Use-after-free in Mozilla Firefox's JavaScript WebAssembly engine enables remote code execution or memory corruption when a victim views a malicious webpage, requiring only that the user loads attacker-controlled content (UI:R) with no authentication (PR:N). The flaw affects all Firefox versions prior to 157 and Firefox ESR prior to 153.4, and is rated CVSS 8.8 due to high confidentiality, integrity, and availability impact; the content-process sandbox (S:U) limits impact to the browser process absent a separate escape. No public exploit identified at time of analysis, and no CISA KEV listing; Mozilla has released patches in Firefox 157 and Firefox ESR 153.4.
A stack-based buffer overflow (CWE-121) in the V8 JavaScript engine allows remote code execution inside the renderer sandbox of Google Chrome builds prior to 154.0.8037.92 when a victim is lured to a crafted HTML page. Exploitation requires user interaction - the target must open or be navigated to the attacker-controlled page - but no authentication or privileges are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), and the default browser configuration is sufficient. No public exploit code or active exploitation has been identified, and CISA's SSVC decision framework rates exploitation as 'none' with automatable 'no'; the practical ceiling on impact is the renderer sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape flaw. All signals align on a genuine but not emergency-level browser RCE, and Google has shipped a vendor patch.
A use-after-free in U-Boot's lwIP-based wget HTTP client lets an attacker who controls (or MITMs) the server a device downloads from crash the bootloader during a netboot/provisioning fetch, interrupting boot. The bug sits in the httpc_recv_cb() receive callback: when HTTP data storage fails, it frees the connection's protocol control block but returns ERR_BUF instead of ERR_ABRT, so the TCP input path continues on released memory. All U-Boot versions before 2026.10-rc5 are affected; the CVSS 4.0 vector scores 8.8 (AV:N/AC:L/PR:N/UI:N, VA:H, VI:L) and our independent CVSS 3.1 assessment rates it 7.5 as an availability-dominant issue - no public exploit identified at time of analysis, and impact is limited to a bootloader crash rather than code execution or data exposure.
Use-after-free in Mozilla Firefox's WebAssembly engine (JavaScript/SpiderMonkey component) allows an unauthenticated remote attacker to corrupt browser memory and potentially achieve code execution against users running Firefox versions prior to 157. Exploitation requires the victim to open attacker-controlled web content that exercises a crafted WebAssembly module (UI:R), and while no public exploit code has been identified at time of analysis and the issue is not on CISA KEV, the CVSS 3.1 base score of 8.8 with C:H/I:H/A:H reflects a full high-impact memory-corruption outcome typical of an RCE-class heap use-after-free. Users on Firefox 157 or later are not affected.
Use-after-free in Mozilla Firefox's Graphics: WebGPU component allows remote attackers to corrupt memory and potentially achieve code execution or read sensitive data when a victim loads attacker-controlled web content that exercises the WebGPU API; the flaw is fixed in Firefox 157. Exploitation is gated by user interaction (CVSS PR:N, UI:R) and by WebGPU being reachable in the victim's build, and no public exploit code or confirmed active exploitation has been identified at time of analysis. The 8.8 CVSS score reflects high confidentiality and integrity impact within the affected browsing process, though the content-process sandbox typically limits standalone impact unless chained with a sandbox escape.
Boundary-condition errors in Mozilla Firefox's Graphics component allow an unauthenticated remote attacker to trigger memory corruption and achieve privilege escalation on the affected platform, provided the victim loads attacker-controlled content that reaches the vulnerable rendering code path. Only builds below Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42 are affected - updating to any of those versions fully remediates the issue. Although the CVSS base score is 8.8 with high confidentiality, integrity, and availability impact, no public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and the flaw as not automatable, and the mandatory user-interaction requirement (UI:R) prevents automated or wormable spread, making this a genuine but not top-priority issue.
Use-after-free in Mozilla Firefox's Graphics: WebRender compositor lets remote, unauthenticated attackers corrupt memory and escalate privileges inside the browser when a victim loads attacker-controlled web content - no authentication is required (PR:N), but the attack is not server-side passive and depends on the target visiting or interacting with a malicious or compromised page (UI:R). The flaw rates CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was fixed in Firefox 157 and in Firefox ESR 153.4, ESR 140.17, and ESR 115.42; no public exploit code has been identified and CISA's SSVC assessment records exploitation as none, so this is a genuine but not urgent priority. Modern Firefox content-process sandboxing further limits post-corruption impact unless the attacker chains a separate sandbox escape, and WebRender is enabled by default, so no unusual configuration is needed to reach the vulnerable path.
Memory corruption in Mozilla Firefox ESR's Graphics: Canvas2D component allows remote attackers to execute code within the browser content process when a victim is induced to load attacker-controlled web content; the root cause is a use-after-free (CWE-416) rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability loss inside the exploited process. Affected builds are ESR 115.x before 115.42, ESR 140.x before 140.17, and ESR 153.x before 153.4, with vendor fixes released in Firefox ESR 115.42, 140.17, and 153.4. Exploitation requires victim interaction (loading a malicious or compromised page) and is unauthenticated over the network (PR:N); no public exploit code was identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' with 'no' automatable applicability and total technical impact.
Remote code execution in Mozilla Firefox's SpiderMonkey JavaScript JIT engine allows unauthenticated attackers to corrupt memory via crafted web content, potentially leading to arbitrary code execution within the browser's content process. Exploitation requires the victim to visit or be redirected to a malicious page (UI:R) that triggers incorrect boundary conditions during JIT compilation; JIT is enabled by default, so no special victim configuration is needed. No public exploit code or active exploitation has been identified at time of analysis, but the flaw is near-critical due to the high-value JIT attack surface. Fixed in Firefox 157 and Firefox ESR 153.4.
Use-after-free in Mozilla Firefox's DOM UI Events and Focus Handling code allows a remote, unauthenticated attacker to corrupt the browser's heap and potentially achieve code execution in the content process when a victim loads attacker-controlled web content. The flaw affects Firefox builds before 157 and Firefox ESR before 153.4, where it has been fixed; the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with the mandatory user interaction (opening the page) being the primary precondition, and CISA's SSVC assessment does not consider it automatable. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none, so despite the high base score this reads as a medium-priority memory-corruption flaw in an ubiquitous browser rather than an emergency, actively exploited issue.
Privilege escalation in the Mozilla Firefox Address Bar component lets a remote, unauthenticated attacker gain elevated privileges within the browser by persuading a victim to load and interact with attacker-controlled web content. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms no credentials are needed but the attack cannot succeed without the targeted user interacting with the malicious page, and CISA's SSVC assessment marks the issue as not automatable with no observed exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis; the flaw is remediated in Firefox 157, Firefox ESR 153.4, and Firefox ESR 140.17, so only unpatched installations prior to those builds remain exposed.
Privilege escalation in Mozilla Firefox's DOM: Service Workers component allows a remote, unauthenticated attacker (CVSS vector PR:N) to elevate privileges inside the browser after convincing a victim to visit an attacker-controlled or compromised page (UI:R), affecting Firefox builds before 157 and ESR branches before 153.4 and 140.17. The 8.8 score derives from high confidentiality, integrity, and availability impact with low attack complexity, but scope is unchanged (S:U), meaning the impact stays confined to the browser's own privilege boundary rather than escaping to the host operating system. There is no public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and automatable as no, so practical exposure is driven by how quickly the supplied ESR/rapid-release fixes are deployed rather than by observed attack activity.
Privilege escalation in the DLL Services component of Mozilla Firefox allows an attacker to achieve elevated code execution - with high confidentiality, integrity, and availability impact - when a victim renders attacker-controlled web content, reflected in a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No authentication is required (PR:N) and attack complexity is low, but the vector mandates user interaction (UI:R), meaning a target must be induced to load a crafted page rather than being compromised by a service-side drive-by. The issue is fixed in Firefox 157, Firefox ESR 153.4, and Firefox ESR 140.17, so unpatched pre-157 and pre-ESR builds are the exposed population; there is no public exploit code and no observed exploitation at time of analysis, and SSVC classifies the flaw as non-automatable.
Use-after-free in the JavaScript JIT compiler of Mozilla Firefox (versions before 157) and Firefox ESR (before 153.4) allows remote attackers to corrupt memory and potentially execute code within the browser process when a victim loads attacker-controlled JavaScript from a malicious or compromised page. Exploitation requires user interaction (the victim must navigate to the crafted content), and while CVSS 8.8 indicates high confidentiality, integrity, and availability impact, no public exploit code or active exploitation in the wild has been identified at the time of analysis. The flaw is fixed in Firefox 157 and Firefox ESR 153.4.
Use-after-free in Mozilla Firefox's CSS Parsing and Computation component allows a remote attacker to corrupt browser memory and potentially achieve code execution in the content process by getting a victim to render attacker-controlled web content. The flaw affects Firefox before 157 and Firefox ESR before 153.4 (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416), and although no authentication or non-default configuration is required, exploitation is not zero-click - the target must actually load the malicious page, win the use-after-free race, and defeat browser memory hardening. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score or KEV listing was provided, so this sits in the high-CVSS but moderate-real-world-priority band rather than an emergency-patch category.
Remote code execution within the browser process could be achieved in Mozilla Firefox before version 157 through an invalid pointer release in the JavaScript JIT compiler. A remote, unauthenticated attacker can trigger this by convincing a user to visit a malicious webpage, requiring user interaction but no privileges. No public exploit code has been identified at time of analysis, and the CVSS base score is 8.8.
Privilege escalation in Mozilla Firefox versions prior to 157 arises from incorrect boundary conditions in the Graphics: WebGPU component, a CWE-119 buffer-bounds flaw that a remote, unauthenticated attacker can trigger when a victim loads attacker-controlled web content. Exploitation depends on user interaction (UI:R) - typically visiting a malicious or compromised page - and is rated CVSS 8.8 with high confidentiality, integrity and availability impact, though scope is unchanged (S:U) so the effect is confined to Firefox's content process rather than the host operating system. No public exploit code was identified and CISA's SSVC assessment records Exploitation: none, so this is a mid-to-high priority browser patch rather than an emergency; the issue is fixed in Firefox 157.
A use-after-free in Mozilla Firefox's Graphics: WebGPU component (CWE-416) lets a remote attacker who gets a victim to render attacker-controlled web content corrupt memory and potentially achieve code execution in the browser's process, earning a High-severity CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). All Firefox builds prior to 157 are affected, and Mozilla fixed the issue in Firefox 157 (advisory mfsa2026-97, Bugzilla 2059020). No public exploit code or confirmed active exploitation has been identified at time of analysis, and because the vector requires user interaction, mass automated exploitation is unlikely, though per-target heap grooming is needed for reliable execution.
Privilege escalation in Mozilla Firefox's Places component lets a remote attacker reach elevated, normally chrome-restricted functionality inside the browser when a victim opens attacker-controlled web content in an affected build. Affected releases are Firefox versions before 157 and Firefox ESR versions before 153.4, rated 8.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which means no attacker-side authentication or privileges are required but the victim must be induced to interact with a crafted page, after which confidentiality, integrity and availability impact is total within the affected security scope (CWE-269 improper privilege management). There is no public exploit identified at time of analysis and no CISA KEV entry; CISA SSVC rates exploitation as "none" and the attack as not automatable, so this is a serious browser flaw rather than a current worm or mass-exploitation emergency, and it is fully resolved by updating to Firefox 157 or Firefox ESR 153.4.
Improper enforcement of a built-in DOM security mitigation in Mozilla Firefox's Service Workers component allows remote, unauthenticated attackers to bypass that protection when a victim loads attacker-controlled web content, with a successful bypass potentially yielding high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation requires the user to visit a malicious or compromised page that registers or abuses a Service Worker (UI:R, PR:N); the underlying CPE confirms only the Mozilla Firefox browser family (versions before 157 and before ESR 153.4) is affected. At time of analysis there is no public exploit identified and no confirmed active exploitation, EPSS is low at 0.16% (4th percentile), and CISA SSVC rates exploitation as 'none' and automatable as 'no', indicating a moderate rather than emergency priority. Because this is a protection-mechanism bypass (CWE-693), realistic full impact likely depends on chaining with a second flaw rather than standalone compromise.
Code cache poisoning in Electron's sandboxed preload machinery allows a compromised renderer to get its own code executed in the more privileged preload context on a later load, affecting desktop applications built on Electron 42.3.3 through versions prior to 42.10.0, 43.0.0-beta.1 through versions prior to 43.5.0, and 44.0.0-alpha.1 through versions prior to 44.0.0-beta.6. Two prerequisites must both hold: the application must load untrusted content (the vendor explicitly states apps that do not load untrusted content are unaffected), and the attacker must already control a renderer process, so this is a local, low-privilege escalation step (CVSS 3.1 vector AV:L/PR:L) rather than a standalone remote attack. Vendor-released patches are available in 42.10.0, 43.5.0, and 44.0.0-beta.6, there are no app-side workarounds, EPSS is 0.09% (0th percentile), and no public exploit code or confirmed active exploitation (no CISA KEV listing) was identified at time of analysis.
Improper TLS certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets a man-in-the-middle who already occupies an adjacent-network position intercept, forge or tamper with protected connections, exposing sensitive information and defeating protection mechanisms. Affected builds are all versions prior to 5.34.00.16 and prior to 5.36; the CVSS vector (AV:A/AC:L/PR:N/UI:N) indicates exploitation needs no credentials and no user interaction, but does require the attacker to be on the same or an adjacent network segment as the SCG Policy Manager rather than reaching it across the internet. No public exploit code and no active exploitation have been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and EPSS is negligible at 0.08% (0th percentile), so risk is driven by network positioning and management-plane exposure rather than mass exploitation.
Memory exhaustion in LightLLM through 1.2.0 lets unauthenticated remote attackers crash KV-transfer worker processes when the server is started with the non-default `--pd_trans_mode nccl` flag. Under that mode the NCCL-based prefill-decode control channel exposes a `set_value` method that stores caller-supplied key-value pairs with no size or count limit, so repeated calls consume worker memory until the process dies and the node fails. Impact is availability-only (CVSS 4.0 base 8.7, VA:H; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no data disclosure or modification; exploitation requires the opt-in NCCL transport mode plus network reachability to the control channel, and no public exploit has been identified at time of analysis.
Basecamp's Upright authentication library contains a login cross-site request forgery (CSRF) flaw in the static-credentials session callback implemented in app/controllers/upright/sessions_controller.rb, where the login action is not protected by an anti-CSRF token. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R, unauthenticated remote attackers can exploit it, but success depends on victim interaction - the victim must load or be redirected to an attacker-controlled page that submits the forged login request while Upright's static-credentials session flow is exposed. The practical consequence is that the victim is silently logged into the attacker's session rather than having their own account compromised, so our independent assessment rates the impact as partial (C:L/I:L/A:N) even though MITRE assigned 8.8 (C:H/I:H/A:H); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Memory disclosure and denial of service in the Eclipse NetX Duo TFTP server addon (nxd_tftp_server) are reachable by an unauthenticated remote attacker sending a single oversized DATA datagram over the network, because the DATA branch enforces only a four-byte minimum (nxd_tftp_server.c:1037) and never validates an upper bound against the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER_MAX. The oversized length is passed as nx_packet_length - 4 into FileX via fx_file_write, and since nx_packet_length measures the whole packet chain rather than the first contiguous buffer, FileX reads past the end of that buffer and the leaked heap contents are written into the file the attacker is uploading, which a subsequent TFTP read request returns to the attacker; the same datagram also wedges the server permanently because nx_packet_copy with NX_WAIT_FOREVER suspends the server thread once the request exceeds the packet pool capacity. Rated CVSS 4.0 base 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H), consistent with an independent assessment of CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:H, and no public exploit code was identified at time of analysis, though the attack path is trivially scriptable and requires only that the optional TFTP addon be compiled in and reachable.
Unauthenticated remote attackers can exploit an out-of-bounds read in Eclipse NetX Duo's DTLS ClientHello parser to disclose up to 255 bytes of adjacent process memory over the network, or to crash the device. The flaw triggers on the very first ClientHello and requires no prior session, credentials, or user interaction, affecting default DTLS-enabled deployments with a reachable DTLS/UDP listener. No public exploit code has been identified at time of analysis, but the issue is rated CVSS 8.8 and is considered a high-priority risk among the NetX Secure DTLS/TLS advisory cluster.
TeamViewer Full Client and Host on Windows, Linux, and macOS contain an improper access control flaw that allows authenticated session participants to bypass user-configured permission settings during session establishment, potentially leading to unauthorized actions or remote code execution. The vulnerability requires the attacker to be a session participant (PR:L) and the victim to accept the session (UI:R), and no public exploit code is identified at time of analysis. This is a moderately high-priority issue but not an emergency.
Privilege abuse in Interprobe Information Technologies Inc. Qorela DC from 1.6.1-RC29 before v1.6.2 allows an authenticated low-privilege user to perform higher-privileged actions because authorization checks are missing on affected application functions. The flaw is network-reachable, low-complexity, and requires no user interaction, resulting in high confidentiality, integrity, and availability impact with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit was identified at time of analysis, and upgrading to v1.6.2 removes the exposure.
Out-of-bounds read in Qt for MCUs occurs when an application passes a Latin-1-optimized string containing Latin-1 characters into the QML String.arg() formatting function, causing an incorrect buffer size calculation that yields incorrect formatting output and out-of-bounds memory reads. The vendor rates this 8.8 (CVSS 4.0) with high availability impact, and the vendor vector indicates unauthenticated (PR:N) network exploitation with no user interaction (UI:N), though practical exploitation is limited by the specific Latin-1 encoding precondition and the need for attacker-influenced data to actually reach String.arg() in embedded MCU firmware. No public exploit identified at time of analysis.
Authenticated stack-based buffer overflow in the TOTOLINK N150RT (NTR150) web management interface (firmware V3.4.0-B20201030) allows a network-adjacent or remote attacker holding low-privilege credentials to crash or seize control of the device by posting an oversized ApCliWEPKey value to the /boafrm/formAjaxSet handler on the topicurl=setting/setWiFiRepeaterConfig branch. Successful exploitation yields total loss of confidentiality, integrity and availability on the router (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which in a home or small-office context means credential interception, DNS/traffic manipulation, and use of the device as a pivot. No public exploit has been identified at time of analysis, CISA SSVC records exploitation as 'none', and no vendor-released patch or fixed firmware version has been identified; exposure is largely gated by whether the administration interface is reachable (LAN-bound by default, internet-reachable only when remote management is enabled).
TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030 contains a stack-based buffer overflow in the web management handler /boafrm/formFilter that is triggered when an oversized url parameter is submitted with the addFilterUrl (or addFilterUrlFlag) action flag set, allowing an attacker who can reach the interface to corrupt stack memory and gain full control of the device (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High). Exploitation is network-reachable and low-complexity but requires low-privilege authenticated access, so the realistic exposure is limited to management interfaces reachable on the LAN or to deployments where WAN-side remote administration has been enabled. No public exploit identified at time of analysis, no CISA KEV entry is present, and SSVC records Exploitation: none with Technical Impact: total; a third-party gist reference is linked but is not confirmed as weaponized exploit code.
Regular expression denial of service in anchorme (published as anchorme.js on npm) through version 3.0.8 lets unauthenticated remote attackers stall a Node.js process by supplying crafted strings with repeated patterns that drive catastrophic backtracking in the IPv6 host-extraction regex. The vendor-supplied CVSS 4.0 score is 8.7, while the independent assessment scores it CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting a pure availability impact that is most severe in server-side deployments where the single-threaded event loop is shared across users; browser-side use only degrades the attacker's own tab. No CISA KEV entry or public exploit code was identified at time of analysis, and the practical severity hinges on whether anchorme is invoked on untrusted input in a shared server process.
Denial of service in iperf3 prior to 3.22 allows unauthenticated remote attackers to permanently pin a UDP receive worker thread at approximately 100% CPU by sending a crafted control-channel parameter message followed by a single 16-byte UDP datagram. The affected server becomes unresponsive and does not respond to normal control-channel closure, requiring SIGKILL to terminate. Exploitation requires a network-reachable iperf3 server in server mode with a UDP test path; the vendor has released patch 3.22, and no public exploit identified at time of analysis.
Denial of service in WatchGuard Fireware OS allows a remote, unauthenticated attacker to exhaust resources on the appliance by sending a specially crafted request to the login process known as wgagent. The affected code is part of the firewall's authentication/VPN interface, so any Firebox whose management or VPN portal is reachable from an untrusted network is exposed; exploitation is low-complexity and requires no credentials, as confirmed by the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N). Impact is bounded to availability and there is no confidentiality or integrity loss and no code execution; no public exploit code was identified in the available intelligence and there is no CISA KEV confirmation of active exploitation at time of analysis.
Authenticated remote code execution in Octopus Server allows any user whose role grants permission to edit an Environment or a Project to store specifically crafted JSON on that object, which the server then deserializes insecurely and executes as arbitrary code inside the Octopus Server process. Exploitation requires a valid account and that specific edit permission but no user interaction and no non-default configuration, and it delivers full loss of confidentiality, integrity, and availability to the deployment platform; the practical threat comes from malicious insiders, over-provisioned users, or attackers who have already compromised an account holding Environment/Project edit rights. No public exploit code has been identified at time of analysis, and the vendor has published advisory SA2026-10 covering the issue.
Authenticated remote attackers can execute arbitrary SQL commands against Flowring Agentflow 4.0 through the /WebAgenda/SQLWin.do endpoint, because the 'sql' request parameter is handed to the database tier without adequate validation or authorization checks (CWE-749, Exposed Dangerous Method or Function). Exploitation requires only a valid low-privileged session (CVSS vector PR:L) plus network reachability to the endpoint, and needs no user interaction; success yields high confidentiality, integrity, and availability impact limited to the Agentflow system itself (VC:H/VI:H/VA:H, SC:N/SI:N/SA:N, score 8.7), meaning database contents can be read, altered, or destroyed. There is no confirmed active exploitation (CISA KEV does not list this CVE) and no public exploit code identified at time of analysis, but the low complexity, low privilege requirement, and network-reachable attack surface make this a high-priority fix for organizations running Agentflow 4.0 builds that predate the 2026/08/28 remediation.
Unauthenticated code execution is possible on WatchGuard Fireware OS through its DHCP fingerprinting daemon (fingerd), which overflows a fixed-size stack buffer when it parses a specially crafted DHCP packet. An attacker only needs Layer 2 adjacency to a Firebox interface whose DHCP-processing path reaches fingerd - the same broadcast domain or VLAN - with no credentials (PR:N) and no user interaction (UI:N); the adjacency requirement keeps this off the internet-attackable surface, since it cannot be triggered across a routed boundary. Successful exploitation yields full compromise of the daemon's process context (high confidentiality, integrity, and availability impact per the assessed vector), with the process crash as the minimum outcome; no public exploit code has been identified at time of analysis and the flaw is not reported as confirmed actively exploited (CISA KEV).
Unrestricted public read access to the Viidure dashcam platform's central cloud storage bucket exposes sensitive user records, live dashcam footage, application packages, and firmware files to anyone on the internet. Because CPE data ties the affected asset to the Viidure Dashcam Android application and the bucket is the shared storage backend for the whole platform, the exposure is platform-wide rather than isolated to a single customer or object. The issue is remotely reachable by unauthenticated attackers (CVSS 4.0 vector AV:N/PR:N/UI:N) with high confidentiality impact only (VC:H, VI:N, VA:N) and a CVSS score of 8.7; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, although accessing the data requires nothing more than an unauthenticated request to the bucket. Our independent assessment agrees this is a genuine, high-real-risk data exposure rather than an inflated CVSS score.
Information disclosure in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows an authenticated, low-privilege user (CVSS vector PR:L) to reach two user-information endpoints that expose sensitive device and account details. The leak is not reproducible in normal operation - it appears only in a non-default, misconfigured, or transient device state - and it is a confidentiality-only exposure in the independent assessment (C:H/I:N/A:N), even though CISA, scoring on behalf of the vendor, assigned a CVSS 4.0 base of 8.7 that also claims high integrity and availability impact. There is no public exploit identified at time of analysis (no CISA KEV listing, no POC reference in the advisory data), and the affected product is a niche RTMP/H5 IoT camera with limited deployment, which constrains real-world risk.
Hardcoded, shared cloud-API credentials baked into Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 can be extracted by anyone who obtains the publicly distributed firmware package and then reused against the vendor's cloud service in ways outside normal device operation, exposing data the cloud API is meant to protect. The issue is exploitable remotely with no authentication or user interaction (CVSS 4.0 8.7: AV:N/AC:L/AT:N/PR:N/UI:N, VC:H with VI:N/VA:N; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), limited primarily by the attacker's ability to reach the cloud endpoint and by the credentials remaining valid and unrotated. No public exploit identified at time of analysis, and practical exposure is reduced by the narrow deployment footprint of this specific ICS/IoT streaming device.
Attackers who can reach the firmware update routine of Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can push arbitrary, unverified firmware images to the device and take full control of it, because both the local and the cloud update paths validate only a basic hash instead of a cryptographic signature. The flaw is a design-level chain-of-trust failure (CWE-347) scored 8.7 under CVSS 4.0, and per the associated CVSS vector it requires low-level privileges (PR:L) with no user interaction (UI:N) while impacting confidentiality, integrity and availability equally. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so practical urgency is driven mainly by device exposure; real-world risk is further bounded by Anjvision's very small deployment footprint.
OS command injection in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows authenticated, low-privileged network attackers to enable a hidden debug interface and then deliver crafted input to a backend command handler, resulting in high impact to confidentiality, integrity, and availability of the device (assessed CVSS:3.1 8.7, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires network reachability to the device's management/control service, valid credentials of at least low privilege, and the specific firmware build; no user interaction is needed, and no public exploit identified at time of analysis. No confirmed vendor patch version is present in the available advisory data, so affected deployments should treat exposure reduction as the immediate priority.
Broken access control in Liberu CRM 0.9.1 through releases before 10.0.0 lets an authenticated low-privileged user who already holds a pending team invitation escalate privileges and bind a second, attacker-controlled account to the team with full admin rights, granting create, read, update, and delete access over all team-scoped data. The root cause is a flawed authorization predicate in TeamPolicy::addTeamMember() that grants invite rights based solely on whether the requesting email matches an outstanding invitation, combined with missing privilege-level validation in InviteTeamMember, so a POST to the team-invitations route specifying the 'admin' role is accepted. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-released fix is version 10.0.0, which removes the flaw.
The SNMP agent addon in Eclipse ThreadX NetX Duo can be driven into an out-of-bounds read by a single unauthenticated remote SNMP packet whose object identifier uses BER multibyte length encoding to claim a length larger than the receive buffer, causing `_nx_snmp_utility_object_id_get` to decode adjacent heap bytes as OID components. On memory-protected (MMU/MPU) builds this faults into a crash of the SNMP agent thread, producing denial of service, while on bare-metal no-MMU targets the out-of-bounds read succeeds silently and instead corrupts the agent's internal OID state with neighboring heap data. Exposure is conditional: the NetX Duo SNMP addon must be compiled into the firmware and actively listening (typically UDP/161), so builds without an SNMP-enabled agent are unaffected; no public exploit code has been identified at time of analysis (no CISA KEV listing).
Unauthenticated remote clients can exhaust the packet pool of the Eclipse ThreadX NetX Duo RTSP server addon, causing a denial of service: roughly two dozen RTSP requests carrying a Session header value that the parser cannot convert (empty or non-numeric) leak one packet block each until the pool hits zero and the server can no longer serve any client. The leak occurs because the Session branch of _nx_rtsp_server_error_response_send's caller returns the raw NetX error code instead of mapping it to an RTSP status, and the error-response path then drops the already-allocated response packet on that unrecognized code. No public exploit identified at time of analysis, and no CISA KEV entry was provided; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote, unauthenticated, availability-only impact, with blast radius worst when the RTSP server shares its packet pool with the rest of the application, as in the shipped sample (22-block pool exhausted by ~26 requests).
Unauthenticated content and configuration tampering in Marmite's optional built-in development server (all versions through 0.4.2) lets any network-reachable attacker create, modify, or overwrite site content and configuration by posting to the /__marmite__/content, /__marmite__/config, and /__marmite__/file/ endpoints, with no credentials or user interaction required. The same handlers pass unsanitized path parameters from handle_create_content and handle_clone_content into filesystem writes, so an attacker can traverse out of the project directory and drop or clobber files elsewhere on the host. Exploitation requires the target to be running `--serve` and reachable over the network - pre-0.4.3 the server bound to 0.0.0.0:8000 by default, and production static sites served by Nginx or Apache are unaffected; no public exploit code was identified at time of analysis, and the vendor released 0.4.3 to fix the issue (loopback-by-default binding plus a documented development-only posture).
Unauthenticated path traversal in Marmite's built-in development server (--serve) lets remote attackers read arbitrary files that the marmite process can access, by submitting percent-encoded '..' sequences that the handle_request function in src/server.rs fails to reject after decoding and path-joining. All versions through 0.4.2 are affected, and exposure is significant because the server previously defaulted to binding 0.0.0.0:8000 (all interfaces) rather than loopback, so any host running --serve on a network-facing address was reachable; the 0.4.3 fix commit narrows the default bind to 127.0.0.1 and labels the server development-only. No public exploit identified at time of analysis and the component is a development-only preview server, but the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:H, 8.7) reflects a low-complexity, unauthenticated high-confidentiality read with no integrity or availability impact.
Denial of service in SGLang 0.5.20 and earlier: the /generate HTTP endpoint in prefill/decode (PD) disaggregation deployments using the Mooncake KV transfer backend does not validate duplicate bootstrap_room identifiers, so remote unauthenticated attackers who fire concurrent requests carrying the same bootstrap_room value can crash scheduler processes or stall other users' requests until the transfer times out. The attack is trivial and requires no authentication or user interaction (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, availability-only VA:H), but it only affects the non-default multi-node PD disaggregation configuration with the Mooncake backend; single-node and default deployments are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the impact is purely availability-related with no confidentiality or integrity loss.
Memory exhaustion in Nicotine+ versions prior to 3.3.11 allows a remote Soulseek peer running a modified client to crash the victim's machine by sending a zlib-compressed peer message crafted as a decompression bomb. The vulnerable code path decompressed incoming peer messages without any cap on the uncompressed output size, so the client inflates attacker-supplied data until the operating system runs out of available memory. No authentication or user interaction is required beyond the victim being connected to the Soulseek network (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor-published CVSS 4.0 score 8.7); impact is limited to availability, with no data access or code execution, and no public exploit code or CISA KEV entry was identified at time of analysis. Vendor-released patch: 3.3.11.
Authenticated users can inject malicious input through the TIBCO Administrator web console (versions 5.13.0 and prior), potentially leading to arbitrary code execution and full compromise of the affected system. The flaw requires a valid low-privilege account (PR:L) and network access to the console; no public exploit code or active exploitation has been identified at this time.