Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34 contain an authorization bypass in relationship queries that can expose protected document data. The vulnerability affects deployments where a readable collection has a relationship, upload, or join field pointing to a second collection whose read access is restricted via access.read where constraints; an unauthenticated attacker can use the 'contains' query operator to retrieve information about related documents that should be hidden. No public exploit identified at time of analysis. The vendor has released patches in 3.90.0 and 4.0.0-canary.34, and there is no complete workaround other than upgrading.
Unauthenticated attackers can forge payment-notification callbacks to the elegro Crypto Payment WordPress plugin (versions through 1.0.1) and arbitrarily change the status of orders on any installation where the shared secret has been left at its default empty value. No credentials, user interaction, or special network position are required against a vulnerable default-config site, and publicly available exploit code exists; however, the attack is fully neutralized once an administrator sets a non-empty shared secret, so only sites that never completed that configuration step are exposed. The independently assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) limits impact to integrity of order/payment state, with no confidentiality or availability effect, making this a moderate, conditional risk.
Insufficient access control in the @payloadcms/plugin-stripe package allows an authenticated Payload user to invoke unintended Stripe REST API operations through the optional /api/stripe/rest proxy, which in vulnerable releases was registered by default (rest defaulted to true). Only deployments that use the plugin, have the REST proxy reachable, and grant the attacker a valid authenticated account are affected; the impact is confined to Stripe API operations rather than host-level compromise, though it crosses a trust boundary into the connected Stripe account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but a vendor patch and a public GitHub advisory exist, so upgrading is the straightforward path. The vendor fix replaces the boolean toggle with an explicit allowlist of exact Stripe method names plus an optional access callback.
Open redirect in Payload CMS authentication flows lets an attacker craft a link that, once a guest user authenticates, forwards that user to an untrusted external destination. Affected packages are npm/payload from 3.40.0 up to (but excluding) 3.88.0 and the 4.0.0 canary line below 4.0.0-canary.27, plus the companion @payloadcms/next package (>= 3.31.0, < 3.88.0 and >= 4.0.0-canary.0, < 4.0.0-canary.27). Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) exploitation is unauthenticated but requires victim interaction, and it only succeeds on deployments that actually pass a user-controlled redirect value through their login or account-creation flow; there is no confirmed active exploitation and no public exploit identified at time of analysis.
Payload CMS (npm package `payload`) versions 3.0.0 through 3.89.x and 4.0.0-canary builds before canary.34 hash account passwords with a PBKDF2 work factor below current recommendations, so anyone who obtains a database dump or backup can test candidate passwords against the stored hashes at materially lower computational cost. The weakness sits behind stored credentials rather than in the request path: it cannot be triggered against a live instance, grants no authentication bypass, and requires the attacker to already have read access to the hash store. No public exploit code has been identified at time of analysis and there is no indication of active exploitation. Payload 3.90.0 and 4.0.0-canary.34 correct the parameters and transparently re-hash legacy credentials on the next successful login.
Missing authentication in the OSSRS SRS proxy System API (internal/proxy/api.go, function systemAPI.Run) lets remote unauthenticated attackers reach management/registration endpoints of the proxy component without presenting any credentials. The affected component is the newer SRS proxy mode in versions up to 7.0-a1; deployments that do not run the proxy component, or that keep its System API port off the network, are not exposed. Exploitation is practical - publicly available exploit code exists (CVSS 4.0 E:P) and the referenced issue #4690 documents the exposure - but this is a moderate-priority finding, not an inflated critical one, with limited per-CVSS confidentiality, integrity and availability impact (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 6.9 under CVSS 4.0). No CISA KEV entry or confirmed active exploitation is associated with this CVE at time of analysis.
Authentication bypass in SourceCodester Drug Recommendation System 1.0 lets remote, unauthenticated attackers impersonate arbitrary accounts by manipulating the user_id argument processed by the application's Auth Guard component. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no credentials, user interaction, or special configuration are required, so any network-reachable default installation is exposed; impact is bounded to LOW confidentiality, integrity, and availability (VC:L/VI:L/VA:L), limiting the attacker to unauthorized read/limited modification rather than full system compromise. Publicly available exploit code exists, including a detailed GitHub write-up of the broken access control issue, so exploitation is trivial for anyone who can reach the instance; the practical risk is tempered mainly by the product's very small real-world deployment footprint and the capped impact ratings.
Unauthenticated remote attackers can obtain sensitive information from Uptrace by triggering detailed error messages in the Login function of pkg/org/user_handler.go, a CWE-209 information-exposure flaw affecting builds up to and including 2.1.0-beta.8. Per the CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:L with no integrity or availability impact) and our independent assessment (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), exploitation requires only network reachability to the exposed login interface, with no authentication and no user interaction, and the resulting impact is limited to low-severity disclosure. Publicly available exploit code exists, and the vendor was reportedly notified through an issue report but has not yet responded, so no vendor-released patch has been identified at time of analysis; this is a genuine but modest-priority issue rather than a high-severity emergency, and the beta/pre-release nature of the affected versions narrows the exposed population.
SQL injection in the Employee Movement Tracking and Monitoring Website for IOCL (a PHP project published at github.com/bhagya3929) allows remote attackers to manipulate the Username argument of /admin_transaction.php and inject arbitrary SQL. Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N, E:P), no authentication or user interaction is required and publicly available exploit code exists, though the 'admin_' endpoint naming means defenders should verify whether the page is actually reachable pre-authentication. The impact is assessed as limited data confidentiality, integrity, and availability loss (VC:L/VI:L/VA:L), and practical priority is low because the project is a rolling-release hobby application with no packaged versions and a very small install base - exploitation depends on finding one of the few publicly reachable deployments. The maintainer was notified via a GitHub issue but has not responded, and no vendor-released patch has been identified.
Improper authorization in PickMall Lilishop 4.2.4 and earlier allows remote attackers to tamper with the mobile-number binding workflow at /buyer/passport/member/bindMobile by manipulating the Username argument, bypassing intended ownership checks (CWE-285). Publicly available exploit code exists but there is no confirmed active exploitation (not in CISA KEV). The vendor-assigned CVSS 4.0 base score is 5.5, while independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, noting that although the scored vector claims PR:N, the buyer/passport endpoint path strongly suggests a valid buyer session is realistically required to reach the vulnerable function, so the PR:N assumption should be verified against the application's authentication flow.
SQL injection in the KusalkaSilva Learning-Management-System's student registration endpoint (student_signup.php) allows unauthenticated remote attackers to manipulate database queries. Publicly available exploit code exists, though no active exploitation has been confirmed by CISA KEV. Affected deployments include all rolling-release versions up to commit ffeb873f8803f1e9664384ff75000c7da45466d2, and the vendor has not responded to the issue report.
On any WordPress site running the File Media Renamer plugin through version 1.3, an authenticated low-privilege user who holds file-upload capability - typically an Author, or a Contributor explicitly granted uploads - can rename media attachments that belong to other users, including administrators, because the plugin never checks whether the requester is authorised to modify the targeted attachment. Beyond the direct rename, the operation rewrites the stored file path while leaving other site data (post content and plugin metadata that referenced the original path) pointing at the old filename, producing broken images and corrupted references that persist until manually repaired. Publicly available exploit code exists, and while there is no confirmed active exploitation (no CISA KEV entry), the flaw is trivially reachable by anyone who can already upload files, with no victim interaction required. Independent assessment characterises this as a broken-access-control / IDOR problem rather than an authentication bypass: the attacker must already hold a valid account, so it is an insider or multi-author-site threat, not a remote-unauthenticated one.
Unauthenticated SQL injection in the KusalkaSilva Learning-Management-System admin login endpoint (admin/login.php) allows a remote attacker to manipulate the username and password parameters passed to mysql_query before any credential check is performed. The project is an unversioned, single-developer codebase with no packaged releases, so every deployment of the repository at or before commit ffeb873f8803f1e9664384ff75000c7da45466d2 is potentially affected, and because the injection sits in the pre-login path no authentication, user interaction, or special configuration is required (CVSS:4.0 PR:N/UI:N, assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N). A publicly available exploit code exists in the form of an issue report on the project's GitHub repository, but there is no confirmed active exploitation (CISA KEV) and the maintainer has not responded or issued a fix, so the practical risk is bounded mainly by how many instances expose this admin login to untrusted networks rather than by any technical bar to exploitation.
SQL injection in Kusalkasilva LMS permits remote, unauthenticated attackers to manipulate the username and password parameters at the login endpoint (login.php) and execute arbitrary SQL against the backend database. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the product is an obscure rolling-release GitHub project with no vendor-released patch. The project was notified via a GitHub issue but has not responded, making the practical risk modest due to very limited exposure rather than urgent.
Denial of service in LZ4 Java (lz4-java) prior to 1.11.4 allows unauthenticated remote attackers to exhaust memory and CPU by supplying a crafted LZ4 frame stream to net.jpountz.lz4.LZ4FrameInputStream in its default concatenated-frame mode; each minimal empty maximum-block-size frame forces readHeader() to allocate two 4 MiB block buffers (roughly 8 MiB per 11 input bytes) with no decompressed output, so decompressed-size limits do not mitigate the issue. The vulnerability is moderate severity (CVSS 5.3, A:L) and is fixed in 1.11.4; readSingleFrame mode is not affected, and no public exploit or KEV entry has been identified at time of analysis.
Unauthenticated information disclosure in the Slider Pro WordPress plugin (versions 0 through 1.0.0) allows any remote visitor to call an AJAX action that performs no capability or authorisation check, returning the titles, excerpts, permalinks and media metadata of non-public posts such as drafts, pending, scheduled, private and trashed items, plus post revisions. The exposure is confined to metadata rather than full post bodies, which keeps the confidentiality impact limited (CVSS 3.1 base 5.3, Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) with no integrity or availability effect. Publicly available exploit code exists, but CISA's SSVC assessment records no active exploitation and no KEV listing applies.
Order tampering in the Fast Courier WordPress plugin (versions through 5.2.3) lets unauthenticated attackers overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying the target order's ID to an unprotected REST route. The underlying defect is a missing authorization check (CWE-862) on the plugin's order-fulfillment endpoint, so remote attackers need no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3); the practical prerequisite is knowing or enumerating a valid WooCommerce order ID. Publicly available exploit code exists, as documented in the WPScan advisory, but there is no confirmed active exploitation according to available intelligence (no CISA KEV entry; SSVC exploitation: none), and impact is limited to the integrity of courier and tracking fields with no data disclosure, code execution, or availability loss.
Unauthenticated attackers can manipulate order states in the Deema Payment Gateway WordPress plugin (versions through 1.1.2) by exploiting a missing payment verification step in the hosted-checkout return handler, causing orders to be marked as paid without any actual payment. The plugin fails to confirm transaction status or amount with the payment provider, and publicly available exploit code exists. With a CVSS score of 5.3 (MEDIUM), the impact is limited to integrity of order data, with no confidentiality or availability effects.
Unauthenticated attackers can mark unpaid orders as paid or cancel/refund existing orders on WordPress sites running the Deema Payment Gateway plugin through version 1.1.2, because the plugin fails to verify the authenticity of incoming payment provider notifications and ships with that verification disabled by default. The flaw is remotely exploitable without authentication (CVSS 5.3, CWE-287) and affects order integrity only, with no server compromise or data disclosure. Publicly available exploit code exists, but CISA SSVC indicates no observed exploitation; this is a genuine but moderate-priority issue rather than a critical emergency, and it should be patched or mitigated promptly.
Authenticated (site-admin) users on MISP installations prior to commit 2ebf29f93 can repoint the application's Redis host settings for the core app, ZeroMQ plugin, and SimpleBackgroundJobs plugin to an attacker-controlled Redis server, because those settings are exposed through the web UI and API instead of being restricted to CLI configuration. Combined with a separate session-hijack primitive such as stored XSS, an attacker can then restart the background workers, which trust raw Redis job payloads without validation, and inject malicious jobs that execute with the privileges of the worker account - effectively remote code execution. Exploitation requires a hijacked site-admin session and an attacker-operated Redis instance, so it is a conditional rather than drop-everything risk; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed CVSS:3.1 vector is AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.
Unauthenticated information disclosure in the StylemixThemes Motors WordPress plugin (car dealership and classified-listings plugin, all versions through 1.4.124) allows any remote visitor to retrieve sensitive data that the plugin embeds into the responses it sends to clients - for example internal configuration values, tokens, or other embedded secrets surfaced in rendered pages or AJAX/REST output. The CVSS 4.0 base score of 6.9 reflects a network-reachable, no-privilege, no-user-interaction, no-configuration-dependency attack path where the only impact is low-sensitivity confidentiality loss (VC:L, with no integrity or availability effect and no subsequent-system impact). No public exploit code has been identified at time of analysis and the CVE is not associated with CISA KEV, so exploitation is not confirmed as active.
Denial of sign-in in Payload CMS before 3.90.0 (and canary releases before 4.0.0-canary.34) allows an unauthenticated remote attacker who already knows a valid account email address or username to deliberately trigger the account lockout mechanism of a local-authentication collection, preventing that specific user from logging in until the lock period expires. The flaw is rated CVSS 6.9 under CVSS 4.0 (independent assessment: CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N, availability-only impact) and requires no prior access, only knowledge of a valid identifier - arbitrary unknown accounts cannot be targeted and no data exposure, code execution, or persistence results. Vendor-released patch: 3.90.0 (canary 4.0.0-canary.34); no public exploit identified at time of analysis.
Session cookie and API token theft in NetBox versions 2.9.5 through 4.6.x lets an authenticated user holding the "Can add custom links" permission exfiltrate the credentials of higher-privileged users who merely view an affected object. The flaw exposes the raw Django HttpRequest object to the Jinja2 custom-link template context, so an attacker can embed request.COOKIES['sessionid'] or a victim's API token inside an <img src> URL that slips past the clean_html sanitizer and auto-transmits to an attacker-controlled host when a privileged user opens the page, enabling full account takeover. Exploitation is conditional: it requires a delegated custom-link permission (PR:L) and a privileged victim to passively trigger the payload (UI:P), and no public exploit has been identified at time of analysis; upgrading to NetBox 4.7.0, which substitutes a sanitized request subset, removes the exposure entirely.
Denial-of-service in ESET PROTECT On-Prem allows remote, unauthenticated attackers to exhaust CPU and RAM resources by sending crafted requests, leading to availability degradation. This moderate-severity issue affects the on-premises management console and requires network reachability to the server's listening service; no public exploit code has been identified, and a vendor patch is available per the ESET advisory. The CVSS 4.0 base score is 6.9, but our independent assessment rates it as a moderate availability-only risk (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Remote SQL injection in SourceCodester Simple Student Information System 1.0 via searchquery.php allows attackers to manipulate database queries and potentially read or alter application data, and the independent assessment rates this as a low-to-moderate real-world risk despite the network-reachable vector. The assessed CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, while the CVSS v4.0 score is 6.9; the PR:N/UI:N values indicate unauthenticated exploitation with no user interaction, but the search endpoint may sit behind an application login in common deployments, so defenders should confirm whether searchquery.php is reachable pre-authentication. No public exploit was identified at time of analysis.
LDAP query injection in Arista CloudVision CUE (versions 2021.2.0 through 2026.2.0) lets an unauthenticated network attacker manipulate directory-service queries when the appliance is configured to authenticate against an external LDAP directory. Exploitation is gated by high attack complexity (CVSS AC:H), meaning the attacker must land on specific conditions largely outside their control - such as a particular directory schema or query-construction path - and the resulting impact is confined to the confidentiality of the downstream directory service (scope-changed C:H), with no direct confidentiality, integrity, or availability effect on CloudVision CUE itself. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); EPSS data was not provided, and the issue should be treated as a moderate-priority hardening item rather than an emergency.
WordPress through version 7.1.2 contains an information disclosure flaw (CWE-201) that allows unauthenticated remote attackers to retrieve embedded sensitive data from server responses. The vulnerability, reported by Patchstack, has a CVSS 4.0 base score of 6.9, reflecting high exploitability but low confidentiality impact; no public exploit identified at time of analysis. The affected version 7.1.2 does not match any known public WordPress core release, so the actual vulnerable scope may be narrower or misreported.
Payload CMS versions prior to 3.88.0 and canary builds prior to 4.0.0-canary.27 allow unauthenticated remote attackers to infer limited information about field values they are not permitted to read, by supplying a protected field name as the sort parameter on a collection they can query. The disclosure is indirect - the attacker learns partial information from result ordering rather than reading raw values - and exploitation requires a specific alignment of conditions (readable collection, attacker-controlled sort, and a field-level-protected sort key), which is why the assessed severity is limited (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:L/I:N/A:N) despite the vendor-published CVSS 4.0 score of 6.9. There is no public exploit code and no confirmed active exploitation (no CISA KEV listing) at time of analysis; vendor patches are available in 3.88.0 and 4.0.0-canary.27, making this a routine low-urgency update rather than an emergency.
Missing authorization in the Mooncake Store master (through 0.3.13.post1) lets unauthenticated remote attackers inject completed LOCAL_DISK replicas via the NotifyOffloadSuccess RPC, poisoning disk-tier cache reads and forging key existence. An attacker mounts a local disk segment with a self-chosen client UUID and attaches replicas pointing at attacker-controlled endpoints, degrading integrity and availability of cached data without exposing confidentiality or compromising the host, consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. No public exploit code was identified at time of analysis, and real-world risk depends heavily on whether the master RPC endpoint is reachable beyond a trusted internal network.
Unauthenticated attackers who can reach the Mooncake Store master's coro_rpc port can hijack replication task queues in Mooncake Store master builds through 0.3.13.post1, creating, stealing, and falsely completing replication tasks on behalf of arbitrary victim clients. The affected master RPC handlers (CreateCopyTask, CreateMoveTask, FetchTasks, MarkTaskToComplete) perform no ownership or authorization checks (CWE-862), and the QueryTask RPC discloses the victim client UUIDs needed to target a specific queue, so no credentials, prior knowledge, or user interaction are required. Impact is bounded to integrity and availability (CVSS 4.0 base 6.9; independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, medium severity) - replication bookkeeping can be corrupted and real replication skipped, but confidentiality is unaffected; no public exploit code or CISA KEV listing was identified at time of analysis, and the practical limiting factor is whether the coro_rpc port is exposed beyond localhost or a trusted network boundary.
Server-side request forgery (SSRF) in Django's GeoDjango spatial lookups allows remote unauthenticated attackers to make the Django process issue outbound network requests when an application passes attacker-controlled `bytes` raster values directly into a lookup against a `RasterField`. Affected versions are Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18; older unsupported series (5.1.x, 5.0.x, 4.2.x) were not evaluated and may also be affected. The flaw is an incomplete fix for CVE-2026-15307, and exploitation requires a deployment that uses GeoDjango raster fields and forwards raw untrusted bytes into spatial lookups - not a default Django configuration. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; Django rates it 'moderate' severity (CVSS 5.3), with impact limited to attacker-directed outbound requests rather than data compromise or code execution.
Quadratic-time parsing of quoted HTTP header parameters in Django 5.2 (before 5.2.18), 6.0 (before 6.0.9), and 6.1 (before 6.1.2) allows unauthenticated remote clients to consume disproportionate CPU by supplying a header value containing many separator characters inside a quoted parameter, potentially degrading or exhausting worker capacity. The vulnerable code path is reached by default through content negotiation such as HttpRequest.accepts() and Accept/Content-Type header handling, and the existing per-call length limit does not bound the combined size of repeated headers, so an attacker can amplify the cost across many headers in a single request. Impact is availability-only (CVSS 5.3, A:L, CWE-407); vendor patches are available in Django 6.1.2, 6.0.9, and 5.2.18, and no public exploit code was identified at time of analysis.
Remote denial-of-service in the Django web framework's language-negotiation helper django.utils.translation.get_supported_language_variant(), which caches attacker-supplied language codes as keys in an in-memory LRU cache before enforcing a length limit. An unauthenticated remote attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) who can influence the negotiated language - typically via the Accept-Language header, a language URL prefix, or LocaleMiddleware - can send many distinct, very long language codes so that each becomes a unique cache entry and steadily consumes process memory, degrading or exhausting the application worker. Affected are Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18; unsupported earlier series such as 5.1.x, 5.0.x, and 4.2.x were not evaluated and may also be affected. Impact is limited to availability (A:L) and requires sustained request volume rather than a single request, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Improper authentication in the Backstage @backstage/plugin-auth-node package (versions 0.3.0 through 0.6.14 and 0.7.x before 0.7.5) lets an already-admitted identity-provider user assume another catalog user's identity and inherit its access and permissions. The flaw is conditional and rated CVSS 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N): it only triggers when a deployment uses an email-based sign-in resolver that derives catalog identity from the selected profile email AND that email carries an explicit negative verification flag (profile email verified:false, a matching raw provider email_verified:false, or an ID-token-only email with email_verified:false) - an absent email_verified claim alone is not affected. Vendor-released patches exist in 0.6.15 and 0.7.5 (Backstage releases v1.49.7 and v1.54.7), and no public exploit or confirmed active exploitation was identified at time of analysis.
Access control bypass in SSSD when configured with non-default ordering that evaluates password-expiration warnings before restrictive access rules allows remote authenticated users with expired passwords to gain unauthorized access to protected systems via alternative authentication methods such as SSH public key authentication. This flaw (CWE-393) affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 deployments using LDAP access control. Exploitation requires a specific non-default configuration, an expired password, and a non-password authentication path, making it a moderate conditional risk; no public exploit identified at time of analysis.
TP-Link Tapo C500 v2.0 cameras with the ONVIF PTZ interface enabled are vulnerable to an out-of-bounds stack write (CWE-121) that can be triggered by an authenticated ONVIF client sending an excessive number of preset-related elements to the PTZ SOAP handlers, resulting in a service crash and denial-of-service. Exploitation requires valid ONVIF credentials and adjacency to the camera's network (CVSS 4.0: 6.8, AV:A/PR:H), and while the attacker cannot execute code or access data, repeated crashes can disrupt camera management and PTZ functionality until the service restarts. TP-Link has released a firmware patch, and no public exploit code has been identified at time of analysis.
Account takeover in Devolutions Server 2026.3.7.0 and earlier is possible through the Azure AD external login flow: an attacker positioned on an adjacent network segment (AV:A) can capture a login-session token that is exposed in the OAuth redirect URL and replay it to hijack the victim's account. Exploitation is limited to deployments where Azure AD external login is actually configured, and it requires intercepting a live, still-valid token during a genuine user login (AC:H), though no victim interaction with the attacker is needed (UI:N, PR:N). Independent signals are currently low - no public exploit identified at time of analysis, not listed in CISA KEV, EPSS 0.22% (11th percentile), and CISA SSVC records Exploitation: none and Automatable: no - but the vendor has released a patch and SSVC rates technical impact as total, so this is a genuine, moderate-priority issue rather than a top-tier emergency.
Heap-based buffer over-read in the HDF5 library's scale-offset filter decoder (H5Z__filter_scaleoffset) allows a local, unauthenticated attacker to cause a denial of service by supplying a crafted HDF5 file that a victim opens. The flaw occurs when the filter's stored minimum-bits parameter equals the datatype's full precision and the decoder attempts to copy d_nelmts * size bytes from a compressed chunk that is too short, triggering an out-of-bounds read and application crash. The vendor CVSS 4.0 vector (6.8 Medium) rates this as an availability-only impact with no confidentiality or integrity effect; no public exploit code has been identified, and the fix is available as an upstream pull request but not yet confirmed in a tagged release.
An out-of-bounds write in the Android kernel's Wacom HID driver (wacom_hid_set_device_mode in wacom_sys.c) lets an attacker who can physically attach or emulate a malicious Wacom HID peripheral corrupt kernel memory and escalate privileges on the affected device. No authentication or user interaction is required once the peripheral is connected, because the crafted report reaches the driver's missing bounds check directly; the CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms a physical-access-only attack path with high confidentiality, integrity, and availability impact. Only Pixel/Android kernel builds that include and exercise the Wacom HID driver are affected, and there is no public exploit identified at time of analysis; CISA SSVC rates exploitation as none and automatable as no, so the practical risk is bounded by the strict physical-access requirement and the inability to exploit this remotely or at scale.
Account takeover is possible in Devolutions Server 2026.3.7.0 and earlier through an authentication bypass in the OAuth device authorization (device code) flow, in which a captured device verification link can be replayed to bind an attacker-controlled client to a victim's account. The flaw is rated 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N): the attacker needs no credentials, but must first obtain a valid, still-replayable verification link and then rely on an already-authenticated victim interacting with it, which keeps attack complexity high and exploitation dependent on user behavior. Exploitation has not been observed (CISA SSVC reports Exploitation: none, Automatable: no) and no public exploit identified at time of analysis; Devolutions has released a fix in Server 2026.3.8.
A heap out-of-bounds read in the Impulse Tracker loader of libmikmod before 3.3.14 lets a crafted .it module drive the parser past its pattern buffer, crashing the host application. Any program statically or dynamically linking the vulnerable library - classic MikMod-based players, games, and media tools - is exposed when it opens an untrusted module. The trigger is an oversized pattern of more than 200 rows, which overruns the hardcoded itpat allocation (200*64 ITNOTE entries) and causes IT_ConvertTrack() to read adjacent heap memory. The assessed impact is availability only (AV:L, UI:P, A:H) with no confidentiality or integrity loss, so there is no public exploit identified at time of analysis; the practical risk is a local denial of service against applications that parse attacker-supplied tracker files.
OS command execution on Dbit WIFI4 N300 1.0.0 routers is achievable by feeding an oversized 'comment' value to the authenticated /api/addStaticDHCP endpoint, which overflows a fixed-size stack buffer in the device's web management daemon and lets the caller pivot from web administrator to a shell on the underlying operating system. The practical barrier is high: the CVSS 3.1 vector (AV:A/PR:H per the independent assessment, versus the vendor-published AV:L/PR:H base of 6.7) means an attacker must already hold valid administrator credentials and be able to reach the device from the local Wi-Fi network - there is no unauthenticated remote path, and no user interaction is required once those preconditions are met. Exploitation status is low-signal: there is no CISA KEV listing and no confirmed in-the-wild activity, though a Klogix Security (Scorpion Labs) technical blog walks through the exploitation chain end-to-end, and EPSS is only 0.22% (12th percentile), underscoring that this is a high-CVSS-but-low-real-world-priority issue.
A use-after-free (CWE-416) in Qualcomm Snapdragon's DMA buffer management allows a local attacker with low privileges to corrupt kernel memory by triggering a race condition between concurrent DMA buffer allocation and deallocation, potentially leading to code execution or privilege escalation. The vulnerability is not remotely exploitable and requires winning a timing window (AC:H). No public exploit code or active exploitation has been identified at time of analysis; the vendor rates the required privileges as high (PR:H), but independent assessment indicates low privileges (PR:L) may be sufficient.
Memory corruption in the Qualcomm Snapdragon camera driver path that handles operations during driver updates allows a locally positioned attacker who already holds high privileges to trigger an out-of-bounds write (CWE-787) and corrupt memory, with the potential for high confidentiality, integrity, and availability impact on the affected device. Rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), this is a moderate-severity local privilege/memory-corruption issue rather than an internet-facing emergency; there is no public exploit identified at time of analysis and no CISA KEV listing, and exploitation is gated by the strict prerequisites of local access plus pre-existing elevated privileges and a driver-update code path. Exact affected chipset families and driver configurations are not enumerated in the available data, so Qualcomm's October 2026 security bulletin should be treated as the authoritative scope statement.
Local attackers with high privileges can trigger an out-of-bounds write in the Qualcomm Snapdragon camera CRE (Camera Request Engine) driver, causing memory corruption during hardware update preparation. Tracked as CVE-2026-25272, the flaw requires local access and elevated permissions (PR:H) to invoke the vulnerable driver operation, but successful exploitation yields high confidentiality, integrity, and availability impact confined to the affected device subsystem (scope unchanged). No public exploit code or confirmed active exploitation has been identified at time of analysis.
Out-of-bounds write in the Qualcomm Snapdragon Android Camera driver allows a locally privileged process to corrupt memory by submitting command buffer requests carrying invalid length parameters, potentially achieving code execution or memory corruption within the driver's execution context on affected devices. Because the CVSS vector is AV:L/PR:H/UI:N, exploitation requires local access and an already-privileged process capable of reaching the camera driver interface, making this realistically a post-compromise privilege-escalation primitive rather than an initial-access vector; no public exploit identified at time of analysis. The CPE entry (cpe:2.3:a:qualcomm,_inc.:snapdragon:*) carries no version constraint, so the exact affected chipset and firmware coverage must be resolved from Qualcomm's October 2026 security bulletin.
Memory corruption in the Qualcomm Snapdragon camera subsystem can be triggered by processing camera requests with excessive batch and IO buffer configurations that exceed allocated memory, resulting in an out-of-bounds write (CWE-787). All versions of Qualcomm Snapdragon platforms are affected according to the vendor CPE. Exploitation requires local access with high privileges (PR:H) and cannot be triggered remotely; no public exploit code or active exploitation has been identified at time of analysis, making this a moderate-priority issue for systems where an attacker already has privileged on-device code execution.
Local privilege escalation in ClearPass OnGuard allows an authenticated local user to write arbitrary files and potentially execute code with elevated privileges, but only when unspecified preconditions outside the attacker's control are met. The vulnerability requires user interaction and is high-complexity (AC:H), limiting practical exploitability to hosts where the OnGuard agent is deployed and those environmental conditions already exist. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue is assessed as moderate and defense-in-depth-tier.
Local privilege escalation in the Aruba/HPE ClearPass client software lets a low-privileged local user execute commands with elevated privileges on the affected host, but only when a specific environmental precondition that the vendor describes as being outside the attacker's control is satisfied. The assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, score 6.7) confirms that exploitation requires an interactive local session with an existing low-privileged account plus user interaction, meaning there is no remote or unauthenticated attack path and the attacker cannot deterministically force the triggering condition. There is no public exploit identified at time of analysis, no CISA KEV listing, and no evidence of active exploitation; the practical risk is moderate and bounded by these prerequisites rather than by remote reachability.
Local privilege escalation in Google Android's platform message handler lets an actor who already holds System-level execution privileges bypass a missing permission check in platform_msg_handler_init (default_msg_handlers.c) and obtain high-impact control over confidentiality, integrity, and availability on the device. Rated CVSS 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), the issue requires local access and a pre-existing high privilege level, making it an authorization-boundary bypass for an already-privileged local actor rather than a path to initial device compromise. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, while a vendor fix is published in the October 2026 Android Security Bulletin.