVSS base score of 3.5, reflecting its narrow confidentiality-only impact.
Improper input validation in Adobe Experience Manager allows a low-privileged remote attacker to bypass a security feature and gain unauthorized limited write access to the platform. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. Exploitation requires social engineering - a logged-in victim must visit a crafted URL or interact with a compromised web page - constraining real-world reach. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Out-of-bounds read in Android's 802.11be (WiFi 7 / EHT) parsing code exposes kernel or userspace memory to adjacent attackers across all currently supported Android releases (14, 15, 16, 16-QPR2, and 17). The flaw resides in get_eht_operation_channel_width() within ieee802_11_common.c, where an incorrect bounds check allows a crafted EHT Operation element - delivered via a rogue access point - to read past the end of a buffer, leaking memory contents to the attacker. With EPSS at 0.12% and no KEV listing, real-world exploitation is not currently observed, but the adjacency-only prerequisite makes this relevant to targeted or physical-proximity attacks.
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to craft a malicious link or page that, when interacted with by an authenticated victim, triggers unintended server-side actions on their behalf. The impact is limited to low-integrity and low-confidentiality effects with no availability impact, confirmed by SAP as part of Security Patch Day (Note 3371336). No public exploit code or active exploitation has been identified at time of analysis.
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) enables a low-privileged attacker to craft a malicious link or web page that, when visited by an authenticated user, submits unauthorized requests to the SAP web server on that user's behalf. The impact is bounded by the description to low integrity and low confidentiality effects, with no availability impact. No public exploit or KEV listing exists at time of analysis, and CVSS 3.5 correctly reflects the low overall severity.
Local information disclosure affects Android 14 through 17, including the Android 16-QPR2 branch, due to a logic error causing improper data sanitization across multiple code locations. An unprivileged local application can exploit this flaw without any user interaction to read data it should not have access to. No public exploit has been identified at time of analysis, and EPSS at 0.12% (2nd percentile) reflects very low observed exploitation interest.
Local information disclosure in Android's `getAllSessions` function across multiple files allows a low-privileged application to obtain session data it is not authorized to access, exploiting a confused-deputy logic error in the code. Affected versions span Android 15, 16, 16-qpr2, and 17, as documented in the September 2026 Android Security Bulletin. No public exploit or active exploitation has been identified; EPSS sits at 0.12%, reflecting the low real-world threat level consistent with the CVSS 3.3 rating.
Location metadata disclosure in Android 17's MediaProvider component allows a low-privileged local app to bypass permission enforcement in getQueryBuilderInternal of MediaProvider.java and retrieve GPS coordinates embedded as EXIF metadata in media files without holding the ACCESS_MEDIA_LOCATION permission. The root cause is CWE-862 (Missing Authorization) in the query builder logic - the authorization gate that should block location-tagged media queries from unpermissioned callers is absent or incorrectly applied. No public exploit has been identified, and the CVSS 3.3 score reflects both the constrained local attack surface and the limited disclosure scope.
Out-of-bounds heap read in Android's ResourceTypes.cpp `setTo` function exposes local heap memory to low-privileged processes across Android 14 through 17. The missing bounds check requires only standard user-level execution - no elevated privileges and no user interaction - to trigger partial disclosure of heap contents. No active exploitation has been identified; EPSS probability is 0.12% (2nd percentile), consistent with a low-severity local disclosure in a narrow attack surface.
Local information disclosure in Android's AppFuseBridge framework component allows any installed app to read files or data it lacks permission to access. The vulnerability exists in the openFile() method of AppFuseBridge.java, where a missing permission check (CWE-693) permits a low-privileged local process to bypass access controls without user interaction. Affected versions span Android 14 through 17, including the QPR2 interim release, giving this issue a broad footprint across current Android deployments. No public exploit or active exploitation has been identified; EPSS is 0.12% (2nd percentile), consistent with the local-only, low-impact nature of the flaw.
Local information disclosure in Android 15 through 17 exploits a confused deputy flaw in `screenArgsForPermissionCheckIfAny`, allowing a low-privileged local app to bypass permission validation and access data it should not be authorized to read. The flaw stems from a privileged component incorrectly acting on behalf of a less-privileged caller without adequate permission verification, resulting in unauthorized local data exposure. No public exploit has been identified at time of analysis, and with an EPSS of 0.12% this is assessed as low-priority despite Android's broad deployment footprint.
Local information disclosure in Android's MediaProvider component affects Android 14 through 17 via a race condition in `updateInternal` of `MediaProvider.java`. An unprivileged local application can exploit a time-of-check-time-of-use (TOCTOU) window during a media record update operation to read file contents that should not be accessible, without requiring elevated privileges. No public exploit has been identified at time of analysis, and EPSS at 0.12% (2nd percentile) reflects the low probability of widespread automated exploitation.
Local information disclosure in Android 14 through 17 stems from a logic error across multiple functions in XmpDataParser.java that causes improper sanitization of XMP metadata during media file parsing. A local attacker with standard user-level privileges can trigger the flaw without any user interaction, leaking restricted information from the parsing context. No public exploit code or active exploitation has been identified, and the September 2026 Android Security Bulletin provides the authoritative patch.
Tapjacking via malicious UI overlay in Android 17's ContactsPickerActivity allows a locally installed application to present misleading UI over the contacts picker, resulting in local information disclosure of contact data. The attack requires only low-privilege access (a sideloaded or installed app) and no user interaction once the overlay is active. No public exploit code is identified, and EPSS at the 2nd percentile reflects negligible opportunistic exploitation probability.
Local information disclosure in Android 16 and 17 exposes the device Bluetooth MAC address through a missing permission check in the writeToParcel method of BleRssiRangingCapabilities.java. Any low-privileged local application can invoke this code path without holding the required Bluetooth permission, silently retrieving a hardware identifier that can be used to track a device across networks. No public exploit has been identified at time of analysis, and CISA SSVC assessment places exploitation at none.
Unauthorized access to and modification of device credentials is possible in Android 14 through 17 due to a missing permission check in the `onCreate` method of `ConfirmDeviceCredentialActivity.java`. Any locally installed application running with standard user-level privileges can trigger this flaw without requiring user interaction, gaining read access to - and potentially altering - stored device credential state. No public exploit code exists and EPSS sits at 0.11% (2nd percentile), placing current real-world exploitation risk very low despite the breadth of affected Android versions.
Local information disclosure in Android 14-16 allows any installed app with basic privileges to read wallet contextual location data by calling WalletContextualLocationsService without a working authorization gate. The root cause is a missing permission check in the isCallerAllowed method of WalletContextualLocationsService.kt (CWE-862): the service fails to verify that the caller holds the required wallet-access permission before returning location context. Impact is limited to confidentiality of wallet location data; no code execution, integrity modification, or privilege escalation is possible. No public exploit code has been identified and EPSS is 0.11% (2nd percentile), reflecting negligible current exploitation interest.
Out-of-bounds read in DPDK's lib/vhost virtio-net control-queue handler allows a local low-privileged attacker - such as a guest VM user with access to the virtio-net control virtqueue - to trigger an unchecked read of command_data, crashing the host-side DPDK vhost process. Affected deployments include NFV platforms, cloud hypervisors, and telco packet-processing stacks that use DPDK vhost-user for guest I/O. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS score of 3.3 reflects local access and limited availability impact.
Server-Side Request Forgery in InstantCMS versions prior to 2.18.2 allows authenticated users to probe internal network services by exploiting a redirect-bypass flaw in the 'upload from URL' feature. The uploader validates the initial URL against a private IP blacklist, but when the remote server issues an HTTP redirect, the redirected target URL is followed without re-validation, allowing the blacklist to be bypassed entirely. An attacker with any authenticated account can use this to map and interact with internal services not exposed to the public internet. No public exploit or CISA KEV listing has been identified at time of analysis.
Missing permission check in multiple functions of RangingServiceImpl.java on Android enables a man-in-the-middle attacker to intercept ranging service communications and disclose sensitive information without requiring additional execution privileges. Affected versions span Android 16, Android 16-QPR2, and Android 17, covering current and near-future Android releases. No public exploit has been identified at time of analysis, and EPSS is very low at 0.14%, but the network-reachable attack surface and absence of user interaction required warrant attention in environments handling proximity or location-sensitive data.
Open redirect (CWE-601) in Fortinet FortiSIEM 7.4.1-7.5.1 allows unauthenticated remote attackers to redirect FortiSIEM users to attacker-controlled sites via a crafted URL, enabling phishing or credential-harvesting attacks against security operations personnel. The CVSS temporal score includes E:P (proof of concept exists) and RL:O (official fix available), per Fortiguard advisory FG-IR-26-169. No active exploitation confirmed and no KEV listing; the overall risk is constrained by AC:H and mandatory user interaction, yielding a low base score of 2.8.
Weak password hashing in aircheng-org iWebShop-5 (all documented versions 5.0-5.15) enables an attacker who separately obtains the application's credential store to crack administrator passwords with significantly reduced effort, due to insufficient computational complexity in the Authentication Storage component's hashing routine within controllers/admin.php. A proof-of-concept exploit has been published (CVSS 4.0 E:P, SSVC Exploitation:poc), and the vendor has not responded to coordinated disclosure via GitHub issue #7, leaving all v5.x branch installations unpatched. No CISA KEV listing exists, indicating no confirmed widespread active exploitation at time of analysis.
Authenticated denial of service in Fortinet FortiOS, FortiPAM, and FortiProxy allows a high-privileged network attacker to crash the httpsd daemon by sending specially crafted HTTP requests, exploiting a NULL pointer dereference (CWE-476). The vulnerability spans FortiOS 7.2.x and 7.4.x, FortiProxy 7.2 through 7.6.6, and every FortiPAM release from 1.0.0 through 1.9.0. No active in-the-wild exploitation is confirmed, but the CVSS temporal metric E:P indicates proof-of-concept code exists; Fortinet has released an official fix under advisory FG-IR-26-173.
Terminal escape sequence injection in ash-project/usage_rules (versions 0.1.18 through 1.2.7) allows a malicious Hex package publisher to forge what developers see when running mix usage_rules.search_docs. The Mix task queries search.hexdocs.pm and renders publisher-controlled fields - title, package name, type, doc reference, and highlighted snippets - verbatim to the terminal with no control-character sanitization, only adding ANSI highlighting rather than stripping injected sequences. A package author who embeds ANSI cursor-movement, line-erase, carriage-return, or OSC 52 clipboard-write sequences in their documentation can cause a developer's terminal to display a forged hexdocs URL, conceal output, or silently write an attacker-controlled command to the clipboard; no public exploit has been identified at time of analysis.
Change stream data corruption in MongoDB Server (versions 7.0.0-7.0.40, 8.0.0-8.0.29, and 8.3.0-8.3.8) enables authenticated database users to insert documents with operator-shaped objects as shard key values that bypass insertion validation in sharded collections. When downstream change stream consumers operate in updateLookup full document mode, these stored values are embedded unsanitized into internal post-image lookup queries, causing MongoDB's query engine to interpret them as operator expressions rather than literal equality predicates. The practical result is that change stream consumers either receive incorrect post-image documents from unrelated records or encounter non-resumable fatal errors that break real-time data pipelines; no public exploit has been identified and vendor-released patches are available across all three affected release trains.
Transient CPU exhaustion in SAP Process Integration's SOAP Adapter allows a privileged authenticated user to craft SOAP requests containing deeply nested XML entity definitions (CWE-776, 'XML Bomb' class), temporarily degrading system responsiveness. The vulnerability scores CVSS 2.2, reflecting that exploitation requires high privileges, high attack complexity, and yields only low availability impact with zero confidentiality or integrity consequences. No public exploit code and no CISA KEV listing have been identified, placing this firmly in the low-priority tier despite network reachability.
Session fixation (CWE-384) in ningzichun Student Management System allows a remote attacker to pre-set a victim's session identifier via login.php, then hijack the authenticated session after the victim logs in. The login.php file's use of session_start fails to regenerate the session ID upon successful authentication, making any pre-supplied session ID persist into the authenticated state. Publicly available exploit code exists (E:P per CVSS 4.0 supplemental vector), though no active exploitation has been confirmed in CISA KEV.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /pages/us_edit.php, enabling arbitrary SQL query execution against the underlying database. The affected product is a PHP-based open-source educational web application distributed via itsourcecode.com. Publicly available exploit code exists (CVSS 4.0 E:P), though no active exploitation or KEV listing has been recorded, consistent with the product's limited real-world deployment footprint.
The Armoury Crate kernel-mode driver on ASUS systems exposes an IOCTL interface without adequate caller verification, enabling a locally authenticated low-privilege user to inject arbitrary process identifiers into the driver's trusted-process whitelist via a crafted IOCTL request. Bypassing this verification (CWE-782) allows the attacker's process to assume whitelisted trust status within the driver, gaining access to driver functions ordinarily restricted to ASUS's own software. No public exploit has been identified and the vendor-assigned CVSS 4.0 score of 2.0 reflects the constrained real-world impact: local-only access, high exploitation complexity, and limited integrity gain.
Cross-site request forgery in NETGEAR's XR500, XR1000, and XR1000v2 gaming routers allows an adjacent-network attacker to tamper with router configuration and disrupt operations by tricking a logged-in administrator into visiting a malicious page. The vulnerability stems from absent or insufficient CSRF protections on the router's web management interface, enabling forged requests to be submitted on behalf of an authenticated admin. No confidentiality impact is present; exploitation requires both social engineering success and admin-session timing, but can result in full configuration integrity loss and service disruption. No public exploit or CISA KEV listing is identified at time of analysis.
Stack-based buffer overflow in the NETGEAR RAX series router management UI (RAX30, RAX35, RAX38, RAX40, RAXE300) enables an adjacent-network attacker holding valid WiFi credentials to crash the web management interface. The vendor explicitly bounds the impact to management UI unavailability - core router services including the WiFi network and routing plane continue operating normally with no confidentiality or integrity exposure. CVSS 3.5 reflects this constrained scope; no public exploit code exists and no active exploitation has been identified.