Denial of service in GPAC's ROUTE/LCT demuxer (src/media_tools/route_dmx.c) is triggerable when the framework processes a crafted ROUTE session, causing uncontrolled resource consumption that ends in a crash or hang. Affected builds include the source tree at commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3, with the flaw fixed upstream in commit 3c4e6c5b3e0c6fa9b16d55599701a08354538fab. Exploitation is not confirmed in CISA KEV, no public exploit code has been identified at time of analysis, and EPSS is only 0.14% (4th percentile), so real-world urgency is modest despite the 6.2 CVSS base score.
ECDSA signature forgery is possible in mirage-crypto-ec before 2.2.0 for OCaml because the P256, P384, and P521 pub_of_octets functions accept 0x00 - the encoding of the elliptic curve point at infinity - as a valid public key. Any application relying on this library to verify ECDSA signatures against externally-supplied public keys can be deceived into accepting signatures crafted without knowledge of any private key. No public exploit has been identified at time of analysis, but the attack is conceptually elementary for anyone familiar with elliptic curve arithmetic.
HarmonyOS 6.1.0's event notification module contains a permission control flaw (CWE-275) that allows a locally-executing process without elevated privileges to disrupt the availability of the notification service. Both the CVSS vector (C:N/I:N/A:H) and Huawei's own bulletin text confirm the impact is strictly an availability denial - confidentiality and integrity are unaffected. Huawei has published remediation across four September 2026 bulletin categories covering consumer devices, smart displays, wearables, and laptops, indicating the flaw spans the full HarmonyOS device ecosystem. No public exploit code has been identified at time of analysis.
Permission control vulnerability in the app management module of Huawei HarmonyOS and EMUI allows a local unprivileged attacker to disrupt device availability without requiring any user interaction or elevated privileges. Affected platforms span nine versions across both HarmonyOS (4.0.0 through 4.3.3) and EMUI (14.0.0 through 16.0.0), covering a broad swath of active Huawei consumer devices. No public exploit has been identified at time of analysis, and Huawei has disclosed this through their September 2026 security bulletin.
Authenticated decryption in mirage-crypto before 2.2.0 for OCaml violates the security invariant of AEAD schemes by writing decrypted plaintext into the caller-supplied output buffer before the authentication tag is verified. When a forged tag is detected, `AES.GCM.authenticate_decrypt_into` and `Chacha20.authenticate_decrypt_into` return `false`, but the destination buffer already contains the full unverified plaintext. Applications that process buffer contents without rigidly checking the boolean return value - or where timing or compiler behavior creates subtle access windows - may consume attacker-controlled forged plaintext as if it were authenticated. No public exploit or KEV listing has been identified at time of analysis.
Cross-site scripting in Rizwan17's open-source PHP inventory-management-system allows remote attackers to inject arbitrary JavaScript via unsanitized category_name, brand_name, or product_name parameters handled by the List Handler in includes/DBOperation.php. A publicly available proof-of-concept (GitHub issue #12) demonstrates exploitation. No patch exists - the maintainer has not responded to the responsible disclosure report - and the project uses rolling releases with no versioned fix available.
Reflected Cross-Site Scripting in the Product Filter for WooCommerce by WBW WordPress plugin (woobewoo) allows unauthenticated network attackers to inject arbitrary JavaScript via the unsanitized 'wpf_fid' parameter. All plugin versions through 3.4.2 are affected on any WordPress/WooCommerce installation running the plugin. Successful exploitation requires social engineering - a victim must click a crafted URL targeting a store page where the plugin's filter recalculation output is rendered - enabling session hijacking, credential theft, or further escalation against authenticated users including store administrators.
Out-of-bounds memory read in the WebView component of Google Chrome on Android allows an attacker who has already compromised the renderer process to escape the sandbox and read arbitrary memory via a crafted HTML page. The vulnerability is fixed in Chrome 153.0.8010.36; all prior Android Chrome versions are affected. No public exploit code has been identified and EPSS probability is low at 0.22%, though the scope-changed confidentiality impact is significant if renderer compromise is already achieved.
Reflected Cross-Site Scripting in the User Access Manager WordPress plugin (all versions through 2.3.18) allows unauthenticated attackers to inject arbitrary JavaScript via the unsanitized 'tab_group_section' GET parameter rendered in admin settings views. Successful exploitation requires tricking a privileged WordPress user - most dangerously an administrator - into clicking a crafted URL, at which point the injected script executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Wordfence has published full technical details including vulnerable source line references, lowering the barrier for independent exploitation.
Open redirect exploitation in Yordam Informatics Technology's Library Information and Document Automation Program enables unauthenticated network-based phishing attacks against end users. Versions from v22.1 up to (but not including) v22.2 fail to validate redirect target URLs, allowing attackers to craft legitimate-looking library system URLs that silently forward victims to attacker-controlled sites. The Scope:Changed designation in the CVSS vector confirms the impact crosses from the server component into the user's browser session, enabling credential harvesting or malware delivery under the trusted domain's brand. No public exploit code or active exploitation has been identified at time of analysis.
yshopmall through version 3.3 exposes an unauthenticated file upload endpoint (/api/upload) that performs no file type validation, allowing attackers to place arbitrary HTML, JSP or other executable content on the server. Because uploaded files are reachable from the application's origin, a crafted HTML file can execute script in a victim's browser session (reflected/stored XSS, CVSS 6.1, CWE-79), and a JSP upload could escalate to server-side code execution if the upload directory is served by a JSP-capable container. Exploitation requires a victim to open the attacker-supplied file URL (UI:R); there is no CISA KEV entry and no confirmed public exploit, and EPSS is low at 0.14% (3rd percentile), indicating limited observed activity rather than mass scanning.
Stored cross-site scripting in zhitan-ems 1.0.0 allows remote attackers to execute arbitrary JavaScript in a victim's browser by uploading a malicious SVG file through the /equipmentFile/upload endpoint. SVG files support embedded script content, and the application fails to sanitize or restrict SVG payloads before serving them, causing the browser to execute attacker-controlled code in the application's origin context. No public exploit code has been identified at time of analysis, and EPSS at 0.14% (3rd percentile) indicates minimal observed exploitation activity.
Out-of-bounds memory write in wpa_supplicant on Samsung Mobile Devices (Android 14 through 17) enables an adjacent unauthenticated attacker to corrupt process memory, with the CVSS 4.0 vector confirming potential high-confidentiality impact - likely exposure of Wi-Fi credentials or session keying material held in the wpa_supplicant process. Samsung resolved this in the SMR Sep-2026 Release 1 patch for all four affected Android generations. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Timing side-channel in mirage-crypto-ec before 2.4.0 for OCaml enables remote cryptographic key recovery by exploiting secret-dependent timing variations during NIST elliptic-curve scalar multiplication table lookups. Affected applications performing ECDH key agreement or ECDSA signing - including TLS endpoints built on this library - leak private key material through measurable latency differences. No active exploitation is confirmed (no CISA KEV listing), but the C:H CVSS impact rating accurately reflects that successful key recovery constitutes full confidentiality compromise of the cryptographic material.
Improper input validation in Chrome's built-in Passwords component (all versions prior to 153.0.8010.36) enables a remote, unauthenticated attacker to potentially leak sensitive stored credential data via crafted network traffic. The flaw is rated CVSS 5.9 (AC:H), with Chromium assigning a 'Medium' severity consistent with the meaningful exploitation complexity required. No public exploits or active exploitation have been identified at time of analysis.
Race condition in Dell Secure Connect Gateway (SCG) 5.0 allows unauthenticated remote attackers to cause denial of service by exploiting improper synchronization of shared resources. Both the Appliance and Application deployment forms are affected across versions prior to 5.36.00.16 and 5.36.00.00 respectively, as confirmed by Dell advisory DSA-2026-382. No public exploit code has been identified at time of analysis.
Cleartext transmission of sensitive information via the HttpsUpgrades component in Google Chrome on iOS (versions prior to 153.0.8010.36) exposes user data to network-positioned attackers through crafted traffic. The HttpsUpgrades mechanism, which is responsible for automatically promoting HTTP requests to HTTPS, fails under certain conditions on iOS, leaving sensitive request content unencrypted in transit. With no public exploit identified and high attack complexity required (network positioning), the real-world risk is moderate despite the C:H confidentiality impact.
Dell Secure Connect Gateway (SCG) 5.0 is affected by a network-exploitable TOCTOU race condition (CWE-367) that an unauthenticated remote attacker can leverage to cause denial of service. The appliance and application variants are both affected, with fixed versions at 5.36.00.16 and 5.36.00.00 respectively per Dell advisory DSA-2026-382. Notably, the vendor's CVSS vector includes low confidentiality and integrity impact metrics (C:L/I:L/A:L) beyond what the published description's DoS-only framing suggests, implying possible additional undisclosed effects from successful race exploitation.
Improper access control in Samsung's Collection app on Android allows local unprivileged attackers to read sensitive information stored by the application. Affected versions are Collection prior to 1.0.1.14 on Android 15 and prior to 2.0.02.7 on Android 16. The flaw is limited to local access (AV:L) but requires no privileges, suggesting an exported Android component - such as a Content Provider, Activity, or Service - is reachable by any co-resident app without proper permission enforcement. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Out-of-bounds read (CWE-125) in the HarmonyOS graphics module affects version 6.1.0 across multiple device categories including smartphones, wearables, and laptops. A local attacker without special privileges can trigger the flaw to cause partial availability loss, limited information disclosure, or a crash of the graphics subsystem. No public exploit code or active exploitation has been identified at time of analysis, and Huawei has released a security bulletin addressing the issue.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows a remote, network-positioned attacker to intercept TLS-protected communications via a man-in-the-middle attack, bypassing the TLS protection mechanism and exposing high-confidentiality data. Both the Appliance form factor (versions prior to 5.36.00.16) and the Application form factor (versions prior to 5.36.00.00) are affected. No public exploit or active exploitation has been identified at time of analysis; Dell has released patches under advisory DSA-2026-382.
Race condition in Dell Secure Connect Gateway (SCG) 5.0 allows unauthenticated remote attackers to trigger denial of service against both the Appliance and Application deployment variants by exploiting improper synchronization of shared resources under concurrent access (CWE-567). Affected versions are Appliance prior to 5.36.00.16 and Application prior to 5.36.00.00, with fixes detailed in Dell advisory DSA-2026-382. Notably, the vendor-supplied CVSS 3.1 vector records C:L/A:N, which conflicts with the stated denial-of-service impact - a likely metadata error, as availability impact is the primary concern here. No public exploit code or active exploitation has been confirmed at time of analysis.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 enables a network-positioned unauthenticated attacker to intercept encrypted communications via a man-in-the-middle attack, bypassing TLS-based trust mechanisms. Both the appliance form factor (versions prior to 5.36.00.16) and the virtual/application form factor (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 5.9 Medium rating reflects the high attack complexity imposed by the MITM positioning requirement.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 permits a local, low-privileged attacker to execute arbitrary OS commands on the affected host, potentially exposing sensitive configuration data and credentials stored on the appliance. Both physical Appliance deployments (prior to 5.36.00.16) and software Application deployments (prior to 5.36.00.00) are affected, as confirmed in Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified; Dell has released corrective patches for both form factors.
Read-only enforcement bypass in Amazon awslabs mysql-mcp-server (versions ≤ 1.0.21) enables context-dependent actors - including AI models or users interacting via the Model Context Protocol - to reach file-read and file-write SQL execution paths that the mutable SQL detector is designed to gate. The detector relies on a regex engine that does not treat SQL inline comments as whitespace, allowing crafted queries containing comment tokens to pass the allowlist check while MySQL parses and executes the full underlying write or file-access statement. No public exploit has been identified at time of analysis; AWS has released a fix in version 1.0.23.
Exploitation of a TOCTOU race condition in Dell Secure Connect Gateway (SCG) 5.0 - both the Appliance and Application variants - allows a remote unauthenticated attacker to cause denial of service, with marginal confidentiality and integrity impact as reflected in the CVSS vector (C:L/I:L/A:L). The High Attack Complexity rating (AC:H) indicates reliable exploitation requires precise timing to win the race between the check and use operations. No public exploit code or CISA KEV listing has been identified, placing this in the category of a vendor-disclosed race condition with moderate real-world exploitability.
JWT signature verification bypass in Dell Secure Connect Gateway 5.0 enables remote unauthenticated attackers to forge or tamper with cryptographically signed tokens, bypassing the product's authentication protection mechanisms. Both the Appliance variant (versions prior to 5.36.00.16) and Application variant (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; Dell has released patches under advisory DSA-2026-382.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows a remote, unauthenticated attacker in a network-adjacent MITM position to bypass TLS protection mechanisms, potentially intercepting and altering communications between the SCG appliance or application and remote endpoints. Both deployment forms are affected - the physical/virtual appliance (versions prior to 5.36.00.16) and the software application (versions prior to 5.36.00.00). No public exploit or KEV listing exists; this is a medium-severity finding under CVSS 5.6 with high attack complexity reflecting the MITM positioning requirement.
Stack-based buffer overflow in Samsung's PROCA (Process Authenticator) TrustZone trustlet allows a local privileged attacker to write out-of-bounds memory, resulting in high-confidentiality impact against affected Samsung Mobile Devices running Android 14 through 17. The flaw is patched in SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified; the CVSS 4.0 score of 5.6 reflects the significant exploitation barriers - local access, high privileges, high complexity, and specific prerequisite conditions all required simultaneously.
Command injection in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance and Application variants - permits unauthenticated remote attackers to perform script injection via network-accessible interfaces. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements in a Command), though Dell's own CVSS scoring constrains the impact to limited confidentiality exposure (C:L, I:N, A:N), suggesting the injected scripts are not fully executed as OS-level commands but rather reflected or partially evaluated. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Missing authentication on the AJAX `addCategory` endpoint in Rizwan17's PHP inventory-management-system allows any unauthenticated remote attacker to invoke category management operations by manipulating the `userid` argument in `includes/process.php`. The CWE-287 root cause means the authentication gate is simply absent rather than bypassable through a logic flaw. A public exploit has been released, the maintainer has not responded to the responsible-disclosure issue, and no patch exists at time of analysis.
SQL injection in Rizwan17's inventory-management-system PHP application exposes the update_record() function in includes/manage.php to unauthenticated remote exploitation via unsanitized parameters (update_category, cid, update_brand, update_product). Exploit code is publicly available per the CVSS 4.0 E:P modifier and a VulDB submission, though the project is a small hobby-tier GitHub application with negligible production footprint. The maintainer was notified via a GitHub issue but has not responded, and no patch exists.
Missing authorization in Google Chrome's TrustedWebActivities (TWA) component on Android prior to version 153.0.8010.36 allows a local attacker to obtain sensitive information through a co-installed malicious application. The vulnerability stems from CWE-862 (Missing Authorization), where the TWA implementation fails to enforce adequate access controls between co-installed apps and Chrome's protected data. No public exploit code has been identified and the EPSS score places this at the 5th percentile, but the confidentiality impact is rated high given Chrome's potential access to session data, credentials, and browsing context.
Sensitive data written to log files in Dell Secure Connect Gateway (SCG) 5.0 is readable by low-privileged local users, resulting in high-confidence confidentiality exposure. Affected products are SCG 5.0 Appliance versions prior to 5.36.00.16 and SCG 5.0 Application versions prior to 5.36.00.00, with a vendor-released patch available under advisory DSA-2026-382. No public exploit code exists and no active exploitation has been identified at time of analysis.
Permission control bypass in HarmonyOS 6.1.0's app lock module allows a local low-privileged user to circumvent locking protections and read content belonging to locked applications. The flaw is rooted in CWE-264, indicating improper enforcement of permission restrictions within the module. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the C:H CVSS impact signal indicates full confidentiality exposure to locked app data once exploited locally.
Denial of service in Wings3D v.2.4.1 allows a local attacker to crash the application by convincing a user to open a specially crafted Wavefront OBJ file. The vulnerability is availability-only, with no confidentiality or integrity impact, and requires user interaction to trigger. No public exploit code or active exploitation has been identified at time of analysis.
Denial-of-service via unvalidated kernel pointer in the Thesycon DPC Latency Checker Windows driver (dpc.sys) through version 1.4.0 allows any local unprivileged user to crash the host system. The driver's IOCTL handler at code 0x81772008 accepts a user-supplied pointer, dereferences it without validation, and passes the resulting value to the kernel API ExSetTimerResolution - causing an arbitrary kernel memory access that triggers an immediate BSOD. No public exploitation in the wild or CISA KEV listing has been identified, but a public researcher writeup with supporting materials exists on GitHub.
Path traversal in LF Edge eKuiper's plugin installation endpoint (POST /plugins/*) allows high-privileged management API users to delete arbitrary files and directories on the host by embedding traversal sequences such as `../../` in the plugin `name` parameter. Affected versions are all eKuiper releases prior to 2.4.1 (Go module github.com/lf-edge/ekuiper/v2). A proof-of-concept is published in the GitHub security advisory GHSA-c23q-fw86-9h5x, demonstrating deletion of arbitrary host paths via `os.RemoveAll`; the advisory explicitly confirms exploitation is bounded to file deletion only - no code execution, file creation, or data exfiltration is achievable.
Server-Side Request Forgery in LF Edge eKuiper (all versions prior to 2.4.0) allows authenticated high-privilege users with management API access to register external service definitions targeting internal network addresses - including loopback (127.0.0.1), RFC1918 private subnets, and cloud metadata endpoints (169.254.169.254) - and trigger outbound requests to those addresses by executing SQL processing rules. Successful exploitation enables probing internal services, exfiltrating sensitive configuration data such as MQTT credentials exposed via eKuiper's own REST API, and interacting with internal APIs reachable from the eKuiper host. No public exploit or CISA KEV listing exists at time of analysis, but a detailed proof-of-concept is embedded in the GitHub security advisory GHSA-pqqc-8v73-9gg2.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 allows a local low-privileged attacker to inject and execute scripts, resulting in high confidentiality impact. Affected are SCG 5.0 Appliance versions prior to 5.36.00.16 and SCG 5.0 Application versions prior to 5.36.00.00. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing.
Sensitive information exposure in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance and Application deployment variants - results from debugging code retained in production builds that exposes confidential data to locally authenticated low-privileged users. The flaw covers Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00, with patches available under Dell Security Advisory DSA-2026-382. No public exploit code or active exploitation has been identified at time of analysis.
UI spoofing in Google Chrome's Session component (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to misrepresent browser UI elements - such as session state indicators or security context - by delivering a crafted HTML page to a victim. The impact is deception-oriented: a user can be misled about the true security or session context of an interaction, enabling downstream phishing or session confusion attacks. No public exploit code has been identified and EPSS probability is 0.29% (21st percentile), consistent with no active exploitation at time of analysis.
UI misrepresentation in Google Chrome's Payments component prior to 153.0.8010.36 allows a remote attacker to spoof payment-related interface elements by serving a crafted HTML page. The spoofed UI can deceive users into believing they are interacting with legitimate Chrome payment dialogs, potentially facilitating credential or payment-data disclosure. No public exploit code has been identified and EPSS sits at 0.27% (19th percentile), placing real-world exploitation risk as low at this time.
Safebrowsing in Google Chrome prior to 153.0.8010.36 fails to properly validate internal state transitions (CWE-754), enabling a remote attacker to bypass the browser's URL-based access restriction mechanism via a crafted HTML page. Successful exploitation requires the victim to visit the attacker-controlled page (UI:R) and yields limited confidentiality and integrity impacts (C:L/I:L) with no availability impact. Chromium's own severity rating of 'Low' is consistent with the constrained impact scope; no public exploit code and no KEV listing have been identified at time of analysis.
UI misrepresentation in Google Chrome's Geometry component (versions prior to 153.0.8010.36) enables remote attackers to spoof browser interface elements through a crafted HTML page, requiring social engineering to achieve user interaction. The flaw (CWE-451) permits an attacker to visually deceive victims about the true origin or nature of displayed content, creating a pathway for phishing and credential harvesting. No public exploit has been identified at time of analysis; vendor-released patch is available in the September 2026 stable channel update.
UI misrepresentation in Google Chrome's Downloads panel prior to version 153.0.8010.36 allows a remote attacker to spoof download-related UI elements, potentially deceiving users into accepting or running malicious content they believe to be legitimate. The vulnerability is triggered by a crafted HTML page and requires social engineering to lure a victim into visiting the attacker-controlled page. No public exploit has been identified at time of analysis, and EPSS at 0.24% (15th percentile) places real-world exploitation risk low; however, Chrome's ubiquitous deployment keeps the absolute exposure surface significant.
UI misrepresentation in Google Chrome's Downloads component prior to 153.0.8010.36 allows remote attackers to bypass system access restrictions by deceiving users through a crafted HTML page. The flaw (CWE-451) causes Chrome to display misleading information about files being downloaded, enabling social-engineering attacks that trick users into accepting or executing content they would otherwise reject. Chromium rates this Medium severity, consistent with the CVSS 5.4; no public exploit code exists and EPSS at 0.24% (15th percentile) reflects low exploitation probability at time of analysis.
Safebrowsing in Google Chrome prior to 153.0.8010.36 contains improper state validation (CWE-754) that allows a remote, unauthenticated attacker to bypass system access restrictions enforced by the Safe Browsing subsystem via a specially crafted HTML page. The bypass yields partial confidentiality and integrity impact (C:L/I:L) but no availability impact, consistent with circumventing protective filtering rather than achieving code execution. No active exploitation has been confirmed - EPSS is 0.24% (15th percentile) and the CVE is absent from CISA KEV - and Chromium's own severity assessment of 'Medium' aligns with the CVSS 5.4 score.
Clickjacking in Google Chrome's Downloads component (all versions prior to 153.0.8010.36) enables a remote attacker to spoof Chrome's download UI elements by luring a victim to a crafted HTML page. Through UI overlay or frame-stacking techniques, the attacker can make a user believe they are interacting with legitimate Chrome download controls while actually triggering attacker-defined actions. No public exploit code exists and EPSS of 0.24% (15th percentile) reflects low real-world exploitation probability; Chromium's own severity rating of Medium aligns with the CVSS 5.4 score.
Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 expose a CWE-377 insecure temporary file flaw that a low-privileged remote attacker can exploit to cause denial of service and tamper with data. The vulnerability stems from unsafe temporary file handling - likely predictable naming or insecure permissions - enabling race-condition or symlink attacks against the storage platform. No public exploit or CISA KEV listing has been identified; Dell has released patches in the 9.13.1.1 and 9.15.0.0 branches.