Let me synthesize. CVE-2026-58710: DecodeFilmGrainParams in film_grain_dec.cc — Android libavc / media codec film grain decoding. Missing bounds check → OOB write → RCE. CVSS 8.8 with AV:N/AC:L/PR:L/UI:N — note PR:L is odd but that's given. CWE-120 (buffer copy without checking size). Reported by Google Devices, references Android Security Bulletin Pixel 2026-09-01. CPE google:android. EUVD affected versions: "Android Android kernel" — weird. Tags: RCE, Buffer Overflow, Google. Missing tag maybe "android". Product name: "Android" — or "Android Film Grain Decoder"? 1-3 words. "Google Android" maybe. Let's use "Android Media Codecs"? Hmm. The vulnerability is in film_grain_dec.cc which is part of libavc (Android's AVC decoder) or a codec2 component. Probably Android's media framework. Product name should be specific: "Android". Let's pick "Google Android" (2 words). Prevalence: Android is ubiquitous. Assessed CVSS vector: Given description "remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation." But CVSS vector says PR:L. Hmm. Media decoding typically happens when processing a media file — remotely delivered via messaging, or via media server. PR:L suggests some level of privilege required — perhaps access to a media-decoding service context, or the requirement to send media to a privileged process. Actually, for Android media codecs, an app can trigger decoding with its own privileges. The vendor assigned PR:L. I should give my own assessment. Given the description says "no additional execution privileges needed" and UI:N, but AV:N with media parsing... Typically media parsing is AV:L or AV:N depending on delivery. Android media codec flaws are usually CVSS AV:N/AC:L/PR:N/UI:R for a crafted file. Here UI:N suggests it's triggered via a network media stream (e.g., RTP, video call) without user opening a file. PR:L — the attacker needs local privileges? Hmm, in Android, media codec processes (media.
An out-of-bounds write in Android's IP Multimedia Subsystem (IMS) telephony stack allows an attacker positioned on the cellular signaling path to corrupt memory and achieve code execution inside the privileged process that handles VoLTE/VoWiFi traffic. User interaction on the target is not required, and the September 2026 Pixel bulletin identifies the flaw as remotely triggerable via improperly validated input. No public exploit code or CISA KEV entry was identified at the time of analysis, and no EPSS score was supplied with the source data, so real-world exploitation activity is unconfirmed.
An out-of-bounds write in Av1DecodeFrameTag (vp9hwd_headers.cc) in the Android media decoding stack allows crafted AV1/VP9 media content to corrupt memory and potentially achieve remote code execution in the codec process, which runs with elevated system privileges relative to a normal app. Google's Pixel security bulletin dated 2026-09-01 lists the fix, and no user interaction is required, though the provided CVSS vector (PR:L) implies the attacker must already be able to route content into the decoder path. No EPSS score, CISA KEV entry, or public exploit code was supplied with this record, so active exploitation is unconfirmed.
An out-of-bounds write in Android's audio RTP payload encoder node (AudioRtpPayloadEncoderNode.cpp) lets a remote attacker execute arbitrary code in the media framework process by supplying a crafted audio RTP payload that the node fails to validate. Affected builds are Android/Pixel devices covered by the September 2026 Android Security Bulletin; the vendor description states user interaction is required to trigger the flaw, and an NVD/EUVD record exists alongside the source.android.com advisory. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided at time of analysis.
An out-of-bounds write in ReadTileInfo of vp9hwd_headers.cc lets a crafted VP9 bitstream corrupt memory inside Android's VP9 hardware-decoder header parser, which Google rates as remote escalation of privilege with no additional execution privileges and no user interaction required. Affected builds are those tracked under the Google Android CPE and addressed by the Android/Pixel security bulletin dated 2026-09-01. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-window issue rather than a confirmed in-the-wild campaign.
Let me synthesize. CVE-2026-56920: Android HEVC decoder, firmware header parsing (fw_hevc_dec_header.c), s_decode_vui_param out-of-bounds write, CWE-787, CVSS 8.8 AV:N/AC:L/PR:L/UI:N. Note: "remote code execution with no additional execution privileges needed" — but CVSS says PR:L. Hmm, this is typical Android bulletin wording: "This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation." That's media framework / remote. But CVSS says PR:L which contradicts "no additional execution privileges needed". Actually Android media codecs often run in a sandboxed process (mediaserver), so PR:L reflects the sandbox context. There's a conflict worth noting. Product name: Android (Google Android). Or "Android HEVC Decoder"? 1-3 words. "Google Android" or "Android". Let's use "Android Media Framework"? Hmm — the file is fw_hevc_dec_header.c, HEVC decoder header parsing. Probably part of Android's media codec/firmware. I'll say "Android HEVC Decoder" — 3 words. Actually the CPE says google:android. Product name: "Android HEVC Decoder". Hmm, maybe safer: "Google Android". The field says the specific product or service name affected. CPE is google:android, and it's the HEVC decoder in Android firmware for Pixel devices (bulletin is Pixel). I'll go with "Android HEVC Decoder". Summary: Out-of-bounds write in HEVC VUI parameter decoding. Affected: Android devices with affected firmware (Pixel bulletin 2026-09-01). Remote code execution with no user interaction. No KEV, no POC identified. EPSS: not provided. KEV: not stated → assume not in KEV. POC: not provided → "no public exploit identified at time of analysis". Technical context: HEVC/H.265 VUI (Video Usability Information) parameters in SPS/VPS NAL units; s_decode_vui_param in fw_hevc_dec_header.c; firmware-based HEVC decoder in Android; logic error → insufficient bounds validation → OOB write → memory corruption in media codec process. CWE-787.
Let me synthesize. CVE-2026-56882: Cellular Modem (Android Pixel), information disclosure due to logic error, leading to RCE, no additional execution privileges, no UI. CVSS 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CWE-200 (Exposure of Sensitive Information). Reported by Google_Devices, Pixel bulletin September 2026. Product name: "Android Cellular Modem" — 1-3 words. Maybe "Android Cellular Modem" (3 words). Or "Pixel Cellular Modem". Let's use "Android Cellular Modem". Prevalence: Android is ubiquitous. But cellular modem specifically... The affected component is the cellular modem firmware in Android/Pixel devices. Prevalence of Android = ubiquitous. Hmm. The CPE is google:android. Modem component. I'd say "ubiquitous" given Android base. But the specific modem component... The CPE says google:android, so I'll go with ubiquitous. Actually maybe "high"? Android is on billions of devices — ubiquitous is defensible. Let me say ubiquitous with basis "core platform component across billions of Android devices". Hmm, but cellular modem is only in phones with cellular. Still ubiquitous. Actually, let's be careful — the CPE is google:android which is the whole OS. Cellular modem affects devices with cellular radios = most Android phones. I'll go with ubiquitous. CVSS vector given: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — PR:L is odd for a modem, but that's the input. Note the mismatch: description says "no additional execution privileges needed" but vector says PR:L. That's a conflict to note. My assessed vector: Given it's a modem logic error leading to info disclosure → RCE, remote. I'll assess AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H? Hmm. Let me think. Cellular modem attack — typically over-the-air from a rogue base station or via malicious network. AC:H might be reasonable (requires specific modem state / malformed signaling). But CVSS says AC:L. I'll go with AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H — hmm, but "no additional execution privileges needed" suggests PR:N. But
An out-of-bounds write in Android's IP Multimedia Subsystem (IMS) telephony stack, corrected in the September 2026 Android/Pixel security bulletin, can be turned into remote code execution against affected devices. The published vector (CVSS 8.8, AV:N/AC:L/PR:L/UI:N, C/I/A all High) indicates network-reachable exploitation with no user interaction, though it assumes low-level privileges while the description claims no additional execution privileges are needed. No public exploit code, EPSS score, or CISA KEV entry was provided, so active exploitation is not confirmed at time of analysis.
A use-after-free race condition in multiple locations of the Android kernel allows an attacker to corrupt kernel memory and escalate to remote code execution, affecting Android devices covered by the September 2026 Android Security Bulletin. Exploitation requires an attacker to already hold a low-privilege foothold on the device (CVSS PR:L) — typically a malicious or compromised application — and no user interaction is needed once that foothold exists. No public exploit code or CISA KEV listing was identified at time of analysis, so this is currently a patch-now kernel hardening issue rather than a confirmed in-the-wild campaign.
Remote exploitation of the cellular modem stack in Google Android devices allows an attacker who controls the radio path to trigger a heap-based out-of-bounds write and escalate privileges on the handset, without any user interaction. The supplied CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity and availability impact, but its PR:L metric (low privileges required) conflicts with the vendor description stating that no additional execution privileges are needed. No public exploit code, EPSS score, or CISA KEV entry was included in the intelligence feed, so active exploitation is unconfirmed at the time of analysis.
An out-of-bounds write in the Android kernel, caused by a logic error in multiple code locations, allows code execution in the kernel context with high impact to confidentiality, integrity and availability. The flaw is remotely reachable per the CVSS vector (AV:N/AC:L/PR:L/UI:N) and requires no user interaction, though the vector indicates a low-privileged rather than fully unauthenticated attacker. Google published a fix in the Pixel security bulletin dated 2026-09-01; no public exploit code, EPSS score, or CISA KEV listing was provided in the available intelligence, so active exploitation is not confirmed.
An out-of-bounds write in Android's VP9 hardware decoder (Vp9DecodeFrameTag in vp9hwd_headers.cc) lets a crafted VP9 video stream corrupt memory in the codec context, giving an attacker code execution at the decoder's privilege level. Affected devices are those running Android builds that include the vulnerable VP9 hardware decoding path prior to the September 2026 Pixel security bulletin fix. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation appears to require a motivated actor with a delivery path for malicious media.
An out-of-bounds write in Google's Android Cellular Modem component allows code execution in the baseband when a crafted message is delivered to the modem, with no user interaction required. Google Pixel devices running Android builds prior to the September 2026 patch level are affected, per the Pixel security bulletin. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact); no public exploit code or CISA KEV entry was identified at time of analysis, so the immediate risk is to targeted radio-layer attacks rather than mass exploitation.
Local privilege escalation in the CrowdStrike Falcon sensor for Windows occurs when the Microsoft Office File Malicious Macro Removal policy setting is enabled, letting an unprivileged process race the sensor's macro-cleanup file operation (CWE-367) and write arbitrary files to protected locations, ultimately reaching SYSTEM-level privileges. Affected builds are the Falcon sensor for Windows at 7.34 and above, the 7.32 LTS line, and 7.16 on Windows 7/2008 R2; the CrowdStrike Laroux Malware Cleanup Tool is also affected, while Mac, Linux, and Legacy sensor platforms are not. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the CVSS 3.1 base score is 8.8.
Authenticated remote code execution in IBM MQ lets an attacker who holds valid MQ credentials - or who can reach a channel configured with weak or blank authentication - deliver malicious serialized data that the queue manager deserializes and executes. The flaw affects the 9.1, 9.2, 9.3, 9.4 and 10.0 streams up to their respective maintenance levels (9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS and 9.3.0.0-9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS and 9.4.0.0-9.4.5.1 CD, plus 10.0.0.0), giving a 8.8 CVSS base score with high confidentiality, integrity and availability impact under AV:N/AC:L/PR:L/UI:N/S:U. Because the vector requires PR:L, no unauthenticated path is confirmed; no public exploit code has been identified at time of analysis, and IBM has released a vendor fix.
Authenticated remote code execution in Koha lets anyone who can reach the affected web service on TCP port 8081 feed a crafted string into an eval() call and run arbitrary code as the service account. The bug is rated CVSS 8.8 (CWE-95) because it needs only a low-privilege authenticated session and no user interaction, yet yields full confidentiality, integrity and availability impact. No CISA KEV listing and no public exploit code were identified at time of analysis.
Privilege escalation in OpenBMC's phosphor-net-ipmid IPMI stack allows an attacker who already holds a valid low-privileged IPMI session to redirect that session's authorization context to a different, higher-privileged account while the original integrity and encryption keys stay in place, so no re-authentication ever occurs. Downstream vendors that package phosphor-net-ipmid — NVIDIA and H3C among them — inherit the flaw in their BMC firmware. Rated CVSS 8.8 with high confidentiality, integrity and availability impact; no public exploit code identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated privilege escalation in the Consulting WordPress theme (versions up to and including 6.7.16) lets any subscriber-level user take over a site as administrator by chaining two coding flaws. The theme's masterstudy_ms_stm_set_discard_transient AJAX action writes an attacker-chosen transient value without any capability check or nonce, and the theme's "developer access" login path trusts a transient value in legacy string mode, so an attacker can seed a known token and then log in as any existing account, including an admin. The CVSS score is 8.8 (network, low privileges, no user interaction, full confidentiality/integrity/availability impact); no EPSS score, KEV listing, or public exploit code was provided at time of analysis.
Improper privilege management in Mozilla Firefox's Enterprise Policies component lets a remote attacker escalate privileges inside the browser after convincing a user to interact with malicious content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). Successful exploitation yields high confidentiality, integrity and availability impact across the browser's security boundary, although CISA's SSVC assessment rates the flaw as not automatable and with no known exploitation. Fixes ship in Firefox 156 and Firefox ESR 153.3; no public exploit code or KEV listing has been identified at time of analysis.
Privilege escalation in Mozilla Firefox's Session Restore component (CWE-269) allows an attacker who lures a user into viewing crafted content to escape the normal browser security boundary and obtain elevated privileges inside the browser process. The issue is fixed in Firefox 156 and Firefox ESR 153.3, and the 8.8 rating reflects a network-delivered, unauthenticated attack that nonetheless requires victim interaction. No public exploit code or CISA KEV entry has been identified at time of analysis, so this is currently a patch-now flaw rather than a confirmed in-the-wild campaign.
Privilege escalation in the Mozilla Firefox DevTools component allows code running in a lower-privileged context to cross the DevTools/chrome privilege boundary and execute with elevated browser privileges; Firefox 156 and Firefox ESR 153.3 contain the fix. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and classified CWE-269 (Improper Privilege Management), but CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit code or KEV listing was observed at time of analysis. Notably, the network attack vector with user interaction suggests a page-delivered trigger rather than purely local DevTools misuse, though the advisory itself is terse.
Memory-corruption privilege escalation in Mozilla Firefox lets a remote attacker achieve arbitrary code execution at elevated privilege when a victim browses attacker-controlled web content — no account or credentials are required, but the CVSS vector (UI:R) confirms the victim must open the page. Mozilla fixed the flaw in Firefox 156 and Firefox ESR 153.3. No public exploit code and no CISA KEV listing were identified at time of analysis, and CISA's SSVC decision points rate exploitation as 'none' and automatable as 'no', so worm-like or mass-scanning abuse is not currently anticipated.
A privilege-escalation flaw in Mozilla Firefox's Graphics: CanvasWebGL component lets attacker-supplied web content cross a privilege boundary inside the browser, with high confidentiality, integrity and availability impact. The issue affects Firefox builds prior to 156 and Firefox ESR prior to 153.3, and exploitation requires the victim to load attacker-controlled content (UI:R) but no authentication (PR:N). No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none', so this is a patch-promptly issue rather than an emergency; the vendor has shipped fixed builds.
Privilege escalation in Mozilla Firefox affects all builds prior to Firefox 156 and Firefox ESR 153.3, stemming from use of uninitialized memory inside the Graphics: CanvasWebGL component. A remote attacker who gets a victim to render crafted WebGL canvas content can corrupt memory in the graphics path and potentially escalate privileges or execute arbitrary code in the browser's context — the CVSS vector confirms no authentication is required (PR:N) but user interaction is (UI:R). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; Mozilla shipped fixes in Firefox 156 and Firefox ESR 153.3 per advisories MFSA2026-90 and MFSA2026-93.
A privilege-escalation flaw in Firefox's Crash Reporting component lets an attacker who can influence crash-report handling gain elevated privileges on the affected host, potentially leading to full compromise of confidentiality, integrity and availability. Exploitation is unauthenticated at the network layer (PR:N) but requires victim interaction (UI:R), and affects Firefox builds prior to 156 and Firefox ESR prior to 153.3. There is no public exploit identified at time of analysis, CISA KEV does not list this CVE, and CISA's SSVC framework rates exploitation as 'none' with automatable 'no', indicating a serious but not currently weaponized issue.
A memory-safety flaw in Firefox's Audio/Video component - a classic out-of-bounds write/overflow class issue caused by incorrect boundary checking - lets an attacker who convinces a user to open a crafted page or media file corrupt memory and escalate privileges to the level the browser process runs at. The issue affects Firefox branches prior to 156 and Firefox ESR prior to 153.3, and is reachable without authentication but requires user interaction. Mozilla has released fixed builds (Firefox 156, Firefox ESR 153.3) via advisories MFSA2026-90 and MFSA2026-93; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as 'none'.
Privilege escalation in Mozilla Firefox for Android allows an attacker who can get a user to open a crafted web page to gain privileges beyond those normally granted to web content, with high impact to confidentiality, integrity, and availability. Mozilla fixed the flaw in Firefox 156; no public exploit code and no active exploitation have been identified, and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no'. The 8.8 CVSS score is driven entirely by a network attack vector plus required user interaction (UI:R), so real-world risk depends on convincing a target to browse attacker-controlled content rather than on mass scanning.
An incorrect-bounds condition in Firefox's WebRender graphics component lets crafted web content corrupt memory inside the browser, giving the attacker a path to code execution and privilege escalation on the affected system. All Firefox releases before 156 are affected, along with the ESR branches before 115.41, 140.16, and 153.3; exploitation requires the victim to load attacker-influenced content (CVSS UI:R), and no public exploit code or CISA KEV entry has been recorded at time of analysis. With a CVSS base of 8.8 across full confidentiality, integrity, and availability impact, this is a high-severity browser flaw that should be patched on a normal browser-update cadence.
Privilege escalation in Mozilla Firefox's DOM: Service Workers component lets attacker-supplied web content break out of its intended privilege boundary and gain elevated capabilities inside the browser. The flaw affects Firefox before 156 and the ESR branches before 115.41, 140.16, and 153.3, and carries a CVSS base score of 8.8 with a user-interaction requirement (the victim must load attacker-controlled content). No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none' with 'automatable: no', so this is a high-severity patch-now issue rather than a known exploited threat.
Let me synthesize. CVE-2026-92015 — privilege escalation in Firefox WebExtensions. CVSS 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CWE-269 improper privilege management. Fixed in Firefox 156, ESR 115.41, ESR 140.16, ESR 153.3. SSVC: exploitation none, automatable no, technical impact total. No KEV, no POC mentioned. Product name: "Firefox WebExtensions" — 1-3 words. Maybe "Mozilla Firefox" is safest but the specific component is WebExtensions. Let's use "Firefox WebExtensions". Hmm, guidance says product name 1-3 words, specific product. "Firefox WebExtensions" works. Summary: must not start with "A vulnerability". Start with impact verb + product. "Privilege escalation in Mozilla Firefox's WebExtensions component allows ..." Requires UI:R, so user interaction — a user must visit a page or install an extension? Description is vague. CVSS says AV:N/PR:N/UI:R. So an attacker could get a user to interact (e.g., install malicious extension or visit a page) which then allows privilege escalation from extension context to higher privileges (browser-level / OS-level?). CWE-269 improper privilege management. Be careful: we don't know exact mechanism beyond "privilege escalation in WebExtensions component". Confidence notes should state that the root cause mechanism is not described publicly beyond CWE-269; Bugzilla bug 2060235 is likely restricted. Affected products: Firefox < 156, ESR < 115.41, ESR < 140.16, ESR < 153.3. CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. Advisories mfsa2026-90 through -93. Remediation: upgrade to Firefox 156, ESR 115.41, ESR 140.16, ESR 153.3. Workarounds: restrict extension installation via enterprise policy (ExtensionSettings / blocked_install_message), disable WebExtensions? Not feasible. Mention that extension installation restrictions reduce exposure; trade-off: blocks all extension installs including legitimate ones. Prevalence: Firefox is widely deployed → high. Maybe "high" — ubiquitous is for OpenSSL/nginx/Linux kernel. Firefox
Incorrect boundary conditions in Firefox's Graphics component allow a privilege escalation that was fixed in Firefox ESR 115.41 and Firefox ESR 140.16. An attacker who can get a victim to load crafted content — a web page or similar rendered surface — can trigger a buffer overflow (CWE-120) in the graphics pipeline and potentially cross from the low-privilege content process into a more privileged browser context, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as 'none', though the CVSS base score of 8.8 and the total technical impact rating make patching a priority for any organization running an unpatched ESR branch.
Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a crafted web page corrupt memory and gain privileges beyond those normally granted to web content. Exploitation requires the victim to open a malicious page in an affected Firefox build (network vector, no authentication, user interaction required), after which an attacker can achieve high confidentiality, integrity and availability impact. Mozilla fixed the flaw in Firefox 156, Firefox ESR 115.41, ESR 140.16 and ESR 153.3; CISA SSVC records no known exploitation and the issue is not considered automatable, and no public exploit code has been identified at time of analysis.
A boundary-condition error in Firefox's Graphics: CanvasWebGL component allows an attacker who lures a victim to a crafted web page to corrupt memory and escalate privileges, with a CVSS base score of 8.8 reflecting high confidentiality, integrity, and availability impact. The flaw is a classic buffer overflow (CWE-120) in the WebGL/Canvas rendering path, reachable over the network with no authentication but requiring user interaction (UI:R) in the form of visiting attacker-controlled content. Mozilla has shipped fixes in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3, and no public exploit code or active exploitation has been identified at time of analysis.
A memory-corruption flaw in Mozilla Firefox's CanvasWebGL graphics component (incorrect boundary conditions, CWE-120) allows a remote attacker to crash or corrupt the browser's heap and potentially escalate privileges beyond the normal content-process security boundary. Every Firefox release before 156 and every ESR branch before 115.41, 140.16, and 153.3 is affected, and exploitation requires the victim to load attacker-controlled web content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). No public exploit code and no active exploitation are reported at time of analysis — CISA's SSVC records Exploitation: none and Automatable: no, so this is a patch-priority issue rather than an emergency.
Memory corruption in Mozilla Firefox's Graphics: CanvasWebGL component lets a web page that renders attacker-crafted WebGL content corrupt memory and escalate out of the browser's restricted process, yielding code execution at higher privilege. All Firefox builds before 156 are affected, with ESR branches fixed in 115.41, 140.16, and 153.3. No public exploit code exists and CISA SSVC records exploitation as 'none', so this is a high-severity patch-now bug rather than an active campaign.
An out-of-bounds write in Firefox's Graphics: CanvasWebGL component lets a malicious web page corrupt memory and gain elevated privileges on the host, affecting Firefox builds prior to 156 and the ESR branches prior to 115.41, 140.16, and 153.3. Exploitation is remote but requires the victim to load attacker-controlled WebGL/Canvas content (CVSS UI:R), so it is not automatable and no public exploit code or active exploitation has been identified at time of analysis. Mozilla rated it High (CVSS 8.8) with total technical impact under CISA's SSVC framework.
Incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allow a remote attacker who convinces a user to open a crafted page to corrupt memory and achieve code execution with the privileges of the browser. The flaw is a classic buffer overflow (CWE-120) rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R), meaning no authentication is needed but the victim must load attacker-controlled content. Mozilla fixed it in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3; no public exploit code has been identified and CISA's SSVC assessment records no active exploitation.
Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a remote, unauthenticated attacker corrupt memory via malformed WebGL content and gain elevated code execution inside the browser process, provided the victim loads an attacker-controlled page. Mozilla shipped fixes in Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3 (mfsa2026-90 through mfsa2026-93). CVSS is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), CISA SSVC records Exploitation: none and Automatable: no, no CISA KEV listing is present, and no public exploit code has been identified at time of analysis.
A memory-safety flaw in the Graphics: CanvasWebGL component of Mozilla Firefox allows a crafted web page to corrupt memory and escalate privileges beyond the browser's normal security boundary. Because exploitation only requires the victim to load attacker-controlled WebGL/Canvas content in an unpatched Firefox build, the issue affects all mainstream, ESR 115, ESR 140, and ESR 153 release trains prior to the fixed versions. Mozilla has released Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3, and while no public exploit code or CISA KEV entry has been identified at time of analysis, the CWE-120 buffer-condition root cause and CVSS 8.8 rating make prompt patching important.
Authenticated command injection in the MitraStar GPT-2742GX4X5v6-SV gateway (firmware GL_g2.5_100XNT0b23_3) lets an attacker who already holds valid web-interface credentials run arbitrary operating-system commands through the /cgi-bin/device-management-utilities-internet.cgi endpoint, taking full control of the device. The flaw is scored CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-78, so compromise yields complete loss of confidentiality, integrity and availability of the unit. No CISA KEV entry or EPSS score was supplied with the intelligence, and no vendor-released patch has been identified; the cveorg reference points to a public GitHub repository that appears to carry technical detail, so publicly available exploit code should be assumed plausible pending verification.
Remote code execution in RuoYi-Vue-Plus 6.0.0 lets an authenticated low-privileged user run arbitrary Java code on the server through the workflow task-completion endpoint POST /workflow/task/completeTask, which flows through FlwTaskController.java into FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process and the Warm-Flow TaskService.skip path. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network reachability and complete confidentiality, integrity and availability impact, but it requires a valid authenticated session rather than being pre-auth. No public exploit code or CISA KEV entry was identified from the supplied intelligence, and no EPSS score was provided.
Insufficient session expiration in bizwell xClick groupware allows authentication bypass through replay of session tokens that should have been invalidated after logout or timeout. Affecting versions R2, R3, and R3.1, the flaw enables an attacker who has obtained a victim's session token to continue using it with full account-level access even after the legitimate session should have ended, carrying high confidentiality, integrity, and availability impact per the CVSS 4.0 score of 8.7. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Authenticated attackers can inject crafted arguments into the tcpdump launch routines exposed by the Nettools feature of Netcore NR255-V firmware 1.5.130703, causing the device to execute attacker-manipulated system commands as part of the tcpdump invocation. The flaw affects multiple CGI/handler components — ntools_start_set_cgi, ntools_tcpdump_start_set_cgi, exe_default and ntools_proc — and carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/PR:L/UI:N) with high confidentiality, integrity and availability impact confined to the device itself. Exploitation requires a low-privileged foothold on the router's management interface, and no public exploit code, EPSS score, or CISA KEV listing was supplied in the available intelligence.
A stack-based buffer overflow in the Netcore NR255-V router (firmware 1.5.130703) allows an attacker who can reach the web management interface to smash a fixed-size stack buffer by submitting oversized form values to the ntools_tcpdump_start_set.cgi endpoint, which passes input to an unsized sprintf call. Successful exploitation can corrupt the saved return address and potentially lead to arbitrary code execution with the privileges of the CGI process on the device. The supplied CVSS 4.0 vector (8.7) rates confidentiality, integrity and availability impact as high with a network vector, but PR:L indicates some level of authentication or low-privilege access is required; no EPSS score, CISA KEV listing, or confirmed public exploit code was included in the intelligence feed, and no vendor patch reference was provided.
Stack-based buffer overflow in the wake_up_set.cgi endpoint of Netcore NR255-V firmware version 1.5.130703 lets an attacker who can reach the router's web management interface corrupt memory by submitting oversized MAC and ID parameter values that are tokenized without any length bound. Successful exploitation yields high confidentiality, integrity, and availability impact on the device - potentially full compromise of the router as a network chokepoint - with a CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so current risk is driven by exposure of the management interface rather than confirmed in-the-wild activity.
Netcore NR268 routers running firmware 1.7.121109 accept forged firmware images because the mtd_write flashing path does not properly validate the firmware authenticity check performed by check_image_uuid.c, allowing an attacker who can reach the upload endpoint (put_file.cgi) with low privileges to load unauthorized firmware. Successful exploitation gives an attacker full control over the device — high confidentiality, integrity and availability impact per the CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) — and the malicious image persists across reboots. The flaw is not listed in CISA KEV and no public exploit code has been identified at time of analysis, though a public technical write-up of the forgery technique and a VulnCheck advisory are available.
adm-zip 0.5.14 through 0.6.0, a widely used Node.js ZIP library, omits zlib decompression output limits whenever a ZIP entry declares an uncompressed size of zero, letting a tiny crafted archive inflate without bound and exhaust the host process memory. Any service that extracts attacker-supplied archives with an affected version — upload endpoints, import jobs, CI tooling — can be crashed by a few kilobytes of input, with no authentication or user interaction required per the CVSS 4.0 vector (PR:N/UI:N, VA:H only). No CISA KEV listing, EPSS score, or public exploit code was supplied at time of analysis, but the fix commit and diff are public and the technique is trivial to reproduce.
Docker Sandboxes 0.37.0 through 0.40.x contain a time-of-check/time-of-use race (CWE-367) in the guest-to-host Unix-domain socket relay: the host validates that a requested socket path sits inside an authorized workspace and then reconnects using that same pathname, letting a malicious guest swap an intermediate directory for a symlink in the gap. A guest that wins the race causes the host-side relay to connect to an arbitrary AF_UNIX socket outside the shared workspace, exposing whatever data or host capabilities that socket provides. Vendor-released fix: Docker Sandboxes 0.41.0; no public exploit code or CISA KEV entry was identified at time of analysis.
Hard-coded credentials in the FTP daemon (ftpd) shipped with multiple Digital Watchdog video recorders and NVRs-including VG4 Recorder, VMAX IP G4 NVR, VMAX A1 PLUS, VA1G4 Recorder, and VMAX A1 G4 DVR-let anyone who can reach the FTP service log in and operate the daemon as root. Because the ftpd runs as root, a successful login grants remote read and write access to the device filesystem, allowing an attacker to tamper with recorded surveillance video, alter device configuration, or use the box as a foothold on the camera VLAN. The flaw is rated 8.7 (CVSS 4.0, adjacent network, no privileges or interaction required), giving it a wide attack surface on flat camera networks. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation would currently require an attacker already positioned on the adjacent network segment.
Unauthenticated attackers positioned on an adjacent network segment can gain root-level control of Digital Watchdog VMAX A1 PLUS, VMAX A1 G4, VA1G4 and VG4 recorders and VMAX IP G4 NVRs, because a critical function performs no authentication and forwards received bytes straight into a system command. CWE-306 combined with that unsafe command handling gives full loss of confidentiality, integrity and availability on the device and on any footage, stored credentials or downstream network reachable through it. Neither public exploit code nor a CISA KEV entry appears in the supplied intelligence, so active exploitation is not confirmed, but the CVSS 4.0 base score of 8.7 reflects the near-trivial effort once adjacency is achieved.