Memory resource limits configured for ImageMagick are not enforced by the PCD coder (and, per the upstream advisory, the CUBE and HALD coders) when a specific command-line option is supplied, so a local user who can control ImageMagick invocation arguments can push the process past its intended policy limit and cause additional memory allocation. Impact is confined to limited availability degradation - no code execution, no data exposure, no integrity change - and the path is local-only with low privileges required (AV:L/PR:L in the assessed vector). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the issue is rated low priority; vendor fixes 7.1.2-31 (7.x) and 6.9.13-56 (6.x) are available, and environments that invoke ImageMagick with fixed, non-user-controlled arguments are not exposed.
Arbitrary file read in NetBackup Flex OS (versions before 6.4) lets an authenticated user who can reach the appliance's management shell read files outside the intended scope - including sensitive system configuration and credential material - by supplying a specially crafted path argument to a diagnostic command. The issue carries a CVSS 4.0 base score of 4.8 and is classified as CWE-347 (improper verification of cryptographic signature), with the advisory's associated tags pointing to an information-disclosure / JWT-style attack path. Exploitation requires valid management-shell credentials and local access to the appliance, so it is not reachable over the network without an existing account; no public exploit code has been identified at time of analysis, the CVE is not listed in CISA KEV, and vendor patches are available.
Cross-site scripting in the Synology DiskStation Manager (DSM) Theme API lets a remote attacker who already holds DSM administrator privileges inject script that executes in another DSM user's authenticated session, enabling limited file read and write through that session. Exploitation requires the privileged attacker to inject the payload and a separate victim to interact with the affected web page (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, base score 4.8); the scope change reflects that the injected script can act outside the attacker's own session, but the confidentiality and integrity impact remain limited. Only DSM builds prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 are affected, and there is no public exploit identified at time of analysis. This is a low-priority, defense-in-depth issue rather than an urgent one, since the attacker must already be an administrator before the flaw grants anything.
ICMPv6 error generation in Zephyr RTOS 1.14.0 through 4.4.1 omits two of the three RFC 4443 §2.4 suppression rules, letting an attacker on the same IPv6 link turn a single spoofed packet into link-wide traffic reflection. Because an unrecognized next-header packet sent to ff02::1 with a spoofed source causes every node on the link to answer the victim, the flaw acts as a reflector whose amplification factor equals the number of listening nodes; alternatively, a unicast packet with a multicast source address makes the node emit its ICMPv6 error straight to that multicast group, flooding the link. Impact is limited to availability degradation of the shared link and the reflection victim plus source-address obfuscation for the attacker (CVSS 4.7, AV:A/PR:N, scope-changed, availability-only), with no memory-safety or data-exposure consequence; no public exploit identified at time of analysis.
Stored cross-site scripting in the WordPress plugin CSS & JavaScript Toolbox (all versions up to and including 12.0.6) lets an authenticated user with Administrator-level access persist arbitrary JavaScript through the plugin's Assignment Engine fields - Expressions, URLs, and Advanced assignment data - which is later executed when an administrator opens the CJT block edit screen in wp-admin. Because the injection prerequisite is already Administrator-level access, and an Administrator can legitimately place script and CSS content through this plugin's intended functionality, the marginal impact is small, making this a low-priority issue despite the stored XSS classification. No public exploit code has been identified at time of analysis, and the flaw maps to CWE-79 (improper neutralization of input during web page generation).
Physical access to a CareCam CM2507 IP camera running firmware HMT.CM2507 v251211.1507 lets an attacker connect to an unauthenticated debug interface, interrupt the normal boot sequence, and reach an interactive bootloader that can inspect or modify boot configuration, firmware data, and loaded software. The weakness requires hands-on access and a physical connection to the device's debug port, so exploitation is confined to scenarios such as device theft, supply-chain tampering, or unsupervised physical placement. It carries a low CVSS base score of 3.5, no public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided in the available intelligence.
Policy evasion in Zscaler Internet Access File Type Control can allow a file to be improperly evaluated or attributed, potentially bypassing file-type enforcement in rare circumstances. The issue affects organizations using ZIA with File Type Control actively enforcing policies and requires a malicious file transfer through the ZIA tenant, low privileges (PR:L), and user interaction (UI:R). Impact is limited to low confidentiality/integrity policy-control evasion with no availability impact or code execution; no public exploit identified at time of analysis, and vendor-managed remediation is applied centrally by Zscaler.
WordPress sites running the WP Easy Pay - Payment and Donation Form Builder for Square plugin through version 4.5.0 allow any authenticated user, including a subscriber-level account, to force-delete arbitrary posts, pages, and custom post types (bypassing the trash) or silently revert any published post to draft status. The root cause is CWE-862 missing authorization: the plugin's action handlers in wpep-setup.php perform no capability or nonce verification before invoking destructive WordPress content operations. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, so the practical risk is moderate and concentrated on sites that permit self-service or open user registration, where a low-privilege account is trivially obtainable and no further interaction or configuration is required.
Authenticated course authors or staff holding course-import permission in Open edX Studio (CMS) can break out of the intended extraction directory by importing a crafted .tar.gz archive, because openedx/core/lib/extract_archive.py validated archive member paths with a string `startswith` comparison instead of a segment-aware containment check. The impact is limited to cross-tenant file corruption: an archive member whose path extends a sibling course staging directory's base64 name as a string prefix can be written into that neighbouring staging area, and the advisory does not establish arbitrary filesystem writes, file reads, or code execution. The flaw affects Open edX releases from Aspen.1 up to but not including Ulmo and Verawood.1, requires PR:L (authenticated) network access per the CVSS vector, scores 4.3, and there is no public exploit identified at time of analysis; while the ingested tags include an 'RCE' label, our assessment confirms that no code-execution primitive is demonstrated by the advisory.
Missing catalog-level authorization in the Kyoo self-hosted media server before 5.1.0 lets an authenticated user who holds the core.play permission read uncataloged files beneath the media directory by submitting a base64-encoded filesystem path to the transcoder API. The flaw is a CWE-639 authorization bypass through a user-controlled key, and exploitation requires both a privileged account and knowledge or successful guessing of the target path, which confines the assessed impact to low-confidentiality, read-only disclosure inside the SafePath subtree. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuine but modest-severity authorization defect rather than an emergency.
Sensitive information exposure in IBM Common Licensing Agent 9.0 through 9.0.0.2 and IBM Administration and Reporting Tool (ART) 9.0 through 9.0.0.2 allows an authenticated low-privilege user to cause error messages to reveal environment, user, or associated data details. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (CVSS 4.3), so exploitation requires valid authentication, has low complexity, and yields only reconnaissance-grade confidentiality impact with no integrity or availability impact. No public exploit was identified at time of analysis, and this is a low-priority information-disclosure issue rather than an actively exploited flaw.
IBM Cognos Analytics versions 12.0.4 through 12.0.4 FP2 and 12.1.0 through 12.1.3 FP1 embed sensitive information within source code delivered to clients, allowing an authenticated user with access to that code to harvest data that can be used to mount further attacks against the system. The flaw carries a CVSS base score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and requires a valid Cognos Analytics account, so exploitation is gated behind existing credentials or a foothold rather than being openly reachable; impact is limited to low confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis, and the issue has not been confirmed actively exploited (CISA KEV); vendor-released remediation is available, making this a low-priority hardening item rather than an urgent threat.
Authenticated users on the IBM TS4300 tape library management interface can degrade the appliance's email notification service by triggering requests faster than it can handle, due to missing interaction-frequency (rate) controls in firmware versions 1.1.0.1 through 1.7.1.1. The impact is confined to availability of the email/alerting subsystem (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L); the data path, stored data, and integrity are unaffected, and valid credentials are a hard prerequisite. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a low-priority, patch-available hardening issue.
LatePoint, a WordPress appointment booking and scheduling plugin, allows remote attackers to enumerate and read arbitrary customer records through the plugin's step-handling endpoint because the customer[id] parameter is trusted without any ownership or identity check (CWE-639). All versions up to and including 5.6.9 are affected, and the exposure is decisive only on sites configured with customer authentication disabled (guest checkout enabled), where the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N applies - unauthenticated, no user interaction, and trivially automatable by iterating integer IDs. The result is disclosure of personally identifiable information including first name, last name, email address and phone number; there is no write, code execution or denial-of-service impact, and no public exploit code has been identified at time of analysis. Sites that require customers to log in before booking are not reachable through the unauthenticated path, which is the primary limiting factor on real-world exposure.
Denial of service in Apache Neethi (org.apache.neethi:neethi) before 3.2.4 allows a malicious or compromised remote policy server to stall a WS-Policy fetch indefinitely, tying up the calling thread for as long as the server keeps trickling bytes. Deployments are exposed only where an application uses Neethi to resolve a remote PolicyReference over HTTP; applications that consume locally embedded or bundled policy documents are not affected. The issue is availability-only (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), rated moderate severity, and no public exploit identified at time of analysis.
File-system information disclosure in IBM WebSphere Application Server 9.0 and 8.5 lets an attacker positioned on an adjacent network segment query the FileTransfer servlet and learn details about the server's file system, such as file and directory names or paths. Per the vendor-supplied vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 4.3), the flaw is rated unauthenticated and requires no user interaction, but the adjacent-network precondition means the attacker must already sit on the same management/admin LAN or WebSphere Network Deployment segment rather than reaching the service from the open Internet, and impact is limited to low-confidentiality disclosure with no integrity or availability effect. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV; overall this is a low-priority issue, though it is notable because WebSphere is widely deployed in large enterprises.
HCL BigFix Service Management ships with a CORS misconfiguration (CWE-942) in which Origin headers are improperly validated, allowing an attacker-controlled web page to issue credentialed cross-origin requests and read or manipulate protected resources and restricted APIs using an already-authenticated victim's session. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N, base 3.1) confirms the attacker needs no account on the application, but the attack only succeeds against a victim who is currently logged in to BigFix Service Management and is lured into visiting the malicious page in the same browser, which is why it is rated high complexity (AC:H). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; combined with the niche deployment of this HCL ITSM module, the practical risk is low, with limited integrity impact and no confirmed confidentiality impact in the published scoring (our internal assessment scopes confidentiality slightly higher, at low).
CareCam CM2507 IP cameras expose an insufficiently protected network maintenance mechanism that can activate a remote debugging service, and an attacker positioned on the same local network who is able to satisfy certain device-state conditions could make that debugging endpoint remotely reachable and use it to obtain unauthorized administrative access. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV does not list this CVE); EPSS data was not supplied. Severity is low - the vendor-published CVSS 4.0 base score is 2.3 (AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N) and our independent assessment scores it CVSS 3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - because exploitation demands LAN adjacency plus an unspecified device-state prerequisite and the immediate consequence is limited to enabling further access rather than full compromise.
An out-of-bounds read in Zephyr RTOS's gPTP (IEEE 802.1AS) announce-qualification routine lets an unauthenticated attacker with layer-2 adjacency to a vulnerable device send a single crafted Announce frame that drives the stack about 2 KB past the end of the received network buffer, potentially faulting the networking RX thread and causing a denial of service. The flaw affects only builds that enable the opt-in, experimental CONFIG_NET_GPTP option used in TSN/AVB deployments (Zephyr 1.13.0 up to before 4.4.2 per EUVD); default configurations are not vulnerable, and because gPTP frames go to a non-routed link-local multicast address, internet or routed exploitation is not possible. The impact is bounded by the assessed CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, and no public exploit has been identified at time of analysis.
Server-side request forgery in the PersonMail API of Synology DiskStation Manager (DSM) allows an authenticated low-privilege user to coerce the appliance into making arbitrary requests, potentially retrieving non-sensitive information from internal or external endpoints. The flaw affects DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2, and carries a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis, and the vendor rates the confidentiality impact as limited to non-sensitive data with no integrity or availability effect.
Path traversal in the Audio API of Synology DiskStation Manager (DSM) allows remote authenticated users to read files outside the intended directory, though the vendor explicitly scopes the exposed content as non-sensitive information. Affected are DSM installations before 7.2.1-69057-10, before 7.2.2-72806-7, and before 7.3.2-86009-2; the flaw is network-reachable (AV:N) but requires a valid DSM account (PR:L) and needs no user interaction, and it carries no write or availability impact (CVSS 3.1 base 4.3). There is no public exploit identified at time of analysis, and the combination of the authentication prerequisite with the non-sensitive nature of the disclosed data keeps realistic risk low.
Integer overflow in the File Operation component of Synology DiskStation Manager (DSM) allows remote authenticated users to trigger a limited denial-of-service condition against affected NAS appliances. Only systems running DSM versions prior to 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2 are affected; the vulnerability requires a valid DSM account with rights to invoke File Operation, matching the CVSS vector's PR:L (authenticated) rating. Impact is confined to low availability loss with no confidentiality or integrity effect, no public exploit code has been identified at time of analysis, and EPSS/KEV data do not indicate active exploitation, making this a low-priority issue despite the network attack vector.
Insecure Direct Object Reference in the LatePoint calendar booking plugin for WordPress (all versions up to and including 5.6.3) lets an authenticated LatePoint Agent-level user - or anyone with a higher role - read bookings and customer PII belonging to other agents and delete arbitrary bookings simply by supplying any booking ID, because the booking key is user-controlled and never checked against the caller's ownership. The CVSS vector (PR:L) confirms authentication is required, and the flaw is only reachable when an administrator has explicitly turned on the plugin's Abilities API toggles (latepoint_abilities_api plus latepoint_abilities_api_delete and/or latepoint_abilities_api_edit), which are not enabled by default and therefore substantially limit real-world exposure. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); independent assessment rates this as a real but modestly-scoped, low-to-moderate priority issue affecting confidentiality and integrity within the agent population.
Authorization bypass in the WordPress plugin Magazine Blocks (Blog Designer, Magazine & Newspaper Website Builder) through version 1.8.6 lets any authenticated user with Contributor-level access or above demote administrator-authored Site Builder templates - header, footer, front page, single, archive, 404 and search - to draft status and substitute their own block content, which is then rendered site-wide. The result is site defacement, phishing content injection and SEO spam on affected sites, with no user interaction required and no non-default configuration beyond having the plugin active and admin-authored templates present to overwrite. Exploitation requires a valid Contributor account (CVSS vector PR:L), so the practical exposure is limited to sites that grant contributor privileges, but the issue is real and should be patched; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) matches a modest-priority hardening fix rather than an emergency.
Authorization bypass in the Filter Gallery plugin for WordPress (versions up to and including 1.1.4) lets any authenticated user with subscriber-level access or higher rewrite the title and content of arbitrary posts, write the _wp_attachment_image_alt meta key on arbitrary posts, and create or overwrite arbitrary ufg_gallery_* options. The flaw is a missing capability/nonce check in the plugin's AJAX-style handlers (CWE-862), so no user interaction and no non-default configuration are required beyond the plugin being installed and active; the practical prerequisite is a low-privilege account, which is trivial on sites with open registration but a real barrier where self-registration is disabled. Impact is integrity-only - no confidentiality or availability loss and no code execution - and no public exploit code has been identified at time of analysis.
Missing authorization checks in the Foxtool All-in-One plugin for WordPress (all versions up to and including 2.5.3) allow any authenticated subscriber-level user to modify arbitrary subkeys of the plugin's foxtool_settings option, including the media-up3 toggle that enables site-wide SVG uploads - a change that can be chained into stored cross-site scripting through a malicious SVG file rendered by a victim. The settings modification itself is unauthenticated only in the sense that no additional user interaction is required once a low-privileged account exists; exploitation therefore matters mainly on sites with open registration or untrusted subscriber accounts. Real-world risk is moderate-to-low: the direct impact is a limited integrity violation (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), the XSS escalation is conditional on a second step, and no public exploit code or active exploitation was identified at time of analysis.
An authenticated user on a Nextcloud instance running the Deck app can set board-scoped configuration keys for arbitrary board IDs via the Deck config API, because the endpoint does not verify that the caller owns or has manage permission on the referenced board. Only Deck 1.16.0 through 1.18.0 are affected, and the impact is confined to configuration integrity of the targeted board - there is no data disclosure or availability loss - making this a low-to-moderate priority authorization flaw rather than a high-urgency issue. Exploitation requires a valid account on the instance (the assessed vector is PR:L, i.e. authenticated, with no user interaction), and the attacker must know or enumerate target board IDs; no public exploit code has been identified at time of analysis.
Approval bypass in the Nextcloud Approval app allows an authenticated user holding approve/reject privileges - or an attacker positioned to intercept and modify that approver's outbound approve/reject HTTP request - to approve or reject a file version whose contents changed after the approver reviewed it, simply by omitting or blanking the etag parameter. The backend only applied its etag freshness check when the parameter was present and non-empty, so the review-integrity control is skippable; impact is limited to integrity of the approval decision (CVSS 4.3, PR:L, no confidentiality or availability effect). No public exploit code was identified at time of analysis, and this is assessed as a genuinely low-priority issue whose signals are consistent.
Insecure direct object reference (CWE-639) in SysReptor before 2026.68 lets a remote attacker holding a public read-write note share link download an uploaded file or image from the same project by editing the shared note to reference the target asset filename. The shared-note authorization logic trusts that user-controlled reference and treats the asset as permitted, so the attacker can then retrieve it; the impact is confined to the project tied to the share link, filenames cannot be enumerated, and the attacker must already know the exact filename. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 2026.68; the CVSS 3.1 base score is 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), which the independent assessment narrows to a confidentiality-only impact (C:L/I:N/A:N).
Parameter substitution in the Elytron token-realm of Red Hat JBoss EAP 7, JBoss EAP 8 and the EAP Expansion Pack allows a remote attacker to manipulate OAuth2 token-introspection requests because parameters are assembled without URL encoding. Only deployments whose application security domain is backed by a token-realm configured with oauth2-introspection are exposed; other realm types (properties, JDBC, LDAP, or JWT validation without introspection) are unaffected, and the achievable impact is limited to Low confidentiality and Low integrity with no availability impact. Vendor scoring is 4.2 on an AC:H basis because success hinges on how the downstream introspection endpoint parses the injected parameters, and no public exploit has been identified at time of analysis.
Heap out-of-bounds read in libheif prior to 1.23.2 lets an application that builds inline-mask region metadata through the library's writer API leak adjacent heap memory or crash. Specifically, heif_region_item_add_region_inline_mask_data() stored a caller-supplied mask buffer without verifying that mask_data_len equals ceil(width*height/8); a later heif_region_get_mask_image() render derives the number of bytes to read from the region geometry, so an undersized buffer causes the reader to copy bytes past the end of the allocation into the returned monochrome mask image. The file-parsing/decode path validates the canonical mask size and is explicitly not vulnerable, so merely opening a crafted HEIF/AVIF file does not trigger the bug; exploitation requires a local program in which attacker-influenced geometry and mask data disagree, consistent with the assessed vector AV:L/AC:H/PR:N/UI:N (CVSS 4.0). There is no confirmed active exploitation (no CISA KEV listing), and no public exploit code was identified at time of analysis; the issue is a genuine but low-priority memory-safety defect rather than an emergency, and version 1.23.2 fixes it.
Administrative session hijacking in HCL BigFix Service Management Version 27 stems from the product allowing multiple simultaneous authenticated sessions for the same admin account, which can make valid session identifiers predictable or hijackable. A remote unauthenticated attacker could exploit this only if a privileged administrator has an active session and the attacker can predict or obtain that session identifier, then act with full administrative permissions; the vendor rates it 9.8, but the independent assessment raises attack complexity to high because that session-identifier step is a significant prerequisite. No public exploit identified at time of analysis, EPSS is low at 0.15% (5th percentile), and SSVC reports no exploitation and not automatable, so active exploitation is not confirmed.
An integer-overflow flaw in libheif's RGB-to-YCbCr conversion path (libheif/color-conversion/rgb2yuv.cc) can crash an application that encodes extremely large RGB images constructed via heif_image_create() and heif_image_add_plane() before calling heif_context_encode_image(); a 32-bit stride field wraps, so the conversion loop computes an invalid input pointer and reads past the end of the allocated interleaved plane. Affected deployments are those running libheif versions prior to 1.19.6 that expose the ENCODE path to caller- or attacker-influenced image dimensions - pure decode/parsing workflows are not affected. Impact is limited to process termination (no code execution, no data disclosure), and no public exploit code was identified at time of analysis.
Missing authorization checks in the IBM WebSphere Application Server 8.5 and 9.0 administrative console allow a remote, unauthenticated attacker (per the CVSS vector PR:N) to read limited sensitive information exposed by affected console functions. The issue is rated low severity (CVSS 3.1 base 3.7, C:L/I:N/A:N) and carries a high attack complexity (AC:H), meaning the attacker must know and reach the specific console paths where checks are absent rather than sending a single trivial request. There is no public exploit identified at time of analysis, no indication of confirmed active exploitation (CISA KEV), and a vendor patch is available via IBM's advisory page.
Session fixation in the password-protected shared-notes flow of SysReptor (Syslifters) before version 2026.68 lets an attacker who can plant a known, unauthenticated share-page session cookie in a victim's browser reuse that session after the victim enters the correct note password, gaining access to that shared note. The main SysReptor login is unaffected; only the 'publicshareinfo-auth' / 'sharednote-detail' share flow fails to rotate the session identifier on successful authentication (CWE-384). Exploitation requires a separate cookie-injection capability (for example an XSS vector, a shared or attacker-controlled device, or a network man-in-the-middle position) plus precise knowledge of the shared-note URL the victim will authenticate against, and the victim must actively submit the password, so the assessed CVSS 3.1 score is 3.7 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N); no public exploit code was identified at time of analysis.
NanoMQ MQTT brokers prior to 0.24.14 can be driven unresponsive by a remote unauthenticated client that sends MQTT v5 PUBLISH or SUBSCRIBE packets containing a large number of User Properties. Each property is inserted via property_append(), which re-walks the entire linked list, so a single packet with many properties forces quadratic (O(N²)) CPU work in the decoder; repeating the packet sustains the denial of service. The vendor has released a fix in 0.24.14, and no public exploit code or confirmed active exploitation has been identified at time of analysis; impact is availability-only and rated low, with the independent assessment noting that effectiveness depends on how many properties can be packed into a packet and on continued resending.
Information disclosure in Synology DiskStation Manager (DSM) lets unauthenticated remote attackers read a limited set of files by overwhelming the built-in Auto Block brute-force protection with sustained authentication attempts. The root cause is an improper restriction of excessive authentication attempts (CWE-307), and exploitation is technically difficult (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) with the payoff confined to low-confidentiality reads and no write or denial-of-service capability. Affected versions are DSM before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2; no public exploit identified at time of analysis, and this remains a low-priority finding despite being remotely reachable and unauthenticated.
An integer-wraparound in Cockpit's do_lastlog() login-accounting routine on ILP32 (32-bit) builds allows a low-privileged but authenticated local user holding an administrator-provisioned abnormally large UID to read and modify other users' lastlog records, producing low confidentiality and low integrity impact (CVSS 3.1 base 3.6, AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Exploitation requires a 32-bit build, a deliberately created large-UID account, and local access to the host; 64-bit LP64 builds do not overflow and are unaffected, and no public exploit code has been identified at time of analysis.
Unauthenticated holders of a SysReptor public note share link can retrieve project-wide collaborative-editing metadata for any deployment running a version prior to 2026.55, because the public-share WebSocket consumer joins the same collaboration group as authenticated project members and forwards client-information, connect/disconnect, awareness, and deletion events without restricting them to the shared note subtree. This leaks project member usernames and display names plus the identifiers and live editing activity of notes that were never shared; note content itself stays protected and no write access is granted. Our reassessment rates the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), higher than the vendor-assigned 3.5 (PR:L/UI:R) because the metadata is returned to an unauthenticated share-link holder on connection, though exploitation still requires possession of a valid share link. There is no public exploit code and no confirmed active exploitation (CISA SSVC exploitation: none); the fix is included in release 2026.55 via commit 1e52e5058b0c7f420dc45c87ad72e7a4585477b1.
Improper neutralization of CRLF sequences in the Sharing API of Synology DiskStation Manager (DSM) allows remote authenticated users to write limited files on the appliance when a victim clicks an attacker-crafted sharing URL. The issue affects DSM builds prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075, and is scored CVSS 3.1 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) - a low-priority rating the vector fairly reflects, since exploitation requires both a valid low-privileged DSM account and a victim's click-through, and yields only a low integrity impact with no confidentiality or availability loss. No public exploit identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Improper filtering of D-Bus broadcast signals in xdg-dbus-proxy allows a sandboxed Flatpak application to receive signal traffic that the configured path, interface, and member restrictions are meant to block, potentially exposing sensitive information carried on the D-Bus session bus and the AT-SPI accessibility bus. The weakness is strictly local and sandbox-scoped: it requires the attacker to already control a Flatpak application running inside the proxy sandbox, involves user interaction, and produces confidentiality-only impact, which is why the assessed CVSS base score is only 3.2 (AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) with no integrity or availability consequences and no code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
An out-of-bounds read in the Zephyr RTOS gPTP (IEEE 802.1AS) Ethernet layer lets an attacker on the same link crash-free but silently expose memory contents: a truncated Ethernet frame with ethertype 0x88F7 and fewer than 34 bytes of payload is accepted by gptp_handle_msg(), which dereferences a gPTP header pointer that extends past the received data and then retains the short packet for later state-machine parsing. Affected are Zephyr releases from 1.13.0 up to (but not including) 4.4.2 built with CONFIG_NET_GPTP on an interface configured as a gPTP port; no authentication or user interaction is required (PR:N/UI:N), though exploitation is limited by the adjacent-only vector and the requirement for a link that can deliver sub-minimum frames (for example the native_sim TAP driver or a MAC that accepts undersized frames). The impact is read-only and low (CVSS 3.1 base 3.1, C:L/I:N/A:N): under the default fixed-size buffer allocator only stale recycled buffer contents within the 128-byte fragment are disclosed, while a genuine out-of-bounds read requires the experimental CONFIG_NET_BUF_VARIABLE_DATA_SIZE allocator. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; an upstream fix commit and vendor advisory are available.
Authorization bypass in Nextcloud Server (Circles feature) lets an authenticated user retrieve the membership list of a circle they do not belong to, exposing membership information for Nextcloud Server 32.0.0 through 34.0.0, as detailed in HackerOne report 3484601. Exploitation is gated by a severe practical constraint: the attacker must supply an existing circle's unique identifier, which lives in a 62^15-space (roughly 90-bit) keyspace, so the CVSS 3.1 score reflects high attack complexity rather than an easily reachable bypass and no public exploit has been identified at time of analysis. Impact is limited to confidentiality of one circle's member list; no modification, deletion, or service disruption is possible, making this a low-priority issue for most deployments.
A SQL injection vulnerability in the EventScheduler API of Synology DiskStation Manager (DSM) allows an authenticated remote attacker with administrator privileges to retrieve non-sensitive information from the underlying database. Affected versions include DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. The CVSS score of 2.7 (Low) accurately reflects the limited impact, and no public exploit has been identified at time of analysis. The primary limiting factor is the requirement for high-privileged (admin) access to the DSM management interface.
ImageMagick's PNM (Netpbm) image coder can be crashed via a NULL pointer dereference when processing a specially crafted or sufficiently large PNM image that pushes the library to its configured memory/resource limit at a specific allocation point where the failed allocation is never checked. The flaw affects ImageMagick releases before 7.1.2-31 on the 7.x branch and before 6.9.13-56 on the legacy 6.x branch, and the outcome is limited to a denial of service - a single-process crash that can be restarted - with no data exposure, integrity loss, or code execution. Severity is low (vendor CVSS 4.0 base 2.3; independent assessment rates CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:L with high attack complexity and partial prerequisite conditions), no public exploit code was identified at time of analysis, and a vendor-released patch is available.
Denial of service in Vinyl Cache releases before 9.0.2 (and in the related Varnish Cache lineage, per the affected CPEs): when the deployed VCL calls the .upper() or .lower() string methods on an attacker-influenced value, a carefully sized request string can overrun the remaining worker-thread workspace at that call site, causing the child process to segfault or trip an assertion and then restart. Reachability is gated by a non-default prerequisite - the VCL must actually apply these methods to request-derived data - and the attacker must know that VCL logic well enough to size the string to land in the narrow window between filling the remaining workspace and the http_req_size / http_req_hdr_len request limits, so this is a deliberately low-priority memory-corruption issue rather than a general-purpose remote attack. No public exploit code has been identified at time of analysis, and the impact is a transient, self-healing outage rather than a persistent one, with no effect on confidentiality or integrity.
Resource exhaustion in the VES Collector component of O-RAN-SC SMO OAM 2025-06-10 allows an authenticated remote attacker to cause a limited denial of service by submitting manipulated input that drives uncontrolled resource allocation. Publicly available exploit code exists, but the issue is low priority per CVSS 2.1 and the independent assessment, with impact limited to availability of the collector and no confidentiality or integrity effect. The project has been notified via a bug report and has not responded, so no vendor patch is confirmed.
Name-constraint bypass in rustls-webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha.1 through 0.104.0-alpha.5 allows a misissued wildcard certificate to escape permitted-subtree DNS name constraints, potentially permitting names outside the intended subtree. The flaw is reachable only after signature verification succeeds and requires a misissued wildcard certificate from a name-constrained CA, making real-world exploitation narrow and high-complexity (assessed CVSS 3.1 base 2.1, PR:N, AC:H). No public exploit identified at time of analysis; vendor-released patches are available in 0.103.12 and 0.104.0-alpha.6.
rustls-webpki 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 accept X.509 name constraints that apply to URI names instead of enforcing them, so a misissued certificate that violates such a constraint is treated as valid. Impact is deliberately narrow: URI name constraints are only reachable after successful signature verification, the library provides no API for asserting URI names, and exploitation therefore requires a certificate authority in the trusted path to have misissued a certificate. There is no public exploit identified at time of analysis, no CISA KEV listing, and our assessment treats this as a low-priority, defense-in-depth hardening fix consistent with the vendor's CVSS 4.0 score of 2.1 rather than an urgent vulnerability.
Memory corruption in ImageMagick's ImagesToBlob blob-conversion routine can crash an affected process on 7.x releases before 7.1.2-31 and 6.x releases before 6.9.13-56. The flaw is a use-after-free (CWE-416) in which a pointer is not updated correctly, and exploitation requires a crafted image to reach a local ImageMagick process or library call (CVSS 4.0 AV:L/AC:H/AT:P, PR:N), so no authentication is required but the attack surface is local and the trigger is difficult to satisfy reliably. Impact is confined to availability (VC:N/VI:N/VA:L) with no evidence of code execution or data exposure, and no public exploit identified at time of analysis; vendor patches are available.