Out-of-bounds write in the camera GDC (Geometric Distortion Correction) hardware driver on Samsung Exynos 1330, 1380, 1480, and 2400 SoCs can corrupt kernel memory under specific operating conditions. The vulnerability is reachable by low-privileged processes with camera subsystem access and crosses a privilege boundary into the kernel, despite the low CVSS availability-only impact scoring. No public exploit has been identified at time of analysis, and Samsung has published a dedicated advisory.
NULL pointer dereference in the 5G NR baseband of Samsung Exynos processors and modems causes a denial-of-service condition when a malformed RRC Reconfiguration message is received from the network. Sixteen Exynos chip variants are affected, spanning Samsung flagship, mid-range, and wearable devices - including Exynos 850, 1080, 2100, 2200, 2400, W920, W930, W1000, Modem 5410, and others. An attacker capable of injecting or spoofing RRC layer signaling (e.g., via a rogue base station) can trigger a crash in the L2/RRC processing stack, disrupting cellular connectivity. No public exploit code or active exploitation has been identified at time of analysis.
A buffer overflow in a PASE (Portable Application Solutions Environment) process on IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated local user to crash the affected process. Per IBM's own description, the impact is limited: the attacker can terminate their own process rather than disrupt other users or system-wide services, which is reflected in the low CVSS 3.3 and Availability-only impact. There is no public exploit code and no CISA KEV listing at time of analysis, and the flaw is classified as CWE-125 (out-of-bounds read).
Comment-injection in the OpenZeppelin Contracts Wizard code generators lets a newline character embedded in the `info.securityContact` or `info.license` option break out of the single-line `//` comment and be emitted as live source declarations in generated Solidity, Cairo, Stellar/Soroban, and Stylus contracts. Only integrations that populate those two fields from untrusted input and then hand the generated source to a downstream consumer are affected — the self-service web app, AI assistant, CLI, and self-hosted API all use user-supplied values and never cross that trust boundary, and shared links cannot set the fields. The flaw is integrity-only (CVSS 3.3, CWE-94): no code executes on any Wizard service, no public exploit is identified in the supplied data, and patched packages are available as @openzeppelin/wizard 0.10.11, wizard-cairo 3.0.1, wizard-stellar 0.6.2, and wizard-stylus 0.3.1.
Authorization bypass in IBM WebSphere Application Server 8.5 and 9.0 lets an attacker positioned on an adjacent network segment reach functionality without the required authorization checks, resulting in limited (low) confidentiality exposure with no integrity or availability impact. The published CVSS 3.1 score is only 3.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting that exploitation demands network adjacency and a high-complexity precondition rather than an internet-facing attack. There is no CISA KEV listing, no public exploit code identified in the provided sources, and an EPSS score was not supplied; IBM has published a fix. Note the tension between the 'authorization bypass' label and the very low scored impact — the advisory's own severity framing should be verified directly against the IBM support page.
Serena, an AI coding assistant built on the Model Context Protocol (MCP), exposed its HTTP-mode server on all network interfaces (0.0.0.0) by default in versions before 1.0.0, allowing any host reachable on the same network to connect to the unauthenticated MCP endpoint. The MCP protocol is a tool-execution channel for LLM agents; in a coding assistant context, those tools routinely include file system access and potentially shell invocation, making the true blast radius of unrestricted access substantially higher than the NVD CVSS of 2.9 suggests. A security blog (dash.security) characterizes the issue as unauthenticated remote code execution, a claim the official scoring does not reflect; no active exploitation is confirmed and no KEV listing exists.
Out-of-bounds read in the Wi-Fi driver subsystem of Samsung Exynos mobile processors allows a local low-privileged attacker to leak kernel memory by sending a malformed Netlink command, potentially exposing sensitive in-kernel data. Affected processors span Samsung's mid-range and flagship mobile lineup plus wearable chips: Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930. No public exploit has been identified at time of analysis, and Samsung has published a product security advisory addressing the issue.
Samsung Exynos camera driver firmware on eight mobile processor variants leaks sensitive information through debug instrumentation that was not removed from production builds (CWE-215). The flaw affects Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680 SoCs - processors found in Samsung Galaxy smartphones and tablets - allowing a local low-privileged attacker to read sensitive data that crosses the kernel-to-userspace security boundary. No public exploit code exists and the vendor-assigned CVSS score of 2.8 (Low) accurately reflects the narrow, local-only attack surface and limited confidentiality impact.
Out-of-bounds write in the Wi-Fi interface kernel driver of Samsung Exynos mobile and wearable processors enables a local low-privileged user to cause a denial of service through a crafted ioctl command. Affected SoCs include the Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000, covering a broad range of Samsung Galaxy smartphones and Galaxy Watch devices. No public exploit has been identified, and the impact ceiling is a recoverable availability disruption with no confidentiality or integrity exposure.
Out-of-bounds write in the Samsung Exynos camera driver error-handling path causes memory corruption on eight Exynos mobile processor variants. Exploitation requires local access with low privileges and high attack complexity to reach the faulty error path, with a changed scope producing only low availability impact - consistent with a crash or transient DoS rather than code execution. No public exploit code exists and the vendor has published a security update via the Samsung Semiconductor support portal.
Out-of-bounds write in the camera driver of Samsung Exynos processors (1330, 1380, 1480, 2400, 1580, and 2500) can be triggered by a local low-privileged attacker writing a malformed message to the debug sysfs entry `test_msg`, causing a denial-of-service condition in the camera subsystem. The vulnerability crosses a privilege boundary (scope changed) from user space into the camera driver, but impact is limited to availability and does not affect confidentiality or integrity. No public exploit code has been identified at time of analysis, and Samsung has published a security advisory addressing the issue.
Camera driver TOCTOU race condition across eight Samsung Exynos SoC families (1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680) allows a local low-privileged attacker to trigger out-of-bounds memory access in the camera driver, resulting in limited availability impact. The vendor-assigned CVSS 3.1 score of 2.8 (AV:L/AC:H/PR:L) accurately captures the constrained real-world risk: exploitation requires winning a timing race from a local context with camera-level access. No public exploit code exists and the vulnerability is not listed in CISA KEV, confirming this as a low-urgency, patch-when-possible finding.
Heap overflow via TOCTOU race in the Exynos DRM HDR Driver affects Samsung Mobile Processors across nine Exynos SoC generations (1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600), enabling a local low-privileged attacker to crash the kernel. The race condition occurs in the Display Processing Unit's HDR handling path, where a check-then-use window can be exploited to corrupt kernel heap memory, resulting in a denial-of-service condition. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present.
Unchecked strcpy() of the GZIP original-filename header field in libarchive 3.8.x causes a heap-based buffer overflow (CWE-122) in the gzip compression writer, with impact limited to a low-severity application crash. The overflow can only be triggered when a caller explicitly passes an overly long, untrusted original-filename string through the libarchive API - a condition the CVE itself characterizes as marginally plausible, since this field is not derived from archived input data. No active exploitation has been confirmed, and the official CVSS score of 2.5 (Low) with AV:L/AC:H/UI:R accurately reflects the constrained, non-default exploitation path.
Really Simple Security (formerly Really Simple SSL) before 9.8.2 ships an unguarded profile-page update handler that lets an authenticated low-privileged WordPress user bypass mandatory two-factor authentication indefinitely. By POSTing to the profile update endpoint without the two-factor-authentication field, the attacker skips nonce verification and reaches delete_two_fa_meta(), which resets the grace-period anchor timestamp on every login cycle, so enforced 2FA is perpetually deferred rather than satisfied. The flaw is rated low severity (CVSS 4.0 base 2.3, PR:L, VI:L) and no public exploit code or CISA KEV entry was identified at time of analysis; a vendor patch is available in 9.8.2.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript into victim browsers by manipulating the `subject` parameter of `/subject1.php`. A public proof-of-concept exploit has been disclosed via a GitHub issue. No active exploitation (CISA KEV) is recorded, and the CVSS 4.0 base score of 2.1 reflects the passive user interaction requirement and limited integrity-only impact on the vulnerable system.
Incorrect privilege assignment in the checkShellCommand permission check (src/capabilities/permissions.ts) of cosmicstack-labs mercury-agent through 1.2.0 lets a low-privileged remote caller obtain shell-command capabilities it should not have. Publicly available exploit code exists, and the maintainers have not responded to the issue report, so no fixed release is confirmed. Impact is limited to low confidentiality exposure per the CVSS 4.0 vector (VC:L, VI:N, VA:N), making this a modest-severity exposure rather than a full compromise.
Arista EOS network switches permit an authenticated 802.1X supplicant on an adjacent Layer 2 segment to send traffic unrestricted by its assigned ACL during a brief race window - spanning milliseconds to seconds - between the completion of the authentication handshake and the point at which the switch fully enforces the authorization policy. The flaw is classified under CWE-862 (Missing Authorization) and affects all EOS releases through 4.33.7.1M as well as specific 4.34.x and 4.35.x branches. No public exploit code has been identified and the issue is not listed in the CISA KEV catalog; its real-world impact is limited by adjacency requirement, authentication prerequisite, and the very short exploitation window.
Arista EOS 4.36.0 through 4.36.1F contains a race condition in IEEE 802.1X port-based Network Access Control that can leave a supplicant in an authorized state after an administrator explicitly issues the 'clear dot1x host all' deauthorization command. The flaw (CWE-459: Incomplete Cleanup) means that a device intended to be removed from the network may retain valid access, undermining the administrative action entirely. No public exploit code exists and SSVC exploitation status is confirmed as none; however, the integrity gap created - a device that should be denied access remaining authorized - is the primary concern for network access control posture.
Arista EOS 802.1X port-based access control exposes a brief ACL enforcement gap (milliseconds to seconds) when an authenticated supplicant is removed - either by the 'clear dot1x host all' CLI command or by supplicant timeout. During this window, the departing supplicant's traffic transits the switch without ACL enforcement, potentially reaching network segments the ACL was meant to restrict. No public exploit exists and the CVSS 4.0 score of 2.1 reflects a low-severity, low-probability timing-dependent issue.
Out-of-bounds read in the Gravity scripting language compiler (versions 0.9.0-0.9.7) allows remote attackers with code-submission access to trigger adjacent-memory disclosure or a process crash by supplying a crafted single-byte numeric token to the parser. The root cause is that `parse_number_expression` in `src/compiler/gravity_parser.c` reads `value[1]` to detect numeric prefixes (hex, octal, binary) without first verifying the token is at least two bytes long. A public exploit exists following disclosure of the issue in GitHub issue #446; the vendor-released patch in version 0.9.8 closes the gap.
Stored cross-site scripting in itranswarp's Markdown rendering pipeline allows authenticated users to inject arbitrary JavaScript into page content that executes in other visitors' browsers. The flaw exists in the `Markdown.toHtml()` method of `Markdown.java`, which fails to sanitize malicious HTML or script constructs embedded in Markdown input before writing rendered output to the page. All 2.x releases through 2.19 are affected, the project is officially end-of-life with no maintainer response to the vulnerability report, and exploit code has been publicly published.
Command injection in D-Link DWR-M921 firmware 1.1.52 enables authenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the `devicename` parameter of the `/boafrm/formDiskPartition` web management endpoint. The firmware passes this parameter unsanitized to a C `system()` call, granting shell-level access to the device's underlying OS. A public proof-of-concept exploit has been disclosed on GitHub by researcher H3rmesk1t, confirming exploitability for any attacker in possession of valid administrative credentials.
Memory corruption in GNU Binutils 2.47 is triggerable locally by supplying a crafted ELF file to any Binutils tool that invokes `_bfd_elf_strtab_delref` in `bfd/elf-strtab.c`. A low-privileged local attacker can corrupt heap memory in the BFD library's ELF string table handler, potentially causing process crash, limited information disclosure, or minor data manipulation. A public proof-of-concept exists per the CVSS 4.0 E:P modifier and CVE description; no vendor patch has been released as the upstream project had not yet responded to the bug report at time of disclosure.
Null pointer dereference in GNU Binutils 2.47 allows a local low-privileged user to crash Binutils toolchain utilities by supplying a crafted input file that triggers the vulnerable `_bfd_write_merged_section` function in `bfd/merge.c`. The Section Merge component of the BFD (Binary File Descriptor) library fails to validate a pointer before dereference, resulting in a denial of service. A proof-of-concept exploit has been publicly disclosed via VulDB and the GNU Binutils bugzilla, and no vendor patch is available as the project has not yet responded to the disclosure.
Null pointer dereference in GNU Binutils 2.47 allows a local attacker with low privileges to crash binutils tools by supplying a crafted ELF binary with a malformed SHT_GROUP section, triggering the defect in `bfd_elf_set_group_contents` within `bfd/elf.c`. A public proof-of-concept has been disclosed and the upstream project has not yet responded to the coordinated disclosure. No public exploit identified for active exploitation (not in CISA KEV); CVSS 4.0 rates this 1.9, reflecting its extremely limited real-world impact.
Null pointer dereference in GNU Binutils 2.47 crashes the ELF linker when processing orphan sections via a crafted object file. The flaw resides in the `elf_orphan_compatible` function in `ld/ldelf.c`, exploitable by any local user who can invoke the `ld` linker against a specially crafted ELF input. A public proof-of-concept has been posted to the upstream Bugzilla tracker (attachment #16882 / bug #34450), but as of this analysis the GNU Binutils project has not yet released a patch or responded to the disclosure.
Reachable assertion failures in GPAC's MP4Box tool through commit f1219cde allow a local attacker to crash the process by supplying a crafted MP4 or MPEG-4 BIFS scene graph file. The flaw originates in gf_node_get_field_count (scenegraph/base_scenegraph.c), where hard gf_assert() calls - and a structural field-ordering mismatch in nodes_mpeg4.h between adjacent MPEG-4 node type definitions - allow malformed input to reach an assert that aborts the process. A proof-of-concept has been publicly published; the vendor-released fix is available in the abi-16.23 tagged release.