Missing directory confinement in SP Page Builder's media upload endpoint allows high-privileged authenticated users to write files into arbitrary directories beneath the Joomla web root. The `folder` request parameter bypasses the extension's own boundary checks and is passed directly to `Folder::create()` and `File::upload()`, enabling file placement in sensitive paths such as `administrator/`, `templates/`, and `cli/`. Exploitation is bounded by Joomla's PATH input filter, which prevents traversal above the web root, and the component does not overwrite existing files. No public exploit or active exploitation has been identified at time of analysis.
Unauthenticated CAPTCHA bypass in SP Page Builder Pro (Joomla extension, versions 5.1.4-6.9.0) allows any remote attacker to defeat form bot-protection by supplying attacker-controlled CAPTCHA parameters directly in the HTTP request. The optin_form addon reads the CAPTCHA type, expected answer, and enabled flag from user-supplied request data instead of the server-stored configuration, reducing verification to a trivially solvable md5($captcha_question) == $captcha_answer check where the attacker supplies both operands. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though SSVC classifies it as automatable, making large-scale scripted abuse realistic.
CAPTCHA verification in SP Page Builder Pro's Contact, Opt-in, and Form Builder addons can be defeated on any Joomla site running versions 3.2.6 through 6.9.0 by submitting the parameter view_type=module alongside any non-empty token string. The addon silently discards the CAPTCHA plugin's actual onCheckAnswer verification result and substitutes a trivially-satisfied non-empty-string check whenever this attacker-controlled parameter is present, rendering all configured CAPTCHA types ineffective for forms placed inside SP Page Builder modules. No public exploit has been identified at time of analysis, but the bypass is trivially automatable per SSVC assessment, requiring only a single parameter change in a standard form POST.
Use-after-free in Open5GS AMF component versions 2.0.x through 2.7.x allows network-reachable attackers to corrupt memory in the Access and Mobility Management Function process by triggering the old AMF discovery fallback handler with a crafted interaction. The root cause is premature deallocation of the SBI transaction structure (`ogs_sbi_xact_remove`) before the `discovery_option` argument derived from that structure is fully consumed; the fix relocates the free call past all dependent uses. No public exploit code has been identified; an upstream patch commit is available.
Cypher injection in Apache Syncope's Neo4j graph database persistence layer allows attackers to craft malicious FIQL search queries that escape intended query boundaries, potentially exposing or manipulating identity governance data. All three active release branches are affected - 3.0.x through 3.0.16, 4.0.x through 4.0.7, and 4.1.x through 4.1.2 - indicating a longstanding architectural deficiency in the FIQL-to-Cypher translation path. No public exploit has been identified at time of analysis, but injection flaws in identity management systems carry elevated risk due to the sensitivity of stored credentials, roles, and relationships.
Unauthenticated REST API access on Contec's CPSN-MCB271 series Remote I/O Coupler Unit (Server Type) allows any network-reachable attacker to read industrial I/O sensor values and issue output control commands without credentials. The vulnerability arises from a complete absence of authentication on the device's REST interface, exposing physical process control functions directly over the network. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a straightforward, condition-free exploitation path.
Database field disclosure in four Regular Labs Joomla extensions - Advanced Module Manager, Conditional Content, Content Templater, and ReReplacer - allows an authenticated high-privilege user to read arbitrary database fields outside the intended scope. The Conditions editor feature accepts user-supplied database table and column names from the HTTP request, which are quoted as SQL identifiers (preventing SQL injection) but are not restricted to the tables and columns supported by Regular Labs integrations. An attacker with administrative access can therefore query unrelated database fields, potentially exposing sensitive Joomla database content such as user records or configuration values. No public exploit code or active exploitation is identified at time of analysis.
XML External Entity (XXE) injection in IBM MQ's mqweb MFT REST API allows network-accessible, low-privileged attackers holding MFT publish authority to read sensitive files from the MQ server filesystem or cause denial of service. Affected deployments span seven release trains across LTS and CD channels from version 9.1 through 10.0.0.0. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is constrained by both authentication and a specific MFT publish privilege requirement.
Out-of-bounds write in the Zephyr RTOS ITE it51xxx I2C target driver allows a malicious or compromised I2C master to corrupt embedded controller firmware memory by sending a write transaction exceeding 256 bytes while the controller operates in buffer mode. The FIFO interrupt handler target_i2c_isr_fifo() accumulated bytes into a fixed-size buffer without a pre-write bounds check, enabling overflow into the adjacent target_out_buffer and following static device data in the interrupt handler context. No software privilege on the victim controller is required; the attacker needs physical or electrical access to the I2C bus with both CONFIG_I2C_TARGET and CONFIG_I2C_TARGET_BUFFER_MODE enabled. No public exploit exists and this vulnerability is not listed in CISA KEV at time of analysis.
A use-after-free write in the Zephyr RTOS ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) affects Zephyr 4.0.0 through 4.4.1 and allows a malicious USB host to create a kernel heap-corruption primitive on the device side. When a multi-packet OUT transfer is received on a non-control endpoint, the driver re-arms the endpoint to keep filling the same net_buf while simultaneously handing that buffer to the upper USB device stack, which may free and recycle it while DMA continues; the completing packet is also submitted a second time, corrupting the event slist and causing a double net_buf_unref(). Exploitation is physical (USB attach) with no authentication or user interaction required, giving a reliable denial of service and plausible adjacent-pool memory corruption; no public exploit code or CISA KEV listing was identified for this CVE at time of analysis.
OAuth redirect URI allowlist bypass in Mattermost's Dynamic Client Registration allows remote unauthenticated attackers to register OAuth clients with attacker-controlled callback hosts. The flaw arises from glob patterns being matched against the raw redirect URI string rather than against parsed URL components, enabling an attacker to embed an allowlisted host or path inside the query string of a malicious URI (e.g., https://evil.com/callback?trusted.example.com/path). A victim who completes the OAuth authorization flow with the rogue client will have their authorization code sent to the attacker's host, enabling potential account takeover. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis.
ASRock Polychrome SYNC/RGB kernel driver improperly restricts I/O port access via its IOCTL interface, allowing any authenticated local user to force an OS reboot. The driver, installed as part of ASRock's RGB lighting control software for motherboards and VGA cards, accepts crafted IOCTL requests without sufficient validation of target I/O ports, enabling a low-privileged local attacker to cause system-wide availability failure. No public exploit or KEV listing exists at time of analysis; the TWCERT advisory is the primary disclosure source.
Authenticated local attackers on Windows systems running ASRock Polychrome SYNC/RGB can crash the operating system by submitting a specially crafted IOCTL request to the product's installed kernel-mode driver, which dereferences an attacker-supplied pointer without validation (CWE-822). Both the Motherboard (MB) and VGA variants of the software are affected, as confirmed by TWCERT. No public exploit code or active exploitation has been identified; impact is strictly denial of service with no confidentiality or integrity dimension, consistent with the CVSS 4.0 vector scoring VA:H with all other impact metrics at N.
Buffer overflow in the Panasonic Industry USB Driver for MINAS A5/A6 servo drives allows a local low-privileged attacker to crash Windows on machines running PanaTerm or RTEX LogReader software. The root cause is classic unchecked buffer copy (CWE-120) in the driver component bundled with the affected Panasonic software titles. Impact is limited to availability - a successful exploitation stops the Windows OS, but no confidentiality or integrity impact has been identified.
Kernel memory corruption in Apple macOS lets a locally running application crash the operating system or corrupt kernel memory, with the potential for further kernel-level compromise. The flaw is a memory-bounds handling defect (CWE-119) present in macOS versions before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7, and is fixed in those releases per Apple's advisories. Exploitation requires the ability to execute code as a local user (CVSS AV:L/PR:L), EPSS is low at 0.19% (9th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
Processing a maliciously crafted file on Apple macOS versions below Golden Gate 27 can crash the affected component, causing a denial-of-service, and may potentially leak partial memory contents. The bug is an integer overflow (CWE-190) corrected through improved input validation, and exploitation requires a local victim to actually open or handle the attacker-supplied file, so both a local attack vector and user interaction are prerequisites. Severity is assessed as moderate (assessed CVSS 6.6-level, availability-high with limited-confidentiality impact); EPSS is low at 0.17% (7th percentile), CISA SSVC records no exploitation, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Apple macOS contains an improper input validation flaw (CWE-20) that a remote attacker can leverage to crash affected system components, producing a denial-of-service condition on the host. Apple addressed the issue in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7, so all earlier builds of those release trains remain vulnerable. Exploitation requires the victim to interact with attacker-supplied content (CVSS UI:R), and there is no public exploit identified at time of analysis, though the CVSS 3.1 base score of 6.5 reflects a high availability impact with no confidentiality or integrity loss.
Uncontrolled resource consumption in IBM Cloud Pak for Business Automation enables authenticated network users to exhaust service resources and trigger a denial of service condition. Affected versions span the 24.0.0, 24.0.1, 25.0.0, and 26.0.0 release lines, each capped at specific interim fix levels. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
A remote denial-of-service flaw in Apple iOS and iPadOS (all versions before 27) stems from insufficient input validation in a code path that processes remotely supplied content, allowing an attacker to crash or hang the affected feature. Exploitation requires the victim to interact with the malicious input (CVSS UI:R) and yields only availability impact - confidentiality and integrity are unaffected. Apple addressed the issue with improved input validation in iOS 27 and iPadOS 27; there is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so the practical priority is routine patching rather than emergency response.
An attribute-read sandbox bypass in the PraisonAI multi-agent framework (pip package praisonaiagents before 1.6.59) lets prompt-influenced Python code reach blocklisted dunder attributes such as __class__, __bases__, __globals__ and __dict__, exposing in-process objects and secrets to the attacker. Exploitation requires the execute_code tool's sandbox mode with approval automatically granted (for example via PRAISONAI_AUTO_APPROVE or the YAML auto-approval path), after which two CPython semantics are chained: runtime string assembly evades the AST blocklist and str.format/str.format_map resolve dotted fields through C-level attribute access that never consults the Python-level _safe_getattr wrapper. The result is a high-confidentiality read primitive rather than a complete in-process execution chain; the vendor has published a fixed release (1.6.59) plus a public GitHub advisory containing a reproducer, and there is no CISA KEV listing indicating active exploitation.
Server-side request forgery in PraisonAI's SpiderTools web-scraping component (praisonaiagents before 1.6.59) lets an attacker-supplied public URL pass the initial validation check and then redirect to loopback, private, link-local, or cloud metadata addresses, with the internal response body returned through scrape_page and its extract_links, crawl, and extract_text callers. Exploitation requires the agent to fetch an attacker-influenced URL, and a local-only proof of vulnerability was published in the vendor's GHSA advisory; there is no public exploit tooling and no evidence of active exploitation (not in CISA KEV, EPSS 0.26% / 17th percentile). The issue is fixed in praisonaiagents 1.6.59 (PraisonAI 4.6.59).
HTTP request smuggling in IBM WebSphere Application Server 8.5 and 9.0 (including the Liberty variant) enables unauthenticated remote attackers to manipulate shared HTTP caches, circumvent web application firewall rules, and inject malicious scripts into responses served to other users. The root cause is improper parsing of the HTTP Transfer-Encoding request header (CWE-444), a class of vulnerability that exploits disagreement between a front-end proxy and the back-end application server over where one HTTP request ends and the next begins. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available.
HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty allows remote unauthenticated attackers to poison web caches, bypass web application firewall protections, and conduct cross-site scripting attacks by sending specially crafted Transfer-Encoding headers. The root cause is CWE-444, inconsistent interpretation of HTTP request boundaries between WebSphere and a frontend proxy component. No public exploit or confirmed active exploitation has been identified at time of analysis; a vendor patch is available from IBM.
Mattermost's data retention teams API endpoint fails to sanitize returned Team objects, exposing private teams' secret `invite_id` and email fields to any authenticated user holding only the read-only Data Retention Policy permission. An attacker exploiting CVE-2026-91181 can call `GET /api/v4/data_retention/policies/{policy_id}/teams`, harvest the `invite_id` of private teams they have no membership in, and use it to join those teams without authorization - effectively achieving lateral movement across private channels and communications. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Open redirect (CWE-601) in IBM WebSphere Application Server 9.0, 8.5, and Liberty enables remote attackers to conduct phishing campaigns by crafting URLs hosted on the trusted WebSphere origin that silently forward victims to attacker-controlled sites. The vulnerability requires no authentication from the attacker but does depend on social engineering to lure victims into visiting the crafted URL. Successful exploitation allows credential harvesting, further targeted attacks, or brand abuse against organizations relying on WebSphere's trusted domain reputation. No public exploit or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.2 enables unauthenticated remote attackers to coerce the application server into issuing arbitrary outbound HTTP requests. Exploiting this flaw, an attacker can probe internal network topology, reach cloud metadata endpoints (e.g., AWS IMDSv1), or use the server as a proxy to bypass network access controls. No public exploit code or CISA KEV listing has been identified at time of analysis, and IBM has released a patch via their support portal.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.5 permits unauthenticated remote attackers to cause the application server to issue arbitrary outbound HTTP requests. The primary risk is internal network enumeration - mapping services, ports, and hosts reachable from the Langflow deployment that are otherwise inaccessible to the external attacker - and potential use as a pivot to reach internal APIs or cloud metadata endpoints. No public exploit code exists and the CVE is not in the CISA KEV catalog; IBM has issued a patch via its support portal.
Loading attacker-controlled web content on an unpatched Apple device can trigger a null pointer dereference in the WebKit rendering pipeline, crashing the browser or app that renders the page and producing a denial-of-service on iPhone, iPad, Mac, Apple Watch and Apple Vision Pro. Apple shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, visionOS 27 and watchOS 27. The flaw scores CVSS 6.5 with a user-interaction requirement (UI:R), EPSS is only 0.20% (10th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
An out-of-bounds read in Apple's font parsing code lets a maliciously crafted font file leak process memory on unpatched builds of iOS, iPadOS, macOS, tvOS, visionOS and watchOS, with all affected platforms fixed in the version 27 releases. Triggering it requires the victim to render attacker-supplied content containing the crafted font — an email, document, web page or message preview — but no credentials or elevated privileges are needed once that interaction happens, and the resulting confidentiality impact is rated high with no integrity or availability effect. No public exploit code or active exploitation has been identified, and EPSS sits at a low 0.20% (10th percentile), so this is best handled as a scheduled platform update rather than an emergency response.
An integer underflow in the macOS SMB client allows a malicious SMB server to crash the operating system, resulting in a denial of service, when a user connects to a shared folder or mount. The flaw affects macOS releases prior to Golden Gate 27, Sequoia 15.8 and Tahoe 26.7, and is fixed in those versions. Exploitation requires the victim to initiate a connection to an attacker-controlled SMB endpoint (CVSS UI:R), there is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is very low at 0.19% (9th percentile), so real-world exploitation pressure is currently minimal.
Mounting a crafted disk image on unpatched macOS releases triggers an out-of-bounds write in the code that parses disk image content, causing unexpected system termination (crash) on macOS Sequoia, Sonoma and Tahoe. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - a user-interaction-dependent denial-of-service with no confidentiality or integrity impact, and CISA's SSVC assessment marks exploitation as 'none' and automatable as 'no'. EPSS is 0.19% (9th percentile), no public exploit code or CISA KEV listing was identified at time of analysis, and Apple has shipped fixed builds in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8 and macOS Tahoe 26.6.
Mounting a crafted disk image on an affected Mac can crash the system: Apple macOS Sequoia, Tahoe and Golden Gate contain a buffer overflow in the disk-image handling path that is triggered when a user opens a malicious image, requiring no credentials. Apple has shipped fixes in macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27. EPSS is low (0.19%, 8th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, so the practical concern is availability loss (forced termination, potential unsaved-work loss) rather than code execution.
An integer overflow in Apple's file-processing code, fixed through improved input validation, allows a maliciously crafted file to cause disclosure of process memory on affected Apple platforms. Unpatched devices running iOS/iPadOS before 26.7 and 27, macOS before Sequoia 15.8, Tahoe 26.7 or Golden Gate 27, plus tvOS, visionOS and watchOS before 27 are exposed, but exploitation requires the victim to open the crafted file (CVSS UI:R). There is no public exploit code and no evidence of active exploitation; EPSS is very low at 0.18% (8th percentile) and CISA SSVC rates the issue non-automatable with only partial technical impact, and Apple has released patches.
Connecting an Apple device to an attacker-controlled NFS server can cause the kernel NFS client to mishandle memory and return out-of-bounds kernel memory to the malicious server, an information-disclosure issue tracked as CVE-2026-43687. All shipping Apple platforms are affected — iOS/iPadOS before 26.7 and 27, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27 — while the fix is distributed across Apple's 26.7/27 update wave. Exploitation requires the victim to initiate a connection to the hostile server (UI:R), which keeps real-world risk moderate: EPSS is only 0.18% (7th percentile), CISA KEV does not list it, SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code was identified at time of analysis.
An out-of-bounds write in Apple's image processing pipeline (CWE-787) allows a maliciously crafted image to corrupt memory when it is viewed on affected Apple platforms. Apple addressed the flaw with improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27. The CVSS 3.1 base score of 6.5 reflects a network-delivered attack requiring the victim to open the image (UI:R), with impact limited to availability (C:N/I:N/A:H); EPSS is very low at 0.18% (7th percentile) and there is no public exploit identified at time of analysis.
An out-of-bounds write in Apple's image handling code lets a maliciously crafted image crash the parsing process on affected iPhones, iPads, Macs, Apple TVs, Vision Pro and Apple Watches. Apple fixed the flaw through improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Exploitation requires the victim to open or preview the crafted image (UI:R), the observed impact is process termination only — no code execution, data theft or tampering is described — and there is currently no public exploit code or CISA KEV listing; EPSS is a low 0.17% (7th percentile).
An out-of-bounds read in the font-parsing path of Apple's operating systems lets a remote attacker disclose the contents of process memory when a victim processes a maliciously crafted font. All Apple platforms are affected prior to the version 27 releases — iOS and iPadOS, macOS Golden Gate, tvOS, visionOS and watchOS — and Apple has shipped fixes for each. There is no CISA KEV listing and no public exploit code identified, and the EPSS score of 0.17% (7th percentile) indicates a low probability of near-term exploitation; because the sole impact is memory disclosure and exploitation requires the victim to open or render attacker-supplied content, this is a moderate-priority patch rather than an emergency.
Mounting a maliciously crafted disk image on unpatched Apple devices triggers an out-of-bounds write in image-parsing code, leading to memory corruption and unexpected system termination (denial of service). Affected platforms include iOS/iPadOS before 26.7 and 27, and macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27. Apple has shipped fixes in iOS 26.7/27, iPadOS 26.7/27, and the corresponding macOS releases; no public exploit code or active exploitation has been identified, and EPSS is negligible at 0.17% (7th percentile), indicating a low-likelihood, availability-only defect.
An out-of-bounds write in Apple macOS is triggered when a user connects to a malicious WebDAV server, resulting in unexpected application termination. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27, and is reachable over the network with no privileges required but with user interaction (the victim must initiate the WebDAV connection). Apple addressed it by removing the vulnerable code and shipped fixes in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 score is 6.5 with availability-only impact.
A use-after-free (CWE-416) in the Apple macOS SMB client allows a maliciously crafted SMB network share to crash the operating system, causing system termination. Exploitation requires the user to mount the attacker-controlled share (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5), so impact is limited to denial of service with no confidentiality or integrity loss. Apple has released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7; there is no CISA KEV listing and no public exploit code identified, and EPSS is low at 0.17% (6th percentile).
An out-of-bounds read in Apple's macOS SMB client allows a malicious SMB server to leak kernel memory to an attacker when a user connects to a shared folder, fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Exploitation requires the victim to initiate a connection to an attacker-controlled or compromised SMB share (CVSS UI:R), so it is user-interaction dependent rather than wormable, and the raw impact is confidentiality only — kernel memory disclosure, not code execution. EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit code has been identified; SSVC rates exploitation as 'none', automatable as 'no', and technical impact as 'partial'.
An unauthenticated attacker positioned within radio range of an Apple iPhone or iPad can send specially crafted wireless input that causes the device to terminate unexpectedly (crash/restart), due to an input validation failure in the affected platform. The flaw is rated CVSS 6.5 (AV:A, A:H) and affects iOS and iPadOS before version 27; Apple has released a fixed version and no public exploit code or active exploitation has been identified (EPSS 0.14%, 4th percentile). Impact is limited to availability - there is no confidentiality or integrity impact.
An out-of-bounds write in Apple macOS (all versions prior to macOS 27 'Golden Gate') allows a maliciously crafted disk image to corrupt kernel memory when mounted, causing unexpected system termination. Apple addressed the flaw by removing the vulnerable code rather than adding a bounds check, and a vendor patch is available in macOS 27. There is no CISA KEV listing and no public exploit code identified at time of analysis; EPSS is very low at 0.14% (4th percentile), so exploitation appears opportunistic at most.
Processing maliciously crafted web content in Apple's WebKit-based browser stack can disclose sensitive user information across Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 and earlier. Apple classifies the root cause as an improper privilege management (permissions) issue and fixed it by removing the vulnerable code rather than adding a check, per the vendor advisories referenced for CVE-2026-64753. Real-world urgency is currently low: EPSS is 0.14% (4th percentile), there is no CISA KEV listing or public exploit identified at time of analysis, and CISA's SSVC assessment is exploitation:none / automatable:no / technical impact:partial, while a vendor patch is already available.
Authentication bypass in IBM WebSphere Application Server 8.5 and 9.0 allows an unauthenticated attacker positioned on an adjacent network segment to reach request-handling functionality that performs no authorization check (CWE-862) and read sensitive information from the response. IBM has released a vendor patch, and there is no public exploit code or CISA KEV entry associated with this issue at time of analysis, so exploitation is not confirmed actively exploited. CVSS rates it 6.5 with confidentiality-only impact and PR:N/UI:N, but no EPSS score was supplied, leaving real-world exploitation likelihood unquantified.
Server-side request forgery in the MCP Atlassian MCP server (versions 0.17.0 through 0.21.x) allows remote unauthenticated attackers to force the server to make outbound requests to internal addresses such as the cloud metadata endpoint 169.254.169.254. The flaw is an incomplete-fix TOCTOU: validate_url_for_ssrf resolves and approves the attacker-supplied X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url host once at middleware time, but the actual HTTP client re-resolves the raw hostname at connect time with no IP pinning, so a DNS-rebinding name can pass validation with a public IP and then resolve to a link-local or RFC1918 address. Exploitation is a documented, publicly described proof-of-concept rather than confirmed in-the-wild activity (no CISA KEV listing), and the vendor has released version 0.22.0 as the fix.
Authenticated denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX and Windows (including Db2 Connect Server) lets a remote attacker with a valid database session crash the engine by triggering a null pointer dereference. The impact is availability-only (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so confidentiality and integrity of stored data are not directly at risk, but any application or Db2 Connect client depending on the affected instance loses service. No public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, SSVC rates exploitation and automatable both as none/no, and no EPSS score was supplied in the intelligence feed.
IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX and Windows (including Db2 Connect Server) can be driven into a denial-of-service condition by a remote attacker who holds valid database credentials, through uncontrolled consumption of server resources. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so the impact is loss of availability only - no confidentiality or integrity exposure is claimed. Patch exists via IBM support document 7286983; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'.
Remote denial of service in the Zephyr RTOS IPv6 Neighbor Discovery stack: an adjacent, unauthenticated attacker sends a Router Advertisement whose Reachable Time field is set to 1, which collapses the randomized reachable-time calculation in net_if_ipv6_calc_reachable_time() to exactly 0 ms. On builds compiled with CONFIG_ASSERT the zero value trips NET_ASSERT("Zero reachable timeout!") and kills the kernel, while assertion-free builds arm a K_MSEC(0) timer that fires immediately, pushing confirmed neighbors into perpetual STALE re-solicitation. Quoted CVSS is
Authenticated topology submission in Apache Storm Nimbus 3.0.0 through 3.0.x allows any authenticated Storm user to read arbitrary files accessible to the Nimbus daemon by supplying a server-side path as the uploadedJarLocation argument to submitTopology or submitTopologyWithOpts, bypassing the intended beginFileUpload flow entirely. Nimbus copies the targeted file into a topology blob and automatically grants the submitter read access via blob ACLs, enabling retrieval of Kerberos keytabs, TLS private keys, and ZooKeeper credentials through standard blob download APIs. A proof of concept was submitted alongside disclosure; upgrade to Apache Storm 3.1.0 is the required remediation.