Cross-site scripting in CONTEC's CONPROSYS nano Series industrial remote I/O coupler units allows an unauthenticated attacker to execute arbitrary JavaScript in the web browser of a logged-in operator. The affected products are OT/ICS edge devices (CPSN-MCB271, CPSN-EOB471EI, CPSN-PCB271-S1-041) used in industrial automation environments where their web management interfaces are the attack surface. If exploited, an attacker could steal session credentials, perform unauthorized device configuration changes, or pivot to broader OT network access through the operator's authenticated session. No public exploit code has been identified at time of analysis.
Stored cross-site scripting in LaraDashboard 0.9.0-1.2.2 allows any authenticated user holding only the `media.create` permission to upload SVG files containing embedded JavaScript. When any user - including administrators - opens the stored SVG served inline from the application origin, the script executes in the dashboard's browser context, enabling session cookie theft and full administrative account takeover. SSVC confirms a proof-of-concept exists; no active exploitation has been identified in CISA KEV at time of analysis.
Missing channel action ownership validation in Mattermost allows an authenticated channel manager to overwrite workflow automation actions belonging to channels outside their management scope via the channel action update API endpoint. Affected releases span four active branches: 10.11.x through 10.11.22, 11.7.x through 11.7.7, 11.8.x through 11.8.4, and 11.9.0. No public exploit code has been identified and CISA has not listed this in KEV; the SSVC assessment records exploitation as none with non-automatable attack mechanics.
Out-of-bounds read in GPAC 26.07.0's MP4Box tool occurs when a NULL node pointer is passed to gf_node_del() in scenegraph/base_scenegraph.c, causing a process crash when parsing a crafted media or scene-graph file. The fix commit (afca1f1181668d85941d51ed1adf647807d5d975) addresses multiple related input-validation deficiencies across the scene graph, LASeR decoder, MPEG video reframer, and BT scene loader. A public proof-of-concept (poc_19_nstatx.zip) has been released; however, impact is limited to a local availability-only process crash with no confidentiality or integrity consequence, and no active exploitation is recorded in CISA KEV.
Reachable assertion in GPAC MP4Box up to commit f1219cde causes a process abort when a crafted LASeR/MP4 file is processed with MP4Box. The flaw resides in lsr_exec_command_list() in laser/lsr_dec.c, where gf_assert(!codec->bs) fires unconditionally if the codec bitstream handle is already open at command list entry, triggering an abort rather than a graceful error return. A local, low-privileged user with user interaction required can crash the MP4Box process by supplying a malformed input file. A public exploit write-up exists, and the vendor has released a patch in version abi-16.23.
GNU Binutils 2.47 contains a heap out-of-bounds write in the ELF `.eh_frame` handler `_bfd_elf_write_section_eh_frame`, triggered when a malformed object file causes the library to compute a negative size that is then passed to a `memmove` during section rewriting. The attack is local: an attacker must get a crafted ELF file processed by a BFD-based tool (such as `ld`, `objcopy`, or `strip`) on the target system, after which the process can corrupt heap memory and crash. Exploit code is publicly available, though the CVSS 4.0 base score is only 0.9 because the required privileges, user interaction, and limited observed impact keep real-world severity low; there is no CISA KEV listing, and upstream has not responded to the bug report.
Apache Syncope, the Apache open-source identity governance and administration (IGA) platform, writes audit events to its configured audit store without adequately masking sensitive values carried in event payloads, so an operator with administrative access to that store can read credentials and other secrets that should have been redacted. All releases from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 are affected. The vulnerability is rated 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/C:H/I:N/A:N), is not listed in CISA KEV, and no public exploit code has been identified at time of analysis.
Sensitive information exposure in Apache Syncope allows a privileged administrator with Derived Schema entitlements to craft a malicious JEXL (Java Expression Language) expression that, when evaluated during User read operations, leaks LinkedAccount or Manager sensitive data - including hashed credentials - to any admin with User read access. Affected versions span three release lines: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No public exploit code has been identified and CISA has not listed this in KEV; exploitation requires high-privilege access, limiting real-world risk to insider threats or compromised admin accounts.
Log injection in IBM WebSphere Application Server 8.5 and 9.0 lets a remote attacker forge entries in the server's administrative log, undermining the integrity of audit records used for monitoring and forensics. The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N) and stems from improper neutralization of log output (CWE-117). IBM has published a vendor fix, and no public exploit code or CISA KEV listing was identified at time of analysis.
Cross-site scripting in Contec's EC1000 series web interface allows a low-privileged authenticated attacker to inject arbitrary scripts that execute in the browser of another logged-in user. Affected models confirmed by JPCERT/CC include the ECE1000, ECE1020, and ECS1020. No public exploit code has been identified at time of analysis, and exploitation requires both attacker authentication and active victim interaction.
Cross-site scripting in the Contec RP-WAH-SR Series web management interface allows an authenticated low-privilege attacker to inject and execute arbitrary JavaScript in the browser of another logged-in user. The CVSS 4.0 vector (PR:L/UI:A) confirms exploitation requires both an authenticated session to plant the payload and a separate victim user who must actively interact with the affected page. Reported by JPCERT with no public exploit or KEV listing at time of analysis.
Cross-site scripting (XSS) in the Contec SGA1000 web management interface allows an adjacent-network attacker to inject and execute arbitrary JavaScript in the browser of an authenticated user who interacts with malicious content. The vulnerability is classified CWE-79 (Improper Neutralization of Input During Web Page Generation) and was disclosed via JPCERT/CC alongside a vendor security advisory from Contec. No public exploit code has been identified at time of analysis, and EPSS data was not provided in source intelligence.
Reflected or stored cross-site scripting in the web management interface of Contec's CAN-2-WF (Wireless LAN) and CAN-2-USB (USB Converter) industrial serial communication units allows an adjacent-network attacker to inject and execute arbitrary JavaScript in the browser of an authenticated user who interacts with the crafted content. The vulnerability affects the embedded web UI exposed by these serial-to-network converter devices, which are commonly deployed in industrial automation environments. No public exploit code has been identified and the device has not appeared in the CISA KEV catalog.
Cross-site scripting in the embedded web management interfaces of Contec Co., Ltd. PC-HELPER Wireless I/O DIO-0404RY-LWF and DIO-0404RY-LWF-US industrial modules allows a low-privilege authenticated attacker to inject malicious script that executes in the browser session of another logged-in user. The CVSS 4.0 score of 4.8 (Medium) reflects mandatory prior authentication (PR:L) and required active victim interaction (UI:A), with impact confined to the subsequent browser context rather than the device itself. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site scripting in Contec FX5000, FX4000, and FX3000 series industrial data loggers allows a low-privileged authenticated attacker to inject arbitrary scripts that execute in a victim's web browser when viewing attacker-controlled content via the device web interface. The vulnerability was reported by JPCERT/CC and affects a broad range of OT/ICS field devices used in industrial monitoring and automation. No public exploit code or CISA KEV listing is present, and the CVSS 4.0 score of 4.8 reflects the constrained real-world impact.
Improper certificate validation in Apple macOS allows an attacker positioned on the network path between the victim and a remote endpoint to intercept and potentially modify traffic that should have been protected by TLS. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate versions before 27, and is rated CVSS 4.8 (network vector but high attack complexity), with an EPSS score of only 0.12% (2nd percentile) and no public exploit or CISA KEV listing at time of analysis. Apple addressed the issue with improved certificate validation in the three corresponding releases, so the primary defense is straightforward patching; no public exploit code has been identified.
A race condition in core Apple operating system components lets a locally installed app trigger an unexpected system termination on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Apple fixed the flaw through improved state handling in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Impact is availability-only (no data exposure or modification), exploitation requires a local malicious app and winning a timing window, EPSS is a low 0.21%, and no public exploit code or active exploitation has been identified at time of analysis.
A race condition in Apple's state-handling code allows a locally installed app to crash the system or cause unexpected termination of system processes on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. The flaw carries a CVSS 3.1 score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) — availability-only impact, local attack vector, high complexity — and is fixed in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and tvOS, visionOS and watchOS 27. Neither public exploit code nor CISA KEV activity has been recorded, and EPSS puts exploitation probability at roughly 0.2% (10th percentile), so this is a patching-hygiene item rather than an emergency.
An open redirect flaw in IBM Verify Identity Access and Security Verify Access (including their container editions) lets a remote, unauthenticated attacker craft a link pointing at the product's own trusted domain that silently forwards the victim to an attacker-controlled site. Because the URL originates from the legitimate IBM identity provider, the redirect is highly convincing and can be used to harvest credentials or push further phishing stages. IBM has released fixes (Interim Fix 001 for the affected 10.0.0–10.0.9.2 and 11.0.0–11.0.3 streams); there is no public exploit identified at time of analysis, exploitation requires the victim to click a crafted link, and EPSS is very low at 0.19% (9th percentile).
A race condition in Apple macOS kernel locking allows a local user with existing code execution on the host to read kernel memory, fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation requires local authenticated access and a high-complexity timing win in the kernel's locking path, so it is probabilistic rather than reliable, and the impact is limited to confidentiality (kernel memory disclosure) with no code execution, modification, or denial of service. There is no public exploit identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.19% (8th percentile), making this a genuine but low-priority issue.
Unexpected system termination (denial of service) in Apple macOS stems from a race condition that a locally running app can win to crash the system; the flaw is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7, so all earlier builds of those release trains are affected. Exploitation requires the attacker to already be able to execute code as a local app with low privileges (CVSS PR:L) and to repeatedly hit a narrow timing window (CVSS AC:H), with no user interaction required at exploit time and no confidentiality or integrity impact (C:N/I:N/A:H, base score 4.7). There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.17% (6th percentile), so this is a low-to-moderate priority availability bug rather than a remote or code-execution threat.
Local applications running on Apple macOS releases prior to Tahoe 26.6 can exploit a race condition in the validation path guarding protected user data, allowing an app to read data it should not be able to reach. The flaw is mitigated in macOS Tahoe 26.6 per Apple's advisory, and the attack is timing-dependent and local-only (CVSS 4.7, AV:L/AC:H/PR:L), which keeps practical risk moderate. EPSS is very low at 0.14% (4th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis.
Holding a locked iPhone or iPad, an attacker can reach a lockscreen-accessible interface that improperly passes an authentication check, allowing sensitive user information to be viewed without the passcode being entered. The flaw is a logic error classed as CWE-287 (improper authentication) that affects iOS and iPadOS builds prior to 26.7 and 27, and Apple has shipped fixes in iOS/iPadOS 26.7 and iOS/iPadOS 27, so it is fully remediated by updating. Exploitation requires hands-on physical possession of the locked device and cannot be performed remotely or at scale; EPSS is 0.17% (6th percentile) and no public exploit has been identified at time of analysis, making this a low-to-medium real-world priority driven mostly by confidentiality exposure on lost or stolen devices.
MISP's interactive CLI shell (versions ≤2.5.45) silently misattributes audit log entries when the CakePHP SysLogLogable singleton has its user context overwritten by a lazy-loaded model, causing privileged CLI writes to appear in the audit trail under the wrong user identity. Additionally, CLI-originated records lacked any distinguishing marker, making them indistinguishable from ordinary web-session actions in audit logs - a forensic and compliance problem for organizations relying on MISP's audit trail to attribute administrative activity. No public exploit exists and no active exploitation has been identified.
Physically attached USB hosts can crash Zephyr RTOS builds that use the ITE it82xx2 USB device-controller driver, because the driver re-initializes an already-pending delayed work item during a disable-then-enable cycle, corrupting kernel timeout and workqueue linked lists and causing a kernel panic. Affected builds are those running Zephyr 3.7.0 through versions below 4.4.2 with the it82xx2 UDC driver enabled, typically on hardware that faces a removable USB host — kiosks, field instrumentation, or development boards. Exploitation requires a direct physical USB connection (CVSS AV:P, score 4.6), delivers denial of service only with no confidentiality or integrity impact, and is not currently listed as actively exploited or accompanied by published exploit code.
A crafted or malfunctioning SDIO card that advertises a maximum block size of zero drives the Zephyr SDIO client API into an infinite loop inside sdio_io_rw_extended_helper(), permanently hanging the calling thread while it holds the per-card mutex. The defect affects Zephyr 3.6.0 through 4.4.1 and is reachable through public driver-facing helpers such as sdio_read_fifo() and sdio_write_fifo(), so the SDIO peripheral — and any dependent subsystem such as Wi-Fi — is denied service until the device is reset. The attack requires physical insertion of a malicious card into a removable SDIO/combo slot, so boards with soldered SDIO peripherals are not attacker-influenceable; there is no memory-safety, confidentiality, or integrity impact, only availability loss. A vendor fix is available and no public exploit code or active exploitation has been identified at time of analysis.
Bypass of on-device network restrictions in Apple iOS/iPadOS, macOS Golden Gate, visionOS, and watchOS builds prior to version 27 allows a locally installed, already-running app to reach network resources the operating system should have blocked, producing low confidentiality and low integrity impact with no availability effect. Exploitation requires an app that is already installed and executing with normal, authenticated app privileges on the target device (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 4.4); there is no remote or unauthenticated attack path, no public exploit identified at time of analysis, and EPSS is a low 0.21% (11th percentile). Apple has shipped vendor-released fixes in iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27.
A locally installed application on macOS versions prior to macOS Golden Gate 27 can bypass Gatekeeper code-origin and notarization checks, weakening the platform control that is supposed to stop untrusted apps from launching. The flaw is assessed at CVSS 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), meaning it requires local presence and normal user privileges, and the resulting impact is limited to partial confidentiality and integrity loss rather than code execution or denial of service. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); EPSS is only 0.18% (8th percentile), and Apple has released a fix in macOS Golden Gate 27. Per the independent assessment, this is a genuinely low-priority issue despite the 'Authentication Bypass' tag.
Cross-tenant SMTP sender spoofing in N-able Mail Assure (all versions through April 2026) permits any authenticated tenant to specify arbitrary MAIL FROM envelope addresses - including domains belonging to other co-hosted tenants - without the relay enforcing any domain-to-account ownership binding. Because the shared relay is itself listed in the SPF records and DMARC policy of every hosted tenant domain, spoofed outbound messages pass SPF and DMARC validation at recipient mail servers, giving the attack the appearance of fully authorized email. N-able has publicly stated this is intended behavior of its shared relay architecture, making no vendor patch expected. A researcher demonstration gist has been published, and no public exploit or CISA KEV listing exists at time of analysis.
IBM Sterling Secure Proxy versions 6.2.0.0 through 6.2.1.2 enforce authorization for certain administrative user interface components only on the client side, so an attacker who already holds a valid low-privileged account can cause the browser to render admin-only UI elements that should have been hidden. The result is a limited information disclosure (CVSS 4.3, C:L, no integrity or availability impact) rather than full administrative takeover, and no public exploit code or CISA KEV entry was identified in the supplied intelligence. Because the flaw is a missing server-side authorization check (CWE-285), any authenticated user of the affected deployment can probe it trivially with low attack complexity.
Navigator for i - the web-based administration interface bundled with IBM i 7.3 through 7.6 - permits authenticated remote attackers to upload files to filesystem paths that Navigator's own configuration should prohibit, via a path traversal flaw (CWE-22). The bypass is bounded by the attacker's underlying IBM i profile permissions: Navigator's upload restrictions are circumvented, but the OS-level object authority of the user's profile still constrains what can actually be written. No public exploit exists and SSVC assesses exploitation status as none, placing this squarely in the medium-priority tier.
Disk exhaustion via zip bomb in Eclipse OpenVSX allows a publisher to cause persistent service disruption on any OpenVSX server instance. A publisher uploads a small, highly compressed VSIX (zip bomb) that the server decompresses without size limits when any client requests a file via /vscode/unpkg/; the decompressed content is cached to java.io.tmpdir under an entry-count eviction policy with no total-size bound, enabling repeated disk exhaustion through new filenames or versions. Impact includes HTTP 500 errors for all uncached resources, publishing failures with 'Failed to read extension file', and a poisoned cache entry that blocks future requests to the same path. No public exploit has been identified at time of analysis, and EPSS data is not available in the provided input.
An information-disclosure flaw in Apple's WebKit-based browser stack lets a malicious website infer which applications a user has installed across Safari, iOS/iPadOS, and macOS. Apple addressed it through improved state management in Safari 27, iOS 27 and iPadOS 27, and macOS Golden Gate 27, so any device still on an earlier release remains exposed. Exploitation requires the victim to visit the attacker's page (CVSS UI:R) and yields only low-confidentiality impact, with no public exploit code and no CISA KEV listing at time of analysis.
iCloud Private Relay on Apple platforms could disclose a user's real IP address to a website even while the privacy proxy is active, because of a state-management flaw in the relay implementation. The issue affects iOS and iPadOS before 18.7.10 and before 26.6.1, macOS Tahoe before 26.6.2, and visionOS before 26.6.1, and requires the victim to browse to attacker-controlled web content (UI:R, no privileges needed). Severity is modest (CVSS 4.3, confidentiality-only) and there is no CISA KEV listing or public exploit identified at time of analysis, but the privacy impact is disproportionate for users who depend on Private Relay for anonymity.
An information disclosure flaw in Apple's iCloud Private Relay lets a website determine a visitor's real IP address even when Private Relay is switched on, defeating the core privacy guarantee of the feature. The issue affects iOS and iPadOS before 26.6.1, macOS before 26.6.2 (Tahoe), and visionOS before 26.6.1, and is reachable from the network but requires the victim to browse to an attacker-controlled page. Apple addressed it through improved state management, and no public exploit code or active exploitation has been identified at time of analysis.
Plugin handler panic recovery failure in Mattermost allows authenticated users to crash installed plugins by sending a post-action request containing a field with an unexpected type. Affected versions span multiple maintained release branches (≤11.9, 11.0.9, 11.4.8, 11.7.7, 10.22.11.0) as disclosed under MMSA-2026-00701. No public exploit code or active exploitation has been identified; impact is bounded to plugin availability disruption with no confidentiality or integrity exposure.
Mattermost's server-side Markdown parser across versions 10.11.x through 11.9.0 fails to enforce a nesting depth limit, allowing any authenticated user to cause CPU resource exhaustion by posting a message containing pathologically deep blockquote or list item nesting. The vulnerability is classified CWE-407 (Inefficient Algorithmic Complexity), producing a denial-of-service condition that degrades availability for all users of the affected instance. With a vendor-confirmed CVSS of 4.3 (Medium), no active exploitation, and SSVC marking it non-automatable, this represents a moderate insider or compromised-account risk rather than an urgent external threat. No public exploit code or CISA KEV listing identified at time of analysis.
The Boards plugin in Mattermost fails to validate the data type of `fields.properties` during block creation, enabling any authenticated user holding editor-level access on a board to crash the Boards plugin worker via a malformed child block. Four release branches are affected (10.11.x, 11.7.x, 11.8.x, 11.9.x). No public exploit has been identified, SSVC rates exploitation as none and the attack as non-automatable, and the CVSS 4.3 Medium score is consistent with a bounded, privilege-gated availability impact.
Mattermost's server-side Markdown autolink parser processes autolinks with unmatched trailing closing parentheses in superlinear time, enabling any authenticated user with post-creation rights to cause excessive CPU consumption and degrade availability for all users on the instance. Affected release trains are 11.9.x through 11.9.0, 11.8.x through 11.8.4, 11.7.x through 11.7.7, and 10.11.x through 10.11.22 across both cloud and self-hosted deployments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV, but the low exploitation barrier - any authenticated account - means insider threat or compromised-account scenarios are the primary realistic risk.
Resource exhaustion in Mattermost's file processing pipeline allows any authenticated user with file upload permissions to spawn unbounded goroutines by continuously uploading large files, degrading or blocking the file indexing service for all other users. Affected versions span the 10.11.x, 11.7.x, 11.8.x, and 11.9.x release trains. The vulnerability stems from two compounding defects: absence of a concurrent-file-processing cap and improper handling of failed file ingestion, together enabling goroutine accumulation in Mattermost's Go runtime. No public exploit code exists and no active exploitation has been identified at time of analysis.
PraisonAI's Server-Sent Events (SSE) server accepts /publish, /events, and /info requests without ever checking the ServerConfig.auth_token value, so any client that can reach the listening port can broadcast arbitrary events into every connected client's stream and read back server configuration and connected-client counts. Affected are praisonaiagents releases prior to 1.6.58 (some package metadata lists 1.6.59 as the fixed version); the npm-style pip package is the delivery vehicle and the flaw only manifests when the optional SSE server mode is started. Public proof-of-concept curl commands are published in the GitHub advisory (GHSA-35w5-pcw4-jx94), but there is no CISA KEV listing and no confirmed active exploitation; CVSS 4.3 with an adjacent-network vector reflects a real but bounded integrity/confidentiality problem rather than remote code execution.
Board-creation permission enforcement is absent from three Mattermost Boards API endpoints-board duplicate, boards-and-blocks, and archive-import-allowing any authenticated user who has been denied board-creation rights to circumvent that restriction and create boards in the workspace. Affected are Mattermost versions 11.9.0, 11.8.x through 11.8.4, 11.7.x through 11.7.7, and 10.11.x through 10.11.22, as confirmed by advisory MMSA-2026-00715. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog; real-world impact is limited to unauthorized board creation with no confidentiality or availability consequence.
Permission enforcement failure in Mattermost Boards allows authenticated non-guest team members to create Open or Private boards in defiance of administrator-imposed restrictions by importing a crafted .boardarchive file. The import code path omits the authorization check enforced by the direct board creation pathway, making administrative board creation controls bypassable by any authenticated non-guest user with import access. Affected versions span the 10.11.x, 11.7.x, 11.8.x, and 11.9.x release trains; no active exploitation has been identified and no public exploit code is known at time of analysis.
Improper validation of the WebSocket origin in IBM i 7.3, 7.4, 7.5, and 7.6 allows a remote attacker to read limited sensitive information by luring a logged-in user into a cross-origin WebSocket connection. The vulnerability requires user interaction (the victim must visit an attacker-controlled page) and yields only low confidentiality impact, giving a CVSS 3.1 base score of 4.3. There is no public exploit identified at time of analysis and CISA SSVC reports no active exploitation, so this is a low-urgency information-disclosure defect rather than an emergency patch item.
Improper cache key isolation in IBM Langflow OSS versions 1.0.0 through 1.11.5 allows an authenticated attacker to read and potentially manipulate another user's MCP (Model Context Protocol) server context by exploiting shared cache entries that are not scoped to individual user sessions. The MCP Tools component fails to include sufficient user-identity signals in cache keys, permitting cross-user context leakage. A vendor patch is available and no public exploit or KEV listing has been identified at time of analysis.
A race condition in the IBM i WebSocket handshake process allows a remote authenticated attacker to obtain sensitive information on IBM i 7.6, 7.5, 7.4, and 7.3. The flaw requires valid credentials and a precisely timed concurrent request pattern (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.2), so it is a low-severity, non-automatable issue rather than a mass-exploitation candidate. CISA's SSVC assessment rates exploitation as 'none' with no automatable path, and no public exploit code has been identified at time of analysis; IBM has published a vendor patch.
Kernel memory corruption in Samsung Exynos DRM HDR driver affects mobile devices powered by Exynos 1280, 2200, and 1380 SoCs. A heap-based buffer overflow (CWE-122) in the DPU HDR processing path - caused by missing buffer size validation - allows a local low-privileged process to corrupt kernel heap memory and force a system crash. No public exploit has been identified at time of analysis, and Samsung has published a security advisory addressing this issue.
Out-of-bounds memory access in Samsung's CustOS Driver on Exynos 1580 processors exposes a local low-privileged attacker to cross-TEE-boundary memory read and write primitives. The fault is triggered by submitting an oversized shared memory allocation request to the custos_iwc inter-world communication device, which the driver services without adequate bounds validation, potentially leaking secure-world data or corrupting CustOS runtime state. No public exploit code has been identified and CISA has not listed this in KEV at time of analysis.
Double-free in the Samsung Exynos Display Processing Unit (DPU) kernel driver allows a local low-privileged attacker to corrupt kernel heap memory and trigger a use-after-free condition across nine Exynos chip families spanning mid-range to flagship Samsung devices. Exploitation requires meeting a high-complexity timing condition during DMA buffer reallocation in the DPU driver, limiting practical attack surface despite the kernel-level impact. No public exploit code exists and this CVE has not been added to the CISA KEV catalog at the time of analysis.
Out-of-bounds write in the Samsung Exynos Display Processing Unit (DPU) kernel driver enables a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges on devices running Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600 mobile processors. The flaw stems from missing input length validation in the color mode LUT (Look-Up Table) parsing path of the DPU driver, allowing attacker-controlled data to overflow a kernel buffer. No public exploit code has been identified at time of analysis, though the Samsung semiconductor advisory page confirms the issue and implies a patch is available.