Heap out-of-bounds write in the mDNS responder of Eclipse ThreadX NetX Duo allows an unauthenticated attacker on the same local network segment to corrupt packet memory by sending two ordinary mDNS PTR records in response to a _http._tcp service query. The flaw arises from a string-table bucket collision: owner names of 12-15 characters round to the same slot size, causing the responder to reuse a shorter stored entry and write 1-3 bytes past the transmit packet's data end. With the mDNS addon active and adjacency to the target, the realistic impact is denial of service through corrupted neighboring packets or pool free lists, though code execution is not demonstrated; no public exploit code or active exploitation has been identified at time of analysis.
Malformed ICMPv6 Neighbor Discovery option parsing in Eclipse NetX Duo can stall the IP thread or read past packet buffers, causing denial of service on devices reachable from the same local link. The affected product is NetX Duo with IPv6/ICMPv6 ND enabled; an adjacent-network attacker with no authentication or user interaction can send crafted Router Advertisement, Router/Neighbor Solicitation, Neighbor Advertisement, or Redirect messages so that a one- or two-byte residue bypasses option validation and later processing loops indefinitely or underflows its counters. The vendor's CVSS 4.0 score is 7.1 (availability-only), the referenced advisory is GHSA-39p4-p83c-58hr, no public exploit identified at time of analysis, and no CISA KEV confirmation is provided.
Denial of service in PX4 Autopilot (through version 1.17.0) through the file2 diagnostic test command, whose -c write-chunk-size option is used to size a stack allocation without any bounds validation, so an oversized value drives a stack overflow and crashes the flight controller. Practical exploitation requires the attacker to already have access to the PX4 nsh command shell (physical serial/USB console or an exposed MAVLink shell over the vehicle's telemetry link), and the running firmware build must include the systemcmds/tests suite containing file2; the CVSS 4.0 vector (7.1) and the independent CVSS 3.1 assessment both characterize this as availability-only (VA:H / A:H) with no confidentiality or integrity impact, and no public exploit identified at time of analysis. The authenticated-shell prerequisite and the variable presence of the test command in production images materially reduce real-world exposure compared with the raw score.
Arbitrary directory deletion in Joomla CMS affects versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3, where a backend user holding administrator-level privileges (CVSS PR:H) can pass a cache group name containing path-traversal sequences that the file-based caching layer fails to sanitize, causing the cache purge action to remove directories outside the intended cache path. The result is high integrity and availability impact with no confidentiality loss, rated 7.0 under CVSS 4.0 (AV:N/AC:L/PR:H/UI:N/VC:N/VI:H/VA:H) and assessed at CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H by independent analysis. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the high-privilege prerequisite confines realistic risk to insider or compromised-administrator scenarios rather than opportunistic remote attackers.
Improper access control in the Joomla CMS Web Services (API) application allows an authenticated user who can reach the affected webservice edit tasks to modify items they are not authorized to edit, affecting Joomla 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. Because the flaw is an authorization bypass in Joomla's edit-task ACL enforcement, the primary impact is to integrity (CVSS VI:H), with only limited confidentiality and availability effects. Exploitation requires a privileged, authenticated account (CVSS PR:H) and the webservices/API application to be enabled and reachable; no public exploit code was identified at time of analysis, and no confirmed active exploitation (CISA KEV) was reported.
Improper access control in Joomla CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 lets an authenticated user with webservice API access perform unauthorized mutation (write/change) operations against access-level endpoints, allowing them to alter how content visibility is governed on the site. Exploitation requires the Joomla Web Services API to be enabled and reachable and a valid account (per the assessed vector PR:H, so anonymous internet users cannot trigger it directly); no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). Rated medium-to-moderate priority - an authorization flaw rather than a critical emergency - with the practical risk concentrated on multi-user or headless/API-enabled sites that grant API tokens to lower-trust accounts.
Integer overflow in GIMP's image parsing can cause memory corruption with high confidentiality, integrity, and availability impact for the user running the application. Exploitation is local and user-driven: the victim must open or import a maliciously crafted image (UI:R), and high attack complexity (AC:H) means the attacker must craft input with precise values to reliably trigger the overflow; no elevated privileges are required (PR:N), and impact is bounded to the user account (S:U). No public exploit identified at time of analysis.
Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 retain a legacy password hash that is exposed on the device's serial (UART) console and protected only by weak DES-based encryption, so an attacker who already has physical access to the hardware with low-level local privileges can lift the hash and crack it offline to recover usable credentials. The attack vector is physical (CVSS AV:P), which rules out any remote or network exploitation, and no public exploit code or confirmed active exploitation has been identified at time of analysis (the product is not listed in CISA KEV). Despite the 7.0 (CVSS 4.0 High) headline score, this is a physical-access hardening weakness and the practical risk is low given the prerequisites.
Local privilege escalation in TeamViewer Full Client and Host for Linux versions before 15.82 allows an authenticated low-privileged attacker to exploit a race condition in the Cloud Session Recording (CSR) feature, potentially causing privileged file operations in unintended locations. The vulnerability requires the CSR feature to be active and carries a CVSS 3.1 score of 7.0 (High) due to high attack complexity (AC:H) and the need to win a TOCTOU race; no public exploit code has been identified at time of analysis. Successful exploitation could lead to high confidentiality and integrity impact, including arbitrary file overwrite or information disclosure.
Local privilege escalation in Ghostscript for Windows (all versions prior to 10.08.0) allows any authenticated local user to plant a malicious PostScript resource file in the predictable C:\gs\ path, which Ghostscript then auto-loads with the privileges of whichever principal next invokes it. The hijack requires no special Ghostscript configuration because it abuses Windows default ACLs that let authenticated users create directories at the root of C:\, and it succeeds only while C:\gs\ is unpopulated - the default state on Windows installations; execution is passive and fires when a user or service subsequently runs Ghostscript, with the payload's privilege gain bounded by that invoking principal (assessed as scope-changed impact). No public exploit code has been identified at time of analysis, and the issue, reported by CERT-PL, is fixed in 10.08.0.
Unauthenticated remote attackers can tamper with uploaded file metadata in Balbooa Forms for Joomla versions before 2.4.3.4 by exploiting insufficient validation of client-supplied filenames and display names during the final form submission. This allows cross-session file claiming and potential path traversal via the getFilePath() function, though the impact is limited to integrity with no confidentiality or availability loss. No public exploit code or active exploitation has been identified, and the CVSS 4.0 score of 6.9 overstates the real-world risk per independent assessment.
Unauthenticated guests can delete other users' temporary file attachments on Joomla sites running the Balbooa Forms extension below version 2.4.3.4. The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file; the controller does verify a Joomla session token, but the model never ties that ID to the uploading session, user, form, upload field, or temporary state, so any guest can obtain a token for their own session and then destroy arbitrary pending uploads by enumerating valid integer IDs. Impact is confined to integrity of temporary/pending attachment records and files (CVSS 3.1 C:N/I:L/A:N, no confidentiality or availability effect), and no public exploit code has been identified at time of analysis.
A malicious or compromised HTTP server can pin the CPU and hang a Python client indefinitely by returning a chunked, deflate-encoded response that carries trailing bytes after the compressed stream, causing urllib3 2.6.2 through 2.7.x to loop without progress. The hang is reachable only on the client streaming path - HTTPResponse.stream() or HTTPResponse.read_chunked() with content decoding enabled (decode_content=True) and a positive finite chunk size (amt=N) - where the Deflate decoder retains the trailing bytes as unconsumed input after end-of-stream and re-decodes them forever; because no further socket read occurs, network read timeouts never interrupt the loop. Impact is availability-only (no confidentiality or integrity effect), unauthenticated from the network per the reported vector (PR:N), and no public exploit identified at time of analysis; exploitation additionally requires the attacker to control or compromise the endpoint the client connects to.
Improper access-control checks in Joomla's tagged-item output let unauthenticated visitors read content items that belong to access-restricted categories, exposing only article content (confidentiality-only) with no modification or denial-of-service impact. Affected releases are Joomla! CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3; exploitation requires no authentication and no user interaction (PR:N/UI:N in both the supplied CVSS 4.0 vector and our assessed CVSS 3.1 vector), so any anonymous visitor can trigger it on a default site that renders tagged items where tags span categories with differing view levels. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited; the practical risk is bounded because disclosure is limited to tagged items in restricted categories, which is why our independent assessment treats this as a genuine but low-to-moderate priority issue.
Cross-site scripting in the HTML mail template feature of Joomla CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 allows attacker-influenced data to reach template fields that are emitted without escaping, so crafted content can execute script when the resulting HTML email is rendered in a browser-based preview or webmail client. Our assessment treats exploitation as requiring the HTML mail template feature to be in use plus an authenticated, operator-level party able to influence template fields and a victim who renders the message, even though the vendor's CVSS 4.0 vector carries PR:N/UI:N; the deliverability of the payload is further limited because many mail clients strip or sanitize inline script. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Joomla has published advisory 20260908 covering the fix.
Unauthenticated remote requests can create lowest-privilege guest-group user accounts on Joomla CMS versions 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3, because the core profile.save controller never checks whether the requester is logged in, so the account-creation path succeeds even on sites where public user registration has been turned off. No CISA KEV listing and no public exploit code were identified at time of analysis. The vendor rates this 6.9 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N) with a confidentiality-only low impact, while our independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:N/I:L/A:N; both agree the attack is remote, unauthenticated and requires no user interaction or special configuration, and that the damage is bounded because only the lowest-privilege account level can be created, never an administrative or full registered-user account.
Remote code execution in Dell Secure Connect Gateway (SCG) Policy Manager allows an unauthenticated, remote attacker to execute code or tamper with/disclose information on affected appliances by exploiting a missing integrity check on code the product downloads, affecting versions prior to 5.34.00.16 and prior to 5.36. Realistic exploitation requires the attacker to control or tamper with the content the Policy Manager retrieves - typically a man-in-the-middle position or a spoofed/compromised download source - which is why our assessment adjusts the vendor's 9.8 score to AC:H while retaining PR:N and UI:N. A vendor patch is available (5.36.00.16; 5.34.00.16 for the 5.34 branch), and there is no evidence of active exploitation or public exploit code; EPSS is 0.11% (1st percentile) and CISA SSVC rates exploitation as 'none' and automatable as 'no'.
Server-side request forgery in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows unauthenticated remote attackers to invoke the device's built-in network-check/connectivity-probe function and make it issue requests to arbitrary hosts reachable from the camera's internal network. The resulting impact is limited to low-confidentiality disclosure -- internal host enumeration and small data leaks via DNS resolution -- with no integrity or availability effect, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; the issue was reported through CISA's ICS-CERT program as ICSA-26-272-05.
Path traversal in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls a scanned VMDK disk image to write arbitrary files outside the extractor's destination directory on the host running the scan, corrupting or overwriting host files. The CVSS 4.0 base score of 6.9 (medium) reflects a genuine but constrained risk profile: the CVSS vector shows PR:N (no host credentials needed) but also AV:L and UI:P/UI:R, so a user or automation must actually run a scan against the malicious image, and impact scales with the privileges of the scanner process (most dangerous in root-running CI or container pipelines). No public exploit code or active exploitation has been identified at time of analysis, and the issue is addressed upstream by PR #2030.
The FTP client component of Eclipse ThreadX NetX Duo trusts the IPv4 address returned in a server's 227 PASV reply, performing only parse and non-zero checks before opening a data connection to that address, which lets a malicious or man-in-the-middle FTP server redirect the client's data transfer to any host it names (CWE-918 server-side request forgery class). Only the IPv4 passive-mode path is affected; the client must itself initiate an FTP control session to a hostile or intercepted endpoint and then request a passive transfer. No authentication or user interaction beyond starting the session is required (CVSS:4.0 base 6.9; independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N), and no public exploit code or active exploitation has been identified at time of analysis.
An out-of-bounds read in the Eclipse NetX Duo TFTP client lets an attacker-controlled or man-in-the-middle TFTP server return a short ERROR packet that causes the client to read up to 64 bytes past the received datagram. The vulnerable receive paths are in the TFTP client add-on and an unauthenticated remote attacker can trigger the condition when a device initiates a TFTP read or open against the attacker's server, potentially disclosing adjacent packet-pool memory if the application logs or displays nx_tftp_client_error_string, and potentially causing a crash. No public exploit identified at time of analysis, and the provided advisory points to a code-level bounds-check fix; risk is moderate rather than critical because exploitation requires the client-initiated, attacker-as-server model and yields no write primitive.
Out-of-bounds heap reads in CTranslate2's binary model loader affect all releases before 4.8.1, allowing an attacker who supplies a crafted model file to crash the loading process or disclose adjacent heap memory contents. The flaw is in the model deserialization path (src/models/model.cc), where string fields are read without validating their declared length or null termination; exploitation is local and requires the victim to load an untrusted .bin model through the library's loader. The vendor has released a fix in 4.8.1, and at time of analysis there is confirmed actively exploited status absent (no CISA KEV listing) and no public exploit identified at time of analysis; severity scores cluster around medium (CVSS 4.0 base 6.9; independent assessment CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H), reflecting a genuine memory-safety flaw but a low-to-moderate real-world priority concentrated in workflows that ingest third-party models.
Cross-site request forgery in OpenSolution Quick.Cart's admin configuration panel allows an attacker-controlled web page to silently submit a POST request that rewrites the administrator's login and password the moment a logged-in admin visits it. The product's only built-in defense is a referer-header check that is trivially bypassed by manipulating or omitting the referer, and the vendor notes that every form in the software is potentially vulnerable, so any deployment running a pre-6.7 version is exposed. Exploitation requires the admin to hold a live authenticated session and to actively browse attacker-supplied content (UI:A); no confirmed active exploitation or public exploit code has been identified at time of analysis, and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (high integrity impact, no confidentiality or availability impact).
PKCE verifier validation in oauthlib 3.0.0 through 3.x compares the client-supplied code_verifier against the stored challenge using Python's short-circuiting == operator, producing a measurable timing oracle (CWE-208) that could in principle allow character-by-character recovery of the verifier. The attack is remote and unauthenticated per the assessed vector (AV:N/PR:N) but requires user interaction and is heavily constrained: the attacker must first independently obtain a valid single-use authorization_code, then issue and precisely time a very large volume of /token requests within that code's short lifetime, with nanosecond-scale per-call deltas in practice dwarfed by normal network jitter. At CVSS 6.8 (AC:H) with no public exploit code and no evidence of active exploitation, this is a genuine defense-in-depth defect rather than a practical account-takeover path, and it is fully resolved by upgrading to oauthlib 4.0.0.
Improper access control in the firmware control-register interface of NVIDIA ConnectX (ConnectX-5 plus GA, LTS23 and LTS24 firmware branches) and BlueField (GA, LTS23, LTS24) adapters allows a user who already holds an SR-IOV virtual function (VF) on the device to send a crafted command to the firmware and disturb the register interface, producing a denial-of-service condition on the affected adapter and, per the scope-change vector, potentially on components beyond it. The issue is reachable from an adjacent network position with low complexity but requires a legitimate VF foothold (PR:L), and the impact is availability-only - no confidentiality or integrity loss is described. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and NVIDIA's own advisory is the authoritative source for fixed firmware releases. EPSS and KEV signals are absent from the supplied intelligence.
An out-of-bounds read in Zephyr's MCUmgr SMP-over-console transport (subsys/mgmt/mcumgr/transport/src/serial_util.c) lets a single 7-byte, unauthenticated console line underflow a net_buf length field and hand the SMP layer a bogus ~65 KB payload window over a buffer whose data area defaults to 384 bytes. The flaw affects builds that enable CONFIG_MCUMGR_TRANSPORT_UART (smp_uart.c) or CONFIG_MCUMGR_TRANSPORT_SHELL (smp_shell.c), both of which select MCUMGR_TRANSPORT_SERIAL_HAS_SMP_OVER_CONSOLE; the test-only CONFIG_MCUMGR_TRANSPORT_DUMMY loopback carries the same pattern but has no external input path and is not exploitable. Because exploitation needs only write access to the management console - on many boards an exposed USB CDC-ACM port rather than a bare UART header - the practical impact is a faulted MCUmgr thread (denial of service) plus possible limited memory disclosure via the default-enabled os echo handler; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Cross-site scripting (CWE-79) in Toptech Systems' TMS7 terminal management platform (and the related TopHat product) allows an authenticated attacker to inject JavaScript that executes in a second application user's browser within that user's active session. Exploitation is not remotely triggerable against a default installation: it requires the attacker to hold valid application credentials (PR:L per the assessed vector) and to socially engineer a logged-in user into issuing the attacker-constructed request (UI:A), with impact confined to the victim's session and limited to low confidentiality effect. Toptech has addressed the issue in TMS7 version 7.8; instances below that release remain exposed, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, making this a genuinely low-priority, social-engineering-dependent XSS.
Code injection in JupyterLab's translation pipeline allows JavaScript appended to a third-party language pack's Plural-Forms header to be executed in the authenticated JupyterLab origin, because the validation regex accepts a matching prefix without requiring the whole header to match and the expression is later passed to new Function. Affected are JupyterLab 3.0.0 through 4.5.11 and 4.6.4 (exclusive of the fixes), plus JupyterLite Core 0.8.3 and earlier. Exploitation requires the victim to install and select a malicious or tampered third-party locale catalogue (the default English locale loads no catalogue and is unaffected), and unauthenticated remote attackers need user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:R), yielding a Medium severity of 6.8; where Jupyter Server kernels, terminals, and APIs are exposed to the JupyterLab origin the injected code can read or modify files and run code, while JupyterLite impact is sharply limited by the usual absence of those surfaces. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Unprivileged local users can disable all Pardus Parental Control restrictions on affected systems by invoking PPCActivator.py --disable via pkexec, which runs as root without authentication due to an overly permissive polkit policy. The flaw affects Pardus Parental Control versions before 0.7.0 and requires an interactive local session on a host with the vulnerable default policy; there is no remote vector. No public exploit code has been identified, and the issue is not known to be actively exploited.
A local time-of-check-to-time-of-use (TOCTOU) race condition in Electron's bundled Squirrel.Mac auto-update framework on macOS allows an attacker who already has local access to the machine to redirect the privileged ShipIt helper into overwriting a different application's files with root privileges during an update install. Only macOS Electron apps that ship Squirrel.Mac-based auto-updates are exposed; apps on other platforms, or that do not use Squirrel.Mac, are unaffected. The attacker is an authenticated local user (CVSS PR:L) and must win a narrow race window between path validation and the root-privileged write (AC:H) while an update is actually being installed (UI:R), yielding high confidentiality, integrity, and availability impact if successful; no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing), and no app-side workaround exists - remediation requires upgrading Electron to 39.8.10, 41.10.5, or 42.0.0-beta.2.
Leftover active debug code shipped in Dell Secure Connect Gateway (SCG) Policy Manager builds prior to 5.34.00.16 can be reached by a high-privileged local attacker, allowing limited information disclosure, information tampering, bypass of protection mechanisms, and unauthorized access. The assessed CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N, base score 3.0) restricts realistic exploitation to insiders or attackers who already hold administrator-equivalent local access on the SCG host, while the high attack complexity (AC:H) indicates additional, non-trivial conditions must be satisfied to actually invoke the debug code. No public exploit code has been identified and there is no confirmation of active exploitation at time of analysis, so this remains a low-priority, hardening-class issue best handled through routine patching.
Memory corruption reachable through an unvalidated format string in the management API of HPE Networking Instant On access points allows an attacker who already holds high administrative privileges to provoke a denial-of-service condition or potentially achieve remote code execution on devices running firmware 3.4.1.0 and earlier. The flaw is scored CVSS 3.1 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting that the attacker must be authenticated with high privileges and that reliable exploitation hinges on crafting format-string input that reliably corrupts memory, which often requires memory-layout knowledge or repeated attempts. No public exploit code or confirmed active exploitation was identified at time of analysis, so the dominant risk driver is the high-privilege prerequisite - an attacker must first obtain or compromise an admin account, or chain another vulnerability to reach the vulnerable function.
The Hitachi Energy RTU500 series CMU web application fails to enforce proper authorization on its reset endpoint, allowing an authenticated low-privilege user to force the remote terminal unit to reboot and temporarily lose availability (CVSS 6.5, CWE-862). Exploitation requires a valid low-privilege account or active session (PR:L) plus network reachability to the web management interface, and the assessed impact is limited to temporary, recoverable device unavailability rather than data exposure or persistent compromise. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was supplied; this is a genuine but moderate-severity availability issue, not a high-priority emergency.
Denial of service in KubeVirt lets an authenticated user with permission to create VirtualMachineInstance (VMI) objects crash the virt-controller by submitting a VM definition containing an empty ephemeral volume; the controller hits a NULL pointer dereference and enters a persistent crash loop because the malformed object remains in the cluster, disrupting VM lifecycle operations environment-wide. The flaw is tracked as CVE-2026-102623 with a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and CWE-476; exploitation requires valid Kubernetes RBAC permissions and API-server reachability, and no public exploit identified at time of analysis.
Loading attacker-controlled graphics content in Mozilla Firefox can trigger a denial of service in the Graphics component, crashing or hanging the browser or tab. Affected versions are Firefox before 157 and Firefox ESR before 153.4, with fixes available in Firefox 157 and Firefox ESR 153.4. No public exploit code was identified at time of analysis, and SSVC records no active exploitation.
Denial of service in Mozilla Firefox's Networking component allows a remote attacker to crash or hang the browser by convincing a victim to load attacker-controlled web content - no authentication or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Only availability is impacted: the flaw does not enable code execution, sandbox escape, or data disclosure, and it is fully addressed by upgrading to Firefox 157. At time of analysis there is no public exploit identified, no CISA KEV listing, and the practical risk is comparatively low against the other fixes shipped in the same Firefox 157 batch - the main limiting factor is the UI:R requirement that the user actually load the crafted content.
Credential disclosure in the Apache Airflow Teradata provider (apache-airflow-providers-teradata before 3.7.0) causes cloud storage secrets to be written into SQL text that is then logged and executed, leaking those secrets to two sinks outside Airflow's control. Deployments using S3ToTeradataOperator or AzureBlobStorageToTeradataOperator against a private bucket or container with no teradata_authorization_name configured - the default credential path for both operators - are affected; S3ToTeradataOperator's runtime AWS credentials and STS session token land in the Airflow task log, readable by any user with log-view permission on the Dag, while both operators write credentials into Teradata's DBQL query logs and live monitoring views, where Airflow masking never applies and the values persist for Teradata's log retention period. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. remote but requiring an already-privileged party with log-read access, and no public exploit identified at time of analysis; impact is information disclosure only, with no integrity or availability effect.
Missing authorization checks in Google Chrome's Payments component (desktop builds prior to 154.0.8037.92) let a remote attacker who has already compromised the browser's renderer process use a crafted HTML page to bypass web origin policy and perform cross-origin payment-related actions. The attacker is a remote, unauthenticated party per the CVSS vector (PR:N), but exploitation carries two hard preconditions: the renderer must first be compromised, and the victim must interact with the crafted page (UI:R). There is no public exploit identified at time of analysis, CISA's SSVC assessment records no exploitation and no automatable path, and only integrity is impacted (C:N/I:H/A:N), so despite the 6.5 base score this is a genuinely low-priority issue whose main risk driver is the prior renderer compromise rather than the origin-policy bypass itself.
Incorrect authorization in Chrome's Site Isolation component (versions prior to 154.0.8037.92) allows an attacker who has already compromised a renderer process to bypass web-origin policy using a crafted HTML page, producing cross-origin integrity violations without direct confidentiality or availability impact. This is a chained, second-stage bug rather than an initial access vector: exploitation presupposes a prior renderer compromise and also requires user interaction to load the attacker's content, which is why Chromium rates it Low security severity despite an NVD base score of 6.5. Google has shipped a patched build and no public exploit code was identified at time of analysis; there is no indication of confirmed active exploitation (no CISA KEV listing).
Origin policy bypass in Google Chrome builds prior to 154.0.8037.92 lets a remote attacker who has already compromised the renderer process escape web origin restrictions via a crafted HTML page, producing a high integrity impact while confidentiality is unaffected. The defect is a missing authorization check in the browser's CORS handling (CWE-862), and it is not independently exploitable - a separate renderer-compromise vulnerability must be chained first, and the victim must load attacker-controlled content (UI:R). No public exploit code has been identified at time of analysis, CISA's SSVC rates exploitation as none and the issue as non-automatable with partial technical impact, and the vendor fix is Chrome 154.0.8037.92.
Denial-of-service in Mozilla Firefox's Storage: StorageManager component allows an unauthenticated remote attacker to crash or hang the browser by persuading a victim to render attacker-controlled web content, requiring user interaction and no special privileges. The flaw is a CWE-770 resource-exhaustion issue fixed in Firefox 157 and Firefox ESR 153.4; all earlier Firefox versions are affected, and there is no public exploit identified at time of analysis. Exploitation is not automatable per CISA SSVC, and the impact is availability-only with no data compromise, making real-world urgency low once patched.
Information disclosure in Apache DolphinScheduler before 3.4.3 allows any authenticated user to call the /datasources/unauth-datasource endpoint and retrieve configuration and metadata for data sources they are not authorized to see. As assessed, exploitation requires a valid low-privileged account and network reachability to the web application (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and it is most impactful in multi-tenant deployments where data sources are meant to be isolated between users; the breadth of leaked fields is not specified by the vendor, so confidentiality impact depends on the deployment. There is no public exploit identified at time of analysis and no evidence of active exploitation.
Elevation of privileges and protection-mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 stem from an insecurely initialized default resource (CWE-1188). An attacker who already holds high privileges (PR:H) on the appliance can exploit the issue remotely with low complexity and no user interaction to escalate privileges, tamper with information, bypass protections, and gain unauthorized access. Impact is partial (C:L/I:L/A:N) rather than full compromise, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Repeated network-interface link-down events can crash or reset devices running Zephyr RTOS v4.3.0 that keep a listening TCP socket open, because the BSD-socket layer parks a pending errno value in the net_context user_data field while the TCP core simultaneously expects that field to hold a parent context pointer; a second interface-down event forwards the stale integer to zsock_accepted_cb(), which dereferences it as a pointer and writes through it, producing a wild-pointer access and a kernel fatal error (denial of service, not attacker-directed memory corruption). The flaw is reachable by unauthenticated adjacent attackers who can force the link down repeatedly (CVSS 3.1 AV:A/AC:L/PR:N/UI:N, 6.5, availability-only impact), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Zephyr v4.3.1 and v4.4.x carry a follow-up change that clears the accept callback after the error path, reducing the issue to a narrow handshake-versus-interface-down race plus an unconditional getsockopt(SO_ERROR) read-back of the kernel pointer stored in user_data, so those lines are far less practically exploitable than v4.3.0.
Information disclosure in Apache DolphinScheduler 3.2.0 through versions before 3.4.3 lets any authenticated low-privilege user read workflow information belonging to projects they are not authorized to access by calling the query-dynamic-sub-workflows API endpoint, which authenticates the caller but omits the project-scope authorization check (CWE-863). The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - network-reachable but requiring a valid account, with impact confined to confidentiality and no write or code-execution path. Exploitation also presumes the attacker knows or can guess workflow references in the target project, and it only matters where project-level isolation is treated as a security boundary (multi-tenant or multi-team deployments); no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
Mozilla Firefox before 157 can disclose sensitive process memory to a remote, unauthenticated attacker who persuades a user to load a crafted JavaScript page, because the browser's JavaScript JIT compiler can miscompile code and trigger a type-confusion condition. Exploitation requires user interaction (the victim must visit or be redirected to attacker-controlled content), and impact is limited to confidentiality within the content process; Mozilla fixed the issue in Firefox 157, and no public exploit code has been identified at the time of analysis, with EPSS at 0.15% (4th percentile).
Authentication bypass in the captive portal of HPE Networking Instant On (all versions up to and including 3.4.1.0) lets a network-reachable, unauthenticated remote attacker circumvent the portal's authentication controls and obtain limited read access to data plus the ability to make limited changes inside that component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5 Medium) confirms a low-friction attack path requiring no credentials and no user interaction, although the impact is bounded to the captive-portal component with no availability effect. No public exploit code or confirmed in-the-wild exploitation has been identified - no public exploit identified at time of analysis - and no EPSS score was supplied with the source data.
Authentication bypass in the PAPI control-plane protocol of HPE Networking Instant On access points running firmware 3.4.1.0 and earlier allows an unauthenticated attacker on the same Layer 2 segment to circumvent existing authentication controls and push unauthorized traffic to the device. The issue is rated CVSS 6.5 (AV:A/AC:L/PR:N/UI:N, integrity-only impact) because exploitation requires an adjacent network position rather than internet reachability, and the PAPI interface is not routable from the public internet. No public exploit code has been identified at time of analysis, the flaw is not confirmed actively exploited (not in CISA KEV), and the principal exposure limiter is the requirement for an existing on-network or on-air foothold.
Memory exhaustion in the sshd-sftp component of Apache MINA SSHD (1.0.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5) lets an authenticated remote SFTP client crash the server by driving the SFTP v6 check-file-name/check-file-handle extension to build an oversized reply entirely in server memory. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the session must be authenticated and must negotiate SFTP protocol version 6, and the attacker must point the request at a very large (possibly sparse) file using a tiny block size such as the 256-byte minimum, so that file-size divided by block size yields an enormous number of hashes; availability impact is high while confidentiality and integrity are unaffected. This is a genuine but bounded availability risk with no public exploit identified at time of analysis, and deployments that already cap SFTP message size (typically 256kB, as OpenSSH does) are not exposed.
Memory exhaustion denial of service in Apache MINA SSHD's SCP subsystem (module sshd-scp) affects all releases before 2.20.0 and the 3.0.0-M1 through 3.0.0-M5 milestones, requiring a connected SSH peer that has reached the SCP protocol handler - on a server deployment this typically means successful low-privilege authentication, which is the main gating factor (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5 Medium). The peer only needs to stream a single malformed SCP command line that never terminates with an LF, causing the handler to buffer the endless input until the JVM throws OutOfMemoryError and the application crashes; there is no confidentiality or integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk is a bounded availability issue for deployments that expose or use the SCP subsystem.