Unauthenticated attackers can delete arbitrary product reviews in mall4j through 4.0 by sending DELETE requests to the /prodComm endpoint in ProdCommController, which applies no authentication or authorization checks to the prodCommId parameter (CWE-306). Publicly available exploit code exists, and no credentials or user interaction are required; the only prerequisite is knowing or enumerating a valid review ID. The impact is limited to integrity tampering with review records, with no confidentiality or availability loss assessed in our independent review, making this a low-severity data-tampering issue rather than a high-impact compromise.
Denial of service in Sliver C2 framework 1.7.7 and earlier allows an attacker who controls a compromised implant session to crash the entire teamserver by returning a malformed or zero-length Download response, disrupting all connected operators. Publicly available exploit code exists, but the provided data does not indicate confirmed active exploitation (CISA KEV). The CVSS 4.0 score is 6.8 and the independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H, so this is a bounded availability impact requiring an established implant session and an operator-initiated download.
Unauthenticated shipment-tracking disclosure in mall4j through version 4.0 lets remote attackers retrieve carrier names, waybill numbers, and full logistics trails for any order by calling the yami-shop-api DeliveryController checkDelivery endpoint with an order number and no credentials. Because the handler performs neither authentication nor ownership verification, any caller who can supply a valid order number - and sequential or guessable numbering would permit enumeration - can harvest tracking data in bulk. Publicly available exploit code exists (a proof-of-concept Python script), but the issue is not confirmed as actively exploited; per the independent assessment this is a real but low-to-moderate priority information-disclosure problem, since impact is limited to confidentiality of shipment metadata with no integrity or availability effects.
Configuration injection in PyPA virtualenv before 21.7.11 lets a line boundary embedded in a prompt value inject extra keys into the generated pyvenv.cfg, potentially overriding the 'home' key so a subsequent environment resolves to an attacker-chosen base interpreter. The flaw is conditional rather than remotely exploitable: it is assessed as local (AV:L) with user interaction (UI:R per the independent assessment, UI:P in the CVSS 4.0 vector) and only has security consequence when the prompt value originates outside the operator's trust boundary - for example an automated venv-creation pipeline or CI job that derives --prompt or VIRTUALENV_PROMPT from an untrusted project name or shared configuration; a prompt typed directly by the operator merely corrupts the operator's own environment. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS/KEV signals were not provided; version 21.7.11 fixes the issue, and the referenced upstream PR adds fuzz and property tests asserting the invariant that a written value can never be read back as extra configuration keys.
Email authentication bypass in OpenDMARC up to 1.4.2 allows remote unauthenticated attackers to spoof sender domains by exploiting a misordered domain-setting sequence in the SPF Macro Handler, causing SPF-backed DMARC checks to evaluate the attacker-controlled HELO domain instead of the envelope MAIL FROM domain. Publicly available exploit code exists, though successful exploitation depends on the libspf2 version (some versions treat the first-set domain as the SPF check domain). This is a low-to-medium severity email-authentication flaw with no confidentiality or availability impact, only limited integrity impact.
DMARC authentication bypass in Trusted Domain Project OpenDMARC through 1.4.2 lets a remote attacker defeat the DMARC anti-spoofing check by supplying a multi-record DMARC TXT set that the Multi-Record Set Handler evaluates more permissively than RFC 7489 requires. The affected mail server must run OpenDMARC as its DMARC verifier and the attacker must control or influence DNS for the spoofed sender domain; no credentials or user interaction are required (PR:N/UI:N), though the resulting impact is limited to forged mail passing DMARC rather than host compromise. Publicly available exploit code exists, the vendor was contacted early and did not respond, and no vendor-released patch was identified at time of analysis.
Missing authentication in the Circleback webhook handler of MODSetter SurfSense (up to and including 2.0.3) lets any remote party who can reach the endpoint submit forged webhook payloads without credentials, yielding low-impact confidentiality, integrity and availability effects scoped to whatever that webhook processes. Exploitation requires the Circleback integration to be enabled and network-reachable; no user interaction is needed and publicly available exploit code exists, though there is no evidence of confirmed active exploitation. With a CVSS 4.0 base score of 6.9 (E:P) and no vendor response to the disclosure, this is a modest-impact but easily testable exposure that should be closed by removing or firewalling the endpoint.
Rebuild instances up to and including 4.4.7 and 4.5.0-beta5 expose a login endpoint (/user/login) that fails to properly validate authentication, allowing unauthenticated remote attackers to bypass the intended login control (CWE-287). Exploitation requires no credentials, no user interaction, and low complexity (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), so any internet- or network-reachable Rebuild login page in its default configuration is a viable target. Publicly available exploit code exists and the vulnerability is documented by VulDB with a linked GitHub POC, but it has not been confirmed as actively exploited (not in CISA KEV); all impacts are rated Low, so successful abuse appears to yield partial access rather than full administrative takeover. The vendor was contacted but did not respond, and no vendor-released patch has been identified, making exposure reduction the primary near-term defense.
Integer overflow in OpenDMARC through 1.4.2 allows unauthenticated remote attackers to corrupt DMARC policy-percentage handling by supplying a crafted 'pct=' value in a DMARC DNS TXT record. Publicly available exploit code exists, but the vulnerability is not confirmed actively exploited (CISA KEV). Exploitation requires the target to be actively performing DMARC verification on inbound mail and the attacker to control a queried domain's DMARC record; assessed impact is limited to integrity of policy-percentage handling and minor availability disruption, not RCE or data disclosure.
Missing authorization in REBUILD up to 4.4.11 allows unauthenticated remote attackers to manipulate the url or fileKey parameter sent to /commons/file-editor-save, enabling unauthorized read and write actions against the file-editor resource. Publicly available exploit code exists, but no fixed version has been published and the vendor did not respond to the disclosure. The issue is medium severity with low confidentiality, integrity, and availability impact; priority depends on whether the Rebuild web interface is exposed.
Improper authorization in the api-admin backend of realjerrytang tacomall 1.0.0 lets remote attackers create organization-staff records with attacker-controlled isAdmin and jobId values, bypassing the privilege checks that OrgStaffServiceImpl.add is supposed to enforce. Publicly available exploit code exists (a GitHub proof-of-concept walking through the crafted request), and the upstream advisory assigns a CVSS 4.0 score of 6.9 with an E:P (proof-of-concept) exploit-maturity rating; the flaw is not listed in CISA KEV, so there is no confirmation of active exploitation. Our independent assessment is more conservative on prerequisites and impact, rating the issue low priority: exploitation realistically requires at least a low-privileged authenticated session on the management API rather than anonymous access, and confidentiality, integrity, and availability impacts are all limited given the niche open-source codebase and small deployment base.
SQL injection in mahonelau kykms (rolling release up to commit 8f130c2d85842d5b44caae78cc46d65e505949f7) allows remote attackers to inject arbitrary SQL through the column argument of QueryGenerator.doMultiFieldsOrder, a multi-field ordering routine in the SqlInjectionUtil component. The flaw is CWE-89 improper neutralization of SQL commands and, because the injection lands in an ORDER BY clause, exploitation is typically limited to blind/boolean or error-based extraction rather than direct UNION dumping. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation at time of analysis. The provided CVSS 4.0 vector claims network reachability with no privileges (PR:N) and no user interaction, yet the independent assessment notes that JeecgBoot-style deployments commonly authenticate sortable data-query endpoints, so a valid session may be required in practice - verify against the specific kykms build.
Disabled mall4j accounts (through 4.0) can indefinitely renew their sessions by calling POST /token/refresh, because the refresh flow issues a new token without re-checking the account's enabled flag, letting a user that an administrator deactivated retain the access they already had. The attacker must already hold a valid, non-expired refresh token obtained before deactivation, so this is an authenticated access-control persistence flaw (CVSS 5.3, CWE-613), not an unauthenticated bypass or a route to new accounts. Publicly available exploit code exists (a proof-of-concept Python script), but no active exploitation has been confirmed (not in CISA KEV), and the practical impact is limited to preserving prior access rather than escalating privileges.
Vertical privilege escalation in mall4j through 4.0 lets any self-registered storefront customer reach back-office administrative endpoints - including menu listings, file uploads, and configuration routes - by presenting the same sa-token session that was issued for the customer storefront. The flaw (CWE-287 improper authentication) is that the session validation layer never checks the sysType field that is supposed to separate customer from admin identity, so only endpoints already guarded by @PreAuthorize remain safe. Independently assessed at CVSS 5.3 with limited confidentiality and integrity impact, this is a genuine but moderate-priority privilege-escalation bug; publicly available exploit code exists, and there is no KEV-listed evidence of confirmed active exploitation.
Information disclosure in GitLab Enterprise Edition allows an authenticated user with guest-level permissions to read private security policy content that they are not authorized to access. The flaw affects GitLab EE from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1, and it is rated CVSS 4.3 with confidentiality-only impact. Publicly available exploit code exists, but CISA KEV does not list this issue as actively exploited at time of analysis.
Authenticated users on affected GitLab CE/EE releases can read the titles and descriptions of private child issues from projects they are not members of, because authorization checks are skipped when traversing work items linked from epics they are permitted to see. The flaw affects GitLab CE/EE 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1, and is rated CVSS 3.1 4.3 (low-moderate, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Publicly available exploit code exists (referenced HackerOne report), but there is no CISA KEV listing indicating confirmed active exploitation; the impact is confined to read-only disclosure of issue text, with no write access, credential exposure, or code execution.
Unauthenticated remote attackers can tamper with uploaded file metadata in Balbooa Forms for Joomla versions before 2.4.3.4 by exploiting insufficient validation of client-supplied filenames and display names during the final form submission. This allows cross-session file claiming and potential path traversal via the getFilePath() function, though the impact is limited to integrity with no confidentiality or availability loss. No public exploit code or active exploitation has been identified, and the CVSS 4.0 score of 6.9 overstates the real-world risk per independent assessment.
Unauthenticated guests can delete other users' temporary file attachments on Joomla sites running the Balbooa Forms extension below version 2.4.3.4. The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file; the controller does verify a Joomla session token, but the model never ties that ID to the uploading session, user, form, upload field, or temporary state, so any guest can obtain a token for their own session and then destroy arbitrary pending uploads by enumerating valid integer IDs. Impact is confined to integrity of temporary/pending attachment records and files (CVSS 3.1 C:N/I:L/A:N, no confidentiality or availability effect), and no public exploit code has been identified at time of analysis.
A malicious or compromised HTTP server can pin the CPU and hang a Python client indefinitely by returning a chunked, deflate-encoded response that carries trailing bytes after the compressed stream, causing urllib3 2.6.2 through 2.7.x to loop without progress. The hang is reachable only on the client streaming path - HTTPResponse.stream() or HTTPResponse.read_chunked() with content decoding enabled (decode_content=True) and a positive finite chunk size (amt=N) - where the Deflate decoder retains the trailing bytes as unconsumed input after end-of-stream and re-decodes them forever; because no further socket read occurs, network read timeouts never interrupt the loop. Impact is availability-only (no confidentiality or integrity effect), unauthenticated from the network per the reported vector (PR:N), and no public exploit identified at time of analysis; exploitation additionally requires the attacker to control or compromise the endpoint the client connects to.
Improper access-control checks in Joomla's tagged-item output let unauthenticated visitors read content items that belong to access-restricted categories, exposing only article content (confidentiality-only) with no modification or denial-of-service impact. Affected releases are Joomla! CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3; exploitation requires no authentication and no user interaction (PR:N/UI:N in both the supplied CVSS 4.0 vector and our assessed CVSS 3.1 vector), so any anonymous visitor can trigger it on a default site that renders tagged items where tags span categories with differing view levels. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited; the practical risk is bounded because disclosure is limited to tagged items in restricted categories, which is why our independent assessment treats this as a genuine but low-to-moderate priority issue.
Cross-site scripting in the HTML mail template feature of Joomla CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 allows attacker-influenced data to reach template fields that are emitted without escaping, so crafted content can execute script when the resulting HTML email is rendered in a browser-based preview or webmail client. Our assessment treats exploitation as requiring the HTML mail template feature to be in use plus an authenticated, operator-level party able to influence template fields and a victim who renders the message, even though the vendor's CVSS 4.0 vector carries PR:N/UI:N; the deliverability of the payload is further limited because many mail clients strip or sanitize inline script. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Joomla has published advisory 20260908 covering the fix.
Unauthenticated remote requests can create lowest-privilege guest-group user accounts on Joomla CMS versions 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3, because the core profile.save controller never checks whether the requester is logged in, so the account-creation path succeeds even on sites where public user registration has been turned off. No CISA KEV listing and no public exploit code were identified at time of analysis. The vendor rates this 6.9 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N) with a confidentiality-only low impact, while our independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:N/I:L/A:N; both agree the attack is remote, unauthenticated and requires no user interaction or special configuration, and that the damage is bounded because only the lowest-privilege account level can be created, never an administrative or full registered-user account.
Server-side request forgery in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows unauthenticated remote attackers to invoke the device's built-in network-check/connectivity-probe function and make it issue requests to arbitrary hosts reachable from the camera's internal network. The resulting impact is limited to low-confidentiality disclosure -- internal host enumeration and small data leaks via DNS resolution -- with no integrity or availability effect, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; the issue was reported through CISA's ICS-CERT program as ICSA-26-272-05.
Path traversal in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls a scanned VMDK disk image to write arbitrary files outside the extractor's destination directory on the host running the scan, corrupting or overwriting host files. The CVSS 4.0 base score of 6.9 (medium) reflects a genuine but constrained risk profile: the CVSS vector shows PR:N (no host credentials needed) but also AV:L and UI:P/UI:R, so a user or automation must actually run a scan against the malicious image, and impact scales with the privileges of the scanner process (most dangerous in root-running CI or container pipelines). No public exploit code or active exploitation has been identified at time of analysis, and the issue is addressed upstream by PR #2030.
The FTP client component of Eclipse ThreadX NetX Duo trusts the IPv4 address returned in a server's 227 PASV reply, performing only parse and non-zero checks before opening a data connection to that address, which lets a malicious or man-in-the-middle FTP server redirect the client's data transfer to any host it names (CWE-918 server-side request forgery class). Only the IPv4 passive-mode path is affected; the client must itself initiate an FTP control session to a hostile or intercepted endpoint and then request a passive transfer. No authentication or user interaction beyond starting the session is required (CVSS:4.0 base 6.9; independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N), and no public exploit code or active exploitation has been identified at time of analysis.
An out-of-bounds read in the Eclipse NetX Duo TFTP client lets an attacker-controlled or man-in-the-middle TFTP server return a short ERROR packet that causes the client to read up to 64 bytes past the received datagram. The vulnerable receive paths are in the TFTP client add-on and an unauthenticated remote attacker can trigger the condition when a device initiates a TFTP read or open against the attacker's server, potentially disclosing adjacent packet-pool memory if the application logs or displays nx_tftp_client_error_string, and potentially causing a crash. No public exploit identified at time of analysis, and the provided advisory points to a code-level bounds-check fix; risk is moderate rather than critical because exploitation requires the client-initiated, attacker-as-server model and yields no write primitive.
Out-of-bounds heap reads in CTranslate2's binary model loader affect all releases before 4.8.1, allowing an attacker who supplies a crafted model file to crash the loading process or disclose adjacent heap memory contents. The flaw is in the model deserialization path (src/models/model.cc), where string fields are read without validating their declared length or null termination; exploitation is local and requires the victim to load an untrusted .bin model through the library's loader. The vendor has released a fix in 4.8.1, and at time of analysis there is confirmed actively exploited status absent (no CISA KEV listing) and no public exploit identified at time of analysis; severity scores cluster around medium (CVSS 4.0 base 6.9; independent assessment CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H), reflecting a genuine memory-safety flaw but a low-to-moderate real-world priority concentrated in workflows that ingest third-party models.
Cross-site request forgery in OpenSolution Quick.Cart's admin configuration panel allows an attacker-controlled web page to silently submit a POST request that rewrites the administrator's login and password the moment a logged-in admin visits it. The product's only built-in defense is a referer-header check that is trivially bypassed by manipulating or omitting the referer, and the vendor notes that every form in the software is potentially vulnerable, so any deployment running a pre-6.7 version is exposed. Exploitation requires the admin to hold a live authenticated session and to actively browse attacker-supplied content (UI:A); no confirmed active exploitation or public exploit code has been identified at time of analysis, and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (high integrity impact, no confidentiality or availability impact).
PKCE verifier validation in oauthlib 3.0.0 through 3.x compares the client-supplied code_verifier against the stored challenge using Python's short-circuiting == operator, producing a measurable timing oracle (CWE-208) that could in principle allow character-by-character recovery of the verifier. The attack is remote and unauthenticated per the assessed vector (AV:N/PR:N) but requires user interaction and is heavily constrained: the attacker must first independently obtain a valid single-use authorization_code, then issue and precisely time a very large volume of /token requests within that code's short lifetime, with nanosecond-scale per-call deltas in practice dwarfed by normal network jitter. At CVSS 6.8 (AC:H) with no public exploit code and no evidence of active exploitation, this is a genuine defense-in-depth defect rather than a practical account-takeover path, and it is fully resolved by upgrading to oauthlib 4.0.0.
Improper access control in the firmware control-register interface of NVIDIA ConnectX (ConnectX-5 plus GA, LTS23 and LTS24 firmware branches) and BlueField (GA, LTS23, LTS24) adapters allows a user who already holds an SR-IOV virtual function (VF) on the device to send a crafted command to the firmware and disturb the register interface, producing a denial-of-service condition on the affected adapter and, per the scope-change vector, potentially on components beyond it. The issue is reachable from an adjacent network position with low complexity but requires a legitimate VF foothold (PR:L), and the impact is availability-only - no confidentiality or integrity loss is described. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and NVIDIA's own advisory is the authoritative source for fixed firmware releases. EPSS and KEV signals are absent from the supplied intelligence.
An out-of-bounds read in Zephyr's MCUmgr SMP-over-console transport (subsys/mgmt/mcumgr/transport/src/serial_util.c) lets a single 7-byte, unauthenticated console line underflow a net_buf length field and hand the SMP layer a bogus ~65 KB payload window over a buffer whose data area defaults to 384 bytes. The flaw affects builds that enable CONFIG_MCUMGR_TRANSPORT_UART (smp_uart.c) or CONFIG_MCUMGR_TRANSPORT_SHELL (smp_shell.c), both of which select MCUMGR_TRANSPORT_SERIAL_HAS_SMP_OVER_CONSOLE; the test-only CONFIG_MCUMGR_TRANSPORT_DUMMY loopback carries the same pattern but has no external input path and is not exploitable. Because exploitation needs only write access to the management console - on many boards an exposed USB CDC-ACM port rather than a bare UART header - the practical impact is a faulted MCUmgr thread (denial of service) plus possible limited memory disclosure via the default-enabled os echo handler; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Cross-site scripting (CWE-79) in Toptech Systems' TMS7 terminal management platform (and the related TopHat product) allows an authenticated attacker to inject JavaScript that executes in a second application user's browser within that user's active session. Exploitation is not remotely triggerable against a default installation: it requires the attacker to hold valid application credentials (PR:L per the assessed vector) and to socially engineer a logged-in user into issuing the attacker-constructed request (UI:A), with impact confined to the victim's session and limited to low confidentiality effect. Toptech has addressed the issue in TMS7 version 7.8; instances below that release remain exposed, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, making this a genuinely low-priority, social-engineering-dependent XSS.
Code injection in JupyterLab's translation pipeline allows JavaScript appended to a third-party language pack's Plural-Forms header to be executed in the authenticated JupyterLab origin, because the validation regex accepts a matching prefix without requiring the whole header to match and the expression is later passed to new Function. Affected are JupyterLab 3.0.0 through 4.5.11 and 4.6.4 (exclusive of the fixes), plus JupyterLite Core 0.8.3 and earlier. Exploitation requires the victim to install and select a malicious or tampered third-party locale catalogue (the default English locale loads no catalogue and is unaffected), and unauthenticated remote attackers need user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:R), yielding a Medium severity of 6.8; where Jupyter Server kernels, terminals, and APIs are exposed to the JupyterLab origin the injected code can read or modify files and run code, while JupyterLite impact is sharply limited by the usual absence of those surfaces. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Unprivileged local users can disable all Pardus Parental Control restrictions on affected systems by invoking PPCActivator.py --disable via pkexec, which runs as root without authentication due to an overly permissive polkit policy. The flaw affects Pardus Parental Control versions before 0.7.0 and requires an interactive local session on a host with the vulnerable default policy; there is no remote vector. No public exploit code has been identified, and the issue is not known to be actively exploited.
A local time-of-check-to-time-of-use (TOCTOU) race condition in Electron's bundled Squirrel.Mac auto-update framework on macOS allows an attacker who already has local access to the machine to redirect the privileged ShipIt helper into overwriting a different application's files with root privileges during an update install. Only macOS Electron apps that ship Squirrel.Mac-based auto-updates are exposed; apps on other platforms, or that do not use Squirrel.Mac, are unaffected. The attacker is an authenticated local user (CVSS PR:L) and must win a narrow race window between path validation and the root-privileged write (AC:H) while an update is actually being installed (UI:R), yielding high confidentiality, integrity, and availability impact if successful; no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing), and no app-side workaround exists - remediation requires upgrading Electron to 39.8.10, 41.10.5, or 42.0.0-beta.2.
Leftover active debug code shipped in Dell Secure Connect Gateway (SCG) Policy Manager builds prior to 5.34.00.16 can be reached by a high-privileged local attacker, allowing limited information disclosure, information tampering, bypass of protection mechanisms, and unauthorized access. The assessed CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N, base score 3.0) restricts realistic exploitation to insiders or attackers who already hold administrator-equivalent local access on the SCG host, while the high attack complexity (AC:H) indicates additional, non-trivial conditions must be satisfied to actually invoke the debug code. No public exploit code has been identified and there is no confirmation of active exploitation at time of analysis, so this remains a low-priority, hardening-class issue best handled through routine patching.
Memory corruption reachable through an unvalidated format string in the management API of HPE Networking Instant On access points allows an attacker who already holds high administrative privileges to provoke a denial-of-service condition or potentially achieve remote code execution on devices running firmware 3.4.1.0 and earlier. The flaw is scored CVSS 3.1 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting that the attacker must be authenticated with high privileges and that reliable exploitation hinges on crafting format-string input that reliably corrupts memory, which often requires memory-layout knowledge or repeated attempts. No public exploit code or confirmed active exploitation was identified at time of analysis, so the dominant risk driver is the high-privilege prerequisite - an attacker must first obtain or compromise an admin account, or chain another vulnerability to reach the vulnerable function.
The Hitachi Energy RTU500 series CMU web application fails to enforce proper authorization on its reset endpoint, allowing an authenticated low-privilege user to force the remote terminal unit to reboot and temporarily lose availability (CVSS 6.5, CWE-862). Exploitation requires a valid low-privilege account or active session (PR:L) plus network reachability to the web management interface, and the assessed impact is limited to temporary, recoverable device unavailability rather than data exposure or persistent compromise. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was supplied; this is a genuine but moderate-severity availability issue, not a high-priority emergency.
Denial of service in KubeVirt lets an authenticated user with permission to create VirtualMachineInstance (VMI) objects crash the virt-controller by submitting a VM definition containing an empty ephemeral volume; the controller hits a NULL pointer dereference and enters a persistent crash loop because the malformed object remains in the cluster, disrupting VM lifecycle operations environment-wide. The flaw is tracked as CVE-2026-102623 with a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and CWE-476; exploitation requires valid Kubernetes RBAC permissions and API-server reachability, and no public exploit identified at time of analysis.
Loading attacker-controlled graphics content in Mozilla Firefox can trigger a denial of service in the Graphics component, crashing or hanging the browser or tab. Affected versions are Firefox before 157 and Firefox ESR before 153.4, with fixes available in Firefox 157 and Firefox ESR 153.4. No public exploit code was identified at time of analysis, and SSVC records no active exploitation.
Denial of service in Mozilla Firefox's Networking component allows a remote attacker to crash or hang the browser by convincing a victim to load attacker-controlled web content - no authentication or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Only availability is impacted: the flaw does not enable code execution, sandbox escape, or data disclosure, and it is fully addressed by upgrading to Firefox 157. At time of analysis there is no public exploit identified, no CISA KEV listing, and the practical risk is comparatively low against the other fixes shipped in the same Firefox 157 batch - the main limiting factor is the UI:R requirement that the user actually load the crafted content.
Credential disclosure in the Apache Airflow Teradata provider (apache-airflow-providers-teradata before 3.7.0) causes cloud storage secrets to be written into SQL text that is then logged and executed, leaking those secrets to two sinks outside Airflow's control. Deployments using S3ToTeradataOperator or AzureBlobStorageToTeradataOperator against a private bucket or container with no teradata_authorization_name configured - the default credential path for both operators - are affected; S3ToTeradataOperator's runtime AWS credentials and STS session token land in the Airflow task log, readable by any user with log-view permission on the Dag, while both operators write credentials into Teradata's DBQL query logs and live monitoring views, where Airflow masking never applies and the values persist for Teradata's log retention period. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. remote but requiring an already-privileged party with log-read access, and no public exploit identified at time of analysis; impact is information disclosure only, with no integrity or availability effect.
Missing authorization checks in Google Chrome's Payments component (desktop builds prior to 154.0.8037.92) let a remote attacker who has already compromised the browser's renderer process use a crafted HTML page to bypass web origin policy and perform cross-origin payment-related actions. The attacker is a remote, unauthenticated party per the CVSS vector (PR:N), but exploitation carries two hard preconditions: the renderer must first be compromised, and the victim must interact with the crafted page (UI:R). There is no public exploit identified at time of analysis, CISA's SSVC assessment records no exploitation and no automatable path, and only integrity is impacted (C:N/I:H/A:N), so despite the 6.5 base score this is a genuinely low-priority issue whose main risk driver is the prior renderer compromise rather than the origin-policy bypass itself.
Incorrect authorization in Chrome's Site Isolation component (versions prior to 154.0.8037.92) allows an attacker who has already compromised a renderer process to bypass web-origin policy using a crafted HTML page, producing cross-origin integrity violations without direct confidentiality or availability impact. This is a chained, second-stage bug rather than an initial access vector: exploitation presupposes a prior renderer compromise and also requires user interaction to load the attacker's content, which is why Chromium rates it Low security severity despite an NVD base score of 6.5. Google has shipped a patched build and no public exploit code was identified at time of analysis; there is no indication of confirmed active exploitation (no CISA KEV listing).
Origin policy bypass in Google Chrome builds prior to 154.0.8037.92 lets a remote attacker who has already compromised the renderer process escape web origin restrictions via a crafted HTML page, producing a high integrity impact while confidentiality is unaffected. The defect is a missing authorization check in the browser's CORS handling (CWE-862), and it is not independently exploitable - a separate renderer-compromise vulnerability must be chained first, and the victim must load attacker-controlled content (UI:R). No public exploit code has been identified at time of analysis, CISA's SSVC rates exploitation as none and the issue as non-automatable with partial technical impact, and the vendor fix is Chrome 154.0.8037.92.
Denial-of-service in Mozilla Firefox's Storage: StorageManager component allows an unauthenticated remote attacker to crash or hang the browser by persuading a victim to render attacker-controlled web content, requiring user interaction and no special privileges. The flaw is a CWE-770 resource-exhaustion issue fixed in Firefox 157 and Firefox ESR 153.4; all earlier Firefox versions are affected, and there is no public exploit identified at time of analysis. Exploitation is not automatable per CISA SSVC, and the impact is availability-only with no data compromise, making real-world urgency low once patched.
Information disclosure in Apache DolphinScheduler before 3.4.3 allows any authenticated user to call the /datasources/unauth-datasource endpoint and retrieve configuration and metadata for data sources they are not authorized to see. As assessed, exploitation requires a valid low-privileged account and network reachability to the web application (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and it is most impactful in multi-tenant deployments where data sources are meant to be isolated between users; the breadth of leaked fields is not specified by the vendor, so confidentiality impact depends on the deployment. There is no public exploit identified at time of analysis and no evidence of active exploitation.
Elevation of privileges and protection-mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 stem from an insecurely initialized default resource (CWE-1188). An attacker who already holds high privileges (PR:H) on the appliance can exploit the issue remotely with low complexity and no user interaction to escalate privileges, tamper with information, bypass protections, and gain unauthorized access. Impact is partial (C:L/I:L/A:N) rather than full compromise, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Repeated network-interface link-down events can crash or reset devices running Zephyr RTOS v4.3.0 that keep a listening TCP socket open, because the BSD-socket layer parks a pending errno value in the net_context user_data field while the TCP core simultaneously expects that field to hold a parent context pointer; a second interface-down event forwards the stale integer to zsock_accepted_cb(), which dereferences it as a pointer and writes through it, producing a wild-pointer access and a kernel fatal error (denial of service, not attacker-directed memory corruption). The flaw is reachable by unauthenticated adjacent attackers who can force the link down repeatedly (CVSS 3.1 AV:A/AC:L/PR:N/UI:N, 6.5, availability-only impact), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Zephyr v4.3.1 and v4.4.x carry a follow-up change that clears the accept callback after the error path, reducing the issue to a narrow handshake-versus-interface-down race plus an unconditional getsockopt(SO_ERROR) read-back of the kernel pointer stored in user_data, so those lines are far less practically exploitable than v4.3.0.
Information disclosure in Apache DolphinScheduler 3.2.0 through versions before 3.4.3 lets any authenticated low-privilege user read workflow information belonging to projects they are not authorized to access by calling the query-dynamic-sub-workflows API endpoint, which authenticates the caller but omits the project-scope authorization check (CWE-863). The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - network-reachable but requiring a valid account, with impact confined to confidentiality and no write or code-execution path. Exploitation also presumes the attacker knows or can guess workflow references in the target project, and it only matters where project-level isolation is treated as a security boundary (multi-tenant or multi-team deployments); no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).