Race-condition-triggered code execution in Google Chrome's V8 JavaScript engine (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to execute arbitrary code inside the Chrome renderer sandbox by serving a crafted HTML page to a victim. Exploitation is constrained to the Chrome sandbox process rather than the underlying OS, which aligns with Chromium's own internal severity rating of 'Low' despite the CVSS base score of 7.5. No public exploit code or CISA KEV listing is present at time of analysis; the high attack complexity metric reflects the timing-sensitive nature of race-condition exploitation.
Improper certificate validation in Chrome's Federated Credential Management (FedCM) component — fixed in Chrome 153.0.8010.36 — lets a remote attacker who controls crafted network traffic, combined with social engineering of the victim, bypass web origin policy and expose cross-origin identity data. The flaw is a confidentiality-only issue (no integrity or availability impact) and Chrome rates it security severity Low, despite a 7.5 CVSS base score; EPSS is only 0.15% (4th percentile), it is not in CISA KEV, and no public exploit code has been identified at time of analysis. Vendor-released patch: 153.0.8010.36.
nuxt-ollama versions 1.2.26 through 1.3.0 unconditionally places the Ollama cloud API key into Nuxt's public runtime config, causing it to appear verbatim in every server-rendered HTML page inside the `window.__NUXT__` script block, readable by any unauthenticated HTTP client. Any visitor or web crawler that fetches any page of an affected application can extract the `api_key` from the serialized SSR payload with a single GET request, then impersonate the operator against the Ollama cloud API to incur billing charges, exhaust rate limits, or exfiltrate stored model data. A publicly available PoC using Docker and Python has dynamically confirmed the leak; no public exploit identified at time of analysis for active KEV-level exploitation.
The krb5 crypto subsystem in the Linux kernel fails to zero derived Kerberos key material before freeing memory buffers, leaving sensitive cryptographic keys resident in freed slab allocator objects. Both `crypto_krb5_prepare_encryption()` and `crypto_krb5_prepare_checksum()` call plain `kfree()` instead of the security-aware `kfree_sensitive()` wrapper, which would first zero the allocation. Systems using Kerberos-authenticated kernel services - primarily NFSv4 with sec=krb5 or CIFS/SMB with Kerberos - on kernel versions from commit 3936f02b through the stable fixes are affected; no public exploit or active exploitation has been identified.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 expose both the Appliance and Application deployments to unauthenticated remote information disclosure. Any attacker who discovers or reverse-engineers the embedded static credentials - which cannot be changed by administrators - can authenticate to the gateway without valid user accounts and access sensitive information. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no privileges or user interaction; no public exploit or CISA KEV listing is recorded at time of analysis.
Hard-coded credentials embedded in Dell Secure Connect Gateway 5.0 allow a remote, unauthenticated attacker to authenticate to the service using the static credentials and access sensitive information. Both the Appliance variant (all versions prior to 5.36.00.16) and the Application variant (all versions prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified, but CWE-798 credentials are static across all unpatched installations worldwide, meaning any party with knowledge of them can exploit any exposed instance without further effort.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 expose sensitive information to unauthenticated remote attackers across both the Appliance and Application deployment variants. The vulnerability (CWE-798) allows an attacker who discovers or possesses the embedded credentials to authenticate without authorization and access confidential data. Dell has released patched versions under advisory DSA-2026-382, and no public exploits or CISA KEV listing have been identified at time of analysis.
Missing brute-force rate-limiting in Dell Secure Connect Gateway (SCG) 5.0 Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) exposes authentication endpoints to unlimited credential-guessing by unauthenticated remote attackers over the network. Successful exploitation allows an attacker to enumerate and compromise valid credentials, with Dell indicating the resulting access can enable client-side request forgery. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Snipe-IT before 8.7.0 allows any authenticated user to bypass authorization controls by replaying signed Livewire component snapshots directly against the /livewire/update endpoint. Because authorization is enforced only at the HTTP route layer and not within Livewire component lifecycle methods, a low-privilege session holder can invoke protected admin operations including creating OAuth clients, minting personal access tokens, and reading sensitive administrative data. No active exploitation has been confirmed (no CISA KEV listing), but the vendor-confirmed fix is available in version 8.7.0.
Stored cross-site scripting in SiYuan's Bazaar marketplace component (all versions before 3.8.2) allows an attacker to publish a package with a crafted iconURL containing JavaScript event handlers that execute in the authenticated user's SiYuan origin when Bazaar listing cards are rendered. The root flaw is unsanitized insertion of iconURL package metadata directly into HTML img src attributes, enabling injected event handlers such as onerror to fire arbitrary JavaScript within the victim's session. Once triggered, the injected script can make authenticated API requests and manipulate application state on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application allows a network-positioned unauthenticated attacker to conduct man-in-the-middle attacks, intercepting and potentially modifying encrypted communications between the SCG and Dell's remote support infrastructure. Affected versions are SCG 5.0 Appliance prior to 5.36.00.16 and SCG 5.0 Application prior to 5.36.00.00, as confirmed by Dell advisory DSA-2026-382. No public exploit code or CISA KEV listing exists at time of analysis, but successful exploitation yields high confidentiality and integrity impact on all intercepted support traffic.
Remote code execution via a download-without-integrity-check flaw affects Dell Secure Connect Gateway (SCG) 5.0 in both its Appliance and Application deployment forms. An unauthenticated network-adjacent attacker who can achieve a man-in-the-middle position between the SCG system and Dell's update infrastructure can substitute malicious code for legitimate downloads, leading to command execution on the appliance. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) captures the high attack complexity from the MITM requirement alongside the absence of authentication prerequisites. No public exploit has been identified at time of analysis.
Improper certificate validation in Dell Secure Connect Gateway 5.0 (both Appliance and Application variants) enables an unauthenticated remote attacker with a man-in-the-middle network position to intercept and modify encrypted communications between the SCG platform and Dell's support infrastructure. Rated CVSS 7.4 (CWE-295) with high confidentiality and integrity impact, this flaw is particularly sensitive given that SCG routinely carries privileged support telemetry and credentials. No public exploit code and no CISA KEV listing have been identified at time of analysis; Dell has released patches in advisory DSA-2026-382.
Remote code execution in HPE Aruba ClearPass Policy Manager (CPPM) allows an authenticated attacker with high-privilege access to the web-based management interface to execute arbitrary commands on the underlying operating system. The attack is network-reachable with no user interaction required beyond obtaining administrator credentials. No public exploit has been identified at time of analysis, but full system compromise is achievable upon successful exploitation.
OS command injection in Dell iDRAC9 and iDRAC10 baseboard management controllers permits a high-privileged remote attacker to execute arbitrary operating system commands on the BMC firmware layer. Affected generations span iDRAC9 14G (pre-7.00.00.184), iDRAC9 15G/16G (pre-7.30.10.50), and iDRAC10 17G (pre-1.30.30.50). Dell has released patched firmware across all affected generations; no public exploit or active exploitation is identified at time of analysis.
Heap out-of-bounds write in VLC Media Player 3.0.0 through 3.0.23 allows a local attacker to corrupt memory by tricking a user into opening a crafted PNG file with attacker-controlled dimensions. The root cause is a 32-bit integer overflow in AllocatePicture() where plane pitch-times-lines multiplication wraps before widening to the size_t accumulator, causing both overflow guards to pass on the already-corrupted value; aligned_alloc then reserves a small wrapped buffer while the PNG decoder writes full-dimension scanlines past its end. No public exploit has been identified at time of analysis, and EPSS indicates 0.30% exploitation probability over the next 30 days.
Authenticated remote code execution in HPE Aruba ClearPass Policy Manager (CPPM) allows a high-privileged attacker to access directory information through the web interface and then escalate that access to arbitrary OS command execution on the underlying system. The attack requires valid credentials with elevated privileges (PR:H per CVSS) but is otherwise straightforward - no interaction from another user is needed and complexity is low. No public exploit code or active exploitation has been identified at time of analysis, but the full C:H/I:H/A:H impact and network-accessible attack surface make this a priority patch target for CPPM deployments.
Denial-of-service via compression bomb in Dell Secure Connect Gateway (SCG) 5.0 allows unauthenticated remote attackers to exhaust server resources by sending highly compressed payloads that expand dramatically upon decompression. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Server-Side Request Forgery (SSRF) in Dell Secure Connect Gateway (SCG) 5.0 allows unauthenticated remote attackers to coerce the appliance or application into issuing arbitrary HTTP/HTTPS requests to internal or external destinations, leading to unauthorized access to internal network services, cloud metadata endpoints, or other back-end resources not intended for external exposure. Both the Appliance and Application deployment modes are affected across all versions prior to the fixed releases. No public exploit code or active exploitation has been identified at time of analysis, but the low-complexity, unauthenticated network vector makes this straightforwardly exploitable against any internet- or intranet-accessible instance.
Improper certificate validation in Dell Secure Connect Gateway 5.0 exposes both Appliance and Application deployments to unauthenticated remote exploitation, enabling MITM-style attacks that bypass TLS trust enforcement and grant unauthorized access to communications relayed through the gateway. The Appliance variant is affected below version 5.36.00.16 and the Application variant below 5.36.00.00. No active exploitation has been confirmed by CISA KEV and no public exploit code is referenced, but the zero-authentication network vector makes patching urgent for any internet-reachable SCG deployment.
Out-of-bounds write in HarmonyOS 6.1.0's rendering and composition module allows a locally executing process to corrupt adjacent memory, with vendor-stated impact to availability and a CVSS vector also indicating potential confidentiality exposure. Affected devices are those running Huawei HarmonyOS version 6.1.0 as confirmed by EUVD-2026-74596. No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
External control of file name or path (CWE-73) in Dell Secure Connect Gateway (SCG) 5.0 enables unauthenticated remote attackers to influence filesystem path resolution, resulting in unauthorized filesystem access. Both the Appliance form factor (versions before 5.36.00.16) and the Application form factor (versions before 5.36.00.00) are affected. Dell has released patched versions and published advisory DSA-2026-382; no public exploit code or active exploitation has been identified at this time.
Path traversal in Dell Secure Connect Gateway (SCG) 5.0 exposes restricted filesystem paths to unauthenticated remote attackers across both Appliance and Application deployment variants. The vulnerability (CWE-22) allows directory escape via crafted request paths, resulting in unauthorized access to files outside the intended serving root. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the unauthenticated network-accessible attack surface and low complexity make this a credible priority for enterprise Dell infrastructure operators.
CVE-2026-85013 is attributed to Ubuntu (vendor source only) but carries no description, CVSS score, CWE classification, or reference material in the available intelligence. Without a description or technical details, the vulnerability type, affected component, impact, and exploitation conditions cannot be established. This record should be treated as a placeholder pending vendor disclosure.
WP EasyCart (Shopping Cart & eCommerce Store) versions up to and including 5.9.3 exposes a privilege escalation path allowing authenticated Store Manager-level users to promote themselves to WordPress administrator. The `ec_ajax_save_page_default_options()` AJAX handler accepts arbitrary POST parameters and writes them directly to the WordPress options table via `update_option()` without any allowlist, while its nonce is embedded in frontend product and category templates accessible to any user holding the plugin's custom 'wpec_manager' capability. No public exploit code has been identified at time of analysis, but the attack technique is mechanically straightforward and requires only a Store Manager credential to execute.
Server-side template injection (SSTI) in Tanium Comply enables remote code execution by a highly privileged authenticated user, yielding full confidentiality, integrity, and availability impact on the Comply server. The vulnerability (CWE-1336) results from insufficient neutralization of template directives in user-controlled input, allowing the underlying template engine to evaluate and execute injected payloads server-side. Tanium addressed this in advisory TAN-2026-040; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in PublishPress Capabilities WordPress plugin (all versions ≤2.50.0) allows authenticated Editor-level users to elevate to site-wide capability managers without administrator consent. The root cause is a hard-coded role assignment in `addPluginCapabilities()` that unconditionally grants the Editor role all 15 `manage_capabilities_*` capabilities on the first `admin_init` hook after plugin activation, writing the grants persistently to the WordPress database. Once escalated, an Editor can create, rename, and delete non-system roles; modify capabilities of non-administrator roles; restore role backups; and write arbitrary plugin options under several namespaced prefixes - stopping short of full Administrator access only because WordPress's `map_meta_cap` layer blocks further escalation. No public exploit or CISA KEV listing identified at time of analysis.
Stored Cross-Site Scripting in the WPBot AI ChatBot WordPress plugin (QuantumCloud, all versions through 8.7.3) allows unauthenticated remote attackers to inject persistent JavaScript into pages viewed by site users and administrators. The critical design flaw is that the only access gate - a WordPress nonce - is rendered useless because it is embedded in every public-facing page via wp_localize_script, making it fully readable by any visitor. No public exploit code has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this a straightforward exploitation path for opportunistic attackers targeting WordPress sites.
Stored Cross-Site Scripting in the Repeater Fields for Gravity Forms WordPress plugin (all versions ≤3.0.4) allows unauthenticated attackers to inject arbitrary JavaScript into pages via multi-input sub-field types (Name, Address, Checkbox) within a repeater block, executing whenever any user views the affected page. The flaw is isolated to complex sub-field types because scalar single-input fields were patched with esc_html() output escaping in 3.0.4, leaving multi-input composite fields unprotected. Discovered and reported by Wordfence; no public exploit identified at time of analysis, though the vulnerability requires no authentication or special site configuration to abuse via a publicly accessible Gravity Form.
Stored cross-site scripting in the WPLP Cookie Consent WordPress plugin (all versions ≤ 4.4.1) enables any unauthenticated site visitor to inject persistent malicious scripts via the `wpl_user_preference` AJAX parameter. The consent-logging endpoint is registered without authentication requirements, and the protective nonce (`wpl_consent_logging_nonce`) is publicly broadcast to every page visitor via `wp_localize_script()`, rendering the nonce mechanism entirely ineffective as an access barrier. Injected payloads execute in the browsers of administrators or users who subsequently view pages rendering consent log data, enabling session hijacking, credential theft, or full administrative account takeover. No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the trivially low exploitation barrier warrants prompt patching.
SQL injection in Dell Secure Connect Gateway (SCG) 5.0 allows a remote high-privileged attacker to execute arbitrary SQL commands against the backend database, resulting in unauthorized access to sensitive data and potential data manipulation. Both the Appliance edition (before 5.36.00.16) and the Application edition (before 5.36.00.00) are affected. No public exploit code has been identified at time of analysis, and the mandatory high-privilege requirement substantially limits the realistic attack surface.
Stored Cross-Site Scripting in the Contact Form to DB by BestWebSoft WordPress plugin (versions ≤1.7.5) allows unauthenticated attackers to compromise administrator sessions via a malicious contact form submission. The `cntctfrm_contact_dropdown` parameter lacks input sanitization and output escaping, so injected JavaScript persists in the plugin's message store and executes automatically in the admin's browser context when they navigate to the message manager page at `/wp-admin/admin.php?page=cntctfrmtdb_manager`. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-prerequisite submission path make this trivially weaponizable against any site with the plugin installed.
The asset update API endpoint in Snipe-IT before 8.7.0 allows authenticated users with only edit permission to bypass explicitly denied checkout authorization by submitting assignment parameters directly to PATCH /api/v1/hardware/{id}. This missing authorization check (CWE-862) permits affected users to reassign assets, skip mandatory check-in procedures, and tamper with custody audit trails without ever holding the assets.checkout permission. The patch commit (f71806b1e0efbd3bc2b6be61994ad2a5d5d6c206) adds an explicit Gate::allows('checkout') guard and an availableForCheckout() status check to the update path. No public exploit identified at time of analysis.
Encrypted custom field values in Snipe-IT before 8.7.0 are exposed in plaintext to authenticated users who lack the assets.view.encrypted_custom_fields permission - a missing authorization gate (CWE-862) on asset form rendering for listbox, textarea, markdown-textarea, and date/datetime picker field types. Any authenticated user holding assets.edit, assets.checkin, assets.checkout, or assets.audit permissions can open an asset form and read values that should be restricted by a separate granular permission. No public exploit code exists and no CISA KEV listing has been identified; risk is confined to insider or low-privilege authenticated users in environments storing sensitive data in encrypted custom fields.
Server-side request forgery in Open WebUI prior to 0.11.1 allows authenticated users to reach internal cloud infrastructure by exploiting gaps in Python's `is_global` address classification. The web retrieval endpoints POST /api/v1/retrieval/process/web and /process/web/search relied solely on Python's built-in global-address check, which does not reject the Azure platform channel IP (168.63.129.16) or other reserved ranges such as multicast, 6to4 relay, NAT64, IPv6 site-local, and embedded-IPv4 representations. On Azure-hosted deployments this enables exfiltration of platform metadata, certificates, and management tokens accessible via the wire-link channel. No public exploit identified at time of analysis; vendor-released patch exists as version 0.11.1.
Improper access control in alf.io's organization/event-scoped 'single configuration' endpoints allows authenticated organization owners to exfiltrate system-level secrets-including the administrator system API key-by supplying arbitrary configuration key names to endpoints that perform a cross-scope lookup without restricting results to the caller's authorization tier. All alf.io deployments running versions prior to 2.0-M5-2605 where organization-owner accounts are held by partially trusted or untrusted parties are affected. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, but successful retrieval of the system API key enables a secondary full administrative escalation.
Improper access controls (CWE-862 Missing Authorization) in Tanium Comply expose compliance and vulnerability assessment data to authenticated users who lack sufficient privileges to access it. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) scores this at 7.1, with high confidentiality impact and limited integrity risk, exploitable over the network by any low-privileged Tanium account holder with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis.
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR Sep-2026 Release 1 enables local privileged attackers to execute arbitrary code within the Trusted Execution Environment. The CVSS 4.0 score of 7.1 with AV:L/AC:H/PR:H reflects a high technical bar: exploitation demands pre-existing high-privilege local access plus significant exploit engineering to achieve reliable heap corruption. Samsung confirmed the fix in the September 2026 Monthly Security Release; no public exploit or active exploitation has been identified.
Denial-of-service in Huawei HarmonyOS and EMUI's input device module allows a local unprivileged attacker to crash affected system components, impacting device availability. The CVSS scope change (S:C) indicates the flaw propagates availability impact beyond the vulnerable input module itself, potentially affecting higher-privileged or dependent subsystems. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Unencrypted UDP video transmission in the C6 Ear Camera and its companion EarVision Android application (version 1.3.1 / firmware 1.3.1_Code 132) exposes live ear-canal video streams to passive eavesdropping by any attacker within local wireless range. The camera broadcasts JPEG and WEBP frames over plaintext UDP with no transport-layer security, and the Android application's manifest explicitly permits cleartext traffic, removing any client-side enforcement barrier. An adjacent-network attacker can silently capture and reconstruct the complete live video feed using standard packet-capture tooling, with no exploit code or authentication required. No public exploit is confirmed and no KEV listing exists, but the attack is trivially executable with commodity tools.
Incorrect permission assignment on a critical resource in Pardus LightDM Greeter allows a local low-privileged user to read sensitive authentication material or tamper with greeter configuration, achieving high confidentiality and integrity impact without elevated rights. All versions before 0.4.15 of the greeter - a graphical login component shipped with Pardus, the Turkish government-backed Linux distribution maintained by TÜBİTAK BİLGEM - are affected. No public exploit or active exploitation has been identified; a vendor-released patch is available. No special configuration is required beyond having a local user account on an affected system.
Inventory integrity corruption in Snipe-IT ≤8.6.3 allows authenticated users holding consumable-checkout permission to over-allocate stock by exploiting a TOCTOU race condition in the API checkout endpoint. Concurrent POST requests to /api/v1/consumables/{consumable_id}/checkout each pass the pre-transaction availability check before either commits, enabling both to write checkout records and drive remaining inventory negative (e.g., a unit with 1 remaining ends at -1). Fixed in 8.7.0 via database row locking inside the transaction; no confirmed active exploitation at time of analysis, though proof-of-concept feasibility is noted by SSVC.
Snipe-IT through version 8.6.4 exposes protected component inventory data to any authenticated user holding only the assets.view permission via a missing authorization check on the GET /api/v1/hardware/<asset-id>/assigned/components REST API endpoint. The components.view permission is incorrectly applied only to the available_actions.view flag in the API response rather than to the underlying component data, allowing enumeration of component IDs, names, assigned quantities, and notes that the permission model is designed to restrict. Vendor-released patch 8.7.0 resolves the issue; no public exploit code or active exploitation has been identified at time of analysis.
Missing authorization on the POST /hardware/history endpoint in Snipe-IT before 8.7.0 allows any authenticated user to reassign arbitrary assets and inject fabricated entries into audit logs. By submitting a crafted CSV payload, a low-privileged attacker can silently transfer assets across organizational boundaries and corrupt the audit trail, undermining inventory accountability and chain-of-custody integrity. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though exploitation is trivially automatable for any authenticated account.
License key exposure in Snipe-IT before 8.7.0 allows any authenticated low-privilege user to bypass the viewKeys authorization gate and retrieve all product license keys stored in the system. Two distinct exploitation paths exist: bulk extraction via the CSV export endpoint and a key-validation oracle via observable API response discrepancies, making CWE-204 an accurate root-cause classification for the latter. No public exploit code or CISA KEV listing exists at time of analysis; the patch is available in version 8.7.0.
Server-side request forgery in Lara Dashboard 0.9.2-1.3.1 allows any authenticated content editor to proxy arbitrary HTTP requests through the application server via the markdown fetch API endpoint, with the server returning response bodies verbatim to the caller. The POST /api/admin/builder/markdown/fetch endpoint validated only URL format (not destination host), enabling requests to internal services and cloud metadata endpoints such as AWS IMDSv1 at 169.254.169.254, which can yield IAM role temporary credentials. No public exploit identified at time of analysis; vendor-released patch is available in v1.3.2.
Argument injection in GitPython 3.1.59's high-level diff API allows low-privileged remote attackers to read arbitrary filesystem paths by passing the unsanitized `--no-index` flag to the underlying git diff command. By chaining `--no-index` with the `-I`/`--ignore-matching-lines` regex filter, an attacker can construct a content-dependent Boolean oracle - issuing repeated queries that distinguish between regex match and mismatch responses to recover single-line secrets from local files. No active exploitation has been confirmed (not in CISA KEV), but the technique is deterministic and requires only authenticated API access. Patch-upgraded version 3.1.60 is available.
Siyuan note-taking application before v3.8.2 leaks private block content to authenticated readers through two export/preview API endpoints that skip publish-access validation when resolving embedded block references. Any user holding reader-level credentials can craft requests to /api/export/preview or /api/lute/copyStdMarkdown referencing public documents whose embed queries target private, hidden, or publish-disabled blocks, receiving their full rendered content. No public exploit code or CISA KEV listing has been identified, but exploitation requires only reader authentication and standard HTTP tooling.
Permanent image data destruction in Snipe-IT ≤8.6.3 results from unchecked return values on Laravel storage operations in ImageUploadRequest::handleImages(). When any authenticated user submits an image upload while the configured storage backend (S3, local filesystem, NFS) experiences a transient failure, the silently-returned false from Storage::put() is ignored - the prior image is deleted, and the database record is updated to reference a file that was never written. A symmetric defect in deleteExistingImage() compounds the problem by nulling the model's image field even when Storage::delete() fails, orphaning files on disk. The condition affects all image-carrying models routed through this handler and produces unrecoverable data loss requiring manual reconciliation. No public exploit has been identified at time of analysis.
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows attackers to trigger silent data corruption or JVM crashes by closing a Zstandard dictionary after it has been associated with a stream or context. The library's locking design released the dictionary's shared lock immediately after the load call, leaving the stream holding a native pointer to freed memory; subsequent read or write operations on that stream then access freed native heap, producing undefined behavior at the JVM/native boundary. No public exploit has been identified at time of analysis, and a patched release (v1.5.7-14) is available with two upstream commits.