Papermerge 3.5.3 permits an authenticated standard user to achieve remote code execution by uploading a crafted file to /api/documents/upload with directory-traversal sequences in the filename, causing a malicious Python .pth file to be written into the interpreter's site-packages directory; the embedded code executes only when the Python interpreter next starts, for example on an application or worker restart. Publicly available exploit code exists via a GitHub PoC repository and accompanying PDF, and the flaw is conditionally gated by requiring the Papermerge process to have write access to site-packages and by the attacker not controlling restart timing, making it a credible but conditionally-gated RCE rather than an immediately triggerable one.
Local file disclosure in Docling allows crafted HTML to embed readable files from the host filesystem into the rendered page image. When an application explicitly sets HTMLBackendOptions(render_page=True), has the optional Playwright dependency installed, and passes untrusted HTML as a filesystem Path, the HTML backend's browser request filter fails to enforce the enable_local_fetch setting or confine file:// access to the source document's directory, so an <iframe src="file:///..."> can pull in .env files, credentials, or other users' documents that Chromium then renders visibly into the output image. Publicly available exploit code exists and the issue is fixed in 2.118.1; EPSS is low (0.30%, 21st percentile) and there is no indication of active exploitation, so real-world priority is comparatively low despite the 7.5 CVSS, because exploitation demands a specific non-default configuration and disclosure is passive, read-only, and limited to text content Chromium renders in the viewport.
Arbitrary code execution in the control plane of Red Hat Multicluster Engine for Kubernetes (HyperShift operator) is possible when an authenticated user with cluster and secret creation permissions supplies a kubeconfig secret containing unauthorized executable credential plugins, which the operator copies without validation into the privileged control plane namespace. Downstream controllers that consume this configuration execute the plugins, granting full control plane compromise. The vulnerability requires low privileges (PR:L) and no user interaction, and no public exploit or CISA KEV entry is identified at time of analysis.
Out-of-bounds write in MediaTek's 'vdec' hardware video-decoder path allows remote escalation of privilege on a broad set of affected MediaTek SoCs - including MT6768, MT6833, MT8186, MT8195 and MT6877 - when a victim opens or plays attacker-controlled media that reaches the vulnerable decode routine. Exploitation requires no additional execution privileges or authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) but does require user interaction, since the crafted stream must actually be rendered by the decoder; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterised as a credible, above-average-priority mobile vulnerability rather than an emergency. MediaTek has assigned patch ID ALPS11383899 (issue MSV-9614) and published guidance in its October 2026 product security bulletin.
PHP object injection in the VK Google Job Posting Manager WordPress plugin (versions through 1.3.1) allows an authenticated low-privilege user to submit crafted serialized input that the plugin deserializes without validation, permitting object injection that can escalate to arbitrary code execution, file manipulation, or sensitive data exposure where a usable gadget chain exists in the plugin or its loaded libraries. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), the flaw is network-reachable with low complexity, requires only low-level authentication, and needs no user interaction, resulting in high confidentiality, integrity, and availability impact. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; reliability of full code execution depends on an unconfirmed PHP POP gadget chain, so successful exploitation is most plausible against sites where subscribers or other low-privilege accounts can be created or reached.
PHP object injection in the WordPress plugin Simple Event Planner (PressTigers) through version 1.5.7 lets an authenticated low-privileged user pass crafted serialized data to a plugin endpoint that is deserialized without validation, potentially leading to arbitrary object instantiation and, if a usable gadget chain exists in the plugin or surrounding WordPress codebase, to full remote code execution. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires a valid low-privilege session - it is not exploitable unauthenticated - with no public exploit identified at time of analysis. Sites that permit open subscriber registration are the most exposed, since any registered user can reach the vulnerable code path.
Docling 2.94.0 through 2.131.x allows an attacker-supplied LaTeX/TikZ document to read files accessible to the converter process and create or overwrite writable files when the caller has explicitly opted into Tectonic rendering via LatexBackendOptions(tikz_engine="tectonic"); enabling the additional tikz_engine_allow_shell_escape option escalates this to shell command execution through TeX. The default Docling configuration does not enable Tectonic rendering and is not affected, and exploitation further requires a victim or operator to feed the crafted document into the pipeline (UI:R), which is why the practical risk is conditional despite the high CVSS base score. Both docling and docling-slim are affected; the flaw is fully fixed in 2.132.0, EPSS is a low 0.30% (21st percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis.
Server-side request forgery in the Progress Sitefinity Next.js SDK npm package (@progress/sitefinity-nextjs-sdk, versions 15.1.8326 through 15.4.8637) allows remote, unauthenticated attackers to coerce the hosting Node.js server into making requests to attacker-chosen hosts, which can expose sensitive internal responses and data reachable from the application server. Exploitation is not fully autonomous: the CVSS vector carries UI:R, so a user or an automated server-side workflow must be induced to process the attacker-supplied URL, and the deployment must route that input into the SDK's vulnerable request path. Progress rates the issue 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while our independent assessment narrows the integrity impact (C:H/I:L/A:N), consistent with a primarily confidentiality-focused SSRF rather than code execution; no public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
Remote code execution in Ghost CMS 6.56.0 through 6.66.x lets any authenticated staff user - including the lowest-privilege Contributor role - execute arbitrary commands on the Ghost server by creating a bookmark card that points to an attacker-controlled website serving a crafted SVG. The root cause is a code-injection flaw (CWE-94) in the SVG handling path of an image-processing library bundled with Ghost, and successful exploitation yields full confidentiality, integrity, and availability impact on the host. Exploitation requires a valid Ghost staff login (the vendor vector claims PR:N, but our assessed vector of PR:L/UI:N is the accurate prerequisite), and there is no public exploit identified at time of analysis. Ghost 6.67.0 is the fixed release.
Heap-based out-of-bounds write in Android's Bluetooth stack, specifically the cfg2prop routine in btif_storage.cc, can be triggered when the Bluetooth subsystem converts attacker-influenced bonded/stored device configuration data into Bluetooth properties, potentially leading to remote code execution. Affected builds are Android 16, Android 16-qpr2, and Android 17; the assessed vector requires low privileges (PR:L, consistent with a pairing/component-level context) and no user interaction, and real-world reachability is expected to be radio-adjacent (a nearby, paired, or spoofed Bluetooth device) rather than arbitrary internet access, even though the vendor-assigned vector carries AV:N. No public exploit code has been identified and SSVC records exploitation as none at time of analysis, but the flaw is memory-corruption class with total technical impact, so it warrants priority patching on devices where Bluetooth is enabled and pairing is common.
Memory corruption in Google Android 16, Android 16-qpr2, and Android 17 lets an attacker who already has low-privilege code executing on the device - for example a malicious or compromised installed app - turn uninitialized-memory handling into an out-of-bounds write and escalate to full privileges with no further execution privileges and no user interaction. The weakness is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which requires a pre-existing local foothold rather than a purely network-reachable entry point, and exploitation is only possible on builds that have not applied the 2026-10-01 Android security patch. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a high-priority patch item rather than an emergency, and it is not listed in CISA KEV.
A race condition in Apache Struts' application-wide localization (i18n) text provider lets a message formatter that has been cached for one request be reused by concurrently served requests, so a date or time value belonging to one user can surface in another user's rendered response, or the formatting can fail and appear as a server error. The flaw affects Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0; applications whose localized messages format no date or time arguments are explicitly not affected, which is the exact gating condition for exposure. No public exploit code or confirmed active exploitation has been identified, EPSS is low at 0.18% (7th percentile), and the outcome is timing-dependent and non-deterministic - leaking only values passed as date/time format arguments, not arbitrary memory - which is why our assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) is materially more conservative than the vendor's 8.8 score.
Local privilege escalation in Google Android 17 lets a locally installed, low-privileged application escape its sandbox and obtain system-level privileges by reaching the isSystem() routine in WifiPermissionsUtil.java, which fails to perform the required permission check (CWE-862). The flaw is rated CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting a changed-scope impact in which a compromised app in the application sandbox compromises the platform itself, with high confidentiality, integrity and availability effects and no user interaction required. An attacker must already have achieved local code execution on the device (for example through a malicious or trojanized app), and only Android 17 is listed as affected, so devices on other releases or on the October 2026 patch level are not exposed; no public exploit identified at time of analysis, and the issue is addressed through the Android Security Bulletin dated 2026-10-01.
Unauthenticated remote attackers can download any customer's purchased digital goods from Joomla sites running the Phoca Cart extension (versions 5.0.0 through 6.1.8), because the order-file download endpoint checks only that the 'd' (download token) and 'o' (order token) parameters are non-empty instead of comparing them with the stored download_token and order_token values. Any guest with no account can enumerate sequential numeric order IDs, supply arbitrary non-empty token values, and retrieve files belonging to other customers, making this a high-severity confidentiality breach with no authentication and no user interaction required (CVSS 4.0 base 8.7; assessed CVSS 3.1 7.5, C:H/I:N/A:N). No public exploit code was identified at time of analysis, and the issue is a genuine high-priority concern rather than an inflated score, with impact limited only by the practical prerequisite that the store actually offers downloadable goods served through this endpoint and has existing order records to enumerate.
Server-side request forgery in Plane, the open-source project management tool, allows a low-privilege user of a connected Gitea instance to make the Plane server issue HTTP requests to internal or private addresses. The flaw affects versions prior to 1.4.0 and only manifests when an administrator has explicitly enabled Gitea OAuth and pointed GITEA_HOST at a legitimate Gitea deployment (the feature is off by default); an authenticated Gitea user then sets an internal URL as their profile avatar and logs in through OAuth, causing Plane to fetch that attacker-chosen target without validation. The result is a largely blind SSRF primitive, since the avatar handler only accepts image Content-Types and enforces a size cap, and no public exploit code or active exploitation has been identified at time of analysis.
Authenticated cross-workspace access control bypass in Plane (makeplane/plane) before version 1.4.0 lets any user with a valid account in one workspace read and modify estimates, and inject comments into issues, belonging to a completely different workspace. The flaw is a CWE-639 (IDOR/BOLA) issue: the PATCH /api/workspaces/{slug}/projects/{project_id}/estimates/{estimate_id}/ and POST /api/workspaces/{slug}/projects/{project_id}/issues/{issue_id}/comments/ handlers resolve estimate_id and issue_id by primary key without re-verifying that those objects belong to the workspace and project named in the URL, even though ProjectEntityPermission validates the caller's membership in the URL-named scope. Exploitation requires authentication and knowledge or enumeration of a foreign object ID, and is confirmed by vendor advisory GHSA-933r-rxg8-f3h2 and fixing PR #9286; no public exploit code and no confirmed active exploitation were identified at time of analysis, though the CVSS 4.0 base score of 8.7 reflects high confidentiality and integrity impact (assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).
Plane prior to 1.4.0 allows an authenticated workspace member to bypass project-level authorization and join any project in that workspace, including private or secret projects with network=0, while receiving a full Member role with read and write access. The root cause is CWE-284 improper access control in the GraphQL joinProject mutation, which validated workspace membership but failed to enforce the target project's visibility. Exploitation requires an active authenticated workspace member and a workspace containing private projects, making this an insider or post-account-compromise escalation rather than an unauthenticated exposure; no public exploit identified at time of analysis, and the issue is fixed in 1.4.0.
Stored cross-site scripting in Plane prior to 1.4.0 lets an authenticated low-privilege workspace member - including a Guest - upload an image/svg+xml file as a generic or issue attachment that is later served with Content-Disposition: inline, so the embedded SVG JavaScript runs in the Plane application's origin under the default self-hosted MinIO deployment. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7) shows the attacker must be authenticated (PR:L) and a victim, such as a workspace administrator, must open the asset-download link (UI:R), after which session compromise can lead to full account takeover. No public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV); vendor-released patch: 1.4.0.
Stored cross-site scripting in Plane (versions up to and including 1.3.1) allows any authenticated user - including a brand-new account with no workspace memberships - to plant arbitrary HTML in a project that has a published DeployBoard with intake enabled, because the public intake endpoint writes description_html without sanitization. When a project member or viewer opens the affected closed intake item and clicks the attacker-planted link, a TipTap javascript: parser bypass and a target="_self" click handler execute JavaScript in the victim's session and exfiltrate a long-lived API token. The issue is fixed in 1.4.0 per vendor advisory GHSA-hh2r-3hwp-mvq3 and upstream patch PR #9287; no public exploit identified at time of analysis.
Missing workspace authorization in Plane's entity-search API before version 1.4.0 allows any authenticated user who knows a workspace slug to retrieve member display names, UUIDs, avatar URLs, and ProjectMember rows from workspaces they do not belong to. The flaw is a CWE-862 missing authorization issue in SearchEndpoint, which enforced only IsAuthenticated; upgrading to 1.4.0, which adds WorkspaceUserPermission, fully remediates. No public exploit code was identified at time of analysis.
Plaintext logging of API keys in Plane (makeplane/plane) prior to 1.4.0 lets an authenticated low-privilege user who can read application logs harvest other users' long-lived API tokens and use them to escalate privileges, potentially including to administrative accounts. The vulnerable behavior is inherent to affected versions - the APITokenLogMiddleware component writes API keys into request/application logs in cleartext - and exploitation requires both a valid low-privilege account (CVSS PR:L) and visibility into the resulting log output; if logs are restricted to admins or shipped to a protected external sink, the realistic exposure narrows to insiders or anyone who can reach the log store. No public exploit code or confirmed active exploitation has been identified at time of analysis and no EPSS signal was supplied; overall this is a credible, moderately-high-priority issue rather than a drop-everything emergency, and it is fixed in Plane 1.4.0.
Improperly protected application-authorization flow in Joplin Server (the self-hosted sync backend for the Joplin note-taking client) before 3.7.13 lets an attacker supply their own placeholder application identifier, have a logged-in victim approve it on the consent page, and then redeem that identifier for a durable application ID and password that yields a victim session with full read and write access to synchronized notebooks and notes. The CVSS vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A) rates it 8.5 because no attacker credentials are required, though success still depends on a victim who is already authenticated actively approving the consent step, making social engineering or a cross-site request against an authenticated session the practical path rather than silent compromise. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the issue is addressed by upgrading to 3.7.13.
Blind SQL injection in the WP BASE Booking WordPress plugin (all versions through 6.4.0) allows an authenticated attacker to inject arbitrary SQL into a plugin query and exfiltrate database contents one bit at a time by observing response timing or boolean behavior. The vendor advisory from Patchstack rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L); our independent review keeps the same authenticated, network-reachable, no-user-interaction profile but narrows the realistic impact to confidentiality only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), since the injected queries read data rather than alter it. Because exploitation requires an account on the target site (PR:L), sites with open self-service registration or reachable low-privilege roles carry materially greater exposure, while sites with no untrusted accounts are largely insulated. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so this is not confirmed as actively exploited; EPSS data was not provided. The vulnerable parameter and the minimum required role are not specified in the available data.
Blind SQL injection in the Sirv WordPress plugin through version 8.2.5 allows an authenticated low-privilege user to execute crafted SQL queries against the underlying WordPress database, potentially exposing sensitive data. The attack is network-reachable, requires no user interaction, and is limited by the need for a valid low-privilege WordPress session and an active vulnerable plugin installation; the specific injectable parameter is not named in the available data. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor CVSS 3.1 score is 8.5.
Arbitrary file write in Mitel MiVoice Office 400 backup restoration can lead to root-level code execution if an attacker can supply a malicious TGZ archive to the configured backup repository; however, exploitation requires privileged access to the backup repository and a restore operation, making it a high-severity issue but not an indiscriminate internet-facing threat. No public exploit identified at time of analysis.
Remote code execution in LibreOffice Calc allows attackers to execute arbitrary Java code by embedding a crafted external data link that loads a malicious Java database driver from a remote URL when the document is opened. This affects LibreOffice versions prior to the fix that enforces file URLs for Java class-path entries. Exploitation requires user interaction (opening the document) and a local attack vector; no public exploit has been identified at time of analysis, yet the high-severity impact can fully compromise the user's system.
Cross-workspace authorization bypass in Plane (makeplane) releases prior to 1.4.0 lets any authenticated user read, duplicate, modify, or delete file assets and read workspace-view data belonging to workspaces they are not members of. The vulnerable surfaces are DuplicateAssetEndpoint (source FileAsset fetched without workspace scoping), WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint (missing workspace authorization on read/create/update/delete), and WorkspaceViewViewSet.retrieve (missing the authorization decorator its sibling actions apply). Exploitation requires a valid authenticated account but not membership in the victim workspace, so multi-tenant, multi-workspace self-hosted deployments carry the most exposure; no public exploit code has been identified and there is no KEV confirmation of active exploitation. The issue is fixed in version 1.4.0.
Authenticated high-privilege attackers with access to the Mitel MiVoice Office 400 web portal on TCP 443 can exploit a directory traversal in Maintenance → File Management → File Browser to delete files outside the intended directory, including application and Linux system files, causing denial of service. The flaw affects MiVoice Office 400 deployments exposing the portal, requires a valid administrative/maintenance account, and has no public exploit identified at time of analysis. The independent assessment rates it as a moderate-priority, authentication-gated destructive issue rather than a mass-exploitation threat.
Server-side request forgery in Eclipse Che 7.29.0 and later allows any authenticated low-privilege user to make the workspace server fetch attacker-chosen URLs through the GET /api/scm/resolve and POST /api/factory/resolver endpoints, which pass the URL to URLFetcher.fetch() without any scheme or host allow-list. Successful abuse yields high confidentiality loss: arbitrary local file reads inside the Che pod (notably the Kubernetes service-account token at file:///var/run/secrets/kubernetes.io/serviceaccount/token), access to internal HTTP services and cloud instance metadata at 169.254.169.254, and delivery of the victim's stored SCM personal access token as an Authorization header to a host of the attacker's choosing; integrity impact is more limited, largely the unauthorized use of forwarded credentials. No vendor-released patch was identified at time of analysis and no public exploit code was identified at time of analysis, though the affected code paths are reachable by any authenticated user. A second, interaction-dependent variant triggers the credential forwarding when a victim opens a workspace from a malicious devfile whose parent.uri points at an attacker-controlled server.
Untrusted in-repo configuration in auto-changelog before 2.6.1 lets attacker-controlled repository content execute code with the privileges of the invoking user or CI job. Because versions prior to 2.6.1 merge the .auto-changelog file and the package.json 'auto-changelog' key into runtime options by default, options such as handlebarsSetup and plugins are passed to Node's require(), yielding code execution without the repository's dependencies ever being installed; under the same conditions output, appendGitLog/appendGitTag, remote and URL templates enable arbitrary file writes, git argument injection and outbound requests. Exploitation is not confirmed actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis, but the attack requires the victim to invoke auto-changelog against a repository they do not control - most realistically a CI job checking out an untrusted pull-request head - so exposure is concentrated in that specific population rather than being broadly remotely reachable.
Remote code execution in Mitel MiVoice Office 400 is possible when an authenticated high-privilege user uploads a malicious shared object through the Music on Hold configuration page instead of a valid WAV file, because the application fails to validate file type before loading it. This is a CWE-434 unrestricted file upload issue affecting the web portal on TCP 443; the independent assessment maps it as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. No public exploit code or confirmed KEV exploitation was identified in the provided intelligence, and exploitation is constrained by the need for administrative credentials to reach the vulnerable upload feature.
Path traversal in the Mitel MiVoice Office 400 web administration portal (https://<ip>:8443, reached through Administration -> View Logs) lets an authenticated administrator view or download sensitive system files that the portal's service context can read. Exploitation requires a high-privileged admin session and no user interaction, so the practical risk is access-gated: insiders, or attackers who have already stolen admin credentials or hijacked an admin session, are the realistic threat actors. The CNA rates it CVSS 4.0 8.4 with PR:H and a proof-of-concept-level exploit maturity metric (E:P), while our independent CVSS 3.1 assessment (7.2, AV:N/AC:L/PR:H/UI:N/C:H/I:N/A:N) characterizes it as a genuine but access-gated risk; no confirmed active exploitation (CISA KEV) or evidence of widespread attack activity appears in the available intelligence.
Local privilege escalation in MediaTek's APU (AI Processing Unit) allows a locally-executing attacker to corrupt memory via malformed input, potentially achieving kernel-level code execution on devices with affected chipsets (MT6899, MT8781, MT8910, MT8793, MT6993, MT8668). The vulnerability is rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and requires the attacker to already run code on the device, such as a malicious Android app, with no additional privileges or user interaction needed. No public exploit identified at time of analysis, and the flaw is fixed by MediaTek patch ALPS11249004.
Local privilege escalation in MediaTek NeuroPilot on affected chipsets (MT8781, MT8189, MT6993, MT8793, MT8910, MT8668, MT8188, MT6881, MT8875) allows an attacker with local code execution to trigger an out-of-bounds write in the APU/AI driver, potentially gaining high-integrity code execution with no user interaction, though no additional privileges are needed once that local app context exists. Vendor patch ALPS11249062 is available; no public exploit identified at time of analysis. It is a high-priority patch target for affected MediaTek-based devices but is not remotely reachable, limiting its scope to privilege escalation rather than initial compromise.
Local privilege escalation in MediaTek's NeuroPilot component allows an attacker with an existing foothold on a device to corrupt memory and elevate privileges via an out-of-bounds write caused by a missing bounds check (CWE-787), rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected platforms are devices built on MediaTek chipsets MT8668, MT8875, MT8781, MT8910, MT6881, MT8188, MT8189 and MT6993 that ship an unpatched NeuroPilot build. The flaw is not remotely reachable and requires local code execution (typically a running or installed Android app with no special privileges); no user interaction or elevated permissions are needed once that foothold exists, and no public exploit code was identified at time of analysis.
Local privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrupt a fixed-size stack buffer via crafted input to the video hardware abstraction layer, yielding code execution in the HAL context with high impact to confidentiality, integrity and availability (CVSS 8.4, AV:L/PR:N/UI:N). The flaw stems from a missing bounds check (CWE-121, stack-based buffer overflow) and affects roughly four dozen MediaTek chipsets spanning the MT6xxx, MT8xxx and MT2718 families used in Android phones, tablets, Chromebooks and automotive platforms. No user interaction and no additional execution privileges are required once local code execution exists, but the attack vector is local only - remote exploitation is not indicated and no public exploit code has been identified at time of analysis. MediaTek has assigned patch ID ALPS11375674 (issue MSV-9571), delivered to OEMs through its October 2026 product security bulletin.
Local privilege escalation in the MediaTek APU (AI Processing Unit) driver allows an attacker with existing code execution on affected devices to trigger a use-after-free, achieving full compromise of confidentiality, integrity, and availability (CVSS 8.4). The flaw affects MediaTek chipsets MT8781, MT6993, MT6899, MT8668, MT8910, and MT8793, and requires no additional privileges or user interaction once local access is obtained. No public exploit code or active exploitation is confirmed at time of analysis.
Out-of-bounds kernel memory writes in the NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) of Zephyr RTOS let a local user-mode thread that has already been granted the ADC device object corrupt memory beyond an undersized buffer it supplies to the adc_read()/adc_read_async() syscalls. Exploitation of the privilege boundary requires a Zephyr build with CONFIG_USERSPACE=y running on an NXP RW61x SoC with the GAU ADC devicetree node enabled; the attack vector is localized (CVSS 3.1 8.4, AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) and the caller must already hold a device-object grant, but the scope change (S:C) and high integrity/availability impact reflect a genuine userspace-to-kernel privilege escalation path capable of kernel memory corruption or a crash. No public exploit code and no confirmed active exploitation were identified at time of analysis; builds without CONFIG_USERSPACE or on SoCs other than RW61x with the GAU ADC node enabled are not exposed to the privilege boundary and only suffer a silent overflow when the application itself passes an undersized buffer.
Arbitrary code execution and full compromise of the underlying Mitel Linux virtual machine in Mitel MiVoice Office 400 occur when a high-privileged local attacker plants a shared object (.so) whose name matches a predictable module that a privileged process loads without verifying its origin or integrity (CWE-73), causing the attacker's code to run with that process's privileges. The assessed attack vector is local with high privileges required (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), so this is a post-compromise escalation or persistence technique rather than a remotely wormable flaw. A proof-of-concept exploit is assessed (CVSS 4.0 E:P); no CISA KEV entry confirms active exploitation at time of analysis.
An out-of-bounds heap read in libexpat's XML_ParseBuffer (expat/lib/xmlparse.c) allows disclosure of adjacent heap memory to the calling application when the caller-supplied len exceeds the remaining capacity of the parse buffer. The vulnerable path is reachable only when a parse buffer already exists - created by a prior XML_GetBuffer call (or a prior XML_Parse call that allocates one internally), otherwise the function returns XML_ERROR_NO_BUFFER - and when the embedding application passes a length that does not match the buffer it actually filled; default parsing where len equals the buffer contents is not affected, and the CVSS 4.0 vector (AV:N/PR:N, no privileges required) confirms this is unauthenticated from the network perspective. Successful reads can disclose heap pointers, libc function pointers and code pointers, undermining ASLR, but exploitation is contingent on application-specific misuse of the API, so no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status is reported. Note that the official CVSS 4.0 score is 8.3 (AT:P reflects the buffer-must-exist precondition), while an independent assessment scored it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L, i.e. information disclosure with no integrity impact and only a low availability impact.
Server-side request forgery in Dify (LangGenius) before 1.13.0 allows unauthenticated remote attackers to make the Dify server fetch attacker-supplied URLs through the /console/api/remote-files/upload (POST) and /remote-files/<path:url> (GET) endpoints, turning the instance into a network pivot against internal services and cloud metadata endpoints. Rated CVSS 3.1 8.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L), the issue is unauthenticated by design - the fix adds @login_required - but practical exploitability is bounded by Dify's existing ssrf_proxy wrapper, which may filter internal or metadata targets depending on allowlist configuration. No public exploit code identified at time of analysis and no confirmed active exploitation; a vendor-released patch (1.13.0) is available.
Prototype pollution in `@graphql-tools/utils` `mergeDeep()` lets a remote, unauthenticated client submit a single aliased GraphQL query that overwrites inherited JavaScript built-ins such as `Function.prototype.call`, causing denial of service against the gateway or schema-stitching service until it is restarted. Only deployments built on @graphql-tools/utils <= 12.0.0 that actually merge objects returned from two subgraphs (the ordinary `@shareable` field or cross-subgraph entity case, e.g. Hive Gateway) invoke the vulnerable code path; single-subgraph servers are not affected. Both CVSS 4.0 (8.2, AV:N/AC:L/AT:P/PR:N/UI:N/VA:H) and the assessor's CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree on high availability impact with no confidentiality or integrity impact, and no public exploit code has been identified at time of analysis.
Atom table exhaustion in the Ash framework (Elixir) allows an unauthenticated remote attacker to crash a BEAM node by supplying filter values for a publicly filterable :atom-typed attribute that is declared with the unsafe_to_atom?: true constraint. Each distinct attacker-controlled string is interned with String.to_atom/1; atoms are never garbage collected and the VM's atom table is fixed in size, so a flood of distinct values exhausts the table and terminates the node. The condition is version- and configuration-dependent: ash from 3.5.1 before 3.34.3 is affected, unsafe_to_atom?: true is not the default, and the vulnerable path is only reachable through a filter interface the attacker can query - AshPaperTrail meets that bar out of the box because its version resources expose a public, filterable version_action_name atom attribute with unsafe_to_atom?: true. A vendor patch is available in 3.34.3 and no public exploit code was identified at time of analysis.
An authenticated attacker who knows a target workspace slug and project ID can hijack a pending project invitation in Plane versions prior to 1.4.0, because the project invitation list endpoint is readable by any authenticated user and the public join endpoint accepted an invite based only on a submitted email address with no token or identity check. If the outstanding invitation targets an email that has not yet registered, the attacker can register an account with that address without mailbox verification and be added to the target workspace and project, gaining confidentiality and integrity impact across a tenant boundary. The flaw (CWE-863) is rated CVSS 8.2 with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N; exploitation requires a low-privilege authenticated session and an outstanding invite for an unregistered address, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Vendor-released patch: 1.4.0.
Stored cross-site scripting in Ghost CMS versions 2.1.0 through 6.63.x allows an attacker-controlled website to inject untrusted script into post content through the editor's oEmbed embed feature. A staff user with post-creation rights must first embed a URL pointing at the malicious site, at which point the site's self-declared oEmbed endpoint can return a 'photo', 'rich', or 'video' response containing an attacker-supplied html field; that payload is stored in the post's Lexical content and then executes in the Ghost admin editor, on the published site, and inside newsletter emails, potentially compromising an administrator's session. No public exploit identified at time of analysis, and the issue is fixed in version 6.64.0.
Authenticated members of a Plane project - including users holding only the lowest GUEST role - can demote project Administrators and Members through the ProjectMemberViewSet.partial_update endpoint, stripping them of project control. The pre-1.3.0 authorization check only blocked assigning a role higher than the requester's own, so it silently allowed assigning a lower or equal role; the attacker cannot elevate themselves, but can degrade other members' access. The issue is fixed in Plane 1.3.0, and no public exploit code or confirmed active exploitation was identified at time of analysis (CVSS 8.1, EPSS not provided).
Plane's InstanceAdminSignUpEndpoint in versions 0.13 through pre-1.4.0 allows unauthenticated remote attackers to exploit a time-of-check time-of-use race during first-run setup and create a second instance administrator with full instance-admin authority alongside the legitimate operator. Exploitation requires that no instance administrator exists yet and that the attacker wins a concurrent-request race before the legitimate first admin is committed; after setup completes, the endpoint rejects new admins and the flaw is unreachable. No public exploit identified at time of analysis, and the risk is situational because the vulnerable window is brief and requires network reachability to the admin signup path.
Deactivated user accounts in Plane prior to 1.4.0 can still authenticate with existing credentials because the login flow does not reject inactive users and save_user_data() silently sets is_active back to True, reactivating the account without notifying administrators. This is an authenticated (CVSS PR:L) improper access control issue (CWE-284) requiring the attacker to possess valid, un-rotated credentials for an account that was deactivated via is_active=False rather than deleted; impact scales with the account's prior role, up to full workspace control if it was an Admin. No public exploit identified at time of analysis, no CISA KEV listing and no EPSS score were present in the provided intelligence; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1 High).
A malicious web page visited on a machine running Joplin Desktop with the opt-in Web Clipper server enabled can pair itself as a trusted client and obtain the permanent API token, yielding ongoing read and write access to the victim's notes, notebooks, tags, resources and master keys. The root cause (CWE-346) is that the pairing endpoints POST /auth and GET /auth/check respond with Access-Control-Allow-Origin: * and accept any http/https origin, while the desktop approval dialog fails to display the requesting origin, so a victim who approves a generic-looking prompt unknowingly authorizes the attacking page. Exploitation requires the Web Clipper server to be explicitly enabled (off by default), a browser context on the same machine, and the victim to approve the prompt; no public exploit identified at time of analysis. Vendor-released patch: 3.7.13.
Privilege escalation in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) lets a local low-privileged attacker replace one of the application's external helper executables with a different, validly signed binary that passes the product's weak publisher-name allow-list check, causing Fiddler to launch attacker-chosen code - including elevated (Administrator) execution for the helper tools that request elevation. Exploitation is local and authenticated (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 7.9), requires write access to the installed helper binaries, and is gated on a user launching the affected tool and approving the elevation prompt without noticing the executable name changed; it is not remotely or unauthenticated exploitable, and there is no public exploit identified at time of analysis. The authoritative assessment rates this a moderate, locally-exploitable privilege-escalation flaw rather than a drop-everything priority, with the UI:R requirement and the need for a pre-existing local foothold being the main limits on real-world abuse.