An out-of-bounds heap read in the DHCP client addon of Eclipse ThreadX NetX Duo (nxd_dhcp_client.c) allows an attacker on the same local link to disclose adjacent heap memory whenever a device performs a DHCP acquisition. The attacker only needs to be a DHCP server, or any LAN host that wins the race to answer the client's broadcast DISCOVER first, and to reply with a single OFFER containing a long run of skippable TLV options; a malformed option layout causes the parser's offset counter to lag the actual read pointer, producing a read roughly a kilobyte and beyond past the end of the message (a one-byte read 164 bytes past a 1648-byte heap region in the reported AddressSanitizer trace). The issue occurs unauthenticated (CVSS PR:N), from an adjacent network (AV:A), on every boot while the interface is unconfigured, with bounded impact limited to low confidentiality and low availability (CVSS 5.3); no public exploit code or confirmed active exploitation was identified at time of analysis.
Authentication bypass in Apache DolphinScheduler before 3.4.3 allows remote unauthenticated attackers to reach protected Spring Boot Actuator endpoints by sending requests whose paths contain percent-encoded characters, causing the application's path-based authorization check to fail to match the request against its protected Actuator path list. Successful exploitation exposes operational and configuration data (for example environment properties or configuration beans) and, where sensitive or write-capable Actuator endpoints are enabled, potentially management functionality; the assessed vector is AV:N/AC:L/PR:N/UI:N with high confidentiality and low integrity/availability impact, so no credentials or user interaction are required. No CVSS score or vector was published by NVD or Apache and no public exploit code was identified at time of analysis, though the technique is a well-understood class of path-matching evasion and exploitation is trivial once a reachable instance is found. Real-world severity is bounded by which Actuator endpoints the deployment exposes.
Improper access control in the ArgusMonitor.sys kernel driver shipped with Argotronic eGbR Argus Monitor 7.4.02 and earlier lets a local, low-privileged user win a TOCTOU race in IRP_MJ_CREATE to obtain a handle to the driver's device object, then issue a crafted IOCTL 0x9C4024A8 that crashes the driver and causes denial-of-service on the affected Windows host. The attack requires an existing local foothold on a machine where the driver is installed and loaded, and success depends on reliably winning a timing race, which is why it is rated high complexity and low overall priority despite the medium 5.3 base score. Impact is limited to availability (system/driver crash) with no confidentiality or integrity effect; there is no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis (CISA SSVC records Exploitation: none).
Heap under-allocation in U-Boot's SquashFS directory-table parser (fs/squashfs/sqfs.c) allows an attacker who supplies a crafted SquashFS filesystem image to trigger out-of-bounds heap writes and crash the bootloader, producing a denial of service during or after boot. All U-Boot releases before 2026.10-rc4 that are compiled with SquashFS support are affected, and exploitation requires the device to read and parse an attacker-controlled image from boot media, which is why the vendor treats this as a physical/local-vector issue (CVSS 4.0 base 5.2; the independent assessment rates it CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). No public exploit code has been identified at time of analysis, and the flaw was reported by VulnCheck alongside a vendor fix commit.
Unauthenticated network access to four maintenance servlets in Hitachi Energy Asset Suite - PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet - lets remote attackers invoke reload and cache-flush operations that can degrade application availability. Our independent assessment rates this an availability-only, partial denial-of-service condition (CVSS 3.1 5.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no path to data disclosure or modification, and the vendor's CVSS 4.0 vector agrees on the availability-only scope (VA:L) while also requiring user interaction (UI:A), which would further constrain practical exploitation. Real-world exposure is deployment-dependent because these servlets are production-maintenance functions whose presence and reachability depend on how the Asset Suite instance is configured; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Improper access-control enforcement in the Joomla CMS workflow feature allows an authenticated backend user to change the workflow stage of content that their assigned ACL should prevent them from touching, in Joomla 5.0.0-5.4.8 and 6.0.0-6.1.3. The CVSS 4.0 vector (5.1, AV:N/AC:L/PR:H) requires a valid backend account, and the impact is limited to the integrity of the workflow stage value (VC:L/VI:L, no availability effect), so this is a genuine but low-priority authorization flaw rather than an emergency. Confirmed actively exploited? No - no CISA KEV listing, and no public exploit code identified at time of analysis; the effect is only meaningful on sites that actually use Joomla's content workflow functionality.
Improper access control in the Joomla CMS content history comparison view allows an authenticated backend user to read content revisions they are not authorized to view, affecting Joomla 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. The issue is rated CVSS 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N; consistent with the independent CVSS:3.1 vector of AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), so it is a genuine but low-severity confidentiality-only exposure: PR:H indicates the attacker must already hold a high-privileged, authenticated backend/administrator session, no victim interaction is required, and there is no integrity or availability impact. The leaked data is limited to stored content versions rather than credentials or system data, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
Physical access to the evbee DC-80 charging station's service menu, which is obfuscated but lacks authentication, allows an attacker to retrieve sensitive information including serial numbers, MAC addresses, and WiFi network credentials. This information disclosure vulnerability has a CVSS 4.0 score of 5.1 (AV:P/AC:L/PR:N/UI:N/VC:H/VI:N/VA:N) and requires hands-on access, making it a low-priority issue per our assessment. No public exploit code has been identified, and while the WiFi password leak could enable network pivoting, exploitation cannot be performed remotely or at scale.
Missing authorization in Devolutions Server's gateway network scan token API lets any authenticated low-privileged account mint a network scan token and drive the gateway to discover internal hosts and probe ports, handing an attacker reconnaissance-grade visibility into the internal network from a single valid login. The flaw affects Devolutions Server 2026.3.5.0 and earlier and is fixed in 2026.3.7.0, which the vendor now ships; at a CVSS of 5.0 the issue is rated moderate because confidentiality is the only impacted property, with no code execution, data tampering, or availability loss. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC assessment rates it neither exploited nor automatable.
Denial of service in HPE Networking Instant On firmware version 3.4.1.0 and earlier lets a remote attacker who already holds an authenticated administrative session (PR:H) disrupt the device's API service, rated CVSS 3.1 4.9 with availability impact High and no confidentiality or integrity impact. The disruption is transient - the affected service restarts and resumes normal operation without manual intervention - so the practical consequence is a brief loss of management/API availability rather than a persistent outage, and the requirement for admin-level credentials sharply limits who can trigger it. There is no CISA KEV listing and no public exploit identified at time of analysis, so this should be treated as a low-priority hardening item rather than an urgent patching driver.
Memory corruption in the network-facing interface of HPE Networking Instant On firmware (version 3.4.1.0 and earlier) allows an unauthenticated remote attacker to disrupt the affected service and retrieve a limited amount of information from the component. The flaw scores CVSS 3.1 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L, so the limiting factor is high attack complexity - reliable triggering depends on specific memory state or precisely crafted input rather than a simple repeatable request - and the realistic impact is service outage plus limited disclosure, with no integrity impact and no confirmed path to code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, and exploitation additionally requires network reachability to the affected interface.
Uninitialized-resource handling in Dawn, Chromium's WebGPU implementation, exposes Chrome for Android builds prior to 154.0.8037.92 to out-of-bounds memory reads triggered by a crafted HTML page (CWE-908). A remote attacker who convinces a victim to load the malicious content can leak limited graphics-process memory that may fall outside the browser sandbox boundary, although the CVSS 3.1 score of 4.7 with C:L/I:N/A:N indicates the payoff is a low-confidence information disclosure rather than code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fixed build.
Uninitialized resource handling in ANGLE, the GPU translation layer bundled with Google Chrome on Windows, lets a remote attacker who gets a victim to load a crafted HTML page trigger a memory read that crosses the browser's sandbox boundary, although the leak is limited to low-severity confidentiality impact (CVSS 4.7, C:L, S:C with no integrity or availability effect). Only Chrome builds on Windows prior to 154.0.8037.92 are affected; the attack is unauthenticated per the CVSS vector but requires user interaction (UI:R) - the victim must open or be redirected to attacker-controlled content that exercises the WebGL/GPU-accelerated path. No public exploit code identified at time of analysis, no confirmed active exploitation (CISA KEV), and Google has already published a fixed build, so the practical risk is low.
An out-of-bounds read in Chrome's WebGL implementation allows a remote attacker to disclose a limited amount of memory beyond the renderer/sandbox boundary in Google Chrome builds prior to 154.0.8037.92. Exploitation is unauthenticated (PR:N) but requires the victim to load attacker-controlled HTML that exercises the WebGL rendering path (UI:R), and the confirmed impact is limited to a partial information disclosure with no integrity or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical value to an attacker is low because the quantity and controllability of the leaked data are constrained and unpredictable. Chromium rated the issue High severity, and Google has published a stable-channel fix, but the assessed CVSS of 4.7 keeps this in low-priority territory relative to memory-corruption bugs that grant code execution.
Cross-origin information disclosure in Mozilla Firefox's panning and zooming component lets attacker-controlled web content defeat the browser's site-isolation boundary and leak a limited amount of data from another origin. The issue affects Firefox builds prior to 157, ESR 153.4, ESR 140.17, and ESR 115.42, and requires the victim to load a malicious page (UI:R) with no authentication or special privileges (PR:N); impact is confined to confidentiality (C:L) with no integrity or availability effect. There is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score of 0.16% (4th percentile) indicates very low predicted exploitation activity, making this a defense-in-depth fix rather than an urgent threat.
Denial of service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 occurs when a local user opens a maliciously crafted Microsoft Network Monitor (netmon) capture file, triggering an unbounded loop in the file parser. Exploitation requires user interaction (opening the file) and high complexity, resulting in a crash or hang of the application; there is no confidentiality or integrity impact. No public exploit or active exploitation has been identified at time of analysis.
Denial of service in the Wireshark CSN.1 protocol dissector (versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18) stems from a heap-based buffer overflow (CWE-122) that crashes the application when it parses malformed CSN.1-encoded data. Exploitation is local and requires user interaction: the target must open an attacker-supplied capture file, and the assessed vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H indicates high attack complexity with a non-deterministic trigger and availability-only impact, with no confidentiality or integrity loss and no confirmed remote path. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; at CVSS 4.7 the practical outcome is a recoverable crash rather than code execution, making this a low-priority availability bug.
Uninitialized memory handling in Firefox's Audio/Video (media playback) component can crash the browser or leak small amounts of stale process memory when a victim loads attacker-controlled media content on an unpatched build. The issue is reachable by unauthenticated attackers (CVSS PR:N) but requires user interaction (UI:R) to render the malicious content, and the underlying uninitialized-memory read is non-deterministic, so reliable weaponization is unlikely and the realistic outcome is a crash or incidental minor memory exposure rather than targeted data theft. No public exploit code has been identified at time of analysis, and this is a genuinely low-priority issue despite Firefox's ubiquity; vendor patches are available in Firefox 157 and in the ESR branches 153.4, 140.17, and 115.42.
Information disclosure in Google Chrome on Android prior to 154.0.8037.92 lets a remote attacker read cross-origin data by delivering a crafted HTML page that drives GPU rendering and reads back uninitialized GPU memory. The flaw is unauthenticated (CVSS PR:N) but gated by required user interaction (UI:R) - the victim must open the malicious page - and its impact is confined to low confidentiality loss (C:L), with no code execution, data modification, or denial of service. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC assessment rates the bug non-automatable with only partial technical impact, so real-world risk remains low despite Chromium's 'High' severity label.
Information disclosure in Mozilla Firefox's Networking: JAR component allows remote, unauthenticated attackers to leak a limited amount of data when a victim loads attacker-controlled web content in an unpatched browser, with no integrity or availability impact. Affected builds are those prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (base 4.3), the practical limiter is the required user interaction and the low value/volume of the exposed information. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied, so this is a low-severity client-side disclosure rather than an active-threat priority.
Uninitialized memory reads in the WebGPU component of Mozilla Firefox before 157 (and ESR before 153.4) can cause availability impacts such as browser crashes when a remote attacker convinces a user to load crafted content that exercises WebGPU. Exploitation requires user interaction (UI:R) and the WebGPU code path to be reachable, and the vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) limits impact to low availability with no confirmed confidentiality or integrity effect. No public exploit has been identified at time of analysis; the issue is considered low priority and was fixed in Firefox 157 and Firefox ESR 153.4 per Mozilla advisories mfsa2026-100 and mfsa2026-97.
Uninitialized memory handling in Firefox's WebGPU implementation (Graphics: WebGPU component) lets a remote attacker crash or destabilize the browser process when a victim loads a crafted page that exercises WebGPU rendering or compute paths, affecting Firefox versions prior to 157. Per Mozilla's assessed CVSS 3.1 vector (4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), the impact is availability-only, requires user interaction, and requires no authentication; no public exploit code and no confirmed active exploitation were identified at time of analysis. The flaw is fixed in Firefox 157 via advisory MFSA2026-97 (Bugzilla 2057833), and pre-157 installations remain vulnerable until updated.
Uninitialized memory handling in Mozilla Firefox's WebGPU graphics component can crash the browser process, giving a remote attacker a low-impact denial-of-service condition against users running builds prior to Firefox 157. Exploitation requires the victim to actively browse attacker-controlled web content and for that content to drive the vulnerable WebGPU rendering path, so no authentication is required (PR:N) but user interaction is (UI:R); the vendor vector rates impact as availability-only (A:L) with no integrity or confidentiality effect. There is no confirmed active exploitation (CISA KEV does not list this CVE) and no public exploit code identified at time of analysis; the issue is considered a genuinely low-priority defect despite Mozilla Firefox being a ubiquitous target.
Uninitialized memory in Google Chrome's WebGPU implementation, in builds prior to 154.0.8037.92, can be read back by a remote attacker as cross-origin data when a victim loads a crafted HTML page. The flaw is unauthenticated and remote (CVSS:3.1/AV:N/AC:L/PR:N) but demands that the victim visit the attacker-controlled page (UI:R) and that WebGPU is reachable on the target platform; the outcome is a limited information disclosure with no code execution, no write primitive, and no availability impact, which is why the CVSS 3.1 base score is only 4.3 despite Chromium's internal 'High' severity label. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), so this is a genuinely low real-world priority even given Chrome's ubiquity.
Address-bar spoofing in Google Chrome for Android versions prior to 154.0.8037.92 lets a remote attacker misrepresent the Omnibox (URL bar) to a victim who opens a crafted HTML page, according to Google's own Chromium severity rating of High. The assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, 4.3) confirms this is an unauthenticated, network-reachable attack that hinges entirely on user interaction, with only a low-integrity impact on the browser UI and no confidentiality or availability loss, and the CISA SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) places it at low real-world priority. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the practical limitation is that the attacker must first lure the target to a malicious page, and only the Android build is affected - desktop and iOS Chrome users are out of scope.
Uninitialized-memory handling in Skia, Chrome's 2D graphics rendering library, allows a remote attacker to leak cross-origin data when a victim loads a crafted HTML page in Google Chrome versions prior to 154.0.8037.92. Exploitation is bounded by the mandatory user interaction (UI:R) - the target must open or render attacker-controlled content - and by the impact, which is limited to a partial confidentiality breach (C:L) with no integrity or availability effect, no code execution, and no authentication requirement (PR:N) on default builds. Google rates the underlying Chromium issue as High severity, though the assessed CVSS of 4.3 reflects the narrow cross-origin information-disclosure outcome; no public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA SSVC scoring aligns (Exploitation: none, Automatable: no, Technical Impact: partial). A vendor patch is available in Chrome 154.0.8037.92.
Information disclosure in the Networking component of Mozilla Firefox can leak limited data to attacker-controlled content, but only after the victim loads a malicious page in a vulnerable build. The flaw affects Firefox versions prior to 157 and the ESR branches prior to 153.4 and 140.17, and can be triggered remotely without authentication (AV:N/AC:L/PR:N) because it requires only that the user interact with attacker-supplied web content (UI:R); impact is confined to low confidentiality loss with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the resulting 4.3 CVSS score, combined with the mandatory user-interaction precondition, makes this a genuinely low-priority issue despite affecting a ubiquitous browser.
Query injection in the Airflow Google provider allows an attacker who can write to a source GCS bucket to steer which Google Drive file or folder is resolved during wildcard gcs_to_gdrive transfers, potentially redirecting uploads into an attacker-named folder or causing a download to return an attacker-placed file. This affects deployments running apache-airflow-providers-google before 22.6.0 that pass externally-sourced names to the Drive hook; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, which indicates low privileges are required-specifically the ability to create or name objects in the source bucket-while no Airflow authentication or user interaction is needed. No public exploit code has been identified at time of analysis, there is no CISA KEV entry, no EPSS score was provided, and Apache rates the issue as low severity.
An out-of-bounds write in U-Boot's Android boot method (boot/bootmeth_android.c) lets someone with physical access to a device boot from crafted media whose boot image header declares a size larger than the containing partition, causing U-Boot to write past its load buffer into bootloader memory before 2026.10-rc3. Only devices that actually use the Android bootmeth and do NOT have Android Verified Boot (AVB) enabled are exposed, since AVB rejects the tampered image; authentication requirements are not confirmed from available data, but the assessed vector is CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H and there is no public exploit identified at time of analysis, nor any CISA KEV listing. The practical risk is low-priority: exploitation is gated on physical possession of the device plus an unprotected boot chain, and impact is limited to integrity and availability of the bootloader rather than confidentiality or a remote attack path.
Incorrect authorization in Grafana's library panel update path allows an authenticated user who holds edit permission on one folder to move a library panel into a different folder where they have only view permission, because the update flow never re-checks create permission on the destination folder. The bug is network-reachable at low complexity with low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) and produces only a low integrity impact: no destination-folder data is exposed and existing content there cannot be changed or deleted. No public exploit code has been identified at time of analysis, and the issue requires a multi-folder RBAC configuration where a user's rights differ across folders.
KitchenAsty versions through 0.3.0 expose an object-level authorization flaw in the reservations API: the authenticated endpoint GET /api/reservations/:id returns whatever reservation record matches the caller-supplied identifier without ever comparing reservation.customerId to the authenticated principal, allowing any logged-in low-privilege customer to read other customers' reservation data. Because the authenticate middleware is enforced, an anonymous attacker cannot reach the handler, which is the main constraint on exploitation; the impact per request is a read-only disclosure of a single reservation record and the assessed severity is correspondingly low (CVSS 3.1 base 4.3, PR:L). No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, though the attack requires only a valid account plus enumeration of sequential or guessable reservation identifiers.
Cryptographic weakness in the Russh SSH library before 0.63.0 lets a malicious remote SSH peer send an all-zero 32-byte X25519 public key during the hybrid ML-KEM-768 + X25519 key exchange, zeroing the classical half of the combined shared secret so the handshake is protected by ML-KEM-768 alone. Any deployment negotiating the mlkem768x25519 kex method is affected, and the flaw is reachable without authentication or user interaction because it triggers inside the key exchange itself (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The practical confidentiality impact is latent rather than immediate: no public exploit has been identified at time of analysis, and the exchange is only recoverable if ML-KEM-768 is independently weakened, so the real consequence today is the loss of the hybrid's classical fallback safety net.
Devolutions Server versions prior to 2026.3.7.0 contain an improper rule enforcement flaw in the PAM Active Directory provider that allows an authenticated user with PAM edit permissions to bypass Devolutions Gateway host rulesets, potentially exposing restricted hosts to unauthorized access. This low-severity (CVSS 4.3) authorization-scoping weakness requires specific configuration-the PAM AD provider and a Gateway host ruleset-and no public exploit or active exploitation has been identified at time of analysis. The primary impact is a limited confidentiality breach.
Improper authorization in Apache DolphinScheduler before 3.4.3 allows an authenticated user to copy or move workflow definitions across project boundaries through the batch-copy and batch-move endpoints, which omit the project-level permission check. Exploitation requires a valid account on the instance with access to at least one project but without the required permissions on the targeted projects, and the effect is limited to low confidentiality and integrity impact (cross-project workflow manipulation) with no availability or code-execution impact; there is no public exploit identified at time of analysis and no confirmed active exploitation. Because the flaw matters mainly in multi-tenant or shared deployments with untrusted tenants, the aggregate signals place it at LOW-to-MEDIUM priority, but organizations relying on DolphinScheduler project isolation as a security boundary should patch promptly.
Incorrect authorization in Apache DolphinScheduler before 3.4.3 allows an authenticated user who holds only read permission on a project to modify workflow instances inside that same project by sending a request to the PUT /projects/{projectCode}/workflow-instances/{id} endpoint, which fails to enforce the write permission the operation requires. The flaw is assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, meaning remote, authenticated, low-complexity exploitation with a limited integrity impact and no confidentiality or availability impact; the attacker must already possess valid credentials and read access to the target project, so exposure is largely limited to insiders or compromised low-privilege accounts. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so it should be treated as a genuine but low-severity authorization bug rather than an urgent, actively exploited threat; upgrading to 3.4.3 fully remediates.
Improper authorization in Apache DolphinScheduler's sub-workflow task handling allows an authenticated user who lacks access to a given project to reference and execute a workflow owned by that project, bypassing project-level access controls. Only deployments using project boundaries as a security boundary (multi-tenant or multi-team instances) are meaningfully exposed, and exploitation requires a low-privileged authenticated account able to create workflows and sub-workflow tasks (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L); no victim interaction is required. Impact is bounded to unauthorized execution of workflow tasks and exposure of data or resources reachable by the target workflow, and no public exploit code has been identified at time of analysis.
Open redirect in the HPE OneView management web interface allows a remote, unauthenticated attacker to craft a URL that, once clicked by a victim, sends that victim's browser to an arbitrary attacker-chosen destination. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) and does not compromise the OneView server itself; the practical risk is phishing and credential-theft staging that borrows the trust of a legitimate OneView hostname. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the overall risk is assessed as low, with the user-interaction prerequisite the primary limiting factor.
Authenticated attackers positioned on the adjacent network can abuse unsafe inline-script and string-evaluation (eval-class) functions in Toptech TMS7 and Toptech TopHat terminal-management deployments, achieving limited code injection with Low confidentiality and integrity impact and no availability effect. The issue is scored 2.1 under CVSS 4.0 and was independently assessed as AV:A/AC:H/PR:L/UI:N with Low C/I, so it sits firmly in the low-priority tier despite its CWE-95 code-injection classification: it is not reachable from the internet by default, requires valid low-privilege credentials, and demands high attack complexity to land the crafted input on the evaluator. No public exploit code has been identified at time of analysis, the issue does not appear on CISA KEV, and no EPSS score was supplied in the source data, so exploitation is not confirmed to be active.
Information disclosure in the underlying operating system of HPE Networking Instant On 3.4.1.0 and earlier allows an authenticated, high-privileged local attacker to read sensitive data from the device, which could then be leveraged to reach further network services supported by the platform - but only when unspecified preconditions outside the attacker's control are satisfied. Per the CVSS vector (AV:L/AC:H/PR:H/UI:N), exploitation requires local presence on the device, pre-existing administrative privileges, and a high-complexity conjunction of runtime conditions, with no user interaction; the resulting confidentiality impact is rated High while integrity and availability are unaffected (CVSS 4.1). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk is low because the issue is confined to post-compromise scenarios on already-privileged local access.
An out-of-bounds write in the printf builtin of the dash shell allows a local user to corrupt one or two bytes past a four-byte reservation when a crafted Unicode \u or \U escape expanding to a five- or six-byte token is processed, including via 'dash -c' with the escape passed as a positional argument to printf or 'echo %b'. The flaw affects dash as shipped in Red Hat Enterprise Linux 6 (CPE cpe:2.3:a:red_hat:red_hat_enterprise_linux_6) and is rated CVSS 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). No public exploit code was identified at time of analysis, and the bounded write stays within the caller's own shell process, so it provides no inherent privilege escalation.
Stack exhaustion in the Apache XmlSchema walker (xmlschema-walker) allows a malicious XML Schema to crash any application that parses untrusted XSD/WSDL content, because the walker performs no cycle detection across type derivations, substitution groups, model groups, or attribute groups and recurses until the stack overflows. The flaw is remotely triggerable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is limited to availability impact - no data disclosure or code execution. It is a third-party library issue rather than a directly network-exposed service: only deployments that walk attacker-controlled or third-party schemas are realistically exploitable, no public exploit code has been identified at time of analysis, and remediation is the vendor-released patch in version 2.3.3.
Stack exhaustion in Apache XmlSchema allows remote attackers to cause a denial of service by supplying a malicious XML Schema (XSD) document with deeply nested structures that recurse until the parsing thread's stack overflows. The library is a Java component, so exposure depends entirely on the host application accepting and parsing externally supplied schemas - deployments that only process trusted, internally authored schemas are not affected, and no authentication or user interaction is inherent to the flaw. No public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing); the vendor-released fix is XmlSchema 2.3.3, and the assessed severity is CVSS:3.1 7.5 (High, availability-only).
Stack overflow denial of service in Apache XmlSchema versions before 2.3.3 allows unauthenticated remote attackers to crash applications that parse attacker-controlled XML schemas by supplying a schema with deeply nested imports or includes. The library lacks a recursion depth limit during schema resolution, so a malicious schema can exhaust the call stack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the flaw carries a high availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects deployments that ingest untrusted schemas.
Authenticated shell command injection in Apache DolphinScheduler (all versions before 3.4.3) lets a user with permission to create or upload resources execute arbitrary commands as the DolphinScheduler service account. An attacker names a resource using shell command-substitution syntax such as $(...), then passes the resulting path as the scriptPath parameter to the Alert Script plugin's /test-send endpoint; because that parameter is concatenated into a /bin/sh -c invocation without neutralization of shell metacharacters, the shell evaluates the injected command. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) confidentiality, integrity and availability impact are all High, and while valid credentials and access to the Alert Script test-send functionality are required, no victim interaction is needed; no public exploit code or confirmed active exploitation was identified at time of analysis.
QUIC-enabled servers running OpenSSL 3.5.0 through 3.5.8, 3.6.0 through 3.6.4, and 4.0.0 through 4.0.2 can be induced to over-account the amplification credit granted to an unvalidated client address, so the library may emit more reflected UDP traffic toward a spoofed source than QUIC's anti-amplification rules permit. The flaw sits in the pre-address-validation path of the QUIC stack, meaning unauthenticated remote attackers who can spoof source IPs need no credentials or user interaction, though the assessed CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) and score of 3.7 reflect the narrow timing and traffic conditions required and a bounded impact limited to traffic amplification rather than code execution or data exposure. No public exploit code is identified at time of analysis, it is not confirmed actively exploited (no CISA KEV listing), and CISA's SSVC assessment records exploitation as none, automatable as no, and technical impact as partial.
OpenSSL's SM2 scalar multiplication on ARM64 and RISC-V is not constant-time, allowing a remote, unauthenticated attacker (CVSS PR:N) who can precisely measure many SM2 operations to conduct statistical timing analysis and potentially recover key material. The flaw affects OpenSSL 4.0.0 before 4.0.3, 3.4.0 before 3.4.8, 3.5.0 before 3.5.9, and 3.6.0 before 3.6.5; practical exploitation is sharply constrained because the target must use SM2 on an affected architecture and the attacker needs high measurement volume and precision. No public exploit code or CISA KEV entry was identified at time of analysis, and vendor patches are available; the 'High' severity of the OpenSSL 4.0.3 release pertains to a sibling CVE, not this low-rated issue (CVSS 3.7).
A timing side-channel in OpenSSL's elliptic-curve scalar multiplication for non-NIST (non-standard or custom) curves can leak information about private-key material to an attacker who can induce and precisely measure many such operations. The affected branches are OpenSSL 1.0.2 before 1.0.2zs, 1.1.1 before 1.1.1zj, 3.0 before 3.0.23, 3.4 before 3.4.8, 3.5 before 3.5.9, 3.6 before 3.6.5, and 4.0 before 4.0.3; deployments that use only the standard NIST curves (P-256/P-384/P-521) are not exposed. Assessment gives it low severity (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, CWE-208): no public exploit code was identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and SSVC rates exploitation as none and automatable as no, with the high-precision timing recovery and the specific curve configuration sharply limiting realistic abuse.
A timing side-channel in SM2 signature generation in OpenSSL lets a remote, unauthenticated attacker who can precisely measure how long signing operations take to infer information about the SM2 private key, producing limited confidentiality impact (CVSS 3.1 base score 3.7, vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Affected branches are 1.1.1 before 1.1.1zj, 3.0.0 before 3.0.23, 3.4.0 before 3.4.8, 3.5.0 before 3.5.9, 3.6.0 before 3.6.5, and 4.0.0 before 4.0.3, with the fix published in the OpenSSL 4.0.3 security release. No public exploit code has been identified at time of analysis, CISA SSVC records no exploitation activity (Exploitation: none, Automatable: no, Technical Impact: partial), and real-world exposure is sharply narrowed to deployments that actually perform SM2 signatures and are reachable over a low-jitter network path.
Russh SSH servers running versions prior to 0.62.6 that set server::Config.max_auth_attempts to a nonzero value silently fail to enforce that limit, letting an unauthenticated remote client keep sending USERAUTH_REQUEST messages on a single connection past the configured cap. The auth_attempts counter is incremented on the server::run_stream path in russh/src/server/encrypted.rs but is never compared against the configured maximum, so the intended 'too many authentication attempts' disconnect never fires, preserving unlimited online password guessing and adding backend authentication load. Practical impact is limited: the attacker must still guess valid credentials, the bug has no effect when max_auth_attempts is 0 or when external throttling (fail2ban, firewall rate limits) is used, and no public exploit code has been identified at time of analysis.
Russh, the Rust SSH client and server library, can be driven into a panic-driven connection teardown by a remote peer whenever a deployment explicitly permits mac=none in its algorithm preferences. All releases prior to 0.63.1 are affected, because negotiation validated the cipher's needs_mac() requirement only on the MAC-selection-failure branch, allowing a MAC-requiring CTR or CBC cipher such as aes256-ctr to be paired with a zero-length MAC; the attacker then sends a packet with a decrypted length of zero, shrinking the buffer read in russh/src/cipher/mod.rs and panicking the indexing at buffer.buffer[16..]. The resulting impact is availability-only (the connection task terminates) with no code execution or data exposure, requires the non-default mac=none configuration and is rated high-complexity per the assessed AV:N/AC:H/PR:N/UI:N vector (unauthenticated remote attackers per the CVSS vector), and no public exploit code has been identified at time of analysis.