Decompression bomb (CWE-409) in ASP.NET Core allows unauthenticated remote attackers to exhaust server resources and deny service by submitting highly compressed HTTP payloads that expand disproportionately during server-side processing. Affected releases span .NET 8.0, 9.0, and 10.0 runtimes, all corresponding ASP.NET Core versions, and Visual Studio 2022/2026 which embed affected runtimes. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected version lines.
OpenBSD's 802.11 TKIP implementation deauthenticates all wireless clients and blocks reassociation for up to 90 seconds when an attacker within RF range sends two malformed TKIP frames separated by more than 60 seconds. The root cause is an inverted comparison operator in ieee80211_michael_mic_failure() that reverses the 60-second MIC failure countermeasure window: out-of-window failures incorrectly trigger the IEEE 802.11i countermeasure (a DoS), while in-window failures that should trigger the countermeasure are silently discarded, leaving active TKIP key-recovery attacks completely undetected. A publicly available exploit exists per the Argus Systems advisory; no KEV listing at time of analysis.
Unrestricted file upload in aircheng-org iWebShop-5 versions up to 5.15 allows remote unauthenticated attackers to upload arbitrary files - including PHP webshells - via the `upload_json` and `uploadFile` functions in `controllers/pic.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier network exploitation requiring no authentication or user interaction. A public proof-of-concept exploit has been disclosed via GitHub issue, and no vendor patch is available as the project has not responded to responsible disclosure.
Direct web-accessible SQL backup file exposure in code-projects Student Crud Operation 1.0 allows unauthenticated remote attackers to download the raw database dump `/card_activation.sql` from the web root. The file likely contains database schema and card activation records, exposing sensitive application data without any authentication. No public exploit identified at time of analysis is incorrect - publicly available exploit code exists per the referenced GitHub writeup, though no CISA KEV listing is present.
Missing authorization in aircheng-org iWebShop-5 (all versions through 5.15) exposes the Update::index controller method in controllers/update.php to unauthenticated remote invocation, allowing any network-reachable attacker to trigger the application's update workflow without credentials. The CWE-862 flaw is confirmed by a public proof-of-concept filed in the project's GitHub issue tracker, and the vendor has not responded to disclosure. No CISA KEV listing exists, but active exploitation risk is elevated by the availability of working exploit code.
Unbounded resource allocation in jackson-coreutils 2.0 exposes any Java application using the library's JSON Pointer parser to remote denial of service. The `TreePointer.tokensFromInput` method in the JSON Pointer parsing component fails to enforce limits on resource allocation when processing attacker-controlled input, allowing a remote unauthenticated attacker to trigger excessive memory or CPU consumption. A public proof-of-concept exists via a GitHub issue report; the project maintainer has not responded to the disclosure, and no patch is available at time of analysis.
Uncontrolled resource consumption in java-json-tools jackson-coreutils 2.0 allows remote unauthenticated attackers to trigger a denial-of-service condition by submitting crafted input that causes BigDecimal.toPlainString() in JacksonUtils.java to exhaust CPU or memory resources. The root cause is CWE-400 (Uncontrolled Resource Consumption), a well-understood class of vulnerability in Java BigDecimal handling where specially constructed numeric values - such as those with extremely large scale or unscaled value - produce pathologically long string representations. No public exploit has been incorporated into the CISA KEV catalog, though exploit code was publicly disclosed via a GitHub issue report. The maintainer has not responded to responsible disclosure.
Sub-workflow caller policy bypass in n8n allows authenticated low-privileged users to invoke restricted workflows via the Agent tool path, reading back outputs they should not have access to. All n8n versions before 2.37.7 and the 2.38.x branch before 2.38.2 are affected. A public proof-of-concept exploit exists (GHSA-7hgx-277f-7vmg); no confirmed active exploitation is recorded in CISA KEV at time of analysis.
Unauthenticated network access to read-only PIMBoards endpoints in AVEVA Pipeline Integrity Monitor exposes operational data intended exclusively for authenticated PIMBoards users. The root cause is CWE-862 Missing Authorization - read paths lack access control enforcement, allowing any network-reachable attacker to retrieve restricted information without credentials. Write operations are explicitly unaffected, bounding the impact to confidentiality. No public exploit code or active exploitation has been identified at time of analysis; CISA SSVC rates exploitation as none and technical impact as partial.
Cross-site scripting in AVEVA PIMBoards (Pipeline Integrity Monitor ≤ 2025 SP1 P1, build 7.1.9580.8513) enables unauthenticated remote attackers to execute arbitrary JavaScript in a targeted user's active browser session by tricking the user into clicking a crafted malicious link. The attack is classified CWE-79 (reflected XSS), requires active user interaction, and is reported by ICS-CERT - indicating relevance to operational technology and industrial pipeline environments. No public exploit code has been identified at time of analysis, and CISA SSVC rates current exploitation as none.
SQL Server information disclosure via buffer over-read (CWE-126) allows an authenticated low-privilege network attacker to read memory contents beyond an intended buffer boundary, potentially exposing sensitive in-process data. The flaw spans SQL Server 2017, 2019, 2022, and 2025 across both GDR and Cumulative Update servicing branches, making the affected population broad. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the network-accessible, low-complexity attack path warrants timely patching given the enterprise prevalence of SQL Server.
Information disclosure in Microsoft SQL Server 2025 allows an authenticated, low-privileged network attacker to extract sensitive data through crafted SQL error messages. Affected are the CU8 and GDR servicing branches of SQL Server 2025, with both patch channels receiving fixes. No active exploitation or public proof-of-concept has been identified at time of analysis, but the CVSS C:H rating indicates the potential for significant confidentiality breach once an attacker has any valid credential.
Out-of-bounds read in Microsoft SQL Server 2017 and 2019 exposes sensitive memory contents to remote unauthenticated attackers over the network. The flaw (CWE-125) exists in a network-accessible SQL Server component and is reachable without authentication, though user interaction is required (CVSS UI:R). Microsoft has released patched builds for all affected servicing branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in Microsoft Exchange Server 2016, 2019, and Subscription Edition enables a network-authenticated low-privilege attacker to force the Exchange server to issue crafted outbound HTTP requests, resulting in high-confidentiality-impact information disclosure and network spoofing. The vulnerability requires only valid Exchange credentials and no user interaction, making it accessible to any mailbox user in an affected organization. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft is confirmed.
Out-of-bounds read in Microsoft SQL Server 2017 through 2025 enables an authenticated low-privileged attacker to crash the database engine remotely, causing a denial of service. The flaw (CWE-125) is reachable over the network with no user interaction required, making it suitable for disrupting database availability from any network-connected authenticated session. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected major versions.
Path traversal in Visual Studio Code (all versions prior to 1.136.2) allows a remote unauthenticated attacker to write files outside the intended restricted directory, achieving high-integrity tampering on the victim's system over a network. The attack requires user interaction - a victim must open or process attacker-controlled content within VS Code - which limits automatability. No active exploitation has been identified; SSVC assessment confirms exploitation status as none with partial technical impact. Microsoft has released a fix in version 1.136.2.
Buffer over-read (CWE-126) in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated low-privilege network attacker to trigger server-side memory disclosure. The flaw causes the SQL Server engine to read past an allocated buffer boundary and return excess memory contents to the caller over the network connection, potentially exposing in-memory data from other sessions or internal state. No public exploit code exists and CISA has not listed this in KEV; SSVC rates exploitation as none and technical impact as partial, making this a moderate-priority patch cycle item.
Out-of-bounds read (CWE-125) in Microsoft SQL Server 2017 through 2025 allows a low-privileged authenticated attacker to disclose potentially sensitive server memory contents over the network. The flaw spans all four supported major versions across both Cumulative Update (CU) and General Distribution Release (GDR) servicing tracks, producing a broad enterprise exposure surface. Microsoft has released patches for all affected version branches; no public exploit code or CISA KEV listing has been identified at the time of analysis.
Out-of-bounds read (CWE-125) in Microsoft SQL Server enables an authenticated network attacker with low privileges to disclose sensitive server-side information. The flaw spans SQL Server 2017 through 2025 across both Cumulative Update and General Distribution Release servicing branches, representing a broad exposure across enterprise database deployments. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches across all affected servicing branches.
Out-of-bounds memory read in Microsoft SQL Server 2017 through 2025 allows network-authenticated, low-privilege database users to disclose sensitive server-side memory contents. The flaw (CWE-125) is reachable over the network with only a valid database account, requiring no user interaction, and affects all currently supported SQL Server release tracks - both Cumulative Update and General Distribution Release channels. Microsoft has released patches across all affected branches; no public exploit code has been identified at time of analysis.
Buffer over-read (CWE-126) in Microsoft SQL Server exposes adjacent memory contents to authenticated low-privileged network attackers across SQL Server versions 2017 through 2025. The vulnerability spans both Cumulative Update (CU) and General Distribution Release (GDR) servicing branches, making patch management across heterogeneous SQL Server estates non-trivial. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Out-of-bounds read (CWE-125) in Microsoft SQL Server 2025 allows an authenticated network attacker to disclose sensitive in-memory information. Affected versions span both the CU8 cumulative-update branch (below 17.0.4085.5) and the GDR branch (below 17.0.1135.8). No public exploit or CISA KEV listing exists at time of analysis; Microsoft has released patches for both branches.
Out-of-bounds read in Microsoft SQL Server (versions 2017 through 2025) allows a low-privileged authenticated attacker to disclose sensitive information over the network by triggering a memory read beyond an allocated buffer boundary. The CVSS vector confirms network-accessible exploitation requiring only low-privilege credentials (PR:L), with no user interaction needed, resulting in high confidentiality impact. No public exploit code or active exploitation has been identified; Microsoft has released patches across all affected servicing branches.
Out-of-bounds memory read in Microsoft SQL Server exposes sensitive server-side data to authenticated network attackers. The flaw (CWE-125) spans four major SQL Server release lines - 2017 through 2025 - in both GDR and Cumulative Update servicing tracks, making it broadly present across enterprise environments. An attacker holding low-privilege SQL Server credentials can exploit this to read memory contents beyond an intended buffer boundary, achieving high confidentiality impact without any user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read (CWE-125) in Microsoft SQL Server enables an authenticated, network-adjacent attacker to disclose sensitive in-process memory contents. Affecting SQL Server versions 2017 through 2025 across both GDR and Cumulative Update servicing tracks, exploitation requires valid database credentials but no elevated privileges. Microsoft has released patched builds for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server allows a low-privileged, authenticated attacker to remotely disclose sensitive memory contents over a network. Affected builds span SQL Server 2017 through 2025 across both Cumulative Update and GDR servicing branches. With a CVSS 6.5 and C:H, successful exploitation could expose confidential server-side data; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server 2022 and 2025 enables an authenticated, low-privileged attacker to disclose sensitive server memory contents over the network. The flaw (CWE-125) resides in the SQL Server engine and is reachable via crafted network queries, resulting in high confidentiality impact with no integrity or availability loss. No public exploit code or active exploitation has been identified at time of analysis, but a vendor-released patch is available.
Uninitialized memory disclosure in Microsoft SQL Server 2017 through 2025 allows a network-connected low-privilege authenticated attacker to read sensitive data from SQL Server memory. The flaw (CWE-908) arises when the engine allocates and uses memory without proper initialization, potentially exposing contents from adjacent queries, sessions, or internal data structures. Microsoft has released patches across all affected Cumulative Update and GDR servicing branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Insufficient audit logging in Microsoft SQL Server 2022 and 2025 allows a low-privileged authenticated attacker to bypass a security control over the network, resulting in high-confidentiality data access without a corresponding audit trail. Affected versions span both the GDR and Cumulative Update branches of SQL Server 2022 (pre-16.0.4275.2 / pre-16.0.1200.5) and SQL Server 2025 (pre-17.0.4085.5 / pre-17.0.1135.8). No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected servicing branches.
Integer overflow in Microsoft SQL Server 2022 and 2025 enables an authenticated, low-privilege network attacker to crash the database service, causing a denial of service for all connected clients. The flaw (CWE-190) is triggered by crafted network input that induces an integer wraparound in SQL Server's processing logic, resulting in complete availability loss. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available for all affected versions.
Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition) exposes an authorization bypass via user-controlled key manipulation (CWE-639), allowing any authenticated network user to tamper with Exchange objects outside their authorized scope. An attacker with low-privilege access can substitute a manipulated object key in requests to affect mailbox data, calendar entries, or other resources belonging to other users, achieving high integrity impact with no confidentiality or availability consequence. Microsoft has released patched versions for all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server exposes server memory to authenticated low-privileged network attackers, enabling information disclosure across SQL Server 2017 through 2025. The flaw (CWE-125) is reachable over the network without elevated privileges or user interaction, making it accessible to any valid SQL Server login. Microsoft has released patches across all affected servicing branches; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Uninitialized memory exposure in Microsoft SQL Server 2017 through 2025 allows a network-authenticated low-privilege attacker to read sensitive server-side data. The root cause is CWE-908 (Use of Uninitialized Resource), where a memory region is accessed before initialization, potentially leaking residual contents from query buffers, session state, or internal structures. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patches are available across all affected version branches.
Uninitialized memory disclosure in Microsoft SQL Server 2017 through 2025 allows a low-privileged authenticated attacker to read sensitive server memory contents over a network connection. The CWE-908 flaw affects all major SQL Server release branches - 2017, 2019, 2022, and 2025 - across both GDR and Cumulative Update servicing tracks. Microsoft has released patches for all affected versions; no public exploit code or active exploitation is documented at time of analysis.
Out-of-bounds read in Microsoft SQL Server 2017 through 2025 exposes server memory contents to authenticated low-privilege network attackers, enabling information disclosure without integrity or availability impact. The flaw (CWE-125) requires only a valid low-privilege database account and network access, making it accessible to any SQL login holder - including application service accounts - against unpatched instances. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the breadth of affected versions across four major SQL Server release families widens the attack surface considerably.
Out-of-bounds read (CWE-125) in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated low-privilege network attacker to disclose potentially sensitive server memory contents. The flaw is exploitable over the network with low complexity and requires only a valid database login - no user interaction or elevated privileges are needed. Microsoft has released patches across all six affected servicing branches; no public exploit code or CISA KEV active exploitation has been identified at time of analysis.
Origin validation error (CWE-346) in Microsoft .NET enables network-based information disclosure where an unauthenticated remote attacker can read sensitive data from a .NET application by exploiting improper validation of request origins. Affected are multiple active .NET release trains (8.0, 9.0, 10.0, 11.0 RC1) and Microsoft Visual Studio 2022 and 2026 where bundled .NET runtimes are included. The CVSS vector (UI:R) indicates user interaction is required, consistent with a cross-origin attack pattern where a victim must visit an attacker-controlled page that triggers the malicious cross-origin request. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated schema mutation in Open-Web-Analytics 1.9.x allows remote attackers to invoke the base.updatesApply action - which applies database schema migrations - without any authentication or CSRF protection. The root cause is an opt-in authorization model in checkCapabilityAndAuthenticateUser(): controllers that omit setRequiredCapability() bypass authentication entirely, leaving the schema-mutation endpoint reachable by anyone. No public exploit or KEV listing exists; a patched release is available at version 1.10.0 via confirmed upstream commit.
Server-side request forgery in opengeos GeoLibre up to version 2.3.0 allows malicious plugins or attacker-controlled WebView content to invoke the application's native Tauri IPC commands (`fetch_url_bytes`, `resolve_url_redirect`) to issue HTTP requests from the desktop process's privileged network position, bypassing browser CORS restrictions and potentially reaching cloud instance-metadata services (169.254.169.254) inaccessible to ordinary browser fetch. The vulnerability is fixed in GeoLibre 2.4.0 via commit b745f62e29fa37364686525a21eee5e5c0f8a369. No public exploit code is identified at time of analysis and no CISA KEV active-exploitation listing exists.
Broken or risky cryptographic algorithm usage (CWE-327) in Microsoft Exchange Server 2016 and 2019 enables unauthenticated remote attackers to intercept and disclose sensitive communications over the network. Affected builds span Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and the Subscription Edition, all prior to their respective patched cumulative update versions. Microsoft has released corrective cumulative updates; no active exploitation or public proof-of-concept has been identified at time of analysis.
Improper authorization in seakee CPA-Manager-Plus 1.11.0-1.11.10 allows unauthenticated remote attackers to have GET and HEAD requests forwarded to the backend CPA service using the application's saved management key, granting read-level access to resources that should require admin credentials. The flaw resides in the CPAResource HTTP proxy handler (`apps/manager-server/internal/http/controller/proxy/handler.go`), where `useSavedManagementKey` was hardcoded to `true` for all read-method requests without invoking `AdminAuthService.VerifyHeader`, a check that was only performed for mutating methods. No public exploit code has been identified at time of analysis, and the vendor-released patch in v1.11.11 resolves the issue.
Side-channel route enumeration in Maravel PHP framework (versions prior to 10.73.1) allows unauthenticated remote attackers to map internal API route structures and controller parameter schemas by exploiting a differential HTTP response. The router's static route checklist incorrectly stores raw dynamic placeholder strings (e.g., `{id}`), so passing literal brace syntax in a request URL bypasses the dynamic tree engine, triggers a PHP 8+ `ArgumentCountError`, and returns a 500 Internal Server Error rather than the expected 404. An adversary can systematically fuzz endpoints with template-syntax paths, distinguish 500 from 404 responses, and reconstruct the application's routing schema without any authentication. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unstripped debug symbols in Siemens Reyrolle 7SR5 protection relay firmware (all versions prior to V2.70) expose internal function names, type definitions, and structure layouts to any party who downloads the publicly available firmware update packages. This does not directly compromise deployed devices but substantially reduces the skill and effort required for an attacker to identify exploitable weaknesses through static firmware analysis. No public exploit or active exploitation has been identified; Siemens has released firmware V2.70 as the fix per advisory SSA-142885.
Privilege escalation in Windows DHCP Server allows an already-authorized (high-privilege) network attacker to gain further elevated privileges by exploiting a missing authentication check on a critical server function (CWE-306). The vulnerability spans nearly every supported Windows Server release from 2012 through 2025, as well as Windows 10 1607/1809. No public exploit code has been identified at time of analysis, and Microsoft has issued patches across all affected builds.
Unauthenticated information disclosure in TP-Link Omada Controller exposes an initialization API endpoint that remains reachable after setup completes, leaking account-related data to any remote unauthenticated user. The endpoint was designed for one-time use during initial controller configuration but lacks post-initialization access controls, allowing attackers to query it freely. Successful exploitation facilitates user enumeration, which can serve as a reconnaissance step toward credential-stuffing or targeted brute-force attacks against administrative accounts. No public exploit or CISA KEV listing is identified at time of analysis.
Microsoft Teams for Android before build 1416/1.0.0.2026133602 inserts sensitive information into outbound network transmissions (CWE-201), enabling a low-privileged authenticated attacker to intercept and read confidential data over the network when a victim user performs an in-app action. The CVSS scope change (S:C) with high confidentiality impact (C:H) signals that the leaked data can cross trust boundaries beyond the attacker's own session, potentially exposing other users' or sessions' sensitive material. No public exploit identified at time of analysis; Microsoft has released a patch via the MSRC advisory.
Privilege escalation via untrusted pointer dereference in the Windows SCSI Class System File affects a broad range of Windows 10, 11, and Windows Server releases, requiring physical access to trigger. An attacker with physical access to a target machine can connect a malicious SCSI device, causing the kernel-mode SCSI class driver to dereference an attacker-controlled pointer and elevate from unprivileged to full system (kernel) control. No public exploit and no CISA KEV listing have been identified at time of analysis; exploitation is constrained to physical proximity.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability spans virtually all supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1/25H2. No public exploit has been identified at time of analysis; a vendor-released patch is available via the Microsoft Update Catalog.
Heap-based buffer overflow in the Windows Storage Spaces kernel driver (Spaceport.sys) enables kernel-mode code execution through a physical attack, affecting nearly every supported Windows desktop and server release. The flaw carries a CVSS 3.1 score of 6.8 with a physical attack vector, meaning an adversary must have hands-on access to the target hardware to trigger the overflow. Microsoft has issued patches covering Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H2; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, allows an attacker with physical access to execute arbitrary code at kernel privilege across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) results in full confidentiality, integrity, and availability compromise of the affected system upon successful exploitation. Microsoft has released patches; no public exploit has been identified at time of analysis and CISA KEV listing is absent.