Transactions built through a remote StorageClient in @bsv/wallet-toolbox 1.1.47 through 2.3.3, @bsv/wallet-toolbox-client 1.1.47 through 2.3.3, and @bsv/wallet-toolbox-mobile 1.3.21 through 2.3.3 can be silently redirected by a malicious or compromised storage provider, which returns output locking scripts the wallet signs without confirming they match the caller's request. Because the provider can substitute a recipient script or append an attacker-controlled output funded by shrinking change, the wallet broadcasts a transaction paying the attacker while the application and user interface still display the intended recipient; the integrity impact is high with no confidentiality or availability effect, and no authentication against the victim wallet is required (CVSS 4.0 8.7, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Exploitation requires the application to use a remote StorageClient backend the attacker controls and the user to initiate a transaction through it - local-storage applications and those that independently verify outputs are unaffected; no public exploit code has been identified at time of analysis and the issue is patched in 2.4.0.
Botslab G980H dash camera firmware can leave a client's authentication state valid after that client's connection is terminated or displaced by a newly established connection, allowing an unauthenticated attacker with adjacent network access (same Wi-Fi/link-layer segment) to potentially reach functionality belonging to the displaced client's session (CWE-613). Exploitation is not internet-remote and is further gated by a race condition: the attacker must connect during the narrow window before the separate session-expiration mechanism invalidates the residual authenticated state, which is why an internal assessment scores the attack complexity as High (CVSS:3.1/AV:A/AC:H/PR:N/UI:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the affected CPE is a wildcard covering all firmware versions.
Session-hijacking authorization bypass in Botslab G980H dash camera firmware lets an attacker on the adjacent network (the camera's Wi-Fi/link-local segment) reach privileged, session-gated commands by presenting a session identifier that belongs to a different, already-authenticated client, because the firmware never binds session state to the connection that created it (CWE-863). Successful abuse gives high impact to confidentiality, integrity and availability of the camera itself - full compromise of the device's privileged functionality - though exploitation is not opportunistic: an attacker must be within adjacent-network range and a legitimate client must already hold a live authenticated session whose identifier can be obtained or replayed. The vendor CVSS 4.0 base score is 8.7 (High, AV:A/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H), while our independent CVSS 3.1 assessment rates it AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to reflect the session-hijack precondition; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Unauthenticated data disclosure in ServiceNow AI Platform instances stems from an authorization bypass (CVSS 8.7) that lets remote attackers read records they are not entitled to access. ServiceNow has already remediated its hosted instances, so exposure now concentrates on self-hosted and partner-managed deployments that have not applied the KB3159623 update or upgraded to a patched release. No public exploit code has been identified and no confirmed active exploitation (CISA KEV) has been reported, yet this remains a genuine priority for ServiceNow customers even in the absence of exploitation telemetry.
Unauthenticated network requests against unpatched ServiceNow AI Platform instances can create, modify, or delete instance data beyond what was intended, per a vendor-remediated improper access control flaw rated 8.7 under CVSS 4.0 (independent assessment: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Impact is integrity-only - no confidentiality or availability loss is described - and ServiceNow scopes exploitation to "certain circumstances," so the flaw is not universally reachable on every default deployment and undisclosed configuration preconditions appear to gate it. ServiceNow patched hosted instances in August 2026 and shipped the update to partners and self-hosted customers, leaving residual exposure concentrated in self-hosted and partner-managed instances that have not yet applied it. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Stored cross-site scripting in Discourse's video-placeholder component lets an authenticated user with default trust-level posting privileges embed a crafted video URL in a post that breaks out of the placeholder's data-video-src attribute and injects an attacker-controlled event handler, which fires when another user opens the post and clicks the video play overlay. Exploitation is gated by three independent conditions - a valid posting account (CVSS PR:L, so authenticated), the target instance running with its Content Security Policy disabled or relaxed (the default CSP blocks inline event handlers and defeats the attack), and specific victim interaction (UI:R) - so realistic risk is materially lower than the 8.7 base score implies; our assessment rates it AC:H with only low confidentiality and integrity impact. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the vendor has released fixed versions 2026.1.8, 2026.6.3, 2026.7.2 and 2026.8.0.
Denial of service in NodeRedis redis-parser through 3.0.0 lets a hostile or hijacked Redis endpoint crash the Node.js client process by returning a crafted RESP multi-bulk header whose declared length exceeds 2^32-1, triggering an uncaught RangeError during parsing. The flaw is reachable by unauthenticated remote attackers (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N) but its impact is strictly availability (VA:H) - no confidentiality, integrity, or scope impact - so a malicious server, a compromised legitimate Redis instance, or an on-path injector in the RESP response stream can only take down the parsing process. Rated 8.7 (HIGH) by CVSS 4.0, with no public exploit identified at time of analysis and no confirmed vendor-released patch, though the issue is publicly tracked upstream.
Authenticated root-level command execution in the Netlink ICT HG323RW router lets an attacker who already holds valid low-privilege credentials on the adjacent network upload a crafted diagnostic script through the web management interface, which the device then executes with root privileges and is fully compromised as a result. The prerequisites matter: the attacker must be able to reach the router's web management interface (normally confined to the LAN/local segment rather than the public internet) and must supply valid credentials, so real-world exposure is narrower than the raw severity suggests. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so prioritization should be driven by asset footprint and the presence of these devices on untrusted or shared network segments rather than by active exploitation.
Heap-based buffer overflow in the Nanomsg WebSocket transport (versions 0.5-beta through 1.x before 1.2.3) allows remote attackers to corrupt heap memory by sending an oversized Sec-WebSocket-Version header during the WebSocket handshake, which is processed before any authentication or user interaction takes place. Exploitation requires that the target application actually enable and expose nanomsg's ws transport; TCP- or IPC-only deployments are unaffected. The flaw yields high integrity and availability impact, and while reliable code execution depends on heap layout and platform, no public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (not in CISA KEV).
Server-side request forgery in the BentoPDF certificate/timestamp CORS proxy (cloudflare/cors-proxy-worker.js) allows unauthenticated remote attackers to relay requests to internal, reserved, or cloud-metadata destinations when the Worker is hosted on a non-Cloudflare runtime. The flaw is a time-of-check/time-of-use gap: isPrivateOrReservedHost() validates the supplied hostname separately from the DNS resolution performed by fetch(targetUrl), so an attacker who controls a domain's DNS with a very low TTL can pass validation with a public address and have the fetch land on a private one; a certificate-like path satisfies ALLOWED_PATH_PATTERNS, and the browser-oriented Origin header can simply be forged by a direct client, with PROXY_SECRET being only an anti-abuse measure that ships in the public client bundle. Affected versions are 2.8.6 and earlier, fixed in 2.8.7; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assessment rates exploitation as high-complexity because it is gated on a non-default off-Cloudflare deployment that can actually route to internal addresses plus a DNS-rebinding timing race.
Amazon Kiro IDE versions before 1.0.242 can have attacker-controlled content written into the agent's auto-loaded global configuration directory (~/.kiro) when a user opens a crafted repository as an untrusted workspace and then sends any message to the agent. The flaw (CWE-829, inclusion of functionality from an untrusted control sphere) is an indirect prompt-injection chain: the agent's file-write tool is steered by repository-supplied instructions rather than by a direct network request, so the attacker does not need credentials (CVSS PR:N) but does depend on victim interaction (CVSS UI:A). Exploitation is not confirmed as active and no public exploit code was identified at time of analysis. Risk is rated High (vendor CVSS 4.0 base 8.6; independent CVSS 3.1 assessment AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L), with the dominant impact being integrity compromise of the developer's global Kiro configuration.
Missing authentication for a critical device function in Dell ThinOS 10 (all versions prior to SecurityAddon_2605.10.2766_T10) allows an unauthenticated remote attacker who can reach the exposed function to gain unauthorized access to it, reflected in a CVSS:3.1 base score of 8.6 under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L, where the high integrity impact dominates and confidentiality and availability effects are limited. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a genuine priority signal rather than a confirmed-exploited emergency. The main practical constraint on exploitation is network reachability: ThinOS endpoints are typically deployed inside enterprise/VDI network segments rather than exposed to the public internet, so meaningful risk arises when an attacker already has a foothold on a segment from which the affected service can be reached.
SQL injection in IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 allows remote unauthenticated attackers to view, add, modify, or delete back-end database information. The flaw (CWE-89) carries a CVSS 3.1 base score of 8.6, with an independent assessment vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, indicating high confidentiality and integrity impact and low availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a vendor patch is available via IBM support.
Server-side request forgery in Logto prior to 1.43.0 allows an authenticated tenant administrator to point outbound connections at internal, loopback, link-local, or cloud metadata addresses and read the resulting response back through API errors, crossing the deployment's network boundary. The flaw affects webhook delivery (including POST /api/hooks/:id/test), custom OAuth2 connectors that forward the OAuth access token in the Authorization header to an attacker-chosen userInfoEndpoint, OIDC SSO discovery/token/userinfo requests and jwksUri fetching, and SAML IdP metadata retrieval. Rated CVSS 4.0 8.5 (HIGH), driven by the high-privilege PR:H precondition and subsequent-system impacts; no public exploit code or confirmed active exploitation was identified at time of analysis, and the highest-impact outcome (credential theft) depends on whether the deployment exposes a reachable cloud metadata endpoint such as 169.254.169.254. Vendor-released patch: 1.43.0.
Taskview Community before 1.56.0 ships its OAuth 2.0 Dynamic Client Registration endpoint enabled by default and reachable without authentication, letting any remote unauthenticated attacker register a rogue OAuth client and obtain a working client_id and client_secret. The attacker then distributes a crafted authorization link that redirects to an attacker-controlled URI, and once the victim approves the consent screen the captured authorization code is exchanged for an access token granting full API access to that victim's account data. No public exploit identified at time of analysis, but with a CVSS 4.0 score of 8.5 and high confidentiality and integrity impact this is a high-priority account-takeover flaw; because exploitation depends on victim interaction it is delivered through phishing-style social engineering rather than a silent compromise.
Pre-shared keys used for IPsec tunnel configuration are recorded in cleartext inside application log files by Brocade SANnav versions before 3.0.1a, so anyone who can read those logs or an exported support bundle can recover credentials that protect network tunnels. The exposure is triggered only when IPsec policies are actually created or modified in SANnav, and the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a local, authenticated precondition rather than anonymous remote reach, meaning an insider or a holder of an exported bundle is the realistic actor. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so priority should be driven by the sensitivity of the logged keys and by how broadly log files and support bundles are shared; the vendor has addressed it in 3.0.1a.
Plaintext disclosure of administrative switch credentials and live session tokens in Brocade SANnav discovery-service log files lets anyone who can read those logs - or who is handed an exported support bundle - recover credentials that unlock the managed SAN fabric. All SANnav releases before 3.0.1a are affected, and the logging occurs under default configuration, so the only barrier is obtaining local read access to the log directory or bundle; the CVSS v3.1 assessment (8.5, AV:L/AC:L/PR:L/UI:N, C/I/A:H) and the vendor-published CVSS v4.0 vector (8.5) both place this at high severity because a successful read escalates into full compromise of managed switches and active user sessions. Exploitation is access-gated rather than remote or unauthenticated, and no public exploit identified at time of analysis; there is no CISA KEV listing for this CVE. Actual fabric compromise is a second step contingent on the disclosed credentials still being valid and the switches being reachable.
Converting an attacker-supplied .docx file with mammoth.js before 1.12.2 allows unauthenticated remote attackers to inject arbitrary properties into Object.prototype via the document's style definitions (CWE-1321 prototype pollution). In versions 1.11.0 through 1.12.1 the pollution can additionally be leveraged to read local server files and disclose them to the document supplier, but only where the application converts further documents in the same long-lived Node.js process and returns the converted HTML back to that party. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; vendor-released patch: 1.12.2.
Stored cross-site scripting in Snipe-IT versions before 8.7.0 lets an authenticated user holding only the customfields.create permission embed HTML/JavaScript in a CustomField.name value, which is rendered unescaped as an asset-list column header title and executes on page load for any user who opens a list tied to the affected fieldset. Since customfields.create is delegable to non-superusers, the injected script runs in a higher-privileged victim's session - the vendor advisory demonstrates an account with no permissions beyond customfields.create issuing authenticated requests in a superuser's session to grant itself superuser rights. Publicly available exploit code exists (reproduction steps and SSVC exploitation state of 'poc'), CISA's SSVC assessment rates technical impact as total, while EPSS remains low at 0.30% (21st percentile) and there is no KEV listing indicating confirmed actively exploited (CISA KEV) activity at time of analysis.
MrSteam iSteamX mobile app and hub users can have their device telemetry and control exposed because the pre-9/18/2026 AWS IoT policy allowed any authenticated app user to subscribe and publish to wildcard MQTT topics. An attacker with a valid iSteamX account and knowledge of the topic namespace can read other users' profile/device data, start or stop connected steam devices, and potentially cause scalding through unintended activation. The flaw requires low-privilege authentication (PR:L) and no victim interaction; it was remediated server-side before 9/18/2026, and no public exploit identified at time of analysis.
Kernel crashes in the Linux kernel's ACPI/AML interpreter can be triggered when acpi_ut_copy_simple_object() adds invalid references for local, argument, or debug objects while processing crafted ACPI tables. Affected versions include Linux kernels before 6.18.53 on the 6.18.y branch, before 6.12.111 on the 6.12.y branch, and upstream before the fix in 7.2; patching is available. No public exploit or KEV listing is identified at time of analysis, and although the published CVSS is 8.4, the independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H because exploitation requires privileged ACPI table injection or malicious firmware and realistically causes denial of service rather than code execution or disclosure.
Integer overflow in the Linux kernel's ACPICA AML interpreter allows memory corruption and a likely kernel crash when a crafted Mid() (three-operand) AML operation is evaluated with operand values chosen so that Index + Length wraps around. Affected are Linux kernels before 6.12.111, before 6.18.53, and before 7.2 in the mainline tree, as tracked under CPE cpe:2.3:a:linux:linux and EUVD-2026-86064. This is not remotely reachable: exploitation realistically requires either the ability to supply malicious ACPI firmware tables (DSDT/SSDT) or root/CAP_SYS_ADMIN-level access such as via debugfs custom_method, so an ordinary unprivileged local user cannot trigger it on a default configuration; no public exploit has been identified at time of analysis, and vendor patches are available. Note that the NVD CVSS of 8.4 (AV:L/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates real-world risk for this class of Linux-kernel ACPICA flaw; our assessment rates it AV:L/AC:H/PR:H/UI:N with impact dominated by kernel memory corruption and denial of service rather than a realistic full confidentiality/integrity compromise.
The Linux kernel's ACPICA interpreter fails to validate the object type of handler objects in acpi_ev_has_default_handler() and acpi_ev_find_region_handler(), so malformed or crafted ACPI/AML tables can drive those paths to operate on a handler of an unexpected type. Exploitation is local and practical only for an attacker who can supply the AML - most plausibly by overriding ACPI tables via CONFIG_ACPI_CONFIGFS table loading (which normally requires CAP_SYS_ADMIN) or by controlling platform firmware/DSDT, and no public exploit or confirmed active exploitation was identified at time of analysis. Our independent assessment rates real-world risk substantially below the published NVD CVSS 3.1 score of 8.4, since the attack is local, depends on a non-default custom-table-loading configuration, and yields integrity/availability impact rather than code execution.
A use-after-free in the Linux kernel's ACPICA AML interpreter, reached through acpi_ds_terminate_control_method(), fails to clear references to a control method's locals and arguments on termination, leaving dangling pointers that can crash the kernel (denial of service). Affected are kernels built from the pre-fix code through the stable branches below 6.12.111 and 6.18.53 and the 7.2 line, with the CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* applying to unpatched builds; triggering requires control of ACPI/AML content - malicious platform firmware supplying crafted DSDT/SSDT tables, or a local user with CAP_SYS_ADMIN injecting AML via configfs/ACPI custom_method - so there is no remote or unprivileged path on default configurations, and the practical outcome is predominantly a kernel crash rather than reliable code execution. Vendor-released patches are 6.12.111, 6.18.53 and 7.2; no public exploit identified at time of analysis.
Authorization bypass in the ServiceNow AI Platform lets any authenticated user with an ordinary low-privilege account read records and data they are not entitled to, and because the flaw crosses a security scope boundary it can also enable further unintended access on resources beyond the vulnerable component. Exploitation is network-reachable and requires only a valid low-privilege session - no elevated role, no user interaction, and no special client configuration - so the practical attack path is a compromised, internal, or low-tier tenant account rather than an anonymous attacker. ServiceNow has already remediated hosted instances and distributed the update to partners and self-hosted customers, and the vendor states it is not aware of malicious exploitation; no public exploit code or CISA KEV entry was identified at time of analysis, leaving unpatched self-hosted and partner deployments as the primary exposure.
A double-free in the Linux kernel's virtio-fs driver can corrupt kernel memory when a virtiofs device advertises more request queues than its transport actually provides, causing virtio_find_vqs() to fail during probe and the cleanup path to free fs->vqs and fs->mq_map twice. The flaw is reachable only from the device/hypervisor side: a guest must be running with a malicious or malfunctioning virtio-fs device, and the bug triggers solely on the probe-failure cleanup path, so it is not reachable in default configurations that do not attach a hostile virtio-fs device. Independent assessment rates this CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H (local, high attack complexity, low integrity and high availability impact), which is materially lower and narrower than the published CVSS 8.4 that assumes PR:N and full integrity impact; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and EUVD's 'Information Disclosure' tag conflicts with the double-free / availability-focused nature of the defect.
Improper TLS certificate validation in Dell ThinOS 10 endpoints running SecurityAddon builds prior to 2605.10.2766_T10 lets an adjacent-network attacker bypass a protection mechanism and gain unauthorized access to client communications and credentials. The flaw is rated CVSS 8.3 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), meaning no authentication or user interaction is required, but the attacker must already sit on the same Layer-2 segment, VLAN, or Wi-Fi network as the thin client to position themselves for a machine-in-the-middle interception. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuine elevated-priority issue rather than an emergency - the practical risk is driven by how flat and trusted the thin-client network segment is.
Attackers can inject arbitrary additional servers into a PyMongo (MongoDB Python Driver) client's connection topology by smuggling the percent-encoded form of a host-list delimiter (for example %2C) inside a hostname value that an application places into a connection string, because PyMongo decodes percent-escapes before it splits the host list. The request is unauthenticated (CVSS 4.0 PR:N) but carries an attack-requirement prerequisite (AT:P): the target application must build a URI at runtime from a host the attacker can influence, meaning static or hardcoded connection strings are not exploitable. MongoDB's own CVSS 4.0 rating of 8.3 (High) is driven by a high integrity impact - the client may route its authentication exchange and subsequent database operations to the rogue host, which can observe limited information and return altered query results. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in PyMongo 4.18.2.
Heap out-of-bounds write in the MongoDB C Driver (libmongoc) allows an unauthenticated attacker who controls DNS resolution and the responses of hosts in a client's connection string to corrupt memory and crash the application. Exploitation requires a privileged network position (MITM or rogue server) and results in denial of service, not code execution or data disclosure. Patched versions 1.30.12 and 2.5.5 are available; no public exploit code or active exploitation has been identified at time of analysis.
A stack-based buffer overflow in Altera Trusted Firmware (the ARM Trusted Firmware-A port for Altera/Intel SoC FPGA Hard Processor Systems) through socfpga_v2.14.0 lets a high-privileged local attacker corrupt a fixed-size stack buffer inside the secure monitor and cross the normal-world-to-secure-world trust boundary. The attacker must already control the normal-world OS on the affected HPS device (CVSS vector PR:H, AV:L, UI:N), so this is an access-gated escalation primitive rather than a remotely reachable issue; the assessed impact is high integrity and availability loss with limited confidentiality exposure in the secure world (CVSS 8.3). No public exploit code has been identified at time of analysis, and no evidence of active exploitation was provided by the vendor or in the supplied intelligence.
Local, high-privileged attackers who can invoke the ARM Trusted Firmware secure-monitor interface on Altera SoCFPGA Hard Processor System (HPS) devices can exploit an untrusted pointer dereference (CWE-822) in Trusted Firmware builds through socfpga_v2.14.0, achieving high integrity and availability impact within the secure world while confidentiality impact is limited. Exploitation requires prior privileged code execution in the normal world to pass a crafted pointer via SMC calls; there is no remote or network-facing exposure and no user interaction. No public exploit code or confirmed active exploitation was identified at the time of analysis.
Privileged local code running in the non-secure world of an Altera SoC FPGA HPS device can make Altera Trusted Firmware dereference an attacker-supplied pointer, corrupting firmware memory protections and crossing the normal/secure-world boundary in all releases up to and including socfpga_v2.14.0. Rated CVSS 8.3 (v4.0) with high integrity and availability impact, the flaw is real but narrow in scope: exploitation requires an already-high-privileged, locally-positioned attacker (PR:H, AV:L, no user interaction), so realistic exposure is limited to actors who have already compromised the running system or its supply chain. No public exploit code has been identified at time of analysis, and neither CISA KEV listing, EPSS score, nor a confirmed patched version was provided in the available data.
Out-of-bounds read in Altera Trusted Firmware for SoCFPGA hard processor systems (all builds through socfpga_v2.14.0) lets an attacker who already holds high privileges in the normal world corrupt or read beyond intended memory bounds inside the secure monitor, enabling escalation from the non-secure HPS environment into the secure world. Exploitation requires local access and pre-existing root-level code execution (CVSS PR:H), so it is not a remote or pre-authentication vector; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. The independent assessment rates this a genuine but access-limited priority given the privileged local precondition.
Local privilege escalation in Altera Trusted Firmware (TF-A) on socfpga Hard Processor Systems lets an attacker who already holds high privileges on the normal-world OS drive an out-of-bounds read inside the secure monitor, exposing and corrupting secure-world memory and escalating execution context, in all versions through socfpga_v2.14.0. The flaw is reachable only by invoking secure-monitor calls from an already-privileged local context, with no network vector and no user interaction, but because it crosses the normal-world/secure-world boundary it yields high integrity and availability impact beyond the vulnerable component (CVSS 4.0 base 8.3; independent assessment CVSS 3.1 8.3). No public exploit code has been identified and the issue is not listed in CISA KEV, so exposure is confined to devices where an adversary has already achieved privileged local execution.
Privilege-gated out-of-bounds write in Altera Trusted Firmware (the SoCFPGA port of ARM Trusted Firmware-A) through socfpga_v2.14.0 allows an attacker who already holds high privileges in the normal world to corrupt memory in the secure firmware, degrading the integrity and availability of the trusted execution environment and extending the scope of compromise beyond the attacker's original context. The root cause is an improperly configured or implemented memory protection (CWE-787) that is reachable only from a local, already-privileged position on Altera/Intel SoC FPGA Hard Processor System platforms, so it is not remotely reachable and does not affect general-purpose systems; no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV).
Buffer overflow in Altera Trusted Firmware (ARM Trusted Firmware-A) running on the Hard Processor System (HPS) of socfpga FPGA SoCs lets a locally-positioned attacker who already holds high privileges corrupt firmware memory through an incorrectly calculated buffer size. All Trusted Firmware releases up to and including the socfpga_v2.14.0 branch are affected, and exploitation requires local access combined with high-privileged normal-world code execution capable of reaching the firmware's service interface - the flaw is not remotely reachable and cannot be triggered by an unprivileged user. There is no confirmed active exploitation and no public exploit identified at time of analysis; the assessed risk is primarily post-compromise privilege and trust escalation on the specific embedded hardware, with real-world exposure constrained by the local, high-privilege prerequisite.
A stack-based buffer overflow in Altera's Trusted Firmware port for SoC FPGA devices (the SoCFPGA branch through socfpga_v2.14.0) lets a local attacker who already controls the non-secure rich OS - root or kernel on the HPS ARM cores - corrupt the secure monitor's stack via the SMC interface and potentially escalate across the trust boundary into the secure world. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H) confirms this is an access-gated privilege/trust-boundary escalation requiring an existing high-privileged foothold, not a remotely reachable default-configuration flaw; impact to integrity and availability is high and scope is changed, but confidentiality impact is limited. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV).
MFA bypass in ZITADEL Login V2 (versions 4.0.0 through 4.16.0) lets an attacker who already holds a victim's valid first-factor password complete an OIDC or SAML login to a customer application without ever satisfying the user's voluntarily enrolled TOTP, OTP, or U2F second factor. The browser session created after password verification is reused when the login flow is abandoned at the MFA step and restarted, and the pre-fix session-validity check only demanded MFA when the organization had Force MFA or Force MFA for local users enabled. The assessed CVSS 3.1 vector is 8.2 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflecting the requirement of the victim's password; Login V1, the ZITADEL Console, Management/Admin APIs, and user self-management are unaffected, a vendor patch is available as 4.16.1, and no public exploit code has been identified at time of analysis.
An authorization gap in OpenWA before 0.23.5 allows a low-privilege VIEWER API key to receive the `session.qr` pairing event over the /events WebSocket gateway, even though the equivalent REST endpoint GET /api/sessions/{sessionId}/qr enforces the OPERATOR role. When a session is in the waiting-to-be-paired state, the leaked QR code lets the key holder link an external device to the linked WhatsApp account, after which they can read and send messages outside OpenWA and outside its audit trail. Exploitation is authenticated (CVSS PR:L) and gated by a transient pairing window that drives the high attack-complexity rating (AC:H); no public exploit code identified at time of analysis. Vendor-released patch: 0.23.5.
Out-of-bounds read and unbounded iteration in the Linux kernel's NVMe driver allow a local attacker who controls or emulates an NVMe device advertising Flexible Data Placement (FDP) to crash the kernel and potentially disclose adjacent memory contents. Only kernels before 6.18.53 and the 7.x line before 7.2 are affected, and exploitation is not reachable purely over a network: per the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H the attacker needs an authenticated local foothold (PR:L) plus a malicious, tampered or emulated NVMe controller, so the published CVSS 8.2 (AV:N/AC:L/PR:N) overstates both reachability and required complexity. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
Stored cross-site scripting in phpMyFAQ versions prior to 4.2.0-alpha allows unauthenticated remote attackers, as well as low-privileged registered users, to plant arbitrary JavaScript in user-submitted FAQ entries that executes in an administrator's browser when the entry is reviewed or edited, enabling admin session theft and full account takeover. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, 8.2 High) reflects that no authentication is needed to submit the payload, but exploitation succeeds only when an administrator later interacts with the attacker-controlled content; the scope change indicates the compromise crosses from the unauthenticated submitter into the privileged admin session. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE, though the default community-submission workflow in affected releases makes the attack path straightforward once a target is identified.
Failed connection acceptance in the Linux kernel's svcrdma transport (server-side NFS-over-RDMA) can corrupt reference-count and XArray registration state, leaking transport memory and mismatched device references. The bug is reachable only on hosts running the kernel NFS server over an RDMA fabric (InfiniBand or RoCE) where svc_rdma_accept() takes its error path before rpcrdma_rn_register() succeeds, and no public exploit has been identified at time of analysis. The assessed impact is primarily availability (repeated failed accepts leak svcxprt_rdma and its net/ns_tracker, leading to memory exhaustion) with a limited integrity effect from an erroneous erase of another caller's slot-0 entry; the CVSS vector carries PR:N, so no authentication is required, but attacks must originate from the adjacent RDMA fabric.
Unauthenticated attackers can bypass TOTP-based two-factor authentication in phpMyFAQ 3.2.0 through 4.1.5 and take over any 2FA-enabled account, including administrator accounts, by submitting a victim's numeric user ID together with a valid or brute-forced six-digit code to the public 2FA verification flow in index.php without ever supplying the account password. The flaw rates CVSS 3.1 base 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H); the high attack complexity reflects the cost of guessing a TOTP code inside its rolling validity window, while the practical enabler pre-patch is the complete absence of any failed-attempt limit and the fact that token verification was never bound to a prior password-authenticated session. There is no public exploit identified at time of analysis and no CISA KEV listing, but exploitation requires only that the targeted account have 2FA enabled, making the exposure significant for deployments that adopted TOTP. Vendor-released patch: 4.1.6.
An out-of-bounds slab read in the Linux kernel's SMB/CIFS client allows an attacker-controlled SMB1 server to make a victim's kernel read past the end of a kmalloc'd response buffer when that victim lists a directory on a mounted share. cifs_filldir() trusts the server-supplied de.namelen field from a TRANS2_FIND_FIRST/FIND_NEXT response without verifying that the name stays inside the response buffer, so an oversized FileNameLength drives memchr() (via filldir64()/verify_dirent_name()) beyond the allocation and produces a KASAN slab-out-of-bounds report; CVSS 3.1 is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H), with high confidentiality and availability impact from the out-of-bounds read. Exploitation requires the victim to mount a share from a hostile server using the deprecated SMB1 dialect and then browse it, so user interaction is required; no public exploit identified at time of analysis.
Permission widening in the Linux kernel's ksmbd in-kernel SMB3 server allows an authenticated SMB session holder to create files and directories whose inherited POSIX ACLs are recomputed incorrectly, discarding restrictive ACL_MASK entries that the parent directory's default ACL was intended to enforce, so newly created objects can end up more permissive than the parent's policy allows. The bug affects the ksmbd code shipped in Linux kernels before 6.18.53 and before 6.12.111, and in practice only matters where an SMB share exports a parent directory with a restrictive default POSIX ACL; userspace Samba deployments are unaffected. Vendor-released patches exist (6.18.53, 6.12.111 and 7.2) and no public exploit code has been identified at time of analysis.
A race condition in the Linux kernel's in-kernel NFS server (nfsd) allows two concurrent callers of nfsd4_end_grace() to both see the non-atomic grace_ended boolean as unset during the NFSv4 grace period following server (re)start, causing both to run the grace-done drain of reclaim_str_hashtbl and corrupt the list with double-frees and use-after-free reads. The defect dates to Linux 5.2 and is resolved by vendor-released patches in Linux 7.2.4 and 7.3-rc1; no public exploit code has been identified at time of analysis, and there is no KEV entry or EPSS data indicating active exploitation. Exploitation realistically requires a permitted NFSv4 client of an export and winning a tight, attacker-uncontrolled timing race between the laundromat kworker and a RECLAIM_COMPLETE compound, so the published CVSS 8.1 vector overstates real-world risk; the assessed vector is AC:H/PR:L with limited confidentiality and integrity impact and high availability impact, and hosts that do not run nfsd are unaffected.
Path traversal in the pulpcore content upload API allows an authenticated user holding only low-privilege file-repository permissions to read arbitrary files accessible to the Pulp server process by submitting a crafted 'file:' URL through the 'file_url' parameter, which is dispatched to the file downloader despite an intended scheme check. Baseline impact is confidentiality loss on the Pulp host; in deployments that include Pulp Container the same flaw escalates to theft of the container registry token signing private key, enabling forged bearer tokens and unauthorized access to every private container repository in the registry. Downstream products embedding pulpcore are affected, including Red Hat Satellite 6, Red Hat Ansible Automation Platform 2, and Red Hat Update Infrastructure 4/5. There is no public exploit identified at time of analysis, and EPSS data was not provided; Red Hat tracks the issue under advisory https://access.redhat.com/security/cve/CVE-2026-90959.
Improper access-mask computation in the Linux kernel's in-kernel SMB3 server (ksmbd) lets an authenticated SMB client obtain file access rights that the stored DACL never granted to it, and can also wrongly deny access that should have been permitted. The maximal-access calculation folds in masks from every ACE in the ACL regardless of whether the ACE's SID applies to the caller, so a client issuing a MAXIMUM_ALLOWED request against a share whose files carry ACEs for other principals can be granted rights belonging to an unrelated user, yielding high confidentiality and integrity impact (CVSS 3.1 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N); SIM, treating an Authenticated Users (S-1-5-11) ACE inconsistently also causes spurious STATUS_ACCESS_DENIED errors. Exploitation requires ksmbd to be running with an exported share and a valid authenticated SMB session; no public exploit code has been identified at time of analysis, and vendor-released fixes ship in Linux 7.2.6 (and 7.3-rc1).
Improper authorization in Dell Rugged Control Center (RCC) builds prior to 5.2.206 allows a low-privileged local user to escalate privileges on an affected rugged Dell endpoint. The vendor rates this CVSS 8.1 with a local attack vector, low privileges required, scope change, and high integrity and availability impact (AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H), meaning an attacker or malware must already hold a foothold on the specific rugged device - it is not remotely or unauthenticated exploitable. No public exploit code or confirmed active exploitation was identified at time of analysis, and Dell has released a fixed build (5.2.206) via advisory DSA-2026-410.
Server-side request forgery in TREK before 3.3.0 allows an authenticated user (CVSS PR:L) to persist an attacker-controlled llm_base_url through the settings API whenever the LLM_PARSING feature is enabled, and that stored URL is later fetched by the server with no SSRF guard. Reaching the vulnerable path additionally requires write permission on the target trip instance, after which the server can be pointed at internal services or link-local cloud metadata endpoints (for example 169.254.169.254), with upstream error text reflected back in parsing warnings, creating a credible path to infrastructure credential disclosure and, per the vendor's assessment, modification of protected cloud resources. No public exploit code has been identified at time of analysis, and independent assessment rates the impact as high confidentiality but only low integrity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), so exploitation is bounded by feature configuration, trip permissions, and network egress controls.