Local information disclosure in MediaTek Modem firmware affects devices built on more than 80 MediaTek chipset models, including MT6983, MT6895, MT6989, and MT6768, when running unpatched modem firmware. A local app with ordinary low privileges (PR:L) can access sensitive modem debug information without user interaction, yielding high confidentiality impact but no code execution or integrity/availability loss; CVSS is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating confirmed active exploitation, but MediaTek patch MOLY01645293 and the October 2026 product security bulletin address the flaw.
A local, low-privileged user can crash the sssd authentication daemon by submitting a crafted passkey (FIDO2/WebAuthn) authentication token that omits expected null terminators, causing an out-of-bounds read and terminating the service, which disrupts authentication for all users relying on that host. Rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the flaw is purely an availability issue confined to systems where sssd's passkey authentication path is configured and reachable; there is no confidentiality or integrity impact and no remote or unauthenticated route. At the time of analysis, no public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV), and no vendor-released patch has been identified.
Crashing the SSSD autofs responder process via a crafted request to its UNIX socket allows a local, low-privileged attacker to cause a denial of service on affected Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 systems. The vulnerability stems from improper buffer offset calculation during request parsing, leading to an out-of-bounds read (CWE-125) that terminates the responder process; it carries a CVSS 3.3 (Low) score with no confidentiality or integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the autofs responder service must be enabled for the flaw to be exploitable.
An out-of-bounds read in Android's NFC Type 5 Tag reader/writer implementation (rw_t5t.cc) lets a local, low-privileged context read memory that should be out of reach, resulting in information disclosure with no user interaction required. The flaw carries a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and per that vector the attacker must already hold a low-privileged foothold on the device, such as an installed application capable of exercising the NFC read path; there is no write or code-execution impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and remediated builds are addressed through the Android Security Bulletin dated 2026-10-01.
Persistent local denial of service in Android's DevicePolicyManagerService (Android 14, 15, 16, 16-QPR2 and 17) allows an on-device caller holding device-owner or profile-owner rights to feed malformed input into the setPermissionGrantState path and corrupt persisted permission/policy state. Because the resulting denial of service is persistent rather than transient, recovery typically requires administrative cleanup (clearing policy state, removing the managed profile/account, or in the worst case a factory reset) rather than a simple reboot. Scoring is AV:L/PR:L/UI:N with availability-only impact (CVSS 5.5), there is no remote vector, and no public exploit has been identified at time of analysis; CISA SSVC records Exploitation: none and Automatable: no, so this is a moderate local availability issue rather than an urgent, remotely exploitable flaw.
Authentication bypass in Casdoor up to 3.161.1 lets remote unauthenticated attackers access API endpoints that should require authentication, because the ApiFilter function in routers/authz_filter.go does not correctly enforce auth. Publicly available exploit code exists, and the reporter rates the issue CVSS 4.0 6.9 with PR:N; independent assessment agrees that exploitation requires only network reachability to the Casdoor API and that impact is Low for confidentiality, integrity, and availability, with no scope change. The vendor was contacted but did not respond, and no fixed version was identified at time of analysis.
Authenticated users of Plane before 1.4.0 can bypass API rate limits by arbitrarily increasing a token's allowed_rate_limit, enabling high-volume API requests that may consume backend resources. Exploitation requires a valid account with access to the API-tokens endpoints, and the issue is fixed in version 1.4.0. No public exploit identified at time of analysis; severity is moderate and impact is limited to integrity of the rate-limit setting and availability pressure.
Cross-site scripting in the OAuth callback handler of Red Hat Quay 3 lets an unauthenticated remote attacker run arbitrary JavaScript in a logged-in user's browser session by luring that user to a crafted URL, with no attacker privileges required (PR:N) but mandatory victim interaction (UI:R), giving a CVSS 3.1 score of 5.4. Successful exploitation is scoped to the victim's Quay application session (S:U, low confidentiality and integrity impact, no availability impact), potentially exposing registry metadata or allowing actions to be performed as the victim, rather than yielding server-side compromise. The vulnerability class is CWE-79 improper neutralization of input during web page generation; no public exploit code was identified in the available intelligence at the time of analysis, and CISA KEV status was not indicated.
Authenticated editors on a Penpot file (prior to version 2.18.0) can delete share links that were created by other users, because the delete-share-link RPC only checks that the caller can edit the parent file and never verifies ownership of the specific share link. By supplying the UUID of a colleague's or owner's share link - IDs that editors can enumerate from the file's view-only bundle - a mid-privileged collaborator can revoke external reviewers' access and disrupt published viewing/inspection links. Rated CVSS 5.4 (broken access control, PR:L), this requires an existing edit-rights account rather than anonymous access, and no public exploit code has been identified at time of analysis. Vendor-released patch: 2.18.0.
An authenticated Project Member (role 15) in Plane can escalate a Project Guest (role 5) to the Member role without Project Admin approval by sending a PATCH request to the project-member update endpoint at /api/workspaces/{workspace_slug}/projects/{project_id}/members/{member_pk}/. The role-update logic only rejected assignments where the new role exceeded the requester's own role, so submitting a role equal to the attacker's Member role slipped past the check and granted the guest Member-level project capabilities, bypassing project governance controls. This is a moderate-severity, authenticated privilege-escalation flaw (CWE-269) affecting Plane deployments prior to 1.4.0; no public exploit code was identified and the issue is not confirmed as actively exploited (CISA KEV).
Authenticated low-privilege users can read and modify support tickets they do not own in the JS Help Desk WordPress plugin (Ahmad) through version 4.0.0, due to an insecure direct object reference (CWE-639) that exposes user-controlled ticket identifiers. Rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), exploitation requires a valid low-privilege account and is limited to confidentiality and integrity impact on support-ticket data, with no availability impact. No public exploit identified at time of analysis; no exploit code or KEV listing is referenced in the available intelligence.
Improper Unicode encoding in the pwhois command-line tool shipped with Net::Whois::Raw before 2.99044 for Perl causes WHOIS lookups for certain internationalized domain names to be sent for the wrong domain, disclosing the queried name to an unrelated registry and returning results for the incorrect domain; the Net::Whois::Raw library modules themselves are not affected. The flaw (CWE-176, CVSS 3.1 5.4, vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) is unauthenticated but requires user interaction - the victim must run pwhois against a unicode label that pwhois does not lowercase (i.e., contains uppercase letters other than ASCII/Cyrillic, or is not in NFC form) - and only the CLI path is impacted. EPSS is low at 0.18% (7th percentile), no public exploit code exists, there is no CISA KEV entry indicating active exploitation, and a vendor patch is available in release 2.99044.
Stored cross-site scripting in Penpot before 2.18.0 allows an authenticated user holding file-edit permission to upload SVG media whose <script> blocks, event-handler attributes, and <foreignObject> elements are persisted without sanitization and later served as image/svg+xml from the Penpot origin; any victim who directly navigates to the stored asset URL executes attacker-controlled JavaScript in that origin and can issue requests and read data with the victim's Penpot session authority. Exploitation requires both a privileged authenticated account (PR:L, effectively a trusted collaborator or a compromised one) and victim navigation to the asset URL (UI:R), which confines realistic exposure to multi-user or externally shared Penpot instances rather than single-user deployments. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; the vendor-released fix is version 2.18.0.
Private AI workflow data in Langflow 1.0.0 through 1.10.0 can be read, enumerated, and partially executed by a caller who knows the target flow's UUID, because the deprecated POST /api/v1/build/{flow_id}/vertices and /vertices/{vertex_id} handlers never verified flow ownership. Through 1.7.1 these handlers were reachable without authentication, while in 1.7.2 through 1.10.0 the attacker must be authenticated but needs no elevated privileges, consistent with the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (score 5.4). Impact is deliberately bounded: a caller can disclose private flow structure, configured values, and selected vertices' outputs and can trigger victim-configured side effects and build-history records, but cannot read the victim's variable-store credentials or modify the stored flow. No public exploit code identified at time of analysis, and the issue is fixed in Langflow 1.10.1 / langflow-base 0.10.1.
Deactivated workspace owners retain owner-level administrative access in Plane project management instances prior to version 1.4.0. The WorkspaceOwnerPermission check queries workspace membership with role=Admin but omits the is_active=True filter, so a formerly-owner account that has been deactivated is still treated as an authorized owner; an attacker who holds valid credentials for such an account - an offboarding or insider-abuse scenario, not a broad unauthenticated compromise - can keep exercising administrative control. The impact is amplified because the authentication adapter (base.py save_user_data) automatically reactivated inactive accounts on login in affected versions, and the fix in 1.4.0 adds the missing is_active check and rejects deactivated logins. No public exploit code has been identified at time of analysis and this issue is not confirmed in CISA KEV; the vendor-released patch is version 1.4.0.
Missing authorization checks in the Starter Templates (astra-sites) WordPress plugin, affecting versions through 4.7.7, allow a remote attacker holding a low-privilege account on the target site - such as a subscriber where open registration is enabled - to trigger plugin functionality that should be restricted to higher-privileged roles, resulting in low-level integrity and availability impact with no confidentiality loss (CVSS 5.4). The flaw is a CWE-862 incorrectly configured access-control level, requiring no user interaction and no special complexity, but it cannot be reached by a fully unauthenticated visitor (CVSS vector PR:L). At the time of analysis there is no public exploit identified and no indication of confirmed active exploitation, so risk is driven primarily by the population of sites running the plugin with open or loosely controlled user registration.
Authentication bypass in the maestro gRPC broker shipped with Red Hat Multicluster Engine for Kubernetes lets a client that already holds a valid mTLS client certificate skip the broker's authentication check and then subscribe to other consumers' event streams or publish forged agent status messages. The consequence is unauthorized information disclosure and loss of data integrity inside the broker, with no availability impact and scope unchanged; the assessed CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, and the valid-client-certificate prerequisite confines abuse to trusted-but-lower-privileged or already-compromised clients rather than anonymous remote attackers.
Stored cross-site scripting in the Bacularis backup management web interface (versions 1.0.0 through 6.5.1) lets an authenticated user with permission to create backup pools inject a script payload into the pool LabelFormat field, which then executes in the browser of any user - such as an administrator - who later views the affected pool configuration. Because exploitation requires a valid low-privileged account (CVSS PR:L) and the payload fires only when a higher-privileged victim opens the crafted view (UI:R), the realistic blast radius is limited and the flaw is rated moderate severity (CVSS 5.4, scope-changed). EPSS is very low at 0.14% (3rd percentile), no CISA KEV entry exists, and no public exploit code has been identified at time of analysis, though a researcher disclosure is referenced at hekk.one.
Boot-time arbitrary code execution is possible on AMD Versal Adaptive SoCs and related Alveo accelerator cards, but only when USB boot mode has been enabled through physical board modifications - a configuration AMD explicitly describes as non-default. A crafted boot image delivered over USB can trigger an out-of-bounds write (CWE-787) that overflows a buffer and overwrites an active function pointer, yielding high confidentiality, integrity, and availability impact confined to the boot process. Because exploitation requires both physical access to the device and a deliberately modified board, plus a non-trivial (high-complexity) overflow, realistic risk is limited to supply-chain, manufacturing, or evil-maid scenarios; no public exploit identified at time of analysis, and no confirmed in-the-wild activity, though the vendor bulletin AMD-SB-8028 documents the issue.
Authenticated members of any workspace on multi-tenant Plane instances running versions prior to 1.4.0 can exploit an IDOR (CWE-639) in the BulkDeleteIssuesEndpoint and SubIssuesEndpoint to delete cycle/module associations or re-parent issues belonging to foreign workspaces, because the permission decorator only verifies membership in the URL-named workspace/project and does not validate that the supplied issue IDs are within that scope. The CVSS 5.4 (Medium) reflects limited confidentiality and integrity impact (C:L/I:L/A:N) with no availability impact; exploitation requires valid credentials and knowledge of foreign issue IDs (typically UUIDs), and no public exploit code has been identified at time of analysis. The vendor released a patch in version 1.4.0, documented in a public GitHub Security Advisory.
Cross-workspace IDOR in Plane prior to 1.4.0 lets any authenticated workspace member create issue relations that link their own issues to issues owned by other workspaces on the same instance, exposing the targeted issue's metadata (titles, identifiers, activity/event data) through the resulting activity events. The flaw affects the issue-relation endpoint and the related cycle, module and sub-issue endpoints, all of which accepted caller-supplied issue UUIDs without confirming they belonged to the caller's workspace; exploitation requires a valid low-privilege account (PR:L) on a multi-workspace instance and knowledge or enumeration of a foreign issue UUID. No public exploit code was identified at time of analysis and no EPSS or KEV signal was provided, so this is best treated as a moderate, authorization-scoped information-disclosure and integrity issue rather than an urgent remote-code-execution class bug. Vendor-released patch: 1.4.0.
Host-based authentication controls in Perforce P4 Search prior to 2026.4.2 can be bypassed because the service trusts a client-supplied address when validating certain authentication requests, allowing a holder of a stolen P4 Server ticket to defeat ticket host-binding and trusted-address restrictions and obtain access to P4 Search as that ticket's owner. The flaw is authenticated in nature (CVSS:4.0 vector shows PR:L and the independent assessment concurs), so it does not grant access on its own - the attacker must already possess a valid but stolen ticket, and the bypass is only meaningful in deployments that rely on host-binding or trusted-address controls; where those controls are absent, the stolen ticket already grants the same access. Severity is moderate (CVSS 5.3, independent CVSS:3.1 base 5.3) with low confidentiality and integrity impact confined to the single compromised ticket's permissions; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV), so this is best treated as a medium-severity defense-in-depth gap rather than a standalone critical issue.
A divide-by-zero fault in vgmstream's Microsoft IMA ADPCM decoder (decode_ms_ima in src/coding/ima_decoder.c) allows an attacker to crash an application that uses the library by tricking a user into opening or playing a malformed IMA ADPCM-encoded audio file. All builds up to and including r2117 are affected, and the issue is reachable remotely only in the sense that the hostile file can be delivered over a network - the victim must still actively load it into a vgmstream-based player or tool, and the CVSS vector confirms the attack is unauthenticated but requires user interaction. Impact is limited to denial of service: the decoder process aborts with no code execution, data disclosure, or integrity loss, and there is no public exploit identified at time of analysis, so this is best treated as a moderate-severity availability bug rather than an emergency.
Unauthenticated denial of service in vLLM 0.24.0 through 0.29.x allows a remote caller to force excessive video frame decoding by supplying uncapped media_io_kwargs.video.max_frames and media_io_kwargs.video.fps values to the /tokenize endpoint, exhausting Python-frontend memory and potentially terminating the API process before scheduling or admission control. Only deployments using the Python frontend and serving Qwen2-VL or Qwen3-VL video-capable multimodal models via Qwen2VLVideoBackend or Qwen3VLVideoBackend are affected; the Rust frontend rejects the media_io_kwargs field. No public exploit has been identified at time of analysis, and the vendor has released a fix in vLLM 0.30.0.
Denial of service in vLLM versions prior to 0.30.0 lets unauthenticated remote callers exhaust shared media-loading CPU and memory. A caller can set the request-level media_io_kwargs field to select the GLMGA video backend and pass oversized fps and max_frames values, causing GLMGA to build and deduplicate an attacker-sized pre-decode frame-index list from a tiny, valid video file. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) confirms no authentication is required and impact is limited to availability, yielding a moderate 5.3 score; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. The flaw is fixed in vLLM 0.30.0.
Reflected cross-site scripting (XSS) in the Dynamic Content Filter addon of the SP Page Builder Pro extension for Joomla (versions 3.0.0 through 5.6.1p2) allows unauthenticated attackers to inject arbitrary HTML or JavaScript into a victim's browser by crafting a URL with a malicious dc_filter_<fieldId> parameter, provided the addon is used with a slider field. The flaw is rated medium severity (CVSS 4.0 base 5.3; independent assessment CVSS 3.1 base 5.3) and requires user interaction-the victim must load the crafted link. No public exploit code has been identified at time of analysis, and CISA KEV does not list active exploitation.
Information disclosure in the WordPress plugin Video Conferencing with Zoom (video-conferencing-with-zoom-api, all versions through 4.6.10) allows any authenticated low-privilege account to retrieve sensitive data that the plugin embeds in the responses it sends to users. Both the CVSS 4.0 vector and the independently assessed CVSS 3.1 vector require a valid account (PR:L) with no user interaction (UI:N) and no administrative access, so exposure is greatest on sites that permit public or subscriber-level registration. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, giving a CVSS 4.0 base score of 5.3 that places this in moderate-severity, real-but-limited confidentiality risk rather than urgent-emergency territory.
Authenticated users of Penpot prior to 2.18.0 can exhaust server-side temporary storage by repeatedly re-uploading a valid chunk index through the chunked media upload RPC, because the backend validated only that the index was in range and never rejected an index that had already been stored. Each duplicate request allocates a new temporary storage object without replacing the previous one, so the session's actual stored bytes grow unbounded relative to its declared logical size, and the mismatch is only detected at assembly time. The vulnerability requires a valid account and an active upload session, is rated 5.3 (CVSS 4.0) with availability impact only, and is addressed in Penpot 2.18.0; no public exploit code identified at time of analysis.
An out-of-bounds read in vgmstream up to revision r2117 is triggered when a victim opens or plays an attacker-crafted PlayStation VAG audio file through any application that embeds the library; the flaw sits in ps_find_padding() in src/coding/psx_decoder.c, which scans for padding at the end of a stream and reads past the input buffer when fewer bytes remain than a full ADPCM frame. Exploitation requires user interaction (CVSS 4.0 UI:P, PR:N - no authentication needed) and impact is limited to minor memory disclosure or a decoder crash, with no code execution or system compromise demonstrated. The vendor has published an upstream fix (PR #2001, commit 4b8316652a30d40f99ad43310bed273fd1f8a7a3) with a straightforward bounds check; no public exploit identified at time of analysis, and the associated reference issue (#2000) is a bug report rather than weaponized code.
Out-of-bounds write in vgmstream up to r2117 lets a crafted TXTP playlist (or a related TXTH/VAB config or name-table file) overflow fixed-size stack buffers when parsed, corrupting memory in any vgmstream-based player, plugin, or library build that loads the file. The flaw sits in the parse_params/txtp_parse routines of src/meta/txtp_parser.c, where sscanf conversions used unbounded '%[^...]' scans without field-width limits; the trigger is an over-length key, value, or command token. Exploitation is unauthenticated but requires the victim to deliberately open the malicious file (UI:P per CVSS 4.0, UI:R per the assessed CVSS 3.1 vector), and no public exploit code has been identified at time of analysis; the issue is rated 5.3 (CVSS 4.0) and low-to-moderate priority, consistent with a client-side parsing fault that exposes no network service.
Unauthenticated information disclosure in the Blubrry PowerPress Podcasting WordPress plugin (versions up to and including 11.17.9) let's remote attackers retrieve embedded sensitive data from an affected site because a function handling that data lacks a proper authorization check (CWE-862). Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), no credentials or user interaction are required, but the impact is confined to confidentiality only, limited to specific embedded data rather than arbitrary site data, credentials, or any write capability. No confirmed active exploitation (CISA KEV) or publicly available exploit code has been identified at time of analysis, making this a genuine but low-to-moderate priority issue rather than an emergency; the exact vulnerable route is not specified in the source advisory, which constrains precise detection.
Missing authorization in the WordPress Name Directory plugin (through version 1.34.2) lets remote, unauthenticated attackers reach functionality and directory data that should require higher privileges or proper access-control checks. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N reflects low-complexity, unauthenticated exploitation against default installs, with impact confined to low confidentiality loss and no integrity or availability effect, so the realistic outcome is unauthorized disclosure of directory entries rather than site takeover. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the primary practical exposure is limited to sites running the vulnerable plugin.
SNMP trap injection against Zabbix's bundled Perl trap receiver script allows a party that can deliver traps accepted by that receiver to forge a record against a different host, corrupting the integrity of collected monitoring data with no confidentiality or availability impact. The root cause is a failure to neutralize the ZBXTRAP record delimiter in CWE-143 terms, and only deployments that ingest traps through the shipped Perl script (typically wired into snmptrapd) are exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the independent assessment rates this as a moderate, low-priority integrity issue (CVSS 3.1 5.3) rather than an urgent threat.
Input data manipulation in Magepeople Inc.'s Taxi Booking Manager for WooCommerce plugin (all versions through 2.1.1) lets unauthenticated remote attackers tamper with a quantity-style input field that the plugin fails to validate properly, with the impact limited to integrity of that constrained booking/order value (C:N/I:L/A:N). The flaw carries a moderate CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning no authentication, user interaction, or special configuration is needed to reach the vulnerable code path on a default WordPress plus WooCommerce installation. There is no CISA KEV entry and no public exploit identified at time of analysis, so real-world priority is low-to-moderate; no EPSS score was supplied with the available intelligence.
Docling 2.83.0 through 2.130.x ignores the enable_remote_services=False policy when OCR is configured with KserveV2OcrOptions, so page-image crops are still transmitted to the caller-configured KServe v2/Triton inference endpoint during PDF processing. The defect is a security-control bypass rather than attacker-driven exfiltration: the remote destination is chosen by the operator, the vulnerable code path is inert unless a second, non-default remote OCR engine is explicitly configured, and satisfying the assessed vector (AV:L/AC:H/PR:H) requires local access with high privileges. The assessed impact is confined to low-severity confidentiality exposure of processed page images, with no integrity, availability, or code-execution effect; no public exploit code and no CISA KEV entry were identified at time of analysis, and the flaw is fixed in 2.131.0.
Docling's HTML backend forwards operator-configured HTTP headers - bearer tokens, API keys, cookies set via HTMLBackendOptions.headers - to every remote image URL named by an untrusted HTML document, including after a cross-origin redirect, leaking the caller's credentials to whoever authored the document. The flaw lives in docling/backend/utils/image_resource_loader.py in versions 2.95.0 through 2.131.x and is only reachable in a deliberately non-default configuration where both enable_remote_fetch and fetch_images are enabled and sensitive headers have been configured; the default configuration carries no exposure. Upstream scored it CVSS 3.7, while independent assessment rates the confidentiality impact as High given that live credentials are disclosed; no public exploit code has been identified at time of analysis, and the issue is fixed in 2.132.0.
Denial of service in MediaTek cellular modem firmware lets an attacker running a rogue base station crash the modem of an attached device by delivering a malformed message that triggers a missing bounds check, severing cellular connectivity until the modem restarts. The flaw is availability-only (CVSS 5.3, AV:A/AC:H/PR:N/UI:N/C:N/I:N/A:H) and is gated by radio proximity plus the victim UE actually attaching to the attacker-controlled cell, so it is not reachable over the internet and carries no confidentiality or integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and MediaTek has shipped fixes (patch IDs MOLY01864925 / MOLY01210562) covering more than 50 chipsets across the October 2026 product security bulletin.
Denial of service in MediaTek's cellular modem firmware can crash the baseband on a broad set of MediaTek chipsets - including MT6991, MT6988, MT6897, MT8755, MT6835, MT8792 and others - causing the device to drop connectivity or reset. Exploitation is unauthenticated (PR:N, UI:N) but requires the attacker to operate a rogue, attacker-controlled base station and to get the target user equipment to attach to it over the radio interface, which is why attack complexity is rated high (AV:A/AC:H) and impact is limited to availability (A:H; no confidentiality or integrity effect). MediaTek publishes fix identifiers MOLY01870473 / MOLY00814393 (issue MSV-9041) in its October 2026 product security bulletin; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with partial technical impact, keeping real-world priority moderate-to-low despite the large number of affected chipsets.
Unauthenticated sensitive information disclosure in the Arraytics WP Event Solution WordPress plugin (all versions through 4.1.25) allows any remote attacker to retrieve embedded sensitive data from the plugin's exposed endpoint. Per the CVSS vector AV:N/AC:L/PR:N/UI:N, exploitation requires no credentials, no user interaction, and no non-default configuration - only that the plugin is installed and active and the affected endpoint is network-reachable. Impact is limited to partial confidentiality loss (C:L, CVSS 5.3) with no integrity or availability effect; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Information disclosure in the Pixelite Events Manager WordPress plugin through version 7.4.5 allows unauthenticated remote attackers to retrieve embedded sensitive data from outbound responses. No public exploit code has been identified at time of analysis, and the CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a confidentiality-only impact rated Low. This is a moderate, low-priority vulnerability rather than a critical threat.
Unauthenticated remote attackers can manipulate the quantity input handled by VillaTheme's BuildKit - Product Builder for WooCommerce - Custom PC Builder (all versions through 1.0.28), altering builder-supplied configuration data on affected stores. The defect is an improper-validation-of-specified-quantity flaw (CWE-1284): the plugin accepts a caller-supplied quantity without adequately checking its type, bounds, or consistency, so a crafted request can subvert the value the builder relies on. Impact is confined to integrity per the assessed vector (CVSS 5.3, I:L with C:N/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; the narrow deployment base of this niche PC-builder plugin further limits real-world exposure.
WP Mailster, a WordPress newsletter and mailing-list plugin, contains a missing authorization flaw (CWE-862) affecting all versions through 1.9.0.0, allowing remote attackers to reach plugin functionality or data that should be gated behind an access-control check. According to the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (score 5.3), exploitation requires no authentication and no user interaction against a default installation, but the resulting impact is limited to low-level confidentiality loss - unauthorized read access to data or functionality rather than modification, deletion, or site takeover. No public exploit code and no confirmed active exploitation were identified in the provided intelligence at time of analysis, and the flaw was reported through Patchstack as a broken access control issue in the WordPress plugin ecosystem.
Incorrect currency-calculation logic in the VillaTheme CURCY (woo-multi-currency) WordPress plugin, present in every release up to and including 2.2.17, allows remote attackers to trigger a bounded security impact against an affected site - the supplied vector requires no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). At CVSS 5.3 this is a moderate-severity, low-priority issue rather than an urgent threat: only a single low-severity outcome is realistic, with the public scoring signals disagreeing on whether that outcome is limited data disclosure (our assessed vector C:L/I:N) or limited data manipulation (the CNA vector I:L). There is no CISA KEV listing and no public exploit code identified at time of analysis, and the only public record is a Patchstack advisory entry, so exploitation in the field has not been observed.
Unauthenticated attackers can mark arbitrary orders as paid in the UPI QR Code Payment Gateway WordPress plugin through version 1.4.3, because the plugin's payment-confirmation handler does not verify that the confirmation request belongs to the order and customer it references (CWE-639, authorization bypass through a user-controlled key). The flaw is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3), but the impact is limited to falsifying payment status with no data disclosure or denial of service, and exploitation requires the plugin to be installed and enabled as an active checkout payment method plus attacker knowledge or enumeration of a valid order ID. No public exploit code or CISA KEV entry was identified at time of analysis, making this a genuine but moderate-priority issue rather than a critical one, consistent with the independent assessment.
A missing permission check in MediaTek modem firmware permits an out-of-bounds read that can crash the baseband, producing a remote denial of service on affected handsets. The attack is unauthenticated (CVSS PR:N) and requires no user interaction (UI:N), but it only succeeds if the victim UE is already camped on a rogue base station the attacker controls, which is why the vector is scored AV:A/AC:H and the issue is assessed as moderate severity and low real-world priority. No public exploit code has been identified at the time of analysis, and impact is limited to availability of the modem - no confidentiality or integrity loss, and no code execution. MediaTek has issued a fix under Patch ID MOLY01774038 / Issue ID MSV-8911.
Remote denial of service against MediaTek modem (baseband) firmware affects more than 80 chipsets - including MT6765, MT6785, MT6833, MT6883, MT6985, MT6991 and MT8798 - where a missing bounds check during cellular message parsing produces an out-of-bounds read (CWE-126) that can crash the baseband. An attacker who operates a rogue base station and gets a victim UE to attach can trigger the fault with no authentication (PR:N) and no user interaction (UI:N), though the adjacent-network position and specialized radio hardware required drive the high attack complexity (AC:H) and the CVSS 3.1 score of 5.3, with impact limited to availability. Neither our independent assessment nor CISA's SSVC framework records known exploitation (Exploitation: none, Automatable: no), so no public exploit is identified at time of analysis.
Out-of-bounds read in MediaTek modem firmware (CWE-126) allows an attacker operating a rogue base station to trigger a memory over-read in the modem stack of any UE that connects to it, resulting in a remote denial of service (availability only; no data exposure or code execution). The issue affects a very wide set of MediaTek chipsets (MT6989, MT6990, MT6983, MT6768, MT6765 and dozens more) enumerated in MediaTek's October 2026 product security bulletin. No authentication or user interaction is required (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.3), but practical exploitation demands radio proximity, rogue base-station infrastructure, and the ability to coerce device attachment - CISA SSVC rates exploitation 'none' and automatable 'no', and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a genuine but moderate-priority issue rather than a critical one.
Denial of service against the cellular modem firmware shipped in a very broad range of MediaTek chipsets (MT6739 through MT6993/MT8893 families) arises from an out-of-bounds read caused by a missing permission check. The precondition is that the victim user equipment has already attached to a rogue base station under the attacker's control, meaning the adversary must operate radio infrastructure within range and successfully induce attachment (downgrade or stronger-signal lure) - hence the AV:A/AC:H scoring and the LOW real-world priority despite the enormous chipset footprint. Once attached, exploiting the flaw requires no authentication (PR:N) and no user interaction (UI:N), but the outcome is availability-only (A:H, with no confidentiality or integrity impact); there is confirmed no active exploitation (CISA KEV absent), no public exploit code identified at time of analysis, and no EPSS signal was provided in the source data.
Modem denial of service in MediaTek baseband firmware allows an attacker operating a rogue base station within radio range to crash or reset a victim handset's modem through an out-of-bounds read (CWE-125) caused by an incorrect bounds check on attacker-influenced over-the-air data. The attacker must first get the target UE to camp on the malicious cell (CVSS 3.1 AV:A/AC:H), after which no privileges and no user interaction are required, and the only impact is loss of availability of the modem (A:H, C:N/I:N), yielding a 5.3 base score. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation=none and Automatable=no, and applicability is limited to devices built on the enumerated MediaTek chipset models with vulnerable modem firmware, so this is a genuine but bounded, proximity-dependent availability risk rather than a mass-exploitation emergency.
Unauthenticated remote attackers can tamper with limited plugin-controlled data in Kit (formerly ConvertKit) for WooCommerce versions up to 2.2.0 due to a missing authorization flaw, enabling unauthorized modification of certain settings or data. The vulnerability has a CVSS score of 5.3 with low integrity impact and does not require authentication or user interaction, though it cannot exfiltrate confidential data or cause denial of service. No public exploit identified at time of analysis, and patch availability is not confirmed.