Authentication bypass and sensitive-information disclosure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift stem from a hard-coded cryptographic key (CWE-321) embedded in the product, scoring 8.1 (High) with the vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Because the key is embedded and therefore shared across deployments, an unauthenticated attacker who is positioned on the same adjacent network as an affected OpenShift deployment can bypass authentication and read or tamper with sensitive financial-transaction data, with no user interaction required; the assessment notes this is not confirmed as directly reachable from the public internet despite the description's 'remote attacker' phrasing. A vendor patch is available, and no public exploit code has been identified at time of analysis.
Incorrect authorization handling (CWE-863) in Google Chrome before 154.0.8037.57 allows remote, unauthenticated attackers to bypass intended authorization checks by convincing a user to load attacker-controlled web content, resulting in high confidentiality and integrity impact with no availability impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Because exploitation hinges on the UI:R component, it is not a fully drive-by condition - the victim must visit a malicious or compromised page while running an unpatched build, and the requirement for that user action is the main limiting factor. Exploitation status at time of analysis is that no public exploit code has been identified, and CISA KEV does not list this CVE; EPSS is low at 0.22% (12th percentile), suggesting limited observed exploitation pressure despite the high base score. Vendor-released patch: 154.0.8037.57.
Authenticated users holding only a Subscriber-level account can abuse the field-management AJAX action in the WC Fields Factory WordPress plugin before 4.1.11 to create, modify, or delete arbitrary post meta on any post - including WooCommerce products they do not own - and to rewrite stored pricing rules so that a product checks out at a reduced price. The root cause is a missing authorization check (CWE-862) on a field-management endpoint, rated CVSS 8.1 by NVD (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; our assessment reaches the same 8.1 base score but caps confidentiality at Low: C:L/I:H/A:N), and no public exploit code or CISA KEV listing was identified at time of analysis. Exploitation requires only that the site runs a vulnerable version of the plugin alongside WooCommerce and that the attacker can obtain a basic account, which is trivially satisfied where WooCommerce customer self-registration is enabled.
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic can bypass TLS certificate validation and update package integrity checks, allowing a forged update to be accepted and executed with system privileges. Exploitation is materially constrained: the client must both be intercepted and perform an update check/download in that window, which is why the CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H vector scores AC:H, and no authentication (PR:N) or user interaction (UI:N) is required. Affected builds are Foxit PDF Editor 2026.2 and earlier, 14.0.7 and earlier, and 13.2.6 and earlier, plus Foxit PDF Reader 2026.2 and earlier; no public exploit code and no confirmed active exploitation (not in CISA KEV) have been identified at time of analysis, EPSS is low at 0.13% (3rd percentile), and CISA's SSVC rates the technical impact as total while noting exploitation and automability as none/no.
Cross-site request forgery in PublishPress Capabilities 2.50.1 and earlier lets an attacker lure a logged-in, sufficiently privileged WordPress user into silently submitting role- and capability-modification requests, producing unauthorized permission changes with high integrity impact. The published CVSS 8.1 reflects PR:N/UI:R, but the independent assessment scores the same flaw as C:N/I:H/A:N, giving a materially lower effective severity: exploitation is not self-driven, it requires an authenticated administrative victim to interact with attacker-controlled content during an active session. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and the issue should be treated as moderate priority despite the headline score.
Configuration tampering in ZohoCorp ManageEngine Applications Manager 182000 and below lets an authenticated low-privileged user modify the application's server-wide proxy settings, an operation that should be restricted to administrators. Because proxy settings govern outbound traffic from the monitoring server - including connections to monitored hosts and external services - a non-admin can redirect or intercept that traffic and expose sensitive configuration data; the independent assessment rates integrity impact lower (I:L) than the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1 HIGH) while agreeing on high confidentiality impact. Exploitation requires a valid low-privileged account and network reachability to the management interface; it is not pre-authentication. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Privilege escalation in Zoho ManageEngine OpManager and Firewall Analyzer 12.8.710 and earlier allows an authenticated low-privilege user to gain Administrator privileges by importing a crafted Report Profile. The issue is network-reachable with low attack complexity and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1 High), but the attacker must already hold working low-privilege credentials on the target instance and no non-default configuration is needed. No public exploit identified at time of analysis.
Google Chrome desktop stable-channel builds are affected by CVE-2026-95333, a flaw whose description, CVSS vector, and CWE classification were all absent from the available intelligence, leaving only a vendor patch flag and a single Chrome Releases stable-channel advisory reference as substantive signals. Because no exploitation, authentication, or impact data is present, the effect on confidentiality, integrity, or availability cannot be characterized from this input, and no public exploit code was identified at time of analysis. The most notable finding is an internal metadata conflict: the record is attributed to vendor:ubuntu while the sole reference is Google's Chrome desktop advisory, so the actually affected package (Google Chrome versus Ubuntu's Chromium/Chrome packaging) should be confirmed directly against the linked Chrome Releases post before remediation is scoped.
Race condition in Google Chrome's stable channel allows a remote, unauthenticated attacker who persuades a user to interact with crafted content to win a time-of-check/time-of-use window and affect data beyond the vulnerable component's security scope. The CVSS 3.1 base score of 8.0 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) reflects high confidentiality and integrity impact with no availability impact, tempered by high attack complexity; no public exploit code or CISA KEV entry was identified at time of analysis. The flaw is addressed in the 154.0.8037.57 stable channel update, and while the vendor feed tags it Information Disclosure, the scoring indicates a broader boundary-crossing defect, so this is best treated as a moderately high-priority browser issue with partly inferred impact.
Information disclosure in Google Chrome desktop builds earlier than 154.0.8037.57 lets an attacker who shares a local network segment with the victim trigger a flaw that the assessed CVSS scores as high impact across confidentiality, integrity, and availability (CVSS 8.0, AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attacker needs no authentication or elevated privileges (PR:N), but must be positioned on the same adjacent L2 segment as the target (AV:A) and must get the victim to load attacker-influenced content (UI:R) - a combination that substantially constrains mass or opportunistic exploitation. An official fix is already available on the stable channel and no public exploit code has been identified at time of analysis, so risk here is driven primarily by Chrome's ubiquity and by unpatched client exposure rather than by observed exploitation activity.
Security policy bypass in Forcepoint Security Engine (NGFW) versions 7.1.0 through 7.1.13, 7.3.0 through 7.3.1, 7.3.3, 7.4.0 through 7.4.1, and 7.5.0 allows unauthenticated network attackers to defeat the enforcement policy the appliance is supposed to apply to traffic passing through it. Because the appliance itself is not the target, impact falls on downstream systems that the NGFW is meant to protect - an attacker who exploits the flaw can make traffic the policy should block appear permitted, with high integrity impact on those subsequent systems (scope-changed). The CVSS 4.0 base score is 7.9 (AV:N/AC:L/AT:N/PR:N/UI:N with subsequent-system impact H/H/H) and the issue is tagged as an authentication bypass; no CISA KEV entry is present and no public exploit code has been identified at time of analysis, though no EPSS data was supplied for this CVE. Exploitation is limited primarily by deployment context rather than access difficulty - the target must actually be enforcing a policy the bypass can negate.
Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local, authenticated user supply overlong input that overflows a buffer and achieves arbitrary code execution under the privileges of the affected process, matching the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. IBM's own advisory scores the issue 9.8 with a network/unauthenticated vector (AV:N/AC:L/PR:N/UI:N), but the vendor description explicitly states a 'local user' is required, so realistic exposure is confined to systems where an attacker already has a local account - a foothold-to-full-compromise escalation rather than a pre-authentication remote RCE. No public exploit code or confirmed active exploitation was identified at time of analysis, and IBM has published an advisory with a vendor-supplied fix.
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an embedded attachment to a directory outside the intended secure area when the document is opened by a local user. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-73) and requires the victim to open the malicious file, so it is user-interaction-gated rather than remotely triggerable, and no authentication is required of the attacker (PR:N). The practical consequence is arbitrary file write under the privileges of the Foxit process, which can escalate into code execution only if the attacker manages to land a file in an execution-relevant location such as a startup or autorun path; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided.
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered when a victim opens a specially crafted PDF containing malformed color space data, causing the application to crash and potentially allowing remote code execution in the context of the logged-in user. The flaw is rated CVSS 3.1 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: exploitation is unauthenticated per the vector but strictly local in attack path and requires user interaction, meaning the attacker must deliver the file and convince the target to open it on an affected default installation. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis; the confirmed outcome is a crash, with code execution described by the vendor as potential rather than demonstrated, and EPSS data was not provided with this record.
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF to corrupt process memory and potentially achieve remote code execution when the victim opens the file. Exploitation requires user interaction (the document must be opened and the malicious 3D model or GIF texture must actually be rendered) and is delivered through the local file/processing path (AV:L), while no application-level authentication is required (PR:N). No confirmed active exploitation and no public exploit code were identified at time of analysis; Foxit directs users to its security bulletins page for version guidance.
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets an attacker embed traversal sequences in a PDF so that files are written outside their intended location when the document is opened or previewed, with a conditional path from that arbitrary-file-write primitive to code execution. Rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the issue is a client-side parsing flaw: no authentication is required, but user interaction is mandatory and there is no network-facing or default-service exposure, so risk is bounded to users who process untrusted PDFs. No public exploit identified at time of analysis, and escalation to code execution remains conditional on a viable write target.
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that includes JavaScript triggered by page-visibility events. The reentrant execution leads the application to access a released page-view object while calculating annotation boundaries, resulting in an invalid memory read and application crash. Exploitation requires user interaction (the victim must open the malicious file) and JavaScript must be enabled, but no public exploit code or active exploitation has been identified at time of analysis; the independent assessment confirms only availability impact (crash), not code execution or data compromise.
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption while the application processes JavaScript array objects, potentially crashing the viewer or achieving arbitrary code execution in the context of the logged-on user. Exploitation is client-side only: the attacker must lure a victim into opening a malicious PDF with JavaScript execution enabled in the product (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8), and there is no privilege prerequisite or network-service exposure. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied; turning the use-after-free into reliable code execution additionally depends on attacker-controlled heap state, which is the principal limiting factor beyond the mandatory user interaction.
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image data inside a PDF and fail to sufficiently validate the embedded image metadata, allowing the malformed metadata to drive writes past the end of an allocated heap buffer. An attacker can deliver the trigger inside an ordinary-looking PDF; because the CVSS vector is AV:L with UI:R and PR:N, the flaw is not remotely exploitable without interaction - the victim must open or render the crafted file, and exploitation then runs in that user's context with high confidentiality, integrity and availability impact (CVSS 7.8). No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and this is a client-side file-parsing bug rather than a wormable or pre-auth network service issue.
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects carry malformed optional-content (OCG) attributes, which the program processes while rendering the page image and which causes it to dereference an already-freed internal data structure. The reliably reproducible outcome described by the vendor is an application crash (denial of service); because the defect is a memory-corruption class (CWE-416), code execution in the context of the user may be possible but would require additional heap grooming that is not demonstrated in the available data. Exploitation requires local delivery of the malicious file and a victim to open it (AV:L, UI:R), while no authentication or privileges are needed on the attacker side (PR:N); the vendor-rated CVSS 3.1 base score is 7.8 (High). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Specially crafted PDFs can trigger a use-after-free in Foxit PDF Reader and Editor when JavaScript is enabled, leading to memory corruption and potential code execution in the user's context. The attack requires local access and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and depends on JavaScript execution being enabled; no public exploit identified at time of analysis.
Use-after-free in Foxit PDF Editor and Foxit PDF Reader is triggered when a victim opens a specially crafted PDF: embedded JavaScript rewrites annotation rich-text attributes with malformed font data, and a freed object is then dereferenced during automatic annotation appearance reconstruction, crashing the application at minimum and, per the vendor-assigned CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), potentially permitting code execution in the user's context. Exploitation is strictly client-side and requires the user to open the malicious file (UI:R) with PDF scripting active; no privileges are required (PR:N), and there is no network-remote trigger. The provided intelligence includes no CISA KEV listing and no public exploit code, so the status is no public exploit identified at time of analysis; the description demonstrates only a crash, while full code execution is asserted by the vendor CVSS rating but not evidenced in the available technical detail.
Opening a malicious PDF in Foxit PDF Editor or Foxit PDF Reader can corrupt memory and terminate the application: the document forces a page-structure change while the file is being rendered, so the page-tree logic accesses a page object that has already been released (CWE-416, use-after-free). Rated CVSS 3.1 base 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the flaw requires no authentication on the victim's side but does require the user to open the crafted file, making social engineering the sole delivery gate. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Memory corruption in Foxit PDF Editor and Reader arises from a heap-based out-of-bounds write (CWE-787) that occurs when the application renders a Circle annotation with a malformed 'Cloudy' appearance stream inside a crafted PDF. The flaw stems from insufficient validation of the annotation's appearance geometry during rendering, requiring the victim to open a malicious file (UI:R) with no privileges needed (PR:N). CVSS is 7.8, but no public exploit code has been identified at time of analysis, and the need for user interaction plus a deliberately malformed annotation structure limits practical, widespread exploitation.
Use-after-free in Foxit PDF Editor and Foxit PDF Reader enables a crafted PDF containing embedded JavaScript to reference form fields after they have been released, causing memory corruption that crashes the application and, given the high confidentiality, integrity, and availability impact in the CVSS vector, could potentially lead to code execution. Exploitation requires the victim to open the malicious file (UI:R) on a local system (AV:L) and does not require authentication (PR:N); environments that disable PDF JavaScript execution are not affected by this specific trigger. No public exploit code or confirmed active exploitation is identified at time of analysis.
Heap-based out-of-bounds memory write in Foxit PDF Editor and Foxit PDF Reader's PRC 3D-content parser (CVSS 7.8) lets an attacker corrupt process memory by getting a user to open a crafted PDF that embeds a PRC model with malformed vertex indices in a triangular fan texture mesh. The attack is not network-triggerable on its own (AV:L) and requires the victim to open the file (UI:R), with no authentication needed (PR:N); successful exploitation yields memory corruption, a likely application crash, and potential code execution in the context of the Foxit process (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the risk is concentrated in email, web-download, and file-share delivery of weaponizable PDFs to engineering/3D-CAD workflows that exercise Foxit's PRC rendering path.
Use-after-free in the annotation-handling code of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF containing embedded JavaScript to trigger reentrant deletion of an annotation object, causing the freed memory to be dereferenced afterwards - crashing the application and, given the CVSS vector's high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), creating memory-corruption conditions that could potentially be steered toward code execution. The attack is client-side and file-based: per the vector (AV:L/AC:L/PR:N/UI:R) no authentication or privileges are required, but the attacker cannot reach the application remotely and the victim must open the malicious document, with JavaScript execution permitted in the reader for the vulnerable code path to be reached. There is no public exploit code identified at time of analysis and no confirmation of active exploitation; no EPSS score was provided with the source data.
Opening a specially crafted PDF with malformed form fields in Foxit PDF Editor or Foxit PDF Reader can trigger a use-after-free (CWE-416) that crashes the application and corrupts memory. The flaw is reachable only through the local, user-interaction vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H per independent assessment), meaning an attacker must first socially engineer a victim into opening a malicious document - there is no remote or unauthenticated network trigger, and no public exploit code was identified at time of analysis. The confirmed outcome is an application crash; reliable code execution from the use-after-free is not demonstrated in the available data, so the practical impact should be treated as availability loss with potential secondary confidentiality/integrity effects rather than a proven full remote code execution chain.
Local privilege escalation in Foxit PDF Editor (14.0.7 and earlier, plus 2026.2 and earlier) and Foxit PDF Reader (2026.2 and earlier) allows a locally authenticated low-privileged attacker to plant a crafted DLL in a user-writable directory that the Foxit updater searches, so that when the updater performs a high-privilege operation the malicious library is loaded and code runs with elevated privileges. The flaw is a classic uncontrolled search path condition (CWE-427) with CVSS 3.1 score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a foothold on the Windows host - there is no remote or network vector - and exploitation only succeeds if the privileged updater actually runs and the relevant path is user-writable. Intelligence signals are quiet: no public exploit identified at time of analysis, no CISA KEV listing (SSVC exploitation: none, automatable: no), and a low EPSS of 0.17% (6th percentile), making this a credible but non-urgent post-compromise escalation issue rather than an imminent threat.
Code execution in GNU Emacs versions prior to 31.2 occurs when Flymake performs on-the-fly syntax checking with a language backend other than Emacs Lisp, allowing code embedded in an untrusted file to run with the privileges of the user who opened or edited it. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects that the attack is local and requires the victim to open a malicious file, but needs no privileges and can fully compromise confidentiality, integrity, and availability of that user's session; the flaw is tracked by Red Hat as CVE-2026-96442 with a vendor score of 7.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is concentrated in developer and administration workstations where Emacs commonly opens untrusted source files from downloads, mail attachments, or repositories.
Heap-based memory corruption in Claris FileMaker Server's database engine block-parsing routine allows a maliciously crafted .fmp12 database file to overflow a heap buffer, potentially enabling arbitrary code execution in the context of the FileMaker Server process. All FileMaker Server releases prior to 26.0.3 are affected; exploitation requires that the crafted database be delivered to and processed by the server and that an operator open or host it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), so the local delivery path and required user interaction are the principal limiting factors rather than any authentication barrier, since no privileges are needed (PR:N). No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and EPSS is low at 0.16% (4th percentile), making this a moderate-priority memory-corruption fix rather than an urgent field threat; Claris has released a vendor patch in FileMaker Server 26.0.3.
Local unprivileged users can execute sudo commands outside the intended NOTBEFORE/NOTAFTER time window on Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat Hardened Images by setting an extreme TZ value that shifts the authorization window by up to roughly 25 hours. The vulnerability is an incorrect authorization check (CWE-863) that affects only sudoers rules whose time-based restrictions omit the trailing 'Z' UTC indicator; authentication is not bypassed, and the attacker must already have a sudoers entry subject to such a rule. Rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), it is a local, low-complexity, authenticated issue, and no public exploit has been identified at time of analysis; an upstream fix commit exists (1820a349...) but released patched versions are not independently confirmed.
Local privilege escalation in Foxit PDF Editor (versions 14.0.7, 13.2.6 and 2026.2 and earlier) and Foxit PDF Reader (2026.2 and earlier) lets an attacker who already has low-privileged local code execution swap the staged update package between download and high-privilege extraction, yielding arbitrary code execution as SYSTEM/admin. The root cause is a time-of-check-to-time-of-use race (CWE-367) combined with insufficient file locking and missing integrity validation on the update package, consistent with the CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High). There is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV negative; SSVC Exploitation: none), and EPSS is only 0.13% (3rd percentile); the attacker must also win a timing race during an in-progress update cycle, consistent with SSVC Automatable: no, making this a genuine but non-urgent local privilege-escalation issue rather than a mass-exploitable remote flaw.
Crafted PDF files can trigger a memory-corruption condition in the FileOpen (DRM) plugin of Foxit PDF Editor and Foxit PDF Reader, exploiting inadequate validation of encryption metadata to dereference an invalid internal pointer. Successful exploitation requires a victim to open a malicious PDF, after which the flaw may allow arbitrary code execution in the context of the local user; the vendor qualifies that code execution is only potentially achievable versus a crash. No public exploit identified at time of analysis, and no authentication is needed on the attacker side.
Local privilege escalation in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already holds a low-privileged account on the host execute arbitrary code by manipulating the search path used when Concert spawns operating system commands. Because Concert does not fully qualify the executable paths it invokes, a malicious binary placed earlier in the search order is executed with the privileges of the Concert process. The flaw is scored CVSS 3.1 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires local system access plus the ability to influence path resolution; no public exploit code has been identified at time of analysis and this CVE is not in CISA KEV. A vendor patch is available.
Malformed HEIF image-grid files can trigger a signed integer overflow in FFmpeg before 9.0, causing memory corruption or crashes when width/height fields from a crafted ispe box exceed INT_MAX. All FFmpeg versions before 9.0 are affected, particularly deployments that process HEIF/HEIC images, such as transcoding or thumbnailing services. The independent assessment is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning an unauthenticated attacker can trigger it if a crafted file is processed through a local path, though user interaction is required; no public exploit identified at time of analysis, and EPSS is low at 0.11% (percentile 1%).
Heap memory corruption in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already has low-privileged local access to the host trigger a double free (CWE-415) and, with heap grooming, execute arbitrary code in the context of the affected process. Exploitation is authenticated and local only - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8) - with full confidentiality, integrity, and availability impact when successful; no public exploit identified at time of analysis. IBM has published a vendor advisory and patch guidance at https://www.ibm.com/support/pages/node/7288830.
Use-after-free memory corruption in Google Chrome desktop builds prior to 154.0.8037.57 lets an attacker who convinces a user to open or interact with crafted content trigger the reclamation and subsequent dereference of a freed object, yielding high confidentiality, integrity, and availability impact within the affected process (CVSS 3.1 base 7.8). The assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates no authentication is required but that user interaction is mandatory and that the scored attack path is local rather than a pure remote drive-by; if the underlying bug proves remotely web-reachable, real-world exposure would be higher than the AV:L score implies. Vendor-released patched builds exist (154.0.8037.57 and later, stable-channel desktop update tracked as EUVD-2026-89226), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Use-after-free in Google Chrome affects desktop installations older than the 154.0.8037.57 stable channel release (September 2026), allowing an attacker who can get a victim to interact with crafted content to corrupt browser memory and potentially achieve code execution, data theft, or an information leak. The flaw is unauthenticated (PR:N) with low attack complexity but requires user interaction (UI:R), and the CVSS 3.1 vector scores it 7.8 with high confidentiality, integrity, and availability impact; note that the vector is AV:L, so the trigger is reached locally rather than as a pure remote drive-by. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though CWE-416 use-after-free flaws in browsers are historically attractive targets; a vendor fix is available in Chrome 154.0.8037.57.
Stored password survey answers in Red Hat Ansible Automation Platform 2's automation-controller can be recovered in plaintext by an authenticated user holding the delegated JobTemplate Admin role. The attacker tightens the minimum/maximum length constraint on a password-type survey question, then forces revalidation of a schedule or workflow job template node created by a higher-privileged user, causing the controller to decrypt the stored secret and embed it in the HTTP length-validation error response. No public exploit identified at time of analysis; exploitation is not unauthenticated (CVSS PR:L) and requires both the delegated role and an existing password-type survey value, making this a lateral, privilege-crossing credential-disclosure issue rather than a mass-exploitable perimeter break.
Recursive filesystem scope escalation in the Tauri dialog plugin (tauri-plugin-dialog) lets an attacker who already holds JavaScript execution inside a Tauri app's webview hijack a single, normal-looking OS file or folder picker dialog and silently widen the granted filesystem scope to the entire selected directory tree, producing persistent read/write access with no user-visible indication and no way to revoke it for the application's lifetime. The flaw affects any Tauri desktop application that uses the plugin's file or folder picker (CPE cpe:2.3:a:tauri:tauri-plugin-dialog, all versions) and is rated 7.7; it does not create the underlying injection, so exploitation requires the combination of an existing XSS/javascript-execution foothold and one user click on the dialog. Exploitation status: no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied with the source data.
Information disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read files and reach resources outside the application's security scope by submitting crafted XML to an XML-processing function (CWE-611 XML external entity injection). The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N rates this 7.7 High: confidentiality impact is high with a scope change, but there is no integrity or availability effect, meaning the outcome is data exposure rather than code execution or service disruption. Exploitation requires a valid low-privilege DataStage account and network reachability to the affected XML handling surface; no user interaction is needed, and no public exploit identified at time of analysis. Patch available per vendor advisory (IBM support page node/7288649).
Information disclosure in Formie, the Craft CMS form-building plugin from Verbb, lets any authenticated control-panel user (CVSS vector PR:L, unauthenticated exploitation is not possible) read the full contents of sent form-submission notification emails - recipient headers and complete HTML bodies containing submitted form data - by enumerating notification IDs through the formie/sent-notifications/get-resend-modal-content action. The flaw bypasses the formie-viewSentNotifications permission entirely, so accounts that were never granted permission to view sent notifications can still retrieve them; it affects releases prior to 2.2.23 in the 2.x line and prior to 3.1.31 in the 3.x line. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, so exploitability depends on an attacker first obtaining any low-privilege Craft CMS control-panel account.
Credential disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated user recover encrypted credentials that were issued for other users or environments, because the product mishandles encrypted credential material. Exploitation is network-reachable and requires no user interaction, but it does require a valid low-privileged account on the deployment (CVSS 3.1: 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), so the risk is a bounded confidentiality exposure that grows with the number of users and environments sharing the cluster rather than a remotely exploitable anonymous flaw; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV). A vendor patch is available per IBM's advisory.
An authenticated GitLab EE user can read sensitive CI/CD variable values from debug-mode job traces via the Duo AI troubleshooting feature because of a missing authorization check (CWE-862). Affected versions are GitLab EE 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. Exploitation is gated behind authentication and requires the non-default combination of CI_DEBUG_TRACE debug tracing and the Duo AI feature, and no public exploit code has been identified at time of analysis; this is a moderate-priority issue rather than a critical one.
An authenticated, low-privileged user of ManageEngine OpManager or ManageEngine Firewall Analyzer (versions 12.8.709 and below) can abuse the 'Rule Tracking Compare Policies' feature to inject crafted XML that is parsed server-side, disclosing data beyond that feature's authorization boundary. The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) reflects a network-reachable, low-complexity issue requiring only any valid console credential and no user interaction, with a scope change and high confidentiality impact but no integrity or availability impact, which confines the practical effect to information disclosure rather than code execution or service disruption. Because a session is required, the flaw is not pre-authentication exploitable; no public exploit code has been identified at time of analysis and no KEV listing was provided in the available intelligence, so exploitation appears to depend on an attacker first obtaining or holding a low-privilege console account with access to the affected feature.
The RabbitMQ management plugin (rabbit_mgmt_cors.erl) reflects an attacker-controlled Origin header straight back in Access-Control-Allow-Origin while also returning Access-Control-Allow-Credentials: true, so when an operator has configured cors_allow_origins = "*" a hostile web page can make a signed-in administrator's browser issue authenticated, state-changing requests to the management HTTP API. Exploitation is conditional rather than automatic: it requires the non-default wildcard CORS setting, a live cached HTTP Basic-auth administrator session, and the administrator being lured to the attacker's page (user interaction), and no public exploit code has been identified at time of analysis; assessed severity is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. The issue affects the management plugin in RabbitMQ releases prior to 3.13.17, 4.0.22, 4.1.13 and 4.2.6.
Remote code execution in Red Hat Ansible Automation Platform 2's automation-controller is possible when a privileged, authenticated user (CVSS PR:H) defines a custom Credential Type and abuses its environment-variable injector to set a process-hijacking loader variable such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP, or GIT_SSH_COMMAND, which the existing ANSIBLE_* prefix check and fixed ENV_BLOCKLIST fail to catch. Paired with the credential file injector, the attacker plants a script in the execution environment and points the loader variable at it, so arbitrary code executes inside the execution-environment container for any job that later attaches a credential of that type; this requires both the high privilege to author the credential type and a subsequent job consuming it. Red Hat's published CVSS of 7.6 (C:L/I:H/A:N) is lower than our independent assessment of the full vector (C:H/I:H/A:H), and because the vulnerable controller and the impacted execution-environment container are different security scopes, S:C applies. There is no CISA KEV listing and no public exploit identified at time of analysis.
Denial of service in GNOME Remote Desktop on Red Hat Enterprise Linux 8, 9, and 10 allows unauthenticated remote attackers to exhaust the global RDP connection-throttling slots by opening connections and never completing the pre-authentication handshake, blocking legitimate RDP clients from connecting until a holding socket closes. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (base 7.5), so impact is availability-only with no confidentiality or integrity loss, and the flaw requires the opt-in RDP server to be enabled and reachable. No public exploit identified at time of analysis; because the RDP service is not enabled by default and is often restricted to LAN or VPN, realistic exposure is narrower than the network vector alone suggests.
Blind SQL injection in the WordPress plugin W4 Post List (versions through 3.0.6) allows an authenticated high-privilege user - an administrator or equivalent role with access to the plugin's functionality - to inject crafted SQL into a query and infer database contents one bit at a time. The attack is remote and low complexity over the network, but it is gated entirely by the PR:H authentication requirement, so unauthenticated and low-privilege visitors cannot reach the vulnerable code path; the primary security consequence is high confidentiality loss (arbitrary data disclosure), with no integrity or availability impact in our assessment. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and no EPSS score was supplied with the source data.