Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an embedded attachment to a directory outside the intended secure area when the document is opened by a local user. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-73) and requires the victim to open the malicious file, so it is user-interaction-gated rather than remotely triggerable, and no authentication is required of the attacker (PR:N). The practical consequence is arbitrary file write under the privileges of the Foxit process, which can escalate into code execution only if the attacker manages to land a file in an execution-relevant location such as a startup or autorun path; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided.
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered when a victim opens a specially crafted PDF containing malformed color space data, causing the application to crash and potentially allowing remote code execution in the context of the logged-in user. The flaw is rated CVSS 3.1 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: exploitation is unauthenticated per the vector but strictly local in attack path and requires user interaction, meaning the attacker must deliver the file and convince the target to open it on an affected default installation. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis; the confirmed outcome is a crash, with code execution described by the vendor as potential rather than demonstrated, and EPSS data was not provided with this record.
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF to corrupt process memory and potentially achieve remote code execution when the victim opens the file. Exploitation requires user interaction (the document must be opened and the malicious 3D model or GIF texture must actually be rendered) and is delivered through the local file/processing path (AV:L), while no application-level authentication is required (PR:N). No confirmed active exploitation and no public exploit code were identified at time of analysis; Foxit directs users to its security bulletins page for version guidance.
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets an attacker embed traversal sequences in a PDF so that files are written outside their intended location when the document is opened or previewed, with a conditional path from that arbitrary-file-write primitive to code execution. Rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the issue is a client-side parsing flaw: no authentication is required, but user interaction is mandatory and there is no network-facing or default-service exposure, so risk is bounded to users who process untrusted PDFs. No public exploit identified at time of analysis, and escalation to code execution remains conditional on a viable write target.
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that includes JavaScript triggered by page-visibility events. The reentrant execution leads the application to access a released page-view object while calculating annotation boundaries, resulting in an invalid memory read and application crash. Exploitation requires user interaction (the victim must open the malicious file) and JavaScript must be enabled, but no public exploit code or active exploitation has been identified at time of analysis; the independent assessment confirms only availability impact (crash), not code execution or data compromise.
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption while the application processes JavaScript array objects, potentially crashing the viewer or achieving arbitrary code execution in the context of the logged-on user. Exploitation is client-side only: the attacker must lure a victim into opening a malicious PDF with JavaScript execution enabled in the product (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8), and there is no privilege prerequisite or network-service exposure. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied; turning the use-after-free into reliable code execution additionally depends on attacker-controlled heap state, which is the principal limiting factor beyond the mandatory user interaction.
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image data inside a PDF and fail to sufficiently validate the embedded image metadata, allowing the malformed metadata to drive writes past the end of an allocated heap buffer. An attacker can deliver the trigger inside an ordinary-looking PDF; because the CVSS vector is AV:L with UI:R and PR:N, the flaw is not remotely exploitable without interaction - the victim must open or render the crafted file, and exploitation then runs in that user's context with high confidentiality, integrity and availability impact (CVSS 7.8). No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and this is a client-side file-parsing bug rather than a wormable or pre-auth network service issue.
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects carry malformed optional-content (OCG) attributes, which the program processes while rendering the page image and which causes it to dereference an already-freed internal data structure. The reliably reproducible outcome described by the vendor is an application crash (denial of service); because the defect is a memory-corruption class (CWE-416), code execution in the context of the user may be possible but would require additional heap grooming that is not demonstrated in the available data. Exploitation requires local delivery of the malicious file and a victim to open it (AV:L, UI:R), while no authentication or privileges are needed on the attacker side (PR:N); the vendor-rated CVSS 3.1 base score is 7.8 (High). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Specially crafted PDFs can trigger a use-after-free in Foxit PDF Reader and Editor when JavaScript is enabled, leading to memory corruption and potential code execution in the user's context. The attack requires local access and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and depends on JavaScript execution being enabled; no public exploit identified at time of analysis.
Use-after-free in Foxit PDF Editor and Foxit PDF Reader is triggered when a victim opens a specially crafted PDF: embedded JavaScript rewrites annotation rich-text attributes with malformed font data, and a freed object is then dereferenced during automatic annotation appearance reconstruction, crashing the application at minimum and, per the vendor-assigned CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), potentially permitting code execution in the user's context. Exploitation is strictly client-side and requires the user to open the malicious file (UI:R) with PDF scripting active; no privileges are required (PR:N), and there is no network-remote trigger. The provided intelligence includes no CISA KEV listing and no public exploit code, so the status is no public exploit identified at time of analysis; the description demonstrates only a crash, while full code execution is asserted by the vendor CVSS rating but not evidenced in the available technical detail.
Opening a malicious PDF in Foxit PDF Editor or Foxit PDF Reader can corrupt memory and terminate the application: the document forces a page-structure change while the file is being rendered, so the page-tree logic accesses a page object that has already been released (CWE-416, use-after-free). Rated CVSS 3.1 base 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the flaw requires no authentication on the victim's side but does require the user to open the crafted file, making social engineering the sole delivery gate. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Memory corruption in Foxit PDF Editor and Reader arises from a heap-based out-of-bounds write (CWE-787) that occurs when the application renders a Circle annotation with a malformed 'Cloudy' appearance stream inside a crafted PDF. The flaw stems from insufficient validation of the annotation's appearance geometry during rendering, requiring the victim to open a malicious file (UI:R) with no privileges needed (PR:N). CVSS is 7.8, but no public exploit code has been identified at time of analysis, and the need for user interaction plus a deliberately malformed annotation structure limits practical, widespread exploitation.
Use-after-free in Foxit PDF Editor and Foxit PDF Reader enables a crafted PDF containing embedded JavaScript to reference form fields after they have been released, causing memory corruption that crashes the application and, given the high confidentiality, integrity, and availability impact in the CVSS vector, could potentially lead to code execution. Exploitation requires the victim to open the malicious file (UI:R) on a local system (AV:L) and does not require authentication (PR:N); environments that disable PDF JavaScript execution are not affected by this specific trigger. No public exploit code or confirmed active exploitation is identified at time of analysis.
Heap-based out-of-bounds memory write in Foxit PDF Editor and Foxit PDF Reader's PRC 3D-content parser (CVSS 7.8) lets an attacker corrupt process memory by getting a user to open a crafted PDF that embeds a PRC model with malformed vertex indices in a triangular fan texture mesh. The attack is not network-triggerable on its own (AV:L) and requires the victim to open the file (UI:R), with no authentication needed (PR:N); successful exploitation yields memory corruption, a likely application crash, and potential code execution in the context of the Foxit process (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the risk is concentrated in email, web-download, and file-share delivery of weaponizable PDFs to engineering/3D-CAD workflows that exercise Foxit's PRC rendering path.
Use-after-free in the annotation-handling code of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF containing embedded JavaScript to trigger reentrant deletion of an annotation object, causing the freed memory to be dereferenced afterwards - crashing the application and, given the CVSS vector's high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), creating memory-corruption conditions that could potentially be steered toward code execution. The attack is client-side and file-based: per the vector (AV:L/AC:L/PR:N/UI:R) no authentication or privileges are required, but the attacker cannot reach the application remotely and the victim must open the malicious document, with JavaScript execution permitted in the reader for the vulnerable code path to be reached. There is no public exploit code identified at time of analysis and no confirmation of active exploitation; no EPSS score was provided with the source data.
Opening a specially crafted PDF with malformed form fields in Foxit PDF Editor or Foxit PDF Reader can trigger a use-after-free (CWE-416) that crashes the application and corrupts memory. The flaw is reachable only through the local, user-interaction vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H per independent assessment), meaning an attacker must first socially engineer a victim into opening a malicious document - there is no remote or unauthenticated network trigger, and no public exploit code was identified at time of analysis. The confirmed outcome is an application crash; reliable code execution from the use-after-free is not demonstrated in the available data, so the practical impact should be treated as availability loss with potential secondary confidentiality/integrity effects rather than a proven full remote code execution chain.
Local privilege escalation in Foxit PDF Editor (14.0.7 and earlier, plus 2026.2 and earlier) and Foxit PDF Reader (2026.2 and earlier) allows a locally authenticated low-privileged attacker to plant a crafted DLL in a user-writable directory that the Foxit updater searches, so that when the updater performs a high-privilege operation the malicious library is loaded and code runs with elevated privileges. The flaw is a classic uncontrolled search path condition (CWE-427) with CVSS 3.1 score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a foothold on the Windows host - there is no remote or network vector - and exploitation only succeeds if the privileged updater actually runs and the relevant path is user-writable. Intelligence signals are quiet: no public exploit identified at time of analysis, no CISA KEV listing (SSVC exploitation: none, automatable: no), and a low EPSS of 0.17% (6th percentile), making this a credible but non-urgent post-compromise escalation issue rather than an imminent threat.
Code execution in GNU Emacs versions prior to 31.2 occurs when Flymake performs on-the-fly syntax checking with a language backend other than Emacs Lisp, allowing code embedded in an untrusted file to run with the privileges of the user who opened or edited it. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects that the attack is local and requires the victim to open a malicious file, but needs no privileges and can fully compromise confidentiality, integrity, and availability of that user's session; the flaw is tracked by Red Hat as CVE-2026-96442 with a vendor score of 7.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is concentrated in developer and administration workstations where Emacs commonly opens untrusted source files from downloads, mail attachments, or repositories.
Heap-based memory corruption in Claris FileMaker Server's database engine block-parsing routine allows a maliciously crafted .fmp12 database file to overflow a heap buffer, potentially enabling arbitrary code execution in the context of the FileMaker Server process. All FileMaker Server releases prior to 26.0.3 are affected; exploitation requires that the crafted database be delivered to and processed by the server and that an operator open or host it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), so the local delivery path and required user interaction are the principal limiting factors rather than any authentication barrier, since no privileges are needed (PR:N). No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and EPSS is low at 0.16% (4th percentile), making this a moderate-priority memory-corruption fix rather than an urgent field threat; Claris has released a vendor patch in FileMaker Server 26.0.3.
Local unprivileged users can execute sudo commands outside the intended NOTBEFORE/NOTAFTER time window on Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat Hardened Images by setting an extreme TZ value that shifts the authorization window by up to roughly 25 hours. The vulnerability is an incorrect authorization check (CWE-863) that affects only sudoers rules whose time-based restrictions omit the trailing 'Z' UTC indicator; authentication is not bypassed, and the attacker must already have a sudoers entry subject to such a rule. Rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), it is a local, low-complexity, authenticated issue, and no public exploit has been identified at time of analysis; an upstream fix commit exists (1820a349...) but released patched versions are not independently confirmed.
Local privilege escalation in Foxit PDF Editor (versions 14.0.7, 13.2.6 and 2026.2 and earlier) and Foxit PDF Reader (2026.2 and earlier) lets an attacker who already has low-privileged local code execution swap the staged update package between download and high-privilege extraction, yielding arbitrary code execution as SYSTEM/admin. The root cause is a time-of-check-to-time-of-use race (CWE-367) combined with insufficient file locking and missing integrity validation on the update package, consistent with the CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High). There is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV negative; SSVC Exploitation: none), and EPSS is only 0.13% (3rd percentile); the attacker must also win a timing race during an in-progress update cycle, consistent with SSVC Automatable: no, making this a genuine but non-urgent local privilege-escalation issue rather than a mass-exploitable remote flaw.
Crafted PDF files can trigger a memory-corruption condition in the FileOpen (DRM) plugin of Foxit PDF Editor and Foxit PDF Reader, exploiting inadequate validation of encryption metadata to dereference an invalid internal pointer. Successful exploitation requires a victim to open a malicious PDF, after which the flaw may allow arbitrary code execution in the context of the local user; the vendor qualifies that code execution is only potentially achievable versus a crash. No public exploit identified at time of analysis, and no authentication is needed on the attacker side.
Local privilege escalation in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already holds a low-privileged account on the host execute arbitrary code by manipulating the search path used when Concert spawns operating system commands. Because Concert does not fully qualify the executable paths it invokes, a malicious binary placed earlier in the search order is executed with the privileges of the Concert process. The flaw is scored CVSS 3.1 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires local system access plus the ability to influence path resolution; no public exploit code has been identified at time of analysis and this CVE is not in CISA KEV. A vendor patch is available.
Malformed HEIF image-grid files can trigger a signed integer overflow in FFmpeg before 9.0, causing memory corruption or crashes when width/height fields from a crafted ispe box exceed INT_MAX. All FFmpeg versions before 9.0 are affected, particularly deployments that process HEIF/HEIC images, such as transcoding or thumbnailing services. The independent assessment is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning an unauthenticated attacker can trigger it if a crafted file is processed through a local path, though user interaction is required; no public exploit identified at time of analysis, and EPSS is low at 0.11% (percentile 1%).
Heap memory corruption in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already has low-privileged local access to the host trigger a double free (CWE-415) and, with heap grooming, execute arbitrary code in the context of the affected process. Exploitation is authenticated and local only - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8) - with full confidentiality, integrity, and availability impact when successful; no public exploit identified at time of analysis. IBM has published a vendor advisory and patch guidance at https://www.ibm.com/support/pages/node/7288830.
Use-after-free memory corruption in Google Chrome desktop builds prior to 154.0.8037.57 lets an attacker who convinces a user to open or interact with crafted content trigger the reclamation and subsequent dereference of a freed object, yielding high confidentiality, integrity, and availability impact within the affected process (CVSS 3.1 base 7.8). The assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates no authentication is required but that user interaction is mandatory and that the scored attack path is local rather than a pure remote drive-by; if the underlying bug proves remotely web-reachable, real-world exposure would be higher than the AV:L score implies. Vendor-released patched builds exist (154.0.8037.57 and later, stable-channel desktop update tracked as EUVD-2026-89226), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Use-after-free in Google Chrome affects desktop installations older than the 154.0.8037.57 stable channel release (September 2026), allowing an attacker who can get a victim to interact with crafted content to corrupt browser memory and potentially achieve code execution, data theft, or an information leak. The flaw is unauthenticated (PR:N) with low attack complexity but requires user interaction (UI:R), and the CVSS 3.1 vector scores it 7.8 with high confidentiality, integrity, and availability impact; note that the vector is AV:L, so the trigger is reached locally rather than as a pure remote drive-by. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though CWE-416 use-after-free flaws in browsers are historically attractive targets; a vendor fix is available in Chrome 154.0.8037.57.
Stored password survey answers in Red Hat Ansible Automation Platform 2's automation-controller can be recovered in plaintext by an authenticated user holding the delegated JobTemplate Admin role. The attacker tightens the minimum/maximum length constraint on a password-type survey question, then forces revalidation of a schedule or workflow job template node created by a higher-privileged user, causing the controller to decrypt the stored secret and embed it in the HTTP length-validation error response. No public exploit identified at time of analysis; exploitation is not unauthenticated (CVSS PR:L) and requires both the delegated role and an existing password-type survey value, making this a lateral, privilege-crossing credential-disclosure issue rather than a mass-exploitable perimeter break.
Recursive filesystem scope escalation in the Tauri dialog plugin (tauri-plugin-dialog) lets an attacker who already holds JavaScript execution inside a Tauri app's webview hijack a single, normal-looking OS file or folder picker dialog and silently widen the granted filesystem scope to the entire selected directory tree, producing persistent read/write access with no user-visible indication and no way to revoke it for the application's lifetime. The flaw affects any Tauri desktop application that uses the plugin's file or folder picker (CPE cpe:2.3:a:tauri:tauri-plugin-dialog, all versions) and is rated 7.7; it does not create the underlying injection, so exploitation requires the combination of an existing XSS/javascript-execution foothold and one user click on the dialog. Exploitation status: no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied with the source data.
Information disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read files and reach resources outside the application's security scope by submitting crafted XML to an XML-processing function (CWE-611 XML external entity injection). The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N rates this 7.7 High: confidentiality impact is high with a scope change, but there is no integrity or availability effect, meaning the outcome is data exposure rather than code execution or service disruption. Exploitation requires a valid low-privilege DataStage account and network reachability to the affected XML handling surface; no user interaction is needed, and no public exploit identified at time of analysis. Patch available per vendor advisory (IBM support page node/7288649).
Information disclosure in Formie, the Craft CMS form-building plugin from Verbb, lets any authenticated control-panel user (CVSS vector PR:L, unauthenticated exploitation is not possible) read the full contents of sent form-submission notification emails - recipient headers and complete HTML bodies containing submitted form data - by enumerating notification IDs through the formie/sent-notifications/get-resend-modal-content action. The flaw bypasses the formie-viewSentNotifications permission entirely, so accounts that were never granted permission to view sent notifications can still retrieve them; it affects releases prior to 2.2.23 in the 2.x line and prior to 3.1.31 in the 3.x line. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, so exploitability depends on an attacker first obtaining any low-privilege Craft CMS control-panel account.
Credential disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated user recover encrypted credentials that were issued for other users or environments, because the product mishandles encrypted credential material. Exploitation is network-reachable and requires no user interaction, but it does require a valid low-privileged account on the deployment (CVSS 3.1: 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), so the risk is a bounded confidentiality exposure that grows with the number of users and environments sharing the cluster rather than a remotely exploitable anonymous flaw; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV). A vendor patch is available per IBM's advisory.
An authenticated GitLab EE user can read sensitive CI/CD variable values from debug-mode job traces via the Duo AI troubleshooting feature because of a missing authorization check (CWE-862). Affected versions are GitLab EE 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. Exploitation is gated behind authentication and requires the non-default combination of CI_DEBUG_TRACE debug tracing and the Duo AI feature, and no public exploit code has been identified at time of analysis; this is a moderate-priority issue rather than a critical one.
An authenticated, low-privileged user of ManageEngine OpManager or ManageEngine Firewall Analyzer (versions 12.8.709 and below) can abuse the 'Rule Tracking Compare Policies' feature to inject crafted XML that is parsed server-side, disclosing data beyond that feature's authorization boundary. The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) reflects a network-reachable, low-complexity issue requiring only any valid console credential and no user interaction, with a scope change and high confidentiality impact but no integrity or availability impact, which confines the practical effect to information disclosure rather than code execution or service disruption. Because a session is required, the flaw is not pre-authentication exploitable; no public exploit code has been identified at time of analysis and no KEV listing was provided in the available intelligence, so exploitation appears to depend on an attacker first obtaining or holding a low-privilege console account with access to the affected feature.
Unauthenticated information disclosure in the MPCX Lightbox WordPress plugin (versions 1.2.2 through 1.2.5) lets any remote visitor call an AJAX action that exposes the title, content, or excerpt of posts they should not be able to read, including private, draft, pending, trashed, and password-protected entries. The flaw carries no authentication or privilege requirement and no user interaction is needed, and WPScan has published a proof-of-concept reference, so publicly available exploit code exists; the vendor has rated the issue as low severity (CVSS 3.1 base 3.7, AC:H), while our assessment scores it 3.1 with AC:L because exploiting the exposed action requires only a direct request to the site's admin-ajax.php endpoint, not special timing or conditions. Practical risk is bounded by data value rather than access difficulty: sites without sensitive unpublished content leak little, and impact is limited to reading post data with no write, privilege escalation, or site takeover.
The RabbitMQ management plugin (rabbit_mgmt_cors.erl) reflects an attacker-controlled Origin header straight back in Access-Control-Allow-Origin while also returning Access-Control-Allow-Credentials: true, so when an operator has configured cors_allow_origins = "*" a hostile web page can make a signed-in administrator's browser issue authenticated, state-changing requests to the management HTTP API. Exploitation is conditional rather than automatic: it requires the non-default wildcard CORS setting, a live cached HTTP Basic-auth administrator session, and the administrator being lured to the attacker's page (user interaction), and no public exploit code has been identified at time of analysis; assessed severity is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. The issue affects the management plugin in RabbitMQ releases prior to 3.13.17, 4.0.22, 4.1.13 and 4.2.6.
Remote code execution in Red Hat Ansible Automation Platform 2's automation-controller is possible when a privileged, authenticated user (CVSS PR:H) defines a custom Credential Type and abuses its environment-variable injector to set a process-hijacking loader variable such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP, or GIT_SSH_COMMAND, which the existing ANSIBLE_* prefix check and fixed ENV_BLOCKLIST fail to catch. Paired with the credential file injector, the attacker plants a script in the execution environment and points the loader variable at it, so arbitrary code executes inside the execution-environment container for any job that later attaches a credential of that type; this requires both the high privilege to author the credential type and a subsequent job consuming it. Red Hat's published CVSS of 7.6 (C:L/I:H/A:N) is lower than our independent assessment of the full vector (C:H/I:H/A:H), and because the vulnerable controller and the impacted execution-environment container are different security scopes, S:C applies. There is no CISA KEV listing and no public exploit identified at time of analysis.
Denial of service in GNOME Remote Desktop on Red Hat Enterprise Linux 8, 9, and 10 allows unauthenticated remote attackers to exhaust the global RDP connection-throttling slots by opening connections and never completing the pre-authentication handshake, blocking legitimate RDP clients from connecting until a holding socket closes. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (base 7.5), so impact is availability-only with no confidentiality or integrity loss, and the flaw requires the opt-in RDP server to be enabled and reachable. No public exploit identified at time of analysis; because the RDP service is not enabled by default and is often restricted to LAN or VPN, realistic exposure is narrower than the network vector alone suggests.
Blind SQL injection in the WordPress plugin W4 Post List (versions through 3.0.6) allows an authenticated high-privilege user - an administrator or equivalent role with access to the plugin's functionality - to inject crafted SQL into a query and infer database contents one bit at a time. The attack is remote and low complexity over the network, but it is gated entirely by the PR:H authentication requirement, so unauthenticated and low-privilege visitors cannot reach the vulnerable code path; the primary security consequence is high confidentiality loss (arbitrary data disclosure), with no integrity or availability impact in our assessment. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and no EPSS score was supplied with the source data.
Unauthenticated remote attackers can reach internal Apache Doris Frontend (FE) metadata service endpoints in affected 2.0.x through 4.1.x releases and read sensitive cluster information, because those endpoints authenticate callers using client-supplied node information rather than verifying the requesting party (CWE-287, header trust). Exploitation is gated by deployment: it only succeeds 'under certain network configurations' where the FE meta interfaces are reachable by the attacker, so clusters with the FE meta service kept off attacker-reachable networks are not exposed. The vulnerability is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with confidentiality-only impact - no integrity or availability effect - and no public exploit has been identified at time of analysis; there is no CISA KEV listing. Vendor-released patches exist in Apache Doris 4.0.8 and 4.1.4.
Deeply nested JSON arrays and objects drive JVM heap exhaustion in Typelevel Jawn versions before 1.7.0, where the thrown java.lang.OutOfMemoryError is a fatal Scala/JVM error that neither scala.util.Try nor cats.effect.IO routinely intercepts, turning untrusted JSON into a denial-of-service condition. The assessed impact is availability-only (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so remote unauthenticated attackers need only reach an endpoint that feeds attacker-controlled input into a pre-1.7.0 Jawn parse call, directly or transitively through circe; services that only parse trusted or internal JSON are not exposed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but this is a genuine, middle-tier priority for any internet-facing JSON API on an affected version; fixed in 1.7.0, which introduces a configurable depth cap.
Ubuntu package maintainers have published a security update tracked as CVE-2026-96280, reported through the vendor:ubuntu intelligence feed. The advisory is described only by the placeholder text 'security update', and the input provides no CVSS score or vector, no CWE classification, no CPE identifiers, no affected version ranges, and no reference URLs, so the specific package, component, and deployment mode in scope cannot be identified. Whether the issue is remotely or locally triggerable, what privilege level an attacker requires, and what the resulting impact would be are all undetermined; no public exploit code has been identified and there is no CISA KEV designation or EPSS score to indicate active exploitation, therefore risk cannot be meaningfully assessed from the provided data and should be treated as unquantified pending NVD or Ubuntu Security Notice enrichment.
Denial of service in the Jawn JSON parser for Scala (all artifacts prior to 1.7.0) lets a remote, unauthenticated attacker exhaust CPU by feeding JSON through the streaming AsyncParser in many tiny chunks, forcing repeated rescans of a single incomplete token. Exploitation is bounded by two preconditions: the target must parse attacker-influenced input incrementally via AsyncParser rather than parsing a fully buffered document, and the attacker must be able to influence chunk boundaries so that one token is split across many small reads - hence the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, an availability-only (HIGH) impact with no confidentiality or integrity effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fixed the issue in version 1.7.0.
Denial of service in FasterXML jackson-core 2.8.0 and later: an unauthenticated remote attacker who can supply a malformed JSON token to a parser created via JsonFactory.createParser(DataInput) causes UTF8DataInputJsonParser._reportInvalidToken() to accumulate the entire offending token into an exception message without ever applying ErrorReportConfiguration.getMaxErrorTokenLength(). The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token (versus 367 characters for identical input on the InputStream path), and because the StringBuilder also incurs byte-to-char expansion and internal array doubling, scaling the payload can exhaust heap and trigger a JVM-wide OutOfMemoryError. Only the DataInput parser path is reachable, impact is availability-only, and no public exploit identified at time of analysis; the 7.5 base score captures the theoretical worst case rather than the narrow real-world reachability.
Unauthenticated time-based blind SQL injection in the WordPress plugin 'Rename wp-login.php to anything you want' (all versions up to and including 2.0.1) allows remote attackers to inject arbitrary SQL through the 'log' username parameter processed by the plugin's wp_login_failed handler, enabling extraction of sensitive data from the underlying WordPress database. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and requires no authentication, user interaction, or non-default configuration - only that the vulnerable plugin is installed and active. Impact is confined to database reads with no write or availability effect, and exploitation is time-based blind, meaning extraction is timing-dependent and slower than direct-return injection; no public exploit code was identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
OpenC3 COSMOS versions 5.0.6 through 7.2.x contain a stored cross-site scripting flaw in the shared-screen BUTTON widget, allowing an authenticated actor with the system_set permission to persist a malicious action through POST /openc3-api/screen that is later evaluated in a different operator's browser when they open the shared screen and click the button. Successful execution runs attacker-controlled script in the COSMOS origin, reads localStorage.openc3Token, and steals the victim operator's bearer token, enabling account takeover and any action the victim could perform. The assessed vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, 7.6 High) reflects that a privileged authoring account plus a second operator's click are both required, and no public exploit code or confirmed active exploitation has been identified at time of analysis. The default permissive content security policy (which allowed inline script) made execution easier, but the root cause is the unsanitized button action; the issue is fixed in version 7.3.0.
Authenticated SQL injection in the WordPress plugin Ultimeter (versions through 3.0.8) lets a high-privileged account - Editor or Administrator level - inject arbitrary SQL through the plugin's editor functionality, exposing data held in the site's WordPress database. The flaw is scored CVSS 3.1 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), where the changed scope and high confidentiality impact reflect that the database is a security authority separate from the vulnerable plugin. No public exploit identified at time of analysis; because the vector requires PR:H, realistic risk is confined to malicious insiders or attackers who have already taken over a privileged WordPress account on a site running the affected plugin version.
SQL injection in the Easy Digital Downloads WordPress plugin through version 3.7.0 lets an authenticated account with the Shop Manager role or higher inject arbitrary SQL into an admin-side database query reachable over the network, exposing sensitive stored data such as customer records, order and payment metadata, and user password hashes, while requiring no victim interaction. The real-world barrier is the credential requirement noted in the assessed vector (PR:H), so this is chiefly a compromised- or over-privileged-account and insider risk rather than an anonymous mass-exploitation path; confidentiality impact is high, integrity impact is none, and availability impact is low. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was included in the source reporting, so exploitation signal remains limited to the advisory disclosure by Patchstack.
SQL injection in the WordPress plugin Email Log (versions ≤2.63) lets an authenticated site Administrator execute crafted SQL against the underlying database through an admin-side parameter that is concatenated into a query without sanitization. Successful abuse is primarily a confidentiality problem - exfiltration of subscriber addresses, message contents and other stored WordPress data (C:H) - with some availability risk (A:L) and no demonstrated integrity impact; the independent assessment retains scope unchanged (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L) rather than the scope-changed 7.6 originally reported, and rates it a genuine but low-urgency issue because exploitation presupposes Administrator credentials. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV entry; no EPSS data supplied by the sources reviewed), so the practical threat is a malicious or compromised admin account rather than mass remote exploitation.
Broken scope enforcement in ZohoCorp ManageEngine Applications Manager (versions 182200 and below) lets an authenticated, low-privileged user trigger administrator-configured MBean actions against monitors that lie outside that user's assigned scope, resulting in high integrity impact with limited confidentiality and availability effects (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, 7.6 HIGH). Exploitation requires a valid low-privileged Applications Manager account and the prior existence of administrator-configured MBean actions on the target instance; no user interaction is needed, and authentication requirements are confirmed as authenticated (PR:L) by the published vector. No public exploit code was identified and the flaw is not listed in CISA KEV, so there is no public exploit identified at time of analysis; the absence of a public exploit and the PR:L prerequisite are the main factors limiting immediate mass exploitation.