A time-of-check to time-of-use (TOCTOU) race condition in multiple locations of the Android kernel allows an attacker who already holds System-level execution privileges on a device to win a timing window and escalate to higher (kernel/root) privileges, with no user interaction required. The flaw is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and is fixed through the September 2026 Android Security Bulletin for Pixel devices. At the time of analysis there is no CISA KEV listing and no public exploit code identified, and no EPSS score was supplied, so the practical risk is concentrated in post-compromise privilege escalation rather than remote mass exploitation.
Local privilege escalation in the Android kernel's PMIC inter-process-communication driver (ap_pmic_ipc.c) lets a caller that already holds System execution privileges bypass permission checks via a confused-deputy flaw in ap_pmic_poll_msg_handler and gain kernel-level code execution. Only Android devices that carry the affected PMIC IPC driver — the Google Pixel bulletin of 2026-09-01 is the vendor reference, and the CPE scopes this to google:android — are exposed, and the attacker must already be running with elevated (System) privileges on the device. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this reads as a post-compromise escalation primitive rather than a remotely reachable entry point.
An out-of-bounds write in the Android kernel, caused by a missing bounds check, allows an attacker who already holds System-level execution privileges on a device to corrupt kernel memory and escalate to full kernel/root privileges. The flaw is reachable only with local access (AV:L, PR:H) and requires no user interaction, and the associated CVSS score of 6.7 reflects high integrity, confidentiality and availability impact rather than ease of reach. No public exploit code or CISA KEV active-exploitation listing was provided in the available intelligence, so this is currently assessed as a patch-priority local privilege-escalation bug rather than a known exploited threat.
A permission bypass in multiple Google Android system components allows an attacker who already holds System-level code execution to escalate privileges via a confused-deputy flaw. Google addressed it in the September 2026 Pixel security bulletin (patch level 2026-09-01); exploitation is local, requires no user interaction, and demands a pre-existing privileged foothold (CVSS PR:H), so it functions as a privilege-escalation link in a chain rather than a standalone remote compromise. No CISA KEV listing, no public exploit code, and no EPSS score were provided at time of analysis.
A missing bounds check in multiple locations of Android kernel code allows a local attacker who already holds System execution privileges to trigger an out-of-bounds write and escalate to higher, kernel-level privileges on affected devices. Google Android builds that ship the impacted kernel code are affected, with fixes published through the September 2026 Pixel/Android security bulletin. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 6.7 score reflects the demanding high-privilege prerequisite rather than any remote reachability.
Out-of-bounds write in the Android kernel lets a local attacker who already holds System-level execution privileges corrupt memory and escalate to full kernel/root code execution without any user interaction. Devices running Android builds that have not yet adopted the September 2026 (2026-09-01) security patch level are affected, with Google rating the flaw High at CVSS 6.7. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with this data.
A permission bypass in Android's CPM component allows a local attacker already running code with System execution privileges to leverage a confused-deputy weakness and escalate further, gaining full read/write/execute impact on the device. Exploitation requires local access and high (System-level) privileges per the CVSS vector but no user interaction, making it a post-compromise escalation primitive rather than a remote entry point. No public exploit code or CISA KEV listing was provided in the intelligence feed, and EPSS data was absent; the fix ships through the September 2026 Android/Pixel security bulletin.
Memory corruption in the Android kernel's GMC mailbox message handler (gmc_mb_msg_handler in gmc_mba.c) allows a local attacker who already holds System-level execution privileges to leverage a confused-deputy condition and escalate privileges on the device. The flaw is tracked as CWE-441 and rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N), meaning it is not remotely reachable and requires a high-privilege foothold rather than being an entry point; user interaction is not needed once that footing exists. Google Devices credited the report and fixed it in the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV entry was identified at time of analysis.
An out-of-bounds write in the Android kernel's remap.c code allows a local attacker holding System-level execution privileges to corrupt kernel memory and escalate to full kernel (root) privileges. The flaw stems from an incorrect bounds check (CWE-787) that fails to validate an offset or length before a write, and no user interaction is required once the attacker has the prerequisite System privileges. At the time of analysis there is no public exploit code and the issue is not listed in CISA KEV, but the September 2026 Pixel security bulletin confirms a vendor fix is available.
Local privilege escalation in the Google Android kernel stems from an out-of-bounds write caused by improper input validation in multiple code locations. An attacker who already holds System-level execution privileges on the device can craft malformed input to corrupt memory and elevate to kernel privileges on affected Android builds. No user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis, though the vendor-published September 2026 Pixel bulletin confirms a fix is available.
An out-of-bounds write in the Android kernel's printf implementation allows an attacker who already holds System-level privileges on the device to corrupt kernel memory and escalate further, typically to kernel/root context, by supplying improperly validated input to the affected formatting routine. Exploitation is local only and requires high privileges (CVSS 3.1 6.7, AV:L/PR:H/UI:N), so a malicious app running as System would be needed rather than a remote attacker. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in Google's September 2026 Pixel/Android security bulletin.
Privilege escalation in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways lets an authenticated, already high-privileged remote user exceed their assigned authorization level and execute arbitrary code on the appliance. Four release branches are affected: 9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1 and 9.7.0.0. The CVSS score of 6.6 understates the operational weight of the flaw because a compromised SD-WAN gateway sits on the control plane of the whole WAN fabric; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Insecure Direct Object Reference in the AI Engine WordPress plugin (tigroumeow, versions ≤3.7.7) allows authenticated subscribers to retrieve transcribed text from private audio attachments owned by any WordPress user, including site administrators. The `mediaId` REST API parameter accepts user-supplied attachment IDs without verifying the requester's ownership or access rights, enabling systematic enumeration of sequential WordPress attachment IDs. Exploitation is configuration-gated - the Public API module must be enabled - and no KEV listing or confirmed public exploit code exists at time of analysis.
Let me produce the JSON. Key facts: Arista EOS DHCP relay, unauthenticated attacker with adjacent network access (AV:A), sends crafted DHCP reply from non-helper address, relay forwards without source validation. Impact: malicious network config to clients → traffic interception or DoS. CWE-345 insufficient verification of data authenticity. CVSS 4.0 base given: AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H → 6.5. Tags: "Denial Of Service" — arguably mislabeled since it's more about spoofing/rogue DHCP. Could emit mislabeled_tag? It's a tag issue; the impact includes DoS but primary is spoofing/traffic interception. Hmm — "Denial Of Service" tag is not exactly wrong but incomplete. Could flag missing_tag "dhcp"? The suggested slug format e.g. "dhcp". Hmm, the missing_tag must be clearly applicable platform/technique/vendor tag. "arista"? Actually vendor tag "arista" would be applicable. Let me think: rules say emit only when unambiguously implied. Vendor "arista" is unambiguously the vendor. But is it a "platform/technique/vendor tag"? Yes, vendor. Hmm, risk of noise. Maybe emit missing_tag target "DHCP" suggested "dhcp" — that's the core protocol. And maybe missing tag "arista". I'll be conservative: one missing_tag for "Arista" → "arista"? Hmm. I think the more defensible one is the product/vendor: the description omits... actually tags list only "Denial Of Service". A DHCP-related tag seems reasonable. I'll include a missing_tag for "DHCP" (slug "dhcp") with high confidence? It's a protocol tag though; typical tag taxonomy includes platform/vendor/technique. DHCP is more a protocol. I'll include "arista" as missing vendor tag — high confidence. Actually maybe both. Let me include just one to avoid noise: missing_tag target "Arista", suggested "arista". Hmm, but also could flag mislabeled_tag "Denial Of Service" — reason: advisory primarily concerns DHCP spoofing/malicious config injection, DoS is secondary. Is that "clearly wrong and verifiable"? No
Unauthenticated network access to the Long Running Actions (LRA) component of Oracle Helidon 4.0.0 through 4.5.4 allows a remote attacker to read a subset of data and to insert, update, or delete records handled by the LRA coordinator without supplying credentials. The flaw is rated CVSS 6.5 with a network attack vector, low complexity, and no required privileges or user interaction, but it produces only partial confidentiality and integrity impact with no availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not supplied in the input.
Oracle Assets, a module within Oracle E-Business Suite, exposes sensitive asset and financial data to any authenticated user with low privileges who can reach the module over HTTP. Versions 12.2.3 through 12.2.15 are affected; a successful attack yields high confidentiality impact (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N) with no integrity or availability effect. Oracle rates the flaw 'easily exploitable', but no EPSS score, KEV listing, or public exploit code was present in the supplied intelligence, so exploitation status is best described as no public exploit identified at time of analysis.
High-privileged users of Oracle E-Business Suite Depot Repair 12.2.3 through 12.2.15 can exploit a flaw in the Depot Repair Diagnostics component over HTTP to read, create, modify, or delete any Depot Repair data they can reach. Oracle rates this CVSS 3.1 6.5 (AV:N/AC:L/PR:H/UI:N, C:H/I:H/A:N), meaning exploitation is network-reachable and low-complexity but requires an already-privileged EBS account; there is no integrity-verified public exploit code and no CISA KEV listing at time of analysis. The practical exposure is privilege escalation or lateral data compromise inside an EBS instance rather than a pre-authentication breach.
A denial-of-service flaw in the Oracle Net Services component of Oracle Database Server (versions 23.4.0 through 23.26.3) lets an unauthenticated attacker with network access over TCPS hang or repeatedly crash the Net Services layer, degrading or halting database connectivity. Exploitation is network-reachable and low-complexity but requires interaction from a person other than the attacker, and it yields availability impact only (CVSS 3.1 base 6.5, C:N/I:N/A:H). No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied with the source data.
Unauthenticated network attackers with access to the TLS interface of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can trigger a hang or repeatedly crash the Forge component while also reading a limited subset of application-accessible data. Oracle's advisory rates it 6.5 (AV:N/AC:H/PR:N/UI:N/C:L/A:H), so impact is dominated by availability loss rather than data compromise, and the high attack complexity suggests exploitation requires carefully crafted conditions rather than a trivial request. No public exploit code or CISA KEV entry is present in the available intelligence, and the vulnerability is not confirmed as actively exploited at time of analysis.
Unauthenticated attackers with network access to the HTTP interface of the Forge component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can exploit a difficult-to-trigger flaw to read the full set of data the platform can reach and to partially degrade its availability. The vendor rates this 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L), so the damage ceiling is high confidentiality loss rather than code execution. No public exploit code and no CISA KEV entry appear in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed — the practical driver for patching is the exposure of complete catalogue and index data, not observed attacks.
Unauthorized read access to critical data in Oracle Process Manufacturing Intelligence (part of Oracle E-Business Suite) is achievable by a low-privileged attacker over the network via Oracle Net, because the Internal Operations component fails to properly enforce authorization for 12.2.3 through 12.2.15. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N, confidentiality-only) and is trivially reachable by anyone holding a valid low-privileged account and network path to the Oracle Net listener. There is no CISA KEV listing and no public exploit identified at time of analysis, but Oracle shipped an official fix in its Critical Security Patch Update, so unpatched internet- or intranet-exposed EBS instances remain the exposure.
A low-privileged, authenticated attacker with HTTP network access can read all data accessible through the Oracle Application Object Library (Core) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, resulting in a full confidentiality compromise of that component with no integrity or availability impact. Oracle rates it CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and describes it as easily exploitable, meaning an existing low-privilege EBS account is enough to reach sensitive data beyond the account's intended scope. No public exploit code or active exploitation is indicated in the available intelligence, and the patch is delivered through Oracle's Critical Security Patch Update for E-Business Suite.
Improper authorization enforcement in the Internal Operations component of Oracle Field Service, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged user read data that the application should have kept out of reach. The attack is delivered over HTTP with no user interaction and no special complexity, but it does require a valid account on the affected system, so it is an authorization/confidentiality failure rather than a pre-authentication bypass. Impact is limited to confidentiality (CVSS 3.1 base 6.5, C:H/I:N/A:N); no public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain an easily exploitable flaw in the Forms Services, C/S and Charmode components that lets a high-privileged attacker with network access over HTTP tamper with or destroy critical Forms data and repeatedly crash the service (complete denial of service). Oracle rated it 6.5 with integrity and availability impacts only, meaning confidentiality is untouched but data can be created, deleted or modified. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS or CISA KEV signal was supplied with this record.
Authenticated command injection in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways (9.4.x, 9.5.x, 9.6.x and 9.7.0.0) lets a remote user who already holds limited access privileges submit specially crafted input that is passed to the underlying operating system, resulting in arbitrary command execution with elevated privileges or a denial-of-service condition on the appliance. The vendor-assigned CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) frames this as an availability-weighted, post-authentication issue rather than a pre-auth compromise. No CISA KEV listing, EPSS score or public proof-of-concept was supplied, so exploitation status is 'no public exploit identified at time of analysis'.
EdgeConnect SD-WAN Gateways expose sensitive information to any user who can authenticate to the web-based management interface with low privileges, letting them read data that can be reused to reach other network services managed by the gateway. All four supported branches listed by ENISA (9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1, and 9.7.0.0) are affected, per HPE's advisory hpesbnw05135en_us. The flaw is rated 6.5 (network vector, low privileges, no user interaction, confidentiality-only impact); no public exploit code and no CISA KEV listing were identified at time of analysis, so exploitation currently depends on an attacker already holding valid low-privilege credentials and reachability to the management interface.
Unauthenticated denial of service in HPE Networking EdgeConnect SD-WAN Gateways allows an attacker who already sits on an adjacent network segment to crash the appliance, with the added consequence that the gateway cannot reboot itself and requires manual intervention to recover. Affected releases span the 9.4, 9.5, 9.6 and 9.7 maintenance trains (up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively) per the ENISA EUVD record. The flaw is rated CVSS 6.5 (AV:A/AC:L/PR:N/UI:N, availability-only impact) and no public exploit code has been identified at time of analysis; there is no CISA KEV listing.
A buffer overflow in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways lets an unauthenticated remote attacker send specially crafted packets to an affected service and corrupt its memory. Rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, CWE-120), successful exploitation degrades the integrity and availability of the gateway service without exposing confidential data. No CISA KEV listing and no public exploit code were identified in the supplied intelligence, and no EPSS score was provided, so exploitation is currently assessed as opportunistic rather than confirmed in the wild.
Sensitive data disclosure in Oracle Web Applications Desktop Integrator (Web ADI), a component of Oracle E-Business Suite 12.2.3 through 12.2.15, where the 'File download' component fails to properly restrict which files a low-privileged user can retrieve over HTTP. An attacker holding any valid low-privileged EBS account can read files they do not own, resulting in unauthorized access to critical data (CVSS 6.5, high confidentiality impact, no integrity or availability impact). Exploitation is network-based, low complexity and requires no user interaction, making it highly automatable once credentials exist; no public exploit code has been identified and there is no CISA KEV listing at time of analysis.
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 expose the Event Management component to low-privileged, network-positioned attackers who can abuse SOAP requests to create, delete, or modify event and management data without authorization. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N, integrity-only impact) and is addressed in Oracle's September 2026 Critical Security Patch Update. No EPSS score, CISA KEV listing, or public exploit code was provided in the source data, so active exploitation is unconfirmed at time of analysis.
Information disclosure in the Google Android modem (baseband) component lets a network-positioned attacker holding low privileges read sensitive data out of the modem by supplying improperly validated input, with no user interaction required; the CVSS 3.1 base score is 6.5 with confidentiality as the only impacted metric. Google's Pixel security bulletin reference indicates a vendor fix path, while no public exploit code and no CISA KEV entry were identified at time of analysis.
Improper input validation in the Android cellular modem component allows a remote party to crash or hang the modem, causing loss of cellular connectivity and a denial-of-service condition on affected Android devices. The official CVSS 3.1 vector is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and the root cause is CWE-20; only availability is impacted, with no confidentiality or integrity loss and no code execution. Google's Pixel security bulletin for September 2026 addresses the issue, but no public exploit code and no CISA KEV entry were identified at time of analysis, so exploitation is not confirmed in the wild.
An improper authentication flaw (CWE-287) in Dell Wyse Management Suite versions prior to 2605.0.3.683 lets an unauthenticated remote attacker bypass the login mechanism and gain unauthorized access to the management console or API. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), reflecting low confidentiality and integrity impact but no availability impact, which is unusually low for a full authentication bypass and suggests the exposed functionality is a constrained subset of the console. No EPSS score, CISA KEV listing, or public exploit code was present in the provided intelligence, so there is no public exploit identified at time of analysis and no confirmed active exploitation.
An XPath injection flaw (CWE-643) in IBM Cloud Pak for Business Automation lets an authenticated user manipulate XPath queries and read data the query engine should never return, including sensitive application records and structural details of the underlying XML documents. All shipped 24.0.x, 25.0.0 and 26.0.0 streams are affected up to and including Interim Fix 001/005/008/009 respectively, and exploitation only requires a low-privileged, network-reachable session — no user interaction and no special complexity. IBM has published a vendor fix; there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-on-schedule issue rather than an emergency.
Privilege escalation in Secomea GateManager 11.5 and 11.4.625515072 allows an authenticated, low-privileged user (CVSS PR:L) to reach data or functionality that should be reserved for higher-privileged roles, resulting in a high confidentiality impact (C:H/I:N/A:N). Secomea has released fixed builds — 11.6 and 11.4.626194074 or later — and the flaw is rooted in CWE-280, improper handling of insufficient permissions or privileges. No public exploit code or CISA KEV entry has been identified in the supplied intelligence, and no EPSS score was provided, so real-world exploitation activity is currently unconfirmed.
Authenticated, low-privileged users of Webkul Bagisto 2.4.9 can obtain sensitive information belonging to other customers by manipulating object identifiers in the add-to-cart API and the downloadable-product fulfilment flow. The flaw is an insecure direct object reference (CWE-639) rated CVSS 6.5 with a network vector, low privileges, and confidentiality-only impact; no CISA KEV entry or public exploit code is associated with this CVE in the available data, so it is currently a patch-and-harden issue rather than an active-exploitation emergency.
Stored cross-site scripting in the file upload feature of 1024-lab SmartAdmin v3.30.0 lets an authenticated remote attacker persist malicious script that executes in the browser of any user who later views the uploaded file or its entry in the file listing. The vendor-assigned vector requires a low-privileged account (PR:L) plus victim interaction (UI:R) and rates the issue 6.5 (Medium), with no CISA KEV listing, no EPSS score, and no confirmed public exploit code in the supplied intelligence. Impact is limited to low confidentiality, integrity, and availability effects within the victim's browser session, but the scope change (S:C) means the injected script can act on resources beyond the vulnerable component.
Stored Cross-Site Scripting in the Eventin WordPress plugin (all versions up to and including 4.1.23) allows contributor-level authenticated attackers to inject persistent arbitrary JavaScript via the `etn_shedule_objective` field within the schedule_slot REST API parameter. The injected payload executes in the browsers of any user who subsequently views an affected event schedule page, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored Cross-Site Scripting in the Job Postings WordPress plugin (versions ≤ 2.8.1) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'position_button' parameter, which subsequently execute in the browsers of any user who views the affected page. The vulnerability stems from insufficient sanitization of input and missing output escaping in class-job-add-edit.php, enabling session hijacking, credential theft, or malicious redirects against visiting users including administrators. No public exploit has been identified at time of analysis and no KEV listing is present, making this a medium-priority finding gated entirely on attacker access to a contributor account.
Stored Cross-Site Scripting in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress (versions up to and including 4.9.5) allows authenticated attackers with Author-level access or higher to persistently inject arbitrary JavaScript via the `shopengine_product_title_header_size` parameter. The injected payload executes in any site visitor's browser upon loading an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.7, permits low-privileged authenticated users with HTTP network access to reach functionality they should not control, enabling unauthorized read and modification of data and affecting systems beyond the vulnerable component (scope change). The flaw is rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting an easily automated but credential-gated attack with limited confidentiality and integrity impact. No public exploit code or CISA KEV entry is identified at time of analysis, and no CWE classification was assigned by the reporting source.
A buffer overflow in a system service of the underlying operating system on HPE Networking EdgeConnect SD-WAN Gateways allows an unauthenticated attacker who already sits on an adjacent network segment to crash the affected service, temporarily disrupting SD-WAN and branch network operations. All editions of the 9.4.x (up to 9.4.8.2), 9.5.x (up to 9.5.8.1), 9.6.x (up to 9.6.3.1) and 9.7.0.0 releases are listed as affected by the vendor. The impact is degraded availability rather than confidentiality or code execution, exploitation requires high attack complexity, and no public exploit code or CISA KEV entry was identified at time of analysis.
Local privilege escalation in Android's Bluetooth stack allows an attacker who already holds System-level execution on a device to turn a race condition in bluetooth_cco.cc into a use-after-free and elevate to a more privileged context. Google device users on builds prior to the September 2026 Pixel bulletin (patch level 2026-09-01) are the affected population, and the flaw requires no user interaction, though attack complexity is high and System privileges are a prerequisite. No public exploit code has been identified and the issue is not listed as actively exploited, so real-world risk concentrates in targeted or chained attacks against already-compromised high-value devices.
Local privilege escalation in the Android kernel stems from a use-after-free condition triggered by a race between concurrent operations, allowing an attacker who already holds System-level execution privileges on the device to elevate to a higher (kernel-level) context. The flaw carries a CVSS 3.1 base score of 6.4 (AV:L/AC:H/PR:H/UI:N) and is addressed in Google's September 2026 Android/Pixel security bulletin. There is no public exploit identified at time of analysis and no indication of confirmed active exploitation (CISA KEV).
Let me synthesize. CVE-2026-56923: Android kernel TIPC virtio driver (tipc_virtio_dev.c) handle_unmap_req race condition memory corruption, local EoP. CVSS 3.1: AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H → 6.4. Note PR:H which is odd for a local privilege escalation "with no additional execution privileges needed" — the description says no additional execution privileges needed. Hmm, the CVSS says PR:H. There's a conflict: description says local EoP with no additional execution privileges needed (implying PR:N or PR:L?), while CVSS vector says PR:H. This is a data conflict worth noting in confidence_notes and risk_assessment. Actually Android's kernel CVEs for local EoP typically are AV:L/AC:H/PR:H/UI:N in their bulletins... Actually Android uses PR:H sometimes? Hmm. Let me note the conflict: description claims "no additional execution privileges needed" but vector shows PR:H (high privileges required), which typically means the attacker already needs elevated privileges — contradictory for an EoP. State explicitly. Product name: "Android Kernel" — 2 words. Or "TIPC Virtio Driver". Primary product per CPE: google:android. I'd say "Android Kernel". Tags: Privilege Escalation, Buffer Overflow, Google, Race Condition. Buffer Overflow mislabeled? The CWE is race condition/memory corruption. Hmm — "Buffer Overflow" tag is arguably a mislabeled tag since CWE-362 race condition and description says memory corruption not buffer overflow. But memory corruption could involve buffer overflow. I'd be moderately confident... The instructions say only emit flag when clearly wrong and verifiable. Memory corruption due to race condition — buffer overflow is a specific subclass. It's arguably mislabeling. I could flag it with low/medium confidence. Hmm. I think I'll flag it as mislabeled_tag with medium confidence since the CVE is a race condition leading to memory corruption, no buffer overflow specified. Actually careful — race conditions can cause buffer overflows (TOCTOU). Risky.
A race condition (CWE-362) in the bigo_worker_thread function of the Android kernel component bigo.c can be won by a local attacker to escalate privileges beyond their current level. Exploitation requires the attacker to already hold System-level execution privileges on the device, and no user interaction is needed; the high attack complexity and PR:H rating reflect the need to win a TOCTOU timing window from an already-elevated context. Google disclosed and fixed the issue in the September 2026 Pixel/Android security bulletin, and there is no public exploit code or CISA KEV listing at time of analysis.
Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to plant JavaScript inside Web UI content that is later rendered to other users. When a victim loads the affected page, the injected script runs inside the application's trusted origin, enabling session-token or credential theft and UI manipulation (CVSS 3.1 6.4, CWE-79). IBM has published a fix; no public exploit code and no CISA KEV listing were identified at time of analysis.
Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to persist arbitrary JavaScript inside Web UI content, which then executes in the browser of any other user who views the affected page. Successful exploitation can disclose session credentials or other sensitive data belonging to the victim's trusted session, and can alter the intended behavior of the Web UI for that user. IBM has published an advisory and states that a fix is available from the vendor; no public exploit code or CISA KEV listing was identified at time of analysis.
Stored cross-site scripting in the Bridge creative multipurpose WordPress theme affects every version through 30.8.9.1, allowing authenticated users with contributor-level access or higher to inject arbitrary JavaScript into pages by abusing the 'circle_line' shortcode attribute, which is stored unsanitized and rendered unescaped. The injected script executes in the browser of any user — including administrators previewing a submitted post — who views the affected page. No public exploit code is identified and the flaw is not listed in CISA KEV, but the low privilege bar (a contributor account) and the scope-changing CVSS vector (S:C) make it a realistic privilege-escalation vector on multi-author sites.
Confused deputy exploitation in hawtio-operator on OpenShift allows a namespace-scoped edit user to claim arbitrary externally-routable Route hostnames that would normally require elevated cluster permissions. The operator holds a cluster-wide `routes/custom-host:create` privilege and blindly propagates the tenant-controlled `spec.routeHostName` field from Hawtio custom resources into OpenShift Route specs without validating whether the requesting user is authorized to claim that hostname. The captured subdomain can then be combined with the cluster's auto-grant OAuthClient to hijack OAuth redirect flows and steal tokens from legitimate users (PR:L, UI:R, C:H, CVSS 6.3). No public exploit code has been identified at time of analysis.