An out-of-bounds write in Oracle VM VirtualBox before 7.2.8 lets a user with a foothold inside a guest VM corrupt memory in the host-side hypervisor process through the emulated PCNet (Am79C970A) network adapter. The flaw sits in pcnetReceiveNoSync in DevPCNet.cpp, and because the write crosses the guest-to-host boundary it can lead to host memory corruption and potential code execution in the VirtualBox process, though integrity and availability impacts are the primary outcomes. Exposure is materially narrower than the vendor-supplied 9.1 network-vector score implies: the vulnerable code path is only reachable when the VM is explicitly configured with the legacy PCNet NIC rather than VirtualBox's modern Intel PRO/1000 or virtio-net defaults, and the attacker must already have local user-level access in the guest. No public exploit has been identified at time of analysis, SSVC records exploitation as none, and there is no CISA KEV listing.
Memory corruption in the wired-uplink network endpoints of Arista Wi-Fi access points lets an unauthenticated attacker who already sits on the same Layer-2 segment as the AP's wired uplink crash the sensor service and, under specific preconditions, potentially achieve remote code execution. No authentication or user interaction is required, but the vulnerability is scored adjacent-network (AV:A) with an explicit attack precondition (AT:P in the CVSS 4.0 vector), so the dependable outcome is a denial-of-service crash of the sensor service while full code execution is condition-dependent; no public exploit code has been identified at time of analysis. Because exploitation demands Layer-2 adjacency to the uplink segment, segmentation of management/uplink VLANs is the single most effective exposure reducer.
Missing authorization in the PowerMax CSI Driver's csireverseproxy component of Dell Container Storage Modules before 1.18.0 allows unauthenticated attackers with adjacent-network access to perform unauthorized actions, with high confidentiality, integrity, and availability impact in a changed-scope CVSS 9.6 scenario. The flaw is only reachable from the cluster or storage-management network, not the public internet, and requires the PowerMax CSI driver to be deployed and network-exposed. No public exploit was identified at time of analysis and EPSS is low at 0.23% (13th percentile), while a vendor patch is available in 1.18.0.