A directory traversal flaw in mark3labs mcp-filesystem-server v0.11.1 lets a caller write files outside the server's configured allowed directories by routing a write-capable tool through a pre-existing dangling symlink that already sits inside an allowed path. The bug is integrity-only (no read or denial-of-service impact) and requires the broken symlink to exist beforehand, which limits realistic exploitation; the only confirmed affected version from available data is v0.11.1. There is no public exploit identified at time of analysis, SSVC records Exploitation: none, and no vendor-released patch was identified in the supplied data, making this a low-urgency defense-in-depth issue rather than an emergency.
Out-of-bounds heap read and a control-flow-integrity gap in the Eclipse ThreadX loadable-module loader (module manager) allow an attacker-supplied module image to trigger out-of-bounds memory disclosure when the device loads it through `_txm_module_manager_memory_load` or `_txm_module_manager_in_place_load`. The affected code fully trusts every size and offset field in `TXM_MODULE_PREAMBLE` - the loader APIs accept only a base pointer and no image length, and the preamble `checksum` is never verified - so `code_size` can drive the code-copy loop past the end of the source image; the copy destination is overflow-guarded, so no controlled out-of-bounds write was found. Exploitation is local and conditional: no authentication or privileges are required (PR:N), but attack complexity is high, user/operator action is needed to trigger the load, and only systems that actually load third-party or externally supplied modules are exposed; no public exploit was identified at time of analysis.
Local information disclosure in the wsl-pro-service component of Ubuntu Pro for WSL (versions before 0.1.19ubuntu3) lets any unprivileged user or process sharing a WSL instance read the Ubuntu Pro attach token while the root-run service executes `pro attach <token> --format=json`; the token sits in cleartext in /proc/<pid>/cmdline, which remains world-readable in WSL because /proc is mounted without hidepid. Because the token is a bearer credential for the subscription, an attacker who wins the short race window can attach their own machines to the victim's Ubuntu Pro subscription and consume its entitlements and services. Exploitation requires a pre-existing local account inside the WSL instance, the WSL-default (non-hardened) /proc mount, and precise timing against a transient process - no public exploit identified at time of analysis, and no evidence of active exploitation.
Local abuse of privileged IPC in Progress Telerik Fiddler Everywhere before 8.2.0 lets a low-privileged, locally authenticated attacker who can tamper with the application's launch parameters - and then persuade the victim to actually start the app - substitute attacker-controlled UI or settings content for the genuine ones. That foothold can expose OAuth authentication tokens, execute locally reachable programs, or silently rewrite application-generated configuration files, with high confidentiality impact and limited integrity impact but no availability impact. No public exploit identified at time of analysis and the issue is not in CISA KEV; the CVSS 3.1 base score of 5.6 reflects the strict prerequisites of local access plus user interaction, making this a developer-workstation-scoped risk rather than an urgent, remotely reachable one.
Local users able to run KVM guests on x86 hosts can crash the host kernel by driving KVM's MMU into an inconsistent write-tracking state, because kvm_gfn_is_write_tracked() inspects only the memslot it is handed even though page tracking is per-address-space and shadow pages are shared across address spaces; under SMM emulation a GFN write-tracked in one address space appears untracked through the other, letting mmu_try_to_unsync_pages() mark an upper-level shadow page unsync and trip the BUG in pte_list_remove(). The flaw is scored CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so access is local with low privileges required and impact is limited to host availability with no confidentiality or integrity effect; exploitation requires /dev/kvm access plus a guest configuration that reaches the SMM dual-address-space path. Vendor patches exist for the stable branches (6.1.187, 6.6.156, 6.12.108, 6.18.49, 7.1.13 and 7.2), EPSS is 0.19% (8th percentile), and no public exploit code or CISA KEV entry is identified at time of analysis.
DKIM signature verification in OpenDKIM through 2.11.0 can be desynchronized by a crafted DKIM-Signature header, causing the tag tokenizer (dkim_process_set in dkim.c) to consume attribute values from a less trusted source than the signed data and return an attacker-influenced authentication verdict. Exploitation is remote and unauthenticated over SMTP against a standard Postfix/Sendmail milter deployment, but the impact is deliberately limited: the desync affects only the DKIM result of the single crafted message, so real damage depends on whether downstream DMARC enforcement or anti-phishing filtering blindly trusts OpenDKIM's verdict. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P and the researcher published a technical write-up), there is no confirmed active exploitation in CISA KEV, and the vendor did not respond to the disclosure, so no vendor-released patch has been identified.
Denial of service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 allows an attacker to crash the application by supplying a crafted packet capture or frame that reaches the MBIM (Mobile Broadband Interface Model) protocol dissector. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5) shows the attack is local with no privileges required but requires user interaction - typically opening a malicious capture file - and the only impact is availability loss from a recoverable crash with no confidentiality or integrity effect. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; consistent with the independent assessment, this is a low-priority, availability-only defect despite its medium 5.5 rating, and consumers of untrusted captures should still patch or restrict the MBIM dissector.
Crashing denial-of-service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 occurs when the RF4CE protocol dissector processes a malformed packet, triggering a heap-based buffer overflow (CWE-122) that terminates the application. The attack is not remotely triggerable: a local user must be induced to open a crafted capture file (or start a live capture containing RF4CE-classified traffic), and no authentication is required (PR:N) while user interaction is mandatory (UI:R), so impact is confined to process availability with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and no CISA KEV listing; the vendor has published an advisory (wnpa-sec-2026-104) that should be consulted for the fixed release.
Denial of service in Wireshark 4.6.0 through 4.6.8: a use-after-free in the ZigBee ZCL (ZigBee Cluster Library) protocol dissector causes the application to crash when a malformed ZCL packet is dissected. The attack vector is local and requires user interaction - an analyst must open a crafted capture file or live-dissect malicious ZigBee traffic (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5), and impact is limited to availability, with no code execution, data disclosure, or tampering reported. No public exploit code and no confirmed active exploitation were identified at time of analysis; exploitation is constrained by the need for the malformed packet to actually reach the ZigBee/ZCL dissector on a machine running an affected build.
An infinite loop in the TTL trace-file parser of Wireshark 4.6.0 through 4.6.8 lets a crafted capture file hang the application when an analyst opens it, producing a denial of service limited to the local Wireshark process. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms the attacker cannot trigger the flaw remotely or without the victim manually opening the malicious TTL capture, and there is no confidentiality or integrity impact. No public exploit code or confirmed active exploitation was reported at the time of analysis, and no EPSS score was supplied, so the practical risk is low-priority availability loss rather than a broad compromise vector.
A NULL pointer dereference in Wireshark 4.6.0 through 4.6.8 allows a local user to crash the application by opening a crafted PEAK CAN TRC trace file, resulting in denial of service. The flaw requires user interaction to open a malicious file and cannot be triggered remotely; no public exploit code or active exploitation has been identified at time of analysis. The CVSS score is 5.5 with availability-only impact.
Memory leakage in Wireshark's IEEE C37.118 Synchrophasor protocol dissector allows a crafted packet capture to progressively exhaust process memory and crash the application on versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. Exploitation requires a local user to open an attacker-supplied capture that actually contains malformed synchrophasor/PMU traffic, so the C37.118 dissector code path must run; the CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms a local, unauthenticated but user-interaction-dependent trigger with availability-only impact. This is a low-priority, moderate-CVSS (5.5) availability bug with no confidentiality or integrity impact and no code execution; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Heap-based buffer overflow in Wireshark's sharkd JSON-RPC backend (CVE-2026-95388) allows attacker-controlled packet-capture data to crash the local analysis process in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. The issue is local and requires user interaction, because an analyst must load a malicious capture into sharkd, and it yields only denial of service (CVSS 5.5, AV:L/PR:N/UI:R, A:H). No public exploit identified at time of analysis, and the practical risk is limited to deployments that actually invoke the sharkd utility.
Malformed TIFF data processed by Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 causes the TIFF protocol dissector to loop indefinitely, hanging the application until it is killed manually. Exploitation is local and client-side (AV:L, UI:R): an attacker must convince an analyst to open a crafted capture file or dissect attacker-controlled traffic containing the malicious TIFF payload, and no privileges are required (PR:N). Impact is availability-only (C:N/I:N/A:H, CVSS 5.5) with no data disclosure, modification, or code execution, and no public exploit has been identified at time of analysis - this is a genuine but low-priority issue whose realistic risk is targeted social engineering of analysts rather than mass exploitation.
A heap-based buffer overflow in the IEEE 802.11 dissector of Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 allows local, unauthenticated attackers to cause a denial of service (application crash) by convincing a user to open a crafted packet capture file or by processing malicious live 802.11 traffic. The vulnerability requires user interaction and has only availability impact, with no confidentiality or integrity loss, and is considered low priority despite its Medium CVSS score of 5.5. No public exploit code or active exploitation has been identified at time of analysis; the IEEE 802.11 dissector is enabled by default, so no special configuration is needed beyond processing the malicious data.
Opening a crafted Catapult DCT2000 capture file in Wireshark 4.6.0 through 4.6.8 or 4.4.0 through 4.4.18 triggers a stack-based buffer overflow in the DCT2000 protocol dissector, terminating the application. The issue is local and client-side (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5): the analyst must actively load the malicious file or a capture whose packets are routed through the DCT2000 dissector, and no authentication is required per the vector, but user interaction is. Impact is limited to an availability loss - a crash of the Wireshark process - with no code execution, data disclosure, or integrity impact indicated. No public exploit code was identified at time of analysis, and the flaw is not confirmed actively exploited (not in CISA KEV); the vendor has published advisory wnpa-sec-2026-110 and an associated GitLab work item.
Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 can be crashed by a reachable-assertion failure in the Frame protocol metadissector, a local, user-assisted denial of service tracked as CVE-2026-96422 (CVSS 5.5, CWE-617). The attack vector is local and requires user interaction: an analyst must open or process a crafted capture file, or capture crafted live traffic that reaches the metadissector, after which the parser aborts the process; the impact is limited to availability (A:H) with no confidentiality or integrity effect and no code execution. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; authentication requirements are not confirmed from the available data, though the assessed vector (AV:L/PR:N/UI:R) indicates no privileges are needed beyond the victim loading the malicious input. Risk is genuine but low-urgency, confined to disruption of the analysis workflow.
Denial of service in Wireshark 4.6.0-4.6.8 and 4.4.0-4.4.18 allows attackers to hang or exhaust memory in the Wireshark process by getting a user to open a crafted capture file containing malformed USB HID data. The flaw is an infinite loop and memory leak in the USB HID protocol dissector (CWE-1325); exploitation requires user interaction to load the file and cannot cause code execution or data disclosure. No public exploit was identified at time of analysis, and the assessed CVSS 3.1 score is 5.5 (Medium) with high availability impact under a local vector.
Local denial of service in the dash shell affects builds compiled without libc fnmatch, where the internal pmatch() matcher handles the '*' wildcard by unbounded recursion over candidate positions. A local attacker who can plant filenames in a directory that later gets globbed - or otherwise feed the internal matcher - can supply a short multi-star pattern such as *.*.*.*.*.tar.gz and drive excessive CPU consumption in the affected shell process. The issue requires a non-default build configuration (PR:L, AV:L, no remote reachability, no privilege escalation or data disclosure), maps to CWE-1333 (inefficient regular expression complexity) with a CVSS 3.1 score of 5.5, and there is no public exploit identified at time of analysis and no confirmed actively exploited status (CISA KEV).
Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 can crash when a user opens a crafted capture file in the Toshiba ('compact router snoop') format, producing a denial-of-service condition limited to the affected process. The underlying issue is a buffer over-read (CWE-126) in the Toshiba wiretap parser; the supplied CVSS vector rates it as local, high-complexity, user-interaction-required, and availability-only, and the independent assessment calls it a genuine but low-priority issue. No public exploit was identified at time of analysis.
SQL injection in risesoft-y9 WorkFlow-Engine (all versions up to and including 9.6.10) lets a remote attacker manipulate the 'year' and 'processInstanceId' arguments passed to the getByIdAndYear function of CustomHistoricProcessServiceImpl.java, with two independent injectable sink positions rather than one. Publicly available exploit code exists (there is no CISA KEV listing, so active exploitation is not confirmed), and the vendor was contacted early but never responded or shipped a fix. The vendor-supplied vector rates the flaw unauthenticated (PR:N), while the independent assessment scores it PR:L because the affected code path sits behind the product's OAuth2 Resource Filter and may require a valid access token; defenders should determine whether the endpoint is reachable before authentication. Impact is bounded (low confidentiality, integrity and availability), so this is a low-to-moderate real-world risk that hinges on whether a given self-hosted instance is internet-exposed.
Stored cross-site scripting in the Ammonia Rust HTML sanitizer affects versions 3.3.2 and earlier, 4.0.0 through 4.0.2, and 4.1.2 through 4.1.3 when a consuming application has explicitly whitelisted the SVG `animate` and `set` tags. An authenticated attacker with a content-submission path can craft an SVG whose `<set>` element sets `attributeName="href"` with a `javascript:` value, surviving sanitization because animation-target attribute names were never validated; the payload only fires if the victim clicks the resulting link (UI:R), yielding a scoped cross-site scripting impact (C:L/I:L). Ammonia's default configuration does not permit `animate` or `set`, so out-of-the-box deployments are unaffected, and no public exploit code or confirmed active exploitation was identified at time of analysis.
A spoofing flaw in Firefox's Networking: HTTP component allows a malicious web page to misrepresent UI content to the user, potentially tricking them into trusting a spoofed page element. The issue affects Firefox versions prior to ESR 153.4 and Firefox 157; it requires the victim to actively load or interact with attacker-controlled web content (UI:R), means no authentication on the attacker's side (PR:N), and yields only limited confidentiality impact. No public exploit code has been identified at time of analysis, CISA KEV does not list it, and SSVC scores exploitation as 'none' with automatable 'no' - overall risk is consistently LOW.
UI spoofing in Google Chrome on iOS versions prior to 154.0.8037.92 allows a remote attacker to impersonate sign-in interface elements by luring the victim to a crafted HTML page, potentially deceiving the user into trusting and interacting with fake prompts. Exploitation requires user interaction (the victim must open the page and engage with the spoofed UI) and no authentication or special privileges; the impact is limited to UI misrepresentation and low-confidentiality disclosure, with no code execution or memory corruption demonstrated. No public exploit code or confirmed active exploitation has been identified at time of analysis, Chromium rates the issue security severity Low, and CISA's SSVC assessment records exploitation as none and automatable as no, so this should be treated as a low-priority hardening item rather than an urgent patch. A vendor patch is available in Chrome 154.0.8037.92, and Google has published a stable channel advisory plus a Chromium issue tracker entry.
UI misrepresentation in the TabStrip component of Google Chrome prior to 154.0.8037.92 lets a remote attacker spoof browser UI elements by luring a victim to a crafted HTML page, rated CVSS 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) and Chromium security severity Low. No authentication or special privileges are required, but the victim must open the malicious page and be deceived by the spoofed chrome, and the outcome is limited to UI deception - no code execution, memory corruption, or direct data exfiltration has been demonstrated. There is no CISA KEV listing and no public exploit code identified at time of analysis, and auto-updated installations at or above 154.0.8037.92 are not affected.
Firefox for Android before 157 can be tricked by a malicious web page into misrepresenting download information in its Downloads component, a spoofing flaw rated CVSS 5.4 (Medium, AV:N/AC:L/PR:N/UI:R). Only the Android builds are affected - desktop Firefox is not implicated - and Mozilla shipped the fix in Firefox 157. Exploitation requires the victim to visit an attacker-controlled page and interact with a download prompt, no public exploit code has been identified at time of analysis, and CISA SSVC records exploitation as 'none', so this is a low-to-moderate priority fix rather than an urgent one.
Mozilla Firefox versions prior to 157 contain a flaw in the WebAssembly component that can be triggered when an unauthenticated remote attacker convinces a victim to load a crafted webpage, resulting in limited information disclosure and integrity impact. No public exploit code has been identified at time of analysis, and EPSS is 0.15% (4th percentile), indicating low real-world exploitation likelihood. Because the bug is scope-unchanged, it does not grant sandbox escape on its own; a full host compromise would require chaining with a separate sandbox-escape vulnerability.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an open redirect vulnerability that allows unauthenticated remote attackers to craft a link which, when followed by a victim user, redirects to an untrusted site and can lead to server-side request forgery (SSRF). The CVSS 3.1 base score is 5.4 (medium) due to the requirement for user interaction (UI:R) and low confidentiality/integrity impact. No public exploit code has been identified at time of analysis, and the vulnerability is not known to be actively exploited.
Argument injection in JupyterLab's PyPI Extension Manager (JupyterLab 4.0.0 through 4.5.10 and the 4.6.x branch before 4.6.4) lets an authenticated account with extension API access submit pip option-like uninstall names - such as '-r/--requirement=' or '--log' - that are forwarded to 'python -m pip uninstall' without sanitization, causing the server to read a local file or fetch an internal URL (with content partially reflected through parse errors) or to create/corrupt a chosen path with pip-generated log text. Exploitation is highly conditional: the PyPI Extension Manager must be enabled, the attacker must be an authenticated user able to call the extension API (PR:L per the CVSS vector), and kernels and terminals must be disabled or delegated to remote hosts - otherwise that same user could already read files and make outbound requests directly. Note that despite the 'RCE' tag on this record, this is parameter injection (CWE-88) with only low confidentiality and integrity impact (CVSS 5.4) and no code execution; no public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Missing authorization in the attachment history API of Devolutions Server 2026.3.5.0 and earlier lets an authenticated low-privileged user permanently delete or restore vault attachments by sending a crafted API request. The flaw requires valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base score 5.4) and is limited to integrity and availability of attachment data - there is no confidentiality exposure and no code execution. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as none and the issue as not automatable, and a vendor patch is available in Devolutions Server 2026.3.7.0.
Improper access control in the partial connection API of Devolutions Server (reported as 2026.3.5.0 and earlier; EUVD tracks all builds prior to 2026.3.7.0) lets an authenticated low-privileged user read, create, modify, and delete System Vault entries through a crafted API request. Exploitation requires valid credentials on the instance plus network reachability to the endpoint, with no user interaction and no non-default configuration needed; the notable concern is integrity of the stored privileged secrets, reflected in the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L and an overall MEDIUM rating rather than a high-severity emergency. No public exploit code has been identified and SSVC records Exploitation: none, so there is no evidence of active exploitation at time of analysis; a vendor fix is available in 2026.3.7.0.
Denial of service in OpenSSL's DTLS 1.2 record processing allows remote, unauthenticated attackers to disrupt affected endpoints by sending an undersized AEAD record that the library fails to validate properly. Only DTLS-over-datagram deployments are exposed - OpenSSL 4.0.0 through 4.0.2, 3.6.0 through 3.6.4, 3.5.0 through 3.5.8, 3.4.0 through 3.4.7, 3.0.0 through 3.0.22, and 1.1.1 through 1.1.1zi - while TLS-over-TCP services such as HTTPS do not traverse the vulnerable code path. Impact is limited to availability (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L); there is no public exploit identified at time of analysis, SSVC records exploitation as 'none', and the vendor has released fixed versions (notably OpenSSL 4.0.3, along with backports 3.6.5, 3.5.9, 3.4.8, 3.0.23 and 1.1.1zj).
Improper enforcement of QUIC connection-level flow control in OpenSSL allows a remote, unauthenticated peer that has established a QUIC connection to open streams while bypassing the connection-wide credit accounting that is supposed to cap in-flight data, resulting in resource exhaustion and availability degradation (CVSS 5.3, CWE-770). The issue affects the OpenSSL QUIC stack in the 3.4.0 through 4.0.2, 3.5.0 through 3.5.8, and 3.6.0 through 3.6.4 lines, and is fixed in the vendor's 4.0.3 security release, which also ships the fixes for the companion 3.4.8, 3.5.9 and 3.6.5 branches; exploitation is limited to deployments that actually enable and terminate QUIC connections, so classic TLS/record-layer usage of the library is unaffected. There is no public exploit identified at time of analysis (no CISA KEV listing and no observed POC), and the assessed impact is confined to denial of service rather than code execution or data disclosure.
Denial of service via CPU exhaustion in OpenSSL's QUIC stack allows unauthenticated remote attackers to degrade availability on endpoints that accept QUIC traffic, by sending crafted fragmented data that forces the fragment reassembly logic into its O(n^2) worst case. Affected builds are OpenSSL 3.4.0 through 3.4.7, 3.5.0 through 3.5.8, 3.6.0 through 3.6.4 and 4.0.0 through 4.0.2, and only deployments with QUIC enabled are reachable, so classic TLS/DTLS-only users are unaffected. Impact is limited to partial availability loss (CVSS 5.3, A:L, CWE-407); CISA's SSVC records exploitation as 'none' and no public exploit code has been identified at time of analysis, with fixes shipped in OpenSSL 3.4.8, 3.5.9, 3.6.5 and 4.0.3.
Excessive memory allocation in OpenSSL's X.509 relative CRL Distribution Point (CRLDP) processing lets remote, unauthenticated attackers drive a low-impact denial of service against applications that validate attacker-supplied certificates or revocation data. Affected releases span OpenSSL 1.0.2 before 1.0.2zs, 1.1.1 before 1.1.1zj, 3.0.0 before 3.0.23, 3.4.0 before 3.4.8, 3.5.0 before 3.5.9, 3.6.0 before 3.6.5 and 4.0.0 before 4.0.3, and the flaw is fixed in the OpenSSL 4.0.3 security release (CWE-770, CVSS 5.3, availability-only). No public exploit code has been identified at time of analysis and no public exploit exists, exploitation is not confirmed (CISA SSVC records Exploitation: none, Automatable: yes, Technical Impact: partial), and real exposure requires the application to actually reach relative-CRLDP handling on untrusted input.
A NULL pointer dereference in OpenSSL's CMP (Certificate Management Protocol) client revocation-response handling lets a malicious or man-in-the-middle CMP server crash the client process, handing remote attackers a denial-of-service primitive against applications that actually exercise the CMP client code path. Affected branches are OpenSSL 3.0.0 through 3.0.22, 3.4.0 through 3.4.7, 3.5.0 through 3.5.8, 3.6.0 through 3.6.4, and 4.0.0 through 4.0.2, with the fix shipping in the OpenSSL 4.0.3 security release. Per the CVSS 3.1 vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) it is a remote, unauthenticated-in-vector availability issue only - no confidentiality, integrity, or code-execution impact - and no public exploit code or active exploitation has been identified at time of analysis (CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial; no KEV listing).
Stored cross-site scripting in GestSup versions before 3.2.62 allows unauthenticated attackers to inject JavaScript into technician sessions by emailing a monitored mailbox with nested MIME encoded-words in the subject line; the IMAP OAuth connector double-decodes the subject after HTML escaping, so the decoded payload survives sanitization and is stored with the ticket. Exploitation is feature-gated: the instance must have the IMAP OAuth connector enabled and actively polling a mailbox reachable from outside, and the script only fires when a technician subsequently opens the affected ticket in the web interface (passive user interaction), yielding script execution in the technician's browser rather than direct server-side impact. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (CISA KEV); risk is real but moderate given the configuration prerequisites.
Stored cross-site scripting in GestSup versions before 3.2.62 lets unauthenticated attackers plant arbitrary JavaScript in ticket descriptions and replies by sending crafted emails to a monitored support mailbox, which then executes in a technician's browser when the ticket is opened. The root problem is that the IMAP LOGIN connector fails to sanitize HTML email bodies, so any instance that has that connector enabled and polling an attacker-reachable inbox is exposed; delivery requires no authentication or special privileges, only knowledge or guessing of the mailbox address, and the payload only fires if a technician actually opens the malicious ticket, limiting impact to that technician's authenticated session (ticket data theft and actions performed as that technician) rather than server compromise. A vendor patch is available (fixed in 3.2.62) and no public exploit identified at time of analysis; the issue carries a moderate CVSS of 5.3 and is not confirmed actively exploited (CISA KEV).
Pausing a shared (public) Grafana dashboard fails to revoke the public access token, so anyone still holding the share link can continue to reach the frontend bootstrap endpoints unauthenticated and retrieve the dashboard's data-source configuration - including stored credentials for data sources configured in browser (direct) access mode. The flaw is a missing authorization check (CWE-862) affecting both Grafana OSS and Grafana Enterprise, rated CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning remote, unauthenticated access with no user interaction but a confidentiality-only impact. Exploitation is materially narrowed by prerequisites: the dashboard must be paused rather than deleted (deleting correctly revokes the token), the attacker must still possess the share link, and credential disclosure specifically requires browser-access data sources; no public exploit code has been identified at time of analysis.
Authenticated users can bypass server-side request forgery (SSRF) protections in ClaraVerse through version 0.3.1 by exploiting flaws in hostname validation and IPv6 transition address filtering within the download_file and scrape_web agent tools, enabling the server to make requests to internal services and cloud instance metadata endpoints. This medium-severity vulnerability (CWE-918, CVSS 5.3) requires a valid ClaraVerse account and is only impactful when the server runs in a network environment where such internal endpoints are reachable. No public exploit code has been identified at time of analysis.
Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 leaves an internal debug interface in the production image that can be turned on through an undocumented activation pathway, exposing diagnostic functions that can provide elevated system access once enabled. Attackers cannot trigger the exposure blindly: reaching the interface requires network access to the device plus at least low-privilege authenticated access (CVSS vector PR:L) and knowledge of the undocumented activation method, which is not publicly documented, and no user interaction is needed. Rated CVSS 5.3 (moderate), there is no public exploit identified at time of analysis and no confirmed active exploitation; the practical risk is post-authentication privilege escalation and unauthorized configuration or information access on affected devices reachable from an untrusted network.
Open redirect in the OIDC initiation endpoint of Dockhand before 1.0.36 allows unauthenticated remote attackers to bounce authenticated users to attacker-controlled sites through an unvalidated redirect query parameter. Because the redirect is chained into the real OIDC callback flow, an authorization code can leak to the attacker via the Referer header of the victim's browser, enabling follow-up credential phishing against any Dockhand account after a legitimate login. No public exploit code has been identified at time of analysis, and exploitation is conditional on OIDC/SSO being the configured authentication mechanism, a valid version below 1.0.36, and successful user interaction (CVSS 3.1 assessment: 5.3, scope-changed, confidentiality-only).
An out-of-bounds heap read in the DHCP client addon of Eclipse ThreadX NetX Duo (nxd_dhcp_client.c) allows an attacker on the same local link to disclose adjacent heap memory whenever a device performs a DHCP acquisition. The attacker only needs to be a DHCP server, or any LAN host that wins the race to answer the client's broadcast DISCOVER first, and to reply with a single OFFER containing a long run of skippable TLV options; a malformed option layout causes the parser's offset counter to lag the actual read pointer, producing a read roughly a kilobyte and beyond past the end of the message (a one-byte read 164 bytes past a 1648-byte heap region in the reported AddressSanitizer trace). The issue occurs unauthenticated (CVSS PR:N), from an adjacent network (AV:A), on every boot while the interface is unconfigured, with bounded impact limited to low confidentiality and low availability (CVSS 5.3); no public exploit code or confirmed active exploitation was identified at time of analysis.
Authentication bypass in Apache DolphinScheduler before 3.4.3 allows remote unauthenticated attackers to reach protected Spring Boot Actuator endpoints by sending requests whose paths contain percent-encoded characters, causing the application's path-based authorization check to fail to match the request against its protected Actuator path list. Successful exploitation exposes operational and configuration data (for example environment properties or configuration beans) and, where sensitive or write-capable Actuator endpoints are enabled, potentially management functionality; the assessed vector is AV:N/AC:L/PR:N/UI:N with high confidentiality and low integrity/availability impact, so no credentials or user interaction are required. No CVSS score or vector was published by NVD or Apache and no public exploit code was identified at time of analysis, though the technique is a well-understood class of path-matching evasion and exploitation is trivial once a reachable instance is found. Real-world severity is bounded by which Actuator endpoints the deployment exposes.
Improper access control in the ArgusMonitor.sys kernel driver shipped with Argotronic eGbR Argus Monitor 7.4.02 and earlier lets a local, low-privileged user win a TOCTOU race in IRP_MJ_CREATE to obtain a handle to the driver's device object, then issue a crafted IOCTL 0x9C4024A8 that crashes the driver and causes denial-of-service on the affected Windows host. The attack requires an existing local foothold on a machine where the driver is installed and loaded, and success depends on reliably winning a timing race, which is why it is rated high complexity and low overall priority despite the medium 5.3 base score. Impact is limited to availability (system/driver crash) with no confidentiality or integrity effect; there is no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis (CISA SSVC records Exploitation: none).
Heap under-allocation in U-Boot's SquashFS directory-table parser (fs/squashfs/sqfs.c) allows an attacker who supplies a crafted SquashFS filesystem image to trigger out-of-bounds heap writes and crash the bootloader, producing a denial of service during or after boot. All U-Boot releases before 2026.10-rc4 that are compiled with SquashFS support are affected, and exploitation requires the device to read and parse an attacker-controlled image from boot media, which is why the vendor treats this as a physical/local-vector issue (CVSS 4.0 base 5.2; the independent assessment rates it CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). No public exploit code has been identified at time of analysis, and the flaw was reported by VulnCheck alongside a vendor fix commit.
Unauthenticated network access to four maintenance servlets in Hitachi Energy Asset Suite - PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet - lets remote attackers invoke reload and cache-flush operations that can degrade application availability. Our independent assessment rates this an availability-only, partial denial-of-service condition (CVSS 3.1 5.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no path to data disclosure or modification, and the vendor's CVSS 4.0 vector agrees on the availability-only scope (VA:L) while also requiring user interaction (UI:A), which would further constrain practical exploitation. Real-world exposure is deployment-dependent because these servlets are production-maintenance functions whose presence and reachability depend on how the Asset Suite instance is configured; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Improper access-control enforcement in the Joomla CMS workflow feature allows an authenticated backend user to change the workflow stage of content that their assigned ACL should prevent them from touching, in Joomla 5.0.0-5.4.8 and 6.0.0-6.1.3. The CVSS 4.0 vector (5.1, AV:N/AC:L/PR:H) requires a valid backend account, and the impact is limited to the integrity of the workflow stage value (VC:L/VI:L, no availability effect), so this is a genuine but low-priority authorization flaw rather than an emergency. Confirmed actively exploited? No - no CISA KEV listing, and no public exploit code identified at time of analysis; the effect is only meaningful on sites that actually use Joomla's content workflow functionality.
Improper access control in the Joomla CMS content history comparison view allows an authenticated backend user to read content revisions they are not authorized to view, affecting Joomla 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. The issue is rated CVSS 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N; consistent with the independent CVSS:3.1 vector of AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), so it is a genuine but low-severity confidentiality-only exposure: PR:H indicates the attacker must already hold a high-privileged, authenticated backend/administrator session, no victim interaction is required, and there is no integrity or availability impact. The leaked data is limited to stored content versions rather than credentials or system data, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
Physical access to the evbee DC-80 charging station's service menu, which is obfuscated but lacks authentication, allows an attacker to retrieve sensitive information including serial numbers, MAC addresses, and WiFi network credentials. This information disclosure vulnerability has a CVSS 4.0 score of 5.1 (AV:P/AC:L/PR:N/UI:N/VC:H/VI:N/VA:N) and requires hands-on access, making it a low-priority issue per our assessment. No public exploit code has been identified, and while the WiFi password leak could enable network pivoting, exploitation cannot be performed remotely or at scale.