Out-of-bounds memory access in Samsung's CustOS Driver on Exynos 1580 processors exposes a local low-privileged attacker to cross-TEE-boundary memory read and write primitives. The fault is triggered by submitting an oversized shared memory allocation request to the custos_iwc inter-world communication device, which the driver services without adequate bounds validation, potentially leaking secure-world data or corrupting CustOS runtime state. No public exploit code has been identified and CISA has not listed this in KEV at time of analysis.
Double-free in the Samsung Exynos Display Processing Unit (DPU) kernel driver allows a local low-privileged attacker to corrupt kernel heap memory and trigger a use-after-free condition across nine Exynos chip families spanning mid-range to flagship Samsung devices. Exploitation requires meeting a high-complexity timing condition during DMA buffer reallocation in the DPU driver, limiting practical attack surface despite the kernel-level impact. No public exploit code exists and this CVE has not been added to the CISA KEV catalog at the time of analysis.
Out-of-bounds write in the Samsung Exynos Display Processing Unit (DPU) kernel driver enables a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges on devices running Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600 mobile processors. The flaw stems from missing input length validation in the color mode LUT (Look-Up Table) parsing path of the DPU driver, allowing attacker-controlled data to overflow a kernel buffer. No public exploit code has been identified at time of analysis, though the Samsung semiconductor advisory page confirms the issue and implies a patch is available.
Use-After-Free in the Samsung Exynos DRM HDR kernel driver causes a kernel crash on devices running Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600 SoCs. The defect lies in the error-handling path of the HDR driver: when a vmap() call fails, cleanup does not properly invalidate the freed mapping, leaving a dangling reference that is subsequently dereferenced, crashing the kernel. The CVSS vector (AV:L/AC:H/PR:L) indicates a local low-privileged attacker can trigger this under specific error conditions, crossing into kernel scope (S:C). No public exploit code or active exploitation has been identified at time of analysis.
Plaintext credential storage in CONTEC's CONPROSYS nano Series industrial remote I/O devices exposes passwords to attackers with physical device access. Affecting multiple coupler unit models (server-type, EtherNet/IP adapter, and software PLC variants), the flaw means credentials are recoverable without decryption from device storage. No public exploit code or active exploitation has been identified; the physical access prerequisite and high attack complexity substantially limit real-world risk.
Baseband crash in Samsung Exynos mobile processors and modems allows a nearby attacker operating a rogue 5G base station to remotely crash the cellular modem by sending malformed, unauthenticated downlink NR RRC Setup messages. The flaw affects a wide range of Exynos chipsets - from Exynos 1080 through 2500, W1000, and Modem 5300/5400/5410 - used in Samsung Galaxy smartphones and tablets. Exploitation results in loss of cellular connectivity (DoS) on the affected device; no public exploit code has been identified at time of analysis.
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.
Local unprivileged users on hosts running the System Security Services Daemon (SSSD) can crash or destabilize the NSS responder by sending a crafted zero-length request to its socket, degrading name-service lookups for every process on the machine. The defect is an integer underflow (CWE-191) in the responder's request parsing, and it is scored CVSS 4.0 because only availability is impacted and the attack requires local access to the host. There is no evidence of active exploitation or public exploit code at the time of analysis, and no vendor-listed fix version is available in the supplied intelligence.
An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).
JWT privilege-spoofing in Apache Syncope allows an authenticated attacker to impersonate any other user if the internal JWKS configuration (at minimum the signing protocol and key) has been disclosed. The attacker must first complete a legitimate authentication and obtain a valid JWT, then leverage the disclosed JWKS material to forge tokens carrying another user's identity claims. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the impact is complete horizontal and vertical privilege escalation within the identity governance platform.
JWT signature bypass in Apache Syncope's SRA (Syncope Reverse Application) component enables unauthenticated network attackers to forge arbitrary JWT bearer tokens when the OAuth 2.0 integration is configured without a JWKS set URI, effectively eliminating all cryptographic identity verification for services proxied through SRA. The vulnerability spans three release lines - 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 - and vendor-released fixes are available in 4.0.8 and 4.1.3. No CISA KEV listing or confirmed public exploit code has been identified at time of analysis.
Out-of-bounds memory read in Withsecure Atlant's Capricorn scanning engine allows remote unauthenticated attackers to crash the antivirus engine by submitting a crafted document file for processing, resulting in a denial of service. All Atlant deployments running a Capricorn engine build prior to 2025-01-20_02 are affected. No public exploit code has been identified and no active exploitation is recorded; the low CVSS score of 3.7 reflects high attack complexity and a limited, partial availability impact.
Out-of-bounds write in the camera GDC (Geometric Distortion Correction) hardware driver on Samsung Exynos 1330, 1380, 1480, and 2400 SoCs can corrupt kernel memory under specific operating conditions. The vulnerability is reachable by low-privileged processes with camera subsystem access and crosses a privilege boundary into the kernel, despite the low CVSS availability-only impact scoring. No public exploit has been identified at time of analysis, and Samsung has published a dedicated advisory.
NULL pointer dereference in the 5G NR baseband of Samsung Exynos processors and modems causes a denial-of-service condition when a malformed RRC Reconfiguration message is received from the network. Sixteen Exynos chip variants are affected, spanning Samsung flagship, mid-range, and wearable devices - including Exynos 850, 1080, 2100, 2200, 2400, W920, W930, W1000, Modem 5410, and others. An attacker capable of injecting or spoofing RRC layer signaling (e.g., via a rogue base station) can trigger a crash in the L2/RRC processing stack, disrupting cellular connectivity. No public exploit code or active exploitation has been identified at time of analysis.
A buffer overflow in a PASE (Portable Application Solutions Environment) process on IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated local user to crash the affected process. Per IBM's own description, the impact is limited: the attacker can terminate their own process rather than disrupt other users or system-wide services, which is reflected in the low CVSS 3.3 and Availability-only impact. There is no public exploit code and no CISA KEV listing at time of analysis, and the flaw is classified as CWE-125 (out-of-bounds read).
Comment-injection in the OpenZeppelin Contracts Wizard code generators lets a newline character embedded in the `info.securityContact` or `info.license` option break out of the single-line `//` comment and be emitted as live source declarations in generated Solidity, Cairo, Stellar/Soroban, and Stylus contracts. Only integrations that populate those two fields from untrusted input and then hand the generated source to a downstream consumer are affected — the self-service web app, AI assistant, CLI, and self-hosted API all use user-supplied values and never cross that trust boundary, and shared links cannot set the fields. The flaw is integrity-only (CVSS 3.3, CWE-94): no code executes on any Wizard service, no public exploit is identified in the supplied data, and patched packages are available as @openzeppelin/wizard 0.10.11, wizard-cairo 3.0.1, wizard-stellar 0.6.2, and wizard-stylus 0.3.1.
Authorization bypass in IBM WebSphere Application Server 8.5 and 9.0 lets an attacker positioned on an adjacent network segment reach functionality without the required authorization checks, resulting in limited (low) confidentiality exposure with no integrity or availability impact. The published CVSS 3.1 score is only 3.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting that exploitation demands network adjacency and a high-complexity precondition rather than an internet-facing attack. There is no CISA KEV listing, no public exploit code identified in the provided sources, and an EPSS score was not supplied; IBM has published a fix. Note the tension between the 'authorization bypass' label and the very low scored impact — the advisory's own severity framing should be verified directly against the IBM support page.
Serena, an AI coding assistant built on the Model Context Protocol (MCP), exposed its HTTP-mode server on all network interfaces (0.0.0.0) by default in versions before 1.0.0, allowing any host reachable on the same network to connect to the unauthenticated MCP endpoint. The MCP protocol is a tool-execution channel for LLM agents; in a coding assistant context, those tools routinely include file system access and potentially shell invocation, making the true blast radius of unrestricted access substantially higher than the NVD CVSS of 2.9 suggests. A security blog (dash.security) characterizes the issue as unauthenticated remote code execution, a claim the official scoring does not reflect; no active exploitation is confirmed and no KEV listing exists.
Out-of-bounds read in the Wi-Fi driver subsystem of Samsung Exynos mobile processors allows a local low-privileged attacker to leak kernel memory by sending a malformed Netlink command, potentially exposing sensitive in-kernel data. Affected processors span Samsung's mid-range and flagship mobile lineup plus wearable chips: Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930. No public exploit has been identified at time of analysis, and Samsung has published a product security advisory addressing the issue.
Samsung Exynos camera driver firmware on eight mobile processor variants leaks sensitive information through debug instrumentation that was not removed from production builds (CWE-215). The flaw affects Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680 SoCs - processors found in Samsung Galaxy smartphones and tablets - allowing a local low-privileged attacker to read sensitive data that crosses the kernel-to-userspace security boundary. No public exploit code exists and the vendor-assigned CVSS score of 2.8 (Low) accurately reflects the narrow, local-only attack surface and limited confidentiality impact.
Out-of-bounds write in the Wi-Fi interface kernel driver of Samsung Exynos mobile and wearable processors enables a local low-privileged user to cause a denial of service through a crafted ioctl command. Affected SoCs include the Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000, covering a broad range of Samsung Galaxy smartphones and Galaxy Watch devices. No public exploit has been identified, and the impact ceiling is a recoverable availability disruption with no confidentiality or integrity exposure.
Out-of-bounds write in the camera driver of Samsung Exynos processors (1330, 1380, 1480, 2400, 1580, and 2500) can be triggered by a local low-privileged attacker writing a malformed message to the debug sysfs entry `test_msg`, causing a denial-of-service condition in the camera subsystem. The vulnerability crosses a privilege boundary (scope changed) from user space into the camera driver, but impact is limited to availability and does not affect confidentiality or integrity. No public exploit code has been identified at time of analysis, and Samsung has published a security advisory addressing the issue.
Out-of-bounds write in the Samsung Exynos camera driver error-handling path causes memory corruption on eight Exynos mobile processor variants. Exploitation requires local access with low privileges and high attack complexity to reach the faulty error path, with a changed scope producing only low availability impact - consistent with a crash or transient DoS rather than code execution. No public exploit code exists and the vendor has published a security update via the Samsung Semiconductor support portal.
Camera driver TOCTOU race condition across eight Samsung Exynos SoC families (1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680) allows a local low-privileged attacker to trigger out-of-bounds memory access in the camera driver, resulting in limited availability impact. The vendor-assigned CVSS 3.1 score of 2.8 (AV:L/AC:H/PR:L) accurately captures the constrained real-world risk: exploitation requires winning a timing race from a local context with camera-level access. No public exploit code exists and the vulnerability is not listed in CISA KEV, confirming this as a low-urgency, patch-when-possible finding.
Heap overflow via TOCTOU race in the Exynos DRM HDR Driver affects Samsung Mobile Processors across nine Exynos SoC generations (1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600), enabling a local low-privileged attacker to crash the kernel. The race condition occurs in the Display Processing Unit's HDR handling path, where a check-then-use window can be exploited to corrupt kernel heap memory, resulting in a denial-of-service condition. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present.
Unchecked strcpy() of the GZIP original-filename header field in libarchive 3.8.x causes a heap-based buffer overflow (CWE-122) in the gzip compression writer, with impact limited to a low-severity application crash. The overflow can only be triggered when a caller explicitly passes an overly long, untrusted original-filename string through the libarchive API - a condition the CVE itself characterizes as marginally plausible, since this field is not derived from archived input data. No active exploitation has been confirmed, and the official CVSS score of 2.5 (Low) with AV:L/AC:H/UI:R accurately reflects the constrained, non-default exploitation path.
Really Simple Security (formerly Really Simple SSL) before 9.8.2 ships an unguarded profile-page update handler that lets an authenticated low-privileged WordPress user bypass mandatory two-factor authentication indefinitely. By POSTing to the profile update endpoint without the two-factor-authentication field, the attacker skips nonce verification and reaches delete_two_fa_meta(), which resets the grace-period anchor timestamp on every login cycle, so enforced 2FA is perpetually deferred rather than satisfied. The flaw is rated low severity (CVSS 4.0 base 2.3, PR:L, VI:L) and no public exploit code or CISA KEV entry was identified at time of analysis; a vendor patch is available in 9.8.2.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript into victim browsers by manipulating the `subject` parameter of `/subject1.php`. A public proof-of-concept exploit has been disclosed via a GitHub issue. No active exploitation (CISA KEV) is recorded, and the CVSS 4.0 base score of 2.1 reflects the passive user interaction requirement and limited integrity-only impact on the vulnerable system.
Incorrect privilege assignment in the checkShellCommand permission check (src/capabilities/permissions.ts) of cosmicstack-labs mercury-agent through 1.2.0 lets a low-privileged remote caller obtain shell-command capabilities it should not have. Publicly available exploit code exists, and the maintainers have not responded to the issue report, so no fixed release is confirmed. Impact is limited to low confidentiality exposure per the CVSS 4.0 vector (VC:L, VI:N, VA:N), making this a modest-severity exposure rather than a full compromise.
Arista EOS network switches permit an authenticated 802.1X supplicant on an adjacent Layer 2 segment to send traffic unrestricted by its assigned ACL during a brief race window - spanning milliseconds to seconds - between the completion of the authentication handshake and the point at which the switch fully enforces the authorization policy. The flaw is classified under CWE-862 (Missing Authorization) and affects all EOS releases through 4.33.7.1M as well as specific 4.34.x and 4.35.x branches. No public exploit code has been identified and the issue is not listed in the CISA KEV catalog; its real-world impact is limited by adjacency requirement, authentication prerequisite, and the very short exploitation window.
Arista EOS 4.36.0 through 4.36.1F contains a race condition in IEEE 802.1X port-based Network Access Control that can leave a supplicant in an authorized state after an administrator explicitly issues the 'clear dot1x host all' deauthorization command. The flaw (CWE-459: Incomplete Cleanup) means that a device intended to be removed from the network may retain valid access, undermining the administrative action entirely. No public exploit code exists and SSVC exploitation status is confirmed as none; however, the integrity gap created - a device that should be denied access remaining authorized - is the primary concern for network access control posture.
Arista EOS 802.1X port-based access control exposes a brief ACL enforcement gap (milliseconds to seconds) when an authenticated supplicant is removed - either by the 'clear dot1x host all' CLI command or by supplicant timeout. During this window, the departing supplicant's traffic transits the switch without ACL enforcement, potentially reaching network segments the ACL was meant to restrict. No public exploit exists and the CVSS 4.0 score of 2.1 reflects a low-severity, low-probability timing-dependent issue.
Out-of-bounds read in the Gravity scripting language compiler (versions 0.9.0-0.9.7) allows remote attackers with code-submission access to trigger adjacent-memory disclosure or a process crash by supplying a crafted single-byte numeric token to the parser. The root cause is that `parse_number_expression` in `src/compiler/gravity_parser.c` reads `value[1]` to detect numeric prefixes (hex, octal, binary) without first verifying the token is at least two bytes long. A public exploit exists following disclosure of the issue in GitHub issue #446; the vendor-released patch in version 0.9.8 closes the gap.
Stored cross-site scripting in itranswarp's Markdown rendering pipeline allows authenticated users to inject arbitrary JavaScript into page content that executes in other visitors' browsers. The flaw exists in the `Markdown.toHtml()` method of `Markdown.java`, which fails to sanitize malicious HTML or script constructs embedded in Markdown input before writing rendered output to the page. All 2.x releases through 2.19 are affected, the project is officially end-of-life with no maintainer response to the vulnerability report, and exploit code has been publicly published.
Command injection in D-Link DWR-M921 firmware 1.1.52 enables authenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the `devicename` parameter of the `/boafrm/formDiskPartition` web management endpoint. The firmware passes this parameter unsanitized to a C `system()` call, granting shell-level access to the device's underlying OS. A public proof-of-concept exploit has been disclosed on GitHub by researcher H3rmesk1t, confirming exploitability for any attacker in possession of valid administrative credentials.
Memory corruption in GNU Binutils 2.47 is triggerable locally by supplying a crafted ELF file to any Binutils tool that invokes `_bfd_elf_strtab_delref` in `bfd/elf-strtab.c`. A low-privileged local attacker can corrupt heap memory in the BFD library's ELF string table handler, potentially causing process crash, limited information disclosure, or minor data manipulation. A public proof-of-concept exists per the CVSS 4.0 E:P modifier and CVE description; no vendor patch has been released as the upstream project had not yet responded to the bug report at time of disclosure.
Null pointer dereference in GNU Binutils 2.47 allows a local low-privileged user to crash Binutils toolchain utilities by supplying a crafted input file that triggers the vulnerable `_bfd_write_merged_section` function in `bfd/merge.c`. The Section Merge component of the BFD (Binary File Descriptor) library fails to validate a pointer before dereference, resulting in a denial of service. A proof-of-concept exploit has been publicly disclosed via VulDB and the GNU Binutils bugzilla, and no vendor patch is available as the project has not yet responded to the disclosure.
Null pointer dereference in GNU Binutils 2.47 allows a local attacker with low privileges to crash binutils tools by supplying a crafted ELF binary with a malformed SHT_GROUP section, triggering the defect in `bfd_elf_set_group_contents` within `bfd/elf.c`. A public proof-of-concept has been disclosed and the upstream project has not yet responded to the coordinated disclosure. No public exploit identified for active exploitation (not in CISA KEV); CVSS 4.0 rates this 1.9, reflecting its extremely limited real-world impact.
Null pointer dereference in GNU Binutils 2.47 crashes the ELF linker when processing orphan sections via a crafted object file. The flaw resides in the `elf_orphan_compatible` function in `ld/ldelf.c`, exploitable by any local user who can invoke the `ld` linker against a specially crafted ELF input. A public proof-of-concept has been posted to the upstream Bugzilla tracker (attachment #16882 / bug #34450), but as of this analysis the GNU Binutils project has not yet released a patch or responded to the disclosure.
Reachable assertion failures in GPAC's MP4Box tool through commit f1219cde allow a local attacker to crash the process by supplying a crafted MP4 or MPEG-4 BIFS scene graph file. The flaw originates in gf_node_get_field_count (scenegraph/base_scenegraph.c), where hard gf_assert() calls - and a structural field-ordering mismatch in nodes_mpeg4.h between adjacent MPEG-4 node type definitions - allow malformed input to reach an assert that aborts the process. A proof-of-concept has been publicly published; the vendor-released fix is available in the abi-16.23 tagged release.
A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to access restricted files.
A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass Gatekeeper checks.
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to modify protected parts of the file system.
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to break out of its sandbox.
A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to bypass Privacy preferences.
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to disclose kernel memory.
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to identify what other apps a user has installed.
This issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. An app may be able to access sensitive user data.