Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimagecodec.quram.so) affects Samsung mobile devices on Android 14, 15, 16, and 17 prior to the SMR Sep-2026 Release 1 patch. A crafted DNG image parsed by the library triggers a heap-based buffer overflow, letting a remote attacker run arbitrary code in the context of the process handling the image. No public exploit identified at time of analysis, and it is not on the CISA KEV list, but Quram image-parsing flaws have a strong historical track record of weaponization on Samsung/Android.
Authentication bypass in Parse Server's built-in LDAP authentication adapter (versions <= 8.6.87 and 9.0.0 through 9.10.1-alpha.6) lets an unauthenticated attacker who knows a valid directory username obtain a session token for that account, resulting in full account takeover. The adapter forwarded a client-supplied empty password to the directory and treated any non-error bind response as successful authentication, so a zero-length credential triggers an RFC 4513 unauthenticated-simple-bind that directories like Active Directory answer with success. No public exploit identified at time of analysis, but the flaw is trivial to trigger against affected LDAP-backed deployments.
Plaintext recovery and content forgery in OpenIDC/cjose 0.6.1 through 0.6.2.5 occurs because the library zero-fills the content-encryption key (CEK) instead of randomizing it whenever a JWE is built with an AES-CBC-HMAC enc (A128CBC-HS256/A192CBC-HS384/A256CBC-HS512) and a key-management algorithm that generates a fresh CEK. Every affected ciphertext is therefore encrypted and authenticated under an all-zero, publicly known key, so anyone who obtains the JWE can decrypt it and forge or modify its contents. Fixed in 0.6.2.6; no public exploit identified at time of analysis, but the flaw is trivially demonstrable and confirmed by the vendor GitHub Security Advisory.
Payment-confirmation forgery in PayTR's Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0 to before v9.0.3) lets remote unauthenticated attackers spoof a trusted payment identifier so the module treats an unpaid or attacker-controlled transaction as legitimately settled. Reported by TR-CERT, it stems from the module relying on a less-trusted, client-influenceable source instead of server-to-server verification of PayTR's callback. No public exploit is identified at time of analysis, and no EPSS or KEV data was supplied.
Remote heap information disclosure in eProsima Fast DDS lets unauthenticated attackers leak adjacent heap memory by sending a crafted RTPS DATA_FRAG submessage. Affected versions before 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fail to validate that the received datagram is large enough before a memcpy() in the last-fragment reassembly path, so bytes past the UDP buffer (potentially pointers useful for ASLR bypass) are copied into the reassembly buffer and, in Discovery Server deployments, relayed to other participants. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.
Sandbox-escape remote code execution in Google Chrome's Extensions component (versions prior to 153.0.8010.36) lets a remote attacker potentially run arbitrary code outside the renderer sandbox by delivering crafted network traffic. The root cause is incorrect reference resolution (CWE-706), where a name or reference is resolved to the wrong target. Google has shipped a fix; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.20%).
Privilege escalation in Sage AR Automation (the 'Cash Collect' product) before the June-R1-2026 release allows an authenticated low-privileged user to create administrator accounts through the AR Automation API, because administrative functions fail to enforce privilege checks. Any user with a valid low-level login can promote themselves to full administrative control of the application. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-tenant privilege escalation in Sage AR Automation (the 'Cash Collect' service) lets an authenticated tenant user reach administrative resources belonging to other tenants by supplying a valid tenant identifier that the API fails to authorize against the caller. Because the identifier is non-predictable, exploitation requires first obtaining a legitimate foreign tenant ID, which raises attack complexity but still breaks the multi-tenant isolation boundary of this SaaS platform. Reported via HackerOne; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 Virtual Edition allows an unauthenticated network attacker to inject arbitrary operating-system commands via improperly neutralized special elements (CWE-78). Affected are the SCG 5.0 Appliance component before 5.36.00.16 and the SCG 5.0 Application component before 5.36.00.00; a vendor patch is available via Dell advisory DSA-2026-382. No public exploit identified at time of analysis, but the network-reachable, no-authentication attack path and 9.8 CVSS make this a high-priority remote-takeover risk.
Command injection in Dell Secure Connect Gateway (SCG) 5.0 - both the Appliance (before 5.36.00.16) and Application (before 5.36.00.00) variants - allows an unauthenticated remote attacker to inject and execute commands, described by Dell as script injection. The CVSS 9.8 vector rates all three impacts as high (C:H/I:H/A:H), though CISA SSVC scores the technical impact as only partial. No public exploit identified at time of analysis and SSVC exploitation status is 'none', but the flaw is marked automatable, raising the risk of scanning-driven mass exploitation once a technique surfaces.