Broken object-level authorization in LimeSurvey Community Edition 7.3.0 lets an authenticated user who holds survey-creation rights tamper with questions, answers, and conditions that belong to other users' surveys. The REST survey-patching endpoint validates the caller's permission against the survey ID in the request URL (the attacker's own survey), but the underlying persistence logic resolves the target question (qid) or answer (aid) globally by ID and never confirms the object actually belongs to that authorized survey. The result is an integrity-only impact (CVSS 4.0 7.1 / assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) requiring a valid account plus survey-creation privileges; no public exploit code has been identified at time of analysis, and the vendor has published an upstream fix.
Authenticated users of GestSup before 3.2.62 can read private comments belonging to other users' tickets by manipulating the threadedit parameter in thread.php, because the comment loader never verifies that the requester owns the referenced ticket. Any valid account, even a low-privilege self-service one, is enough to iterate sequential comment IDs and harvest confidential ticket discussions over the network with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released version 3.2.62 to close the exposure.
Denial of service of the diagnostic-tools subsystem in WatchGuard Fireware OS can be triggered by a low-privileged, authenticated user who repeatedly starts and aborts a specially crafted diagnostic task through the management web UI. The authentication requirement (PR:L per the supplied vector) and the subsystem-confined blast radius, which does not reach the firewall's core traffic-processing functions, keep this a genuine but modest-priority issue rather than a device-wide outage; no public exploit code has been identified at time of analysis and no KEV listing is present in the intelligence. Note that the vendor's CVSS 4.0 score of 7.1 records high availability impact (VA:H) on the product, while our independent assessment scores availability as low (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) because the resource exhaustion is limited to the diagnostic tooling.
Authenticated low-privileged users - including read-only or guest administrator accounts - can crash the wgagent management daemon and read arbitrary files accessible to that daemon on WatchGuard Fireware OS by sending a specially crafted request to the management API's session initialization function, which is missing an authorization check. The attack is network-reachable and requires no user interaction, but it is gated behind a valid management-plane session at low privilege (PR:L), so exposure depends on how many such accounts exist and whether the management interface is reachable by the attacker. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the availability impact (high) dominates the limited confidentiality loss, giving this a genuine but access-gated priority.
JIT miscompilation in Firefox's WebAssembly engine allows crafted WebAssembly delivered through attacker-controlled web content to corrupt in-process memory via a type confusion (CWE-843), producing high confidentiality impact and limited integrity impact but no availability impact. The flaw is remotely reachable at low complexity and unauthenticated (AV:N/AC:L/PR:N) but is gated by user interaction (UI:R) - the victim must load a malicious page that exercises the vulnerable JIT path - and by the content-process sandbox, so on its own it yields in-process memory disclosure rather than host compromise, which would require chaining a separate sandbox-escape bug. Mozilla has fixed it in Firefox 157, Firefox ESR 153.4, and Firefox ESR 140.17; EPSS is only 0.16% (4th percentile) and no public exploit or CISA KEV entry was identified at time of analysis.
Local privilege escalation in the npm package adm-zip through version 0.6.0: when an application extracts an archive with the non-default keepOriginalPermission=true option, the library copies the Unix permission bits recorded in each zip entry's external file attributes straight to disk via fs.chmodSync() without stripping the setuid (0o4000), setgid (0o2000) or sticky (0o1000) bits. An attacker who can supply a zip - no special access needed to craft one - can therefore plant a 04755 root-owned binary whenever the extraction runs as root (the common Docker-build, CI-runner and privileged-install posture where this flag is used), and the attacker's code executes as root once a lower-privileged user later runs that file. The issue is correctly rated Medium despite a 7.1 CVSS score because it is highly conditional (flag enabled, root extraction, setuid file preserved and executed by another user); confirmed actively exploited: no - not in CISA KEV - but a working proof-of-concept (a Python-crafted zip with external_attr 0o4755 << 16) is documented in the vendor advisory. Default usage with the flag off, or extraction as a non-root user, is not exploitable.
Denial of service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 allows a malformed X11 protocol message to crash the application via a heap-based buffer overflow in the X11 dissector. Exploitation requires a user to load a crafted capture file or dissect attacker-supplied live X11 traffic, giving a local, user-interaction-dependent vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) that, per the assessed vector, degrades only availability with no confidentiality or integrity impact - despite the vendor's 7.1 base score, which rated confidentiality high. Publicly available exploit code exists and CISA's SSVC rates the issue as proof-of-concept exploitation, not automatable, with partial technical impact; active exploitation is not indicated, and EPSS is only 0.13% (2nd percentile), so real-world risk is low. A vendor fix is available in 4.6.9 and 4.4.19.
Heap-based out-of-bounds write in the RPM Package Manager (rpm) affects Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, allowing a local, unauthenticated attacker to corrupt memory by crafting an RPM package that is then parsed with rpm2cpio, rpm2archive, or rpm -qlvp. The flaw arises from an integer overflow in iterReadArchiveNext() when a symlink entry declares RPMTAG_LONGFILESIZES as 0xFFFFFFFFFFFFFFFF, shrinking the buffer allocation to one byte and enabling attacker-controlled data from the cpio filesize field to overwrite heap memory. Exploitation requires user interaction to inspect the malicious package and no public exploit code has been identified at time of analysis; the CVSS 3.1 base score is 7.1.
Memory corruption in U-Boot's DHCPv6 netboot path allows an attacker on the same local network to crash or corrupt the bootloader by sending crafted DHCPv6 ADVERTISE or REPLY packets with oversized DUID (SERVERID/CLIENTID) option lengths. All U-Boot builds prior to 2026.10-rc5 that perform DHCPv6-based network boot are affected; the assessed impact is availability-focused (CVSS:3.1 AV:A/AC:L/PR:N/UI:N/C:N/I:L/A:H), with confidentiality unaffected and integrity impact limited. Exploitation requires adjacency to the booting device and only works during the brief netboot window, so devices that boot from local storage are not exposed; no public exploit and no confirmed active exploitation were identified at time of analysis.
Heap out-of-bounds write in the mDNS responder of Eclipse ThreadX NetX Duo allows an unauthenticated attacker on the same local network segment to corrupt packet memory by sending two ordinary mDNS PTR records in response to a _http._tcp service query. The flaw arises from a string-table bucket collision: owner names of 12-15 characters round to the same slot size, causing the responder to reuse a shorter stored entry and write 1-3 bytes past the transmit packet's data end. With the mDNS addon active and adjacency to the target, the realistic impact is denial of service through corrupted neighboring packets or pool free lists, though code execution is not demonstrated; no public exploit code or active exploitation has been identified at time of analysis.
Malformed ICMPv6 Neighbor Discovery option parsing in Eclipse NetX Duo can stall the IP thread or read past packet buffers, causing denial of service on devices reachable from the same local link. The affected product is NetX Duo with IPv6/ICMPv6 ND enabled; an adjacent-network attacker with no authentication or user interaction can send crafted Router Advertisement, Router/Neighbor Solicitation, Neighbor Advertisement, or Redirect messages so that a one- or two-byte residue bypasses option validation and later processing loops indefinitely or underflows its counters. The vendor's CVSS 4.0 score is 7.1 (availability-only), the referenced advisory is GHSA-39p4-p83c-58hr, no public exploit identified at time of analysis, and no CISA KEV confirmation is provided.
Denial of service in PX4 Autopilot (through version 1.17.0) through the file2 diagnostic test command, whose -c write-chunk-size option is used to size a stack allocation without any bounds validation, so an oversized value drives a stack overflow and crashes the flight controller. Practical exploitation requires the attacker to already have access to the PX4 nsh command shell (physical serial/USB console or an exposed MAVLink shell over the vehicle's telemetry link), and the running firmware build must include the systemcmds/tests suite containing file2; the CVSS 4.0 vector (7.1) and the independent CVSS 3.1 assessment both characterize this as availability-only (VA:H / A:H) with no confidentiality or integrity impact, and no public exploit identified at time of analysis. The authenticated-shell prerequisite and the variable presence of the test command in production images materially reduce real-world exposure compared with the raw score.
Arbitrary directory deletion in Joomla CMS affects versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3, where a backend user holding administrator-level privileges (CVSS PR:H) can pass a cache group name containing path-traversal sequences that the file-based caching layer fails to sanitize, causing the cache purge action to remove directories outside the intended cache path. The result is high integrity and availability impact with no confidentiality loss, rated 7.0 under CVSS 4.0 (AV:N/AC:L/PR:H/UI:N/VC:N/VI:H/VA:H) and assessed at CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H by independent analysis. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the high-privilege prerequisite confines realistic risk to insider or compromised-administrator scenarios rather than opportunistic remote attackers.
Improper access control in the Joomla CMS Web Services (API) application allows an authenticated user who can reach the affected webservice edit tasks to modify items they are not authorized to edit, affecting Joomla 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. Because the flaw is an authorization bypass in Joomla's edit-task ACL enforcement, the primary impact is to integrity (CVSS VI:H), with only limited confidentiality and availability effects. Exploitation requires a privileged, authenticated account (CVSS PR:H) and the webservices/API application to be enabled and reachable; no public exploit code was identified at time of analysis, and no confirmed active exploitation (CISA KEV) was reported.
Improper access control in Joomla CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 lets an authenticated user with webservice API access perform unauthorized mutation (write/change) operations against access-level endpoints, allowing them to alter how content visibility is governed on the site. Exploitation requires the Joomla Web Services API to be enabled and reachable and a valid account (per the assessed vector PR:H, so anonymous internet users cannot trigger it directly); no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). Rated medium-to-moderate priority - an authorization flaw rather than a critical emergency - with the practical risk concentrated on multi-user or headless/API-enabled sites that grant API tokens to lower-trust accounts.
Integer overflow in GIMP's image parsing can cause memory corruption with high confidentiality, integrity, and availability impact for the user running the application. Exploitation is local and user-driven: the victim must open or import a maliciously crafted image (UI:R), and high attack complexity (AC:H) means the attacker must craft input with precise values to reliably trigger the overflow; no elevated privileges are required (PR:N), and impact is bounded to the user account (S:U). No public exploit identified at time of analysis.
Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 retain a legacy password hash that is exposed on the device's serial (UART) console and protected only by weak DES-based encryption, so an attacker who already has physical access to the hardware with low-level local privileges can lift the hash and crack it offline to recover usable credentials. The attack vector is physical (CVSS AV:P), which rules out any remote or network exploitation, and no public exploit code or confirmed active exploitation has been identified at time of analysis (the product is not listed in CISA KEV). Despite the 7.0 (CVSS 4.0 High) headline score, this is a physical-access hardening weakness and the practical risk is low given the prerequisites.
Local privilege escalation in TeamViewer Full Client and Host for Linux versions before 15.82 allows an authenticated low-privileged attacker to exploit a race condition in the Cloud Session Recording (CSR) feature, potentially causing privileged file operations in unintended locations. The vulnerability requires the CSR feature to be active and carries a CVSS 3.1 score of 7.0 (High) due to high attack complexity (AC:H) and the need to win a TOCTOU race; no public exploit code has been identified at time of analysis. Successful exploitation could lead to high confidentiality and integrity impact, including arbitrary file overwrite or information disclosure.
Local privilege escalation in Ghostscript for Windows (all versions prior to 10.08.0) allows any authenticated local user to plant a malicious PostScript resource file in the predictable C:\gs\ path, which Ghostscript then auto-loads with the privileges of whichever principal next invokes it. The hijack requires no special Ghostscript configuration because it abuses Windows default ACLs that let authenticated users create directories at the root of C:\, and it succeeds only while C:\gs\ is unpopulated - the default state on Windows installations; execution is passive and fires when a user or service subsequently runs Ghostscript, with the payload's privilege gain bounded by that invoking principal (assessed as scope-changed impact). No public exploit code has been identified at time of analysis, and the issue, reported by CERT-PL, is fixed in 10.08.0.
Stack exhaustion in the Apache XmlSchema walker (xmlschema-walker) allows a malicious XML Schema to crash any application that parses untrusted XSD/WSDL content, because the walker performs no cycle detection across type derivations, substitution groups, model groups, or attribute groups and recurses until the stack overflows. The flaw is remotely triggerable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is limited to availability impact - no data disclosure or code execution. It is a third-party library issue rather than a directly network-exposed service: only deployments that walk attacker-controlled or third-party schemas are realistically exploitable, no public exploit code has been identified at time of analysis, and remediation is the vendor-released patch in version 2.3.3.
Stack exhaustion in Apache XmlSchema allows remote attackers to cause a denial of service by supplying a malicious XML Schema (XSD) document with deeply nested structures that recurse until the parsing thread's stack overflows. The library is a Java component, so exposure depends entirely on the host application accepting and parsing externally supplied schemas - deployments that only process trusted, internally authored schemas are not affected, and no authentication or user interaction is inherent to the flaw. No public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing); the vendor-released fix is XmlSchema 2.3.3, and the assessed severity is CVSS:3.1 7.5 (High, availability-only).
Stack overflow denial of service in Apache XmlSchema versions before 2.3.3 allows unauthenticated remote attackers to crash applications that parse attacker-controlled XML schemas by supplying a schema with deeply nested imports or includes. The library lacks a recursion depth limit during schema resolution, so a malicious schema can exhaust the call stack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the flaw carries a high availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects deployments that ingest untrusted schemas.
Authenticated shell command injection in Apache DolphinScheduler (all versions before 3.4.3) lets a user with permission to create or upload resources execute arbitrary commands as the DolphinScheduler service account. An attacker names a resource using shell command-substitution syntax such as $(...), then passes the resulting path as the scriptPath parameter to the Alert Script plugin's /test-send endpoint; because that parameter is concatenated into a /bin/sh -c invocation without neutralization of shell metacharacters, the shell evaluates the injected command. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) confidentiality, integrity and availability impact are all High, and while valid credentials and access to the Alert Script test-send functionality are required, no victim interaction is needed; no public exploit code or confirmed active exploitation was identified at time of analysis.
Use-after-free in libpng 1.6.0 through 1.6.58 can crash applications that use the sequential reader and call png_read_end after png_read_info without first reading the image rows. A crafted PNG containing a zTXt, iTXt or iCCP chunk that makes libpng abandon zlib decompression early leaves a stale input pointer in the zlib stream; the zTXt/iTXt path then reads through a freed heap buffer (a larger tEXt or pCAL chunk before IDAT must first reallocate the read buffer), while the iCCP path is a stack use-after-return. Impact is confined to denial of service - the dangling pointer is only read into a discarded scratch buffer, so there is no data disclosure or corruption - and the required API call sequence is rare in practice; no public exploit has been identified at time of analysis, and the vendor rates it 5.9 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), consistent with the independent assessment.