Cross-origin credential leakage in the Mechanize Ruby library (versions prior to 2.14.1) allows attackers who control a redirect target to capture bearer tokens, session cookies, Proxy-Authorization credentials, or Cookie2 values that the calling application supplied through Mechanize#request_headers= or the per-request headers argument. The flaw is conditional: it only triggers when an application actually sets credentials via those header APIs and a response issues a cross-origin HTTP redirect (or a cross-origin meta refresh), so same-origin redirects are unaffected and credentials managed through Mechanize#cookie_jar or Mechanize::HTTP::AuthStore are explicitly out of scope; there is no public exploit identified at time of analysis. Because the attacker must influence the redirect destination rather than merely reach the service, this is a genuine but conditional information-disclosure issue (CWE-200) rather than a mass-exploitation priority.
Credential leakage in the Ruby Mechanize library before 2.14.1 lets an attacker who controls page content encountered during a crawl capture bearer tokens or session cookies, because a cross-origin meta refresh caused Mechanize::HTTP::Agent#response_follow_meta_refresh to reapply the caller's global default headers to the refresh request. Exploitation is conditional and rated AC:H: Mechanize#follow_meta_refresh must be explicitly enabled (it defaults to false), the caller must have placed sensitive credentials in the agent-wide default headers via Mechanize#request_headers=, and the attacker must be able to serve attacker-controlled markup to the crawl, though the request itself is unauthenticated (PR:N) and requires no user interaction (UI:N). There is no KEV entry, no public exploit identified at time of analysis, and no EPSS score supplied; the vendor-released fix is Mechanize 2.14.1, where cross-origin meta refreshes now discard credential and cookie headers under the same origin rules as HTTP redirects.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victim's balance in the Wallet System for WooCommerce plugin (versions before 2.8.0) by exploiting a failure to validate positive transfer amounts and a stale balance snapshot. Publicly available exploit code exists, and the flaw rates 6.5 on CVSS with high integrity impact but no confidentiality or availability impact. Sites with real monetary value in wallets are at risk, though exploitation requires an attacker account (obtainable via open registration).
Missing output encoding in AdonisJS HTTP Server's shared createURL() helper allows an attacker-influenced first route parameter (or wildcard segment) to escape the application's origin and produce a scheme-relative redirect target, enabling open-redirect phishing and OAuth/authentication flow abuse. Only applications running versions prior to 8.2.3 (v8 line) or 9.3.0 (v9 line) are affected, and exploitation is conditional: the app must place untrusted data in a leading dynamic path segment, generate the URL through Router.makeUrl()/urlFor() or Response.redirect().toRoute(), and use that string as a redirect destination - a victim still has to follow the crafted link (UI:R, CVSS 6.1). No public exploit code and no confirmed active exploitation were identified at time of analysis, and APIs that intentionally accept complete redirect URLs are explicitly not affected.
fast-jwt through 6.2.4 silently accepts expired and not-yet-active JSON Web Tokens when a verifier is constructed with clockTolerance set to Infinity, because the option validation only checks that the value is a number and non-negative rather than finite. The precondition is privileged and non-default: an application administrator or anyone controlling the verifier's configuration must explicitly set that value, which is why the assessed vector carries PR:H and the score remains moderate at 5.9; default configurations are unaffected. A secondary effect is that the verifier's internal LRU cache derives infinite validity bounds, so cached decisions made under the misconfiguration persist even after the Infinity setting is removed, until cache eviction. No active exploitation is recorded (not in CISA KEV), but publicly available exploit code exists in the upstream advisory, which demonstrates both the exp and nbf bypass empirically.
A heap-based buffer overflow in the PNG metadata reader of Eye of GNOME (eog) allows an attacker to potentially achieve arbitrary code execution or cause a denial of service (application crash) when a user opens a specially crafted PNG file. Exploitation requires user interaction and local access, but the vulnerability is unauthenticated (no privileges required) according to the CVSS vector PR:N. No public exploit code or confirmed active exploitation has been identified at time of analysis; the risk is constrained by the need for a user to open the malicious file on a system with eog installed.
Stump through 0.1.10 allows any authenticated user with the shared AccessSmartList permission to overwrite, delete, or take over other users' smart lists via vulnerable GraphQL mutations. The updateSmartList and deleteSmartList mutations lack a creator check, enabling attackers to set themselves as the new creator and change list visibility to PRIVATE, locking out the original owner. Publicly available exploit code exists, but exploitation requires a multi-user Stump instance and low-privileged credentials, limiting impact to insiders or compromised accounts.
Stored cross-site scripting in Indico before 3.3.13 lets authenticated users with content-creation privileges - event managers, submitters, and speakers who can upload material or edit minutes - store crafted javascript: URLs and unsanitized HTML in fields that accept custom links, including attachment link URLs, event layout/menu links, and event notes. When another user clicks one of these stored links, the attacker's script runs in the victim's browser within the Indico origin, enabling session-riding or data disclosure in the application context. The issue is rated CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that it requires a privileged event role plus victim click-through rather than unauthenticated access; no public exploit code has been identified at time of analysis, and the vendor notes the practical risk is relatively low because of these preconditions.
An authentication bypass in EspoCRM versions before 10.0.6 allows an attacker who already possesses a valid username and password for a two-factor-enabled account to stop at the second-factor prompt and still reach routes that do not enforce full authentication, exposing configuration parameters that are not otherwise publicly available. The CVSS vector carries PR:L, confirming the attack presupposes previously obtained first-factor credentials, so it provides no initial access on its own and the demonstrated impact is read-only confidentiality loss with no write, code execution, or account takeover. Publicly available exploit code exists and the vendor has released EspoCRM 10.0.6 as the fix, while CISA's SSVC assessment rates exploitation as none and the vulnerability as not automatable, consistent with a medium-severity issue that is not urgent in the absence of prior credential compromise.
Stored HTML injection in EspoCRM before 10.0.6 allows unauthenticated attackers to plant arbitrary markup through the public Lead Capture form, which is persisted in LeadCaptureLogRecord.data and rendered unescaped when an administrator later opens the log record in the admin UI; the practical impact is limited to content and interface spoofing because the application's Content Security Policy blocks JavaScript execution, preventing classic script-based XSS or session theft. Exploitation requires the Lead Capture public form to be enabled and externally reachable, and the payload stays inert until a privileged administrator views the affected entry, so there is no immediate attacker-controlled trigger. Vendor-released patch 10.0.6 is available, publicly available exploit code exists, and no active exploitation has been confirmed (CISA KEV). The independently assessed severity is low-to-moderate (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), consistent with the limited integrity-only, interaction-gated impact.
Unauthenticated attackers can bypass disabled user registration in Easy Digital Downloads WordPress plugin versions before 3.7.1 to create a WordPress account and obtain a logged-in session, with the new user assigned the site's default role. Publicly available exploit code exists, and the independent assessment rates this as a moderate-priority issue (CVSS 5.3) rather than a critical emergency, because the impact is largely determined by the default role-typically a low-privilege Subscriber. Sites that rely on disabled registration for protection are directly exposed, while those with registration already enabled see little added risk.
Unauthenticated account creation in the TutorStarter WordPress theme (all versions before 4.0.4) allows any remote visitor to create a WordPress user account through the theme's AJAX registration handler even when the site has disabled user registration. The flaw bypasses the users_can_register setting administrators rely on as a safety control, but created accounts receive WordPress's default registration role, typically a low-privilege Subscriber, with no confidentiality or availability impact (CVSS 5.3, PR:N per the assessed vector). Publicly available exploit code exists and the WPScan advisory documents the vector, but there is no confirmed active exploitation (not in CISA KEV); exposure lasts only while an affected theme version is active. This is a low-to-moderate priority issue despite its network/unauthenticated profile.
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 accepts forged payment notifications and marks orders as paid when no webhook secret has been configured, allowing unauthenticated remote attackers to obtain goods or services without completing payment. The flaw is a business-logic integrity issue rather than a system-compromise bug: CVSS 3.1 scores it 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), with impact limited to falsified order/payment state. It is exploitable only on stores that have left the webhook secret empty, and publicly available exploit code exists (WPScan); there is no evidence of confirmed active exploitation in the wild.
Stored cross-site scripting in Indico event management system before 3.3.13 lets authenticated users with content-creation privileges, such as speakers who can create minutes, store crafted HTML in event minutes. The script executes in a victim's browser only when a second privileged user makes concurrent edits to the same minutes, triggering the minute editor's conflict-resolution UI that renders the unsanitized payload. No public exploit has been identified at time of analysis, and the vendor rated the risk as relatively low due to the collaboration and privilege prerequisites.
Spoofing of trusted event sources in Microsoft Azure Event Grid is possible because the service fails to enforce an authorization check on event publishing and routing operations (CWE-862). Exploitation requires the attacker to already hold a valid, low-privilege identity in the Azure environment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), so this is not a remote-unauthenticated attack: an authorized principal who can reach the Event Grid endpoint over the network can push events across an authorization boundary they should not cross, undermining the integrity of event-driven workflows. Impact is integrity-only with no confidentiality or availability loss, scope is assessed as changed, no public exploit code has been identified at time of analysis, and because Event Grid is a Microsoft-managed cloud service the fix is applied server-side by the vendor rather than by customers themselves.
An authenticated user with Viewer privileges can exploit a relative path traversal flaw in the data import functionality of Satel Netco Design versions prior to v2.1.7 to probe file paths outside the intended import directory and use application responses as an existence oracle for files on the host system. The vulnerability is network-reachable (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N) but requires valid low-privilege credentials, and its impact is confined to low confidentiality loss via file-existence inference; it does not disclose file contents, allow writes, or enable code execution. No public exploit identified at time of analysis.
Denial of service in MIT Kerberos KDCs (krb5 through 1.22.2) lets a malicious or compromised cross-realm trusted KDC crash krb5kdc by sending an S4U2Proxy request whose PAC carries a malformed client name, interrupting authentication for the affected realm until the daemon restarts. The root cause is a NULL pointer dereference (CWE-476) in get_pac_princ_with_realm(), which reports success while leaving the client principal NULL for malformed names. Exploitation is gated by a significant prerequisite - the victim realm must have a cross-realm trust and the attacker must control or have compromised the KDC in that trusted foreign realm (PR:H in both the CVSS 4.0 and independently assessed CVSS 3.1 vectors) - so single-realm deployments without trusts are not exposed; no public exploit was identified at time of analysis and the issue is not listed in CISA KEV.
Missing rate limiting in Jivejdon's unauthenticated /account/smsVRAction endpoint allows remote attackers to send unlimited SMS messages to arbitrary phone numbers, leading to harassment and depletion of the operator's Tencent Cloud SMS balance. Affected commits range from e0306088 through ee67a65e, and exploitation requires the instance to have Tencent Cloud SMS integration configured and funded; attackers must first load newAccount.jsp to set session attributes before repeatedly calling the endpoint. No public exploit code or active exploitation has been identified, and this is assessed as a medium-severity resource and financial abuse issue rather than a high-priority emergency.
Frappe Cloud and ERPNext fail to properly validate the email field in the self-service registration endpoint /api/method/press.api.account.signup, allowing unauthenticated remote attackers to supply multiple email addresses and have the OTP code delivered to all of them as long as one address is valid. This can lead to OTP interception, impersonation during registration, creation of accounts using other people's email addresses without mailbox access, and indirect confirmation of already registered emails. The issue is rated moderate (CVSS 4.0 6.9, CVSS 3.1 6.9 with low confidentiality and integrity impact); no public exploit identified at time of analysis, and impact is limited to deployments that expose open self-service signup.
SQL injection in Jivejdon through 5.0 allows an authenticated user with the Admin role to read arbitrary database contents, including other accounts' password hashes, by submitting a crafted username to the /admin/user/userListAction endpoint (AccountDaoSql.getAccountByNameLike()). The CVSS 4.0 vector (PR:H) confirms this is not reachable by anonymous or low-privilege users, so the practical risk is insider abuse or post-compromise credential harvesting rather than broad exploitation. No public exploit code or CISA KEV entry is identified in the provided data, and the assessed impact is confidentiality-only (database read; no integrity or availability effect).
Authentication bypass in Jivejdon through 5.0 allows remote attackers to log in as any user whose account was created through the Sina Weibo OAuth flow, because OAuthAccountServiceImp.transferSina() and the SinaUserCallBackAction callback assign those accounts a password made up of the first four digits of the user's public Weibo ID. Since the Weibo ID is publicly visible, an unauthenticated attacker who knows or enumerates a victim's ID can submit that four-digit value through the ordinary form login and then read or post content as the victim (limited confidentiality and integrity impact). No public exploit code was identified and the CVE is not listed in CISA KEV, so exploitation is currently a design-flaw/credential-prediction risk rather than a confirmed actively exploited campaign; only accounts provisioned via the Weibo integration are exposed, not accounts created by other means.
Improper neutralization of CRLF sequences in the Federated Authentication (FA) configuration of Brocade Fabric OS before 10.0.1 lets an authenticated administrator - or anyone able to supply a crafted FA configuration file that an operator imports - inject arbitrary web server directives through the Identity Provider (IdP) issuer parameter, which can prevent the web management daemon from starting (denial of service) or alter web server security controls. Exploitation is heavily constrained: the target must run a vulnerable Fabric OS release with FA actually in use, the attacker needs administrative privilege (CVSS PR:H) and adjacent-network access to the management interface (AV:A), with no user interaction otherwise required, and no public exploit code has been identified at time of analysis. This is a medium-severity, operator-dependent flaw rather than a top-priority emergency, and it is not confirmed actively exploited (CISA KEV).
An authorization-logic bypass in the Brocade Fabric OS web management framework (all versions before 10.0.1) allows an authenticated, low-privileged user to circumvent inner Role-Based Access Control checks and lower the authorization mode of their active session, gaining access to configuration settings reserved for administrative roles. Exploitation is not trivial: it requires a valid low-privileged account, adjacent-network (management-plane) access, a vulnerable Fabric OS build, and the additional environmental conditions the vendor cites as the trigger; the weakness affects integrity only and does not by itself yield code execution or data disclosure. This is a MEDIUM-severity issue (vendor CVSS 4.0 base 6.9; independent CVSS 3.1 assessment AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) and no public exploit code or confirmed active exploitation was identified at time of analysis.
An authenticated path traversal (CWE-22) in the Zone Alias Import flow of Brocade SANnav before 3.0.0a allows an attacker who already holds valid SANnav credentials to write uploaded content outside the intended upload directory, corrupting or planting files on the management host. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confines impact to integrity only, with no confidentiality or availability effect and no user interaction required; per the vendor's CVSS 4.0 vector the attack surface is the management interface reached from an adjacent network segment. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is a moderate-risk, authenticated file-write issue rather than a top-priority emergency.
Denial of service in Brocade Fabric OS before 10.0.1: an authenticated user holding administrative privileges on the switch can crash the diagnostic execution utility by passing a diagnostic command string containing an excessive number of tokenized arguments, which overflows a fixed-capacity argument array on the stack and terminates the process. The issue is reachable only from an adjacent network position such as the management LAN (AV:A) and requires pre-existing admin credentials (PR:H, no user interaction), so it is a medium-severity availability problem for already-privileged operators rather than a remote, unauthenticated compromise path; confidentiality and integrity of the device are unaffected, with the availability impact rated High. No CISA KEV entry or publicly available exploit code was identified, and no public exploit identified at time of analysis; EPSS data was not provided in the available intelligence.
Stack buffer overflow in Brocade Fabric OS WebTools administrative interface allows an authenticated user with permissions to perform configuration downloads using remote server profiles to crash the weblinker daemon, resulting in a privileged denial of service. Affected versions are Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. Exploitation requires adjacent network access (AV:A) and high privileges (PR:H); no public exploit code has been identified at time of analysis.
Denial of service in Dislocker through 0.7.3 is triggered when the tool parses a crafted BitLocker volume image whose VMK or FVEK datum declares a datum_size smaller than the 36-byte AES-CCM header it must contain, causing an integer underflow that yields a near-4GB payload length and sends hexdump() into an out-of-bounds heap read that crashes the process. Exploitation is local and requires user interaction: a victim must actively point dislocker at the attacker-supplied image, which matches the assessed vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, unauthenticated but victim-driven. Impact is availability only - there is no memory corruption of confidentiality or integrity consequence described, no public exploit identified at time of analysis, and the defect is not listed as confirmed actively exploited (CISA KEV).
Denial of service and heap memory disclosure in Dislocker 0.7.3 and earlier: a crafted BitLocker volume image whose metadata announces inflated dataset or datum sizes pushes the parsing routines get_dataset() and get_next_datum() past the end of the allocated metadata buffer, crashing the tool or leaking adjacent heap memory through the volume-parsing output. Any default build of Dislocker at or below 0.7.3 that opens the malicious image is affected, which is of practical concern mainly to forensic, incident-response, and disk-recovery workflows that routinely process untrusted BitLocker volumes. Exploitation is local and requires the victim to actually open or mount the crafted image (UI:P), and no public exploit code has been identified at time of analysis; an upstream fix commit is available. This is a genuinely Medium-severity, lower-priority issue rather than an urgent one, and it is not noted as confirmed actively exploited (CISA KEV).
Brocade Fabric OS before 10.0.1 contains a stack-based buffer overflow in its security library when parsing uploaded X.509 PEM certificates. An authenticated administrator can trigger the overflow by importing a certificate with an oversized Authority Key Identifier (AKI) extension, crashing the management daemon and causing a denial of service. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 3.1 score is 6.9 (medium), reflecting the need for adjacent-network access and admin credentials.
Integer overflow in containerd overlaybd's LSMT index loader (do_load_index) lets a crafted, untrusted overlaybd blob pulled from a registry corrupt heap state and crash the host-side runtime, degrading availability for all overlaybd-backed containers on the node. Affected are overlaybd builds through 1.0.18 that are actually used as the container snapshotter/backend; exploitation is unauthenticated (CVSS PR:N) but requires high attack complexity (AC:H) - the victim must load an attacker-controlled blob in a deployment running multiple overlaybd-backed containers, which is why Scope is Changed. Impact is availability-only (C:N/I:N/A:H, CVSS 6.8); there is no public exploit identified at time of analysis and no CISA KEV confirmation, and organizations pulling only from trusted, signed sources are not realistically exposed.
Plaintext HTTP responses can plant, overwrite, or delete Secure cookies held in AsyncHttpClient's ThreadSafeCookieStore, because the store never considers the scheme a Set-Cookie arrived on, so the attacker's value is subsequently sent back to the HTTPS site inside TLS. Affected are the Maven artifact org.asynchttpclient:async-http-client 3.0.0 through 3.0.13 and 2.1.0 through 2.16.1; exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N, 6.8, CWE-384) but conditional - the application must have the cookie store enabled and share one store across plaintext and HTTPS origins of the same site, and the HTTPS application must rely on the affected cookie for session or CSRF state. Concretely this yields session fixation into the HTTPS session, a clobbered CSRF token, or the removal of a cookie the site depends on; there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and the severity is tempered by the requirement for a plaintext foothold on the same site (a same-site plaintext host setting a Domain cookie, or a network man-in-the-middle).
Server-side request forgery in Indico (all versions prior to 3.3.13) allows an authenticated event organizer to make the server fetch a prohibited local or internal URL by embedding a backslash in a crafted URL, and then read the target's response through affected Indico features. The vulnerability is a CWE-918 SSRF stemming from an incomplete fix for CVE-2026-25738; the trigger (demonstrated as 'http://127.0.0.1\@1.1.1.1') defeats Indico's local-target filter, which now rejects any URL containing a backslash. Exploitation requires the trusted event-organizer role (CVSS 3.1 PR:H, score 6.8, scope changed), there is no confirmed active exploitation (not in CISA KEV), and no public exploit code was identified at time of analysis.
Server-side request forgery in Pydantic AI's URL-fetching guards lets an application that has explicitly opted a URL into local-network access reach IPv6 cloud metadata endpoints such as fd00:ec2::254 and read short-lived cloud IAM credentials, because appending an RFC 4007 zone identifier (for example fd00:ec2::254%251) makes the address unequal to its blocklist entry while the kernel silently ignores the zone for a non-link-local destination and routes the request anyway. Affected releases are pydantic-ai and pydantic-ai-slim at 1.56.0 up to but not including 1.107.6, and 2.0.0b1 up to but not including 2.44.0; exploitation additionally requires that the URL be attacker-influenced or model-chosen, that one of the two opt-ins be enabled (FileUrl with force_download='allow-local', or web_fetch_tool(allow_local_urls=True) - both off by default), and an IPv6-enabled environment with a reachable metadata service. Vendor-released patches are available in versions 1.107.6 and 2.44.0 (upstream fix tracked via pull requests 8401 and 8402); no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting (XSS) in the Workflow Template feature of SQLView KRIS lets an actor who already holds administrative access store a script payload in the 'template name' field, which the application renders into an onclick attribute on the main dashboard without server-side sanitisation; the script then executes in the browser of any user who loads that dashboard and triggers the affected element. Per the CVSS vector (AV:N/AC:L/PR:H/UI:R), exploitation requires high administrative privileges and a separate victim's interaction, so the practical exposure is confined to malicious or compromised administrators rather than unauthenticated outsiders, and the independent assessment rates the resulting confidentiality and integrity impact as Low with no availability impact (CVSS 6.8, Medium). There is no KEV entry and no public exploit code identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Image Photo Gallery Final Tiles Grid (versions before 3.6.14) lets an authenticated attacker with contributor-level access or above inject arbitrary JavaScript that runs in the browser session of anyone viewing the affected post. The flaw arises because several gallery configuration values can be overridden through the plugin's gallery shortcode and are printed unsanitised into an inline script block; because no gallery ownership is required, any gallery already present on the site can be referenced, and an administrator previewing a pending contributor submission is the most likely victim. Exploitation requires the victim to load the crafted post (UI:R), there is no public exploit identified at time of analysis, and a vendor-released patch in version 3.6.14 is available.
Malformed Apache configuration data accepted by Brocade Fabric OS during web management service setup or re-initialization can corrupt the stored configuration and prevent the administrative web interface from starting or recovering, producing a persistent denial of service that recurs on each service bring-up. Exploitation requires an attacker who already holds high administrative privileges on the switch and can reach it from an adjacent network segment (assessed CVSS:3.1 AV:A/AC:L/PR:H/UI:N, availability-only impact), and no public exploit code was identified at time of analysis. Only Fabric OS releases before 9.2.2d and the 10.0.0 through 10.0.0a1 branch are affected, with a vendor advisory published by Broadcom.
Information disclosure in AWS CDK's core library (aws-cdk-lib) before 2.267.0 allows a context-dependent actor to cause files from the build host to be published as a deployed asset through improper symbolic-link resolution during asset bundling. Exploitation is local to the build environment and requires the victim to actually run the bundling/synth step (UI:P) on a directory whose contents the attacker can influence, so a developer or CI pipeline must consume untrusted asset sources for the issue to trigger. No public exploit code or confirmed active exploitation has been identified at time of analysis; the primary risk is unintended disclosure of build-host files (for example credentials or configuration) into a deployed stack. Vendor-released patch: 2.267.0, which changes bundling to throw on external symlinks via SymlinkFollowMode.BLOCK_EXTERNAL.
Heap- or stack-based memory corruption in the internal FSPF route-validation and diagnostic routine of Brocade Fabric OS can crash the routing daemon or, worst case, allow code execution in the daemon's context, but only for a local, authenticated attacker who first chains one or more separate vulnerabilities to inject an oversized diagnostic state payload. The flawed code path is explicitly not exposed through standard user interfaces or CLI management commands, so the CVSS 4.0 score of 6.8 overstates standalone risk; our independent assessment rates it medium (CVSS 3.1 AV:L/AC:H/PR:L/UI:N, availability-only impact) and it cannot be triggered in isolation against a default configuration. No public exploit code was identified at time of analysis and there is no evidence of active exploitation; the vendor fix is Fabric OS 10.0.1.
Opening a malicious CHM (compiled HTML Help) file in SumatraPDF 3.6.1 or earlier crashes the application: unsigned file-controlled string offsets from the /#WINDOWS and /#IVB sections are narrowed to signed integers in ChmFile::GetCharZ() without a lower-bound check, so a negative offset drives a read before the /#STRINGS buffer. Exploitation is local and requires the victim to open the crafted file, and the outcome is limited to a deterministic termination (denial of service) with no code execution, data disclosure, or privilege gain; no public exploit code was identified at time of analysis. Cross-referenced with the advisory and the fixing commit, this is a medium-severity availability issue rather than a high-urgency priority.
Opening a crafted TIFF file in SumatraPDF 3.6.1 and earlier can crash the application through a stack-based buffer overflow in MaybeFlipBitmap(), where GDI+ writes an attacker-controlled EXIF PropertyTagOrientation size into a fixed 64-byte stack buffer. The attack is local and requires the victim to open a malicious image (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P, base 6.8), and successful exploitation corrupts stack control data that the compiler's stack cookie check intercepts in tested builds, terminating the process. Impact is limited to availability (no confidentiality or integrity loss is claimed), with no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis.
Cleartext storage of HTTP proxy credentials in Brocade Fabric OS SupportLink diagnostic support bundles (all versions before 10.0.1) lets anyone who can read a generated bundle recover the proxy account's username and password. The issue is access-gated rather than network-reachable: it only manifests when SupportLink is configured to use an authenticated HTTP proxy, and the attacker must already have read access to the bundle, either as support personnel handling it or as a user able to reach the file share where bundles are retained. Impact is limited to confidentiality of the proxy credentials (CVSS 4.0 score 6.8; assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N/C:H/I:N/A:N) with no integrity or availability effect, and no public exploit identified at time of analysis.
A local null pointer dereference in SumatraPDF 3.6.1 and earlier lets any process in the same interactive Windows session that runs at an integrity level equal to or higher than SumatraPDF's (the Windows UIPI requirement for sending it inter-process messages) terminate the reader by dispatching a CmdExec command over DDE or WM_COPYDATA while the application sits on its start page with no document tab open. The sole consequence is abrupt process termination and loss of unsaved state; no code execution, data disclosure, or persistence is claimed, and there is no network-reachable vector. No public exploit identified at time of analysis, and no fixed release version was confirmed at review time, although an upstream fix commit and its regression test are publicly visible.
World-readable CodeCatalyst token cache files in AWS Toolkit for VS Code versions before 4.10.0 let any other local user on the same host recover bearer tokens for a victim who has connected the CodeCatalyst integration. The flaw is a local information-disclosure and privilege-escalation concern (CWE-276, CVSS 6.8) rather than a remote attack: it requires a shared multi-user system, an ordinary local login, no user interaction, and no elevated privileges, and yields only read impact (confidentiality) with no integrity or availability loss. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; the vendor has released a fix in version 4.10.0.
Stack exhaustion denial of service in OFFIS DCMTK 3.7.0 lets an attacker crash a JSON-parsing process by supplying a crafted DICOM JSON document whose sequence (SQ) values are nested deeply enough to exhaust the call stack through uncontrolled mutual recursion in DcmJSONReader (parseDataSet, parseElement and parseSequence in dcmdata/libsrc/dcjsonrd.cc). The affected components are the json2dcm conversion tool and any service that converts untrusted DICOM JSON, such as DICOMweb ingestion endpoints, with impact limited to availability (process crash) and no code execution, disclosure or integrity loss. No public exploit identified at time of analysis and CISA's SSVC records Exploitation: none, but the flaw is trivially automatable by anyone who can deliver a malicious JSON payload; it is fixed upstream in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7, which caps sequence nesting at 128 levels.
Deeply nested <sequence> and <item> elements in a crafted XML file drive unbounded mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in OFFIS DCMTK 3.7.0's XML-to-DICOM converter, exhausting the call stack and crashing the process (CWE-674, denial of service only). The vulnerable code path is reached by the xml2dcm command-line tool and by any service or application that embeds DCMTK 3.7.0 to convert untrusted XML into DICOM; per the vendor vector the attack is unauthenticated (PR:N) but local (AV:L) and requires the victim to process the malicious file (UI:P), so risk is highest for automated, unattended conversion pipelines. Impact is limited to availability - no code execution, data disclosure, or integrity loss - and no public exploit identified at time of analysis, nor is the issue listed in CISA KEV; the upstream fix introduces a hard 128-level nesting cap.
Stack exhaustion in OFFIS DCMTK 3.7.0 allows an attacker who supplies a crafted DICOMDIR file to crash any application built on the library that opens it, including dcmgpdir and third-party DICOM media viewers. The root cause is uncontrolled recursion (CWE-674) in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc, which follows a maliciously deep chain of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute until the process stack is exhausted. The affected vector is local with a user-interaction requirement (AV:L/PR:N/UI:P in the vendor CVSS 4.0 vector; AV:L/AC:L/PR:N/UI:R in the independently assessed CVSS 3.1 vector), impact is availability-only (no code execution, disclosure, or integrity loss), there is no confirmed active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, and a vendor fix is available as upstream commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f.
Stack exhaustion and process crash in OFFIS DCMTK 3.7.0 can be triggered by feeding the bundled XML parser a crafted document with deeply nested elements, because XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() recurse without a depth limit. An attacker who can make a DCMTK-based tool ingest untrusted XML - most directly by running dcmencap to encapsulate a malicious CDA document, or any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on attacker input - can terminate the process at will. The impact is availability only: no code execution, data disclosure, or persistence, and exploitation is constrained by the vendor's assessment of a local vector (AV:L) with passive user interaction (UI:P), meaning some actor or workflow must hand the file to the parser. No public exploit identified at time of analysis; the vendor scores it 6.8 under CVSS 4.0, while our independent assessment scores it CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
Tokens issued through @fastify/jwt before 10.2.3 can be created without an exp claim - and therefore never expire - when expiresIn, notBefore, or maxAge is given a time-span string the plugin's parser cannot read, such as a compound span like '1h30m', a month unit, an ISO 8601 duration, a value using a decimal comma, or a string with surrounding whitespace. The identical flaw silently disables maxAge age-rejection on the verification path, so a token that should be rejected as too old is accepted. The issue is tracked as CVSS 3.1 6.8 (Medium; AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), and the vector's PR:L reflects that an attacker generally needs to already hold a token - their own aged one or a stolen/leaked one - to benefit, with AC:H because the unparseable string must actually be in use as a non-default developer misconfiguration; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Docker Sandboxes can expose host-managed OAuth access and refresh tokens to untrusted code inside a sandbox when the managed-credential injection feature is in use and a user actively completes the OAuth authorization flow. A case-sensitivity mismatch in token-endpoint hostname masking (CWE-178) lets malicious code request a case-variant hostname that reaches the genuine provider while bypassing response masking; exploitation requires local code execution inside the sandbox plus user interaction, not a remotely exploitable, no-interaction attack. No public exploit identified at time of analysis, and no KEV or EPSS data is provided; the independent assessment rates this as a moderate-priority confidentiality issue rather than a high-urgency emergency.
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 (fixed in 6.3.6) lets an attacker who already executes code as the low-privilege hMailServer service account ride a subsequent administrator- or root-run operation to full SYSTEM/root privileges. The flaw is improper link resolution (CWE-59): administrative command-line operations, the installer, DBSetup, the Control Panel, and store-maintenance/object-storage routines resolve file paths inside the log and data folders without guarding against junctions, mount points, or symbolic links that the service account can plant - and on Linux those maintenance routines run as root, so a planted symlink is followed with root authority. The attacker must already hold a foothold as NT SERVICE\hMailServer (Windows) or the packaged hmailserver user (Linux) and must wait for a privileged operation to be triggered, so exploitation is local-only, requires user interaction on the privileged side, and carries elevated complexity; no public exploit code or KEV-listed active exploitation was identified at time of analysis, and the CVE-org references point to the upstream work item and the v6.3.6 release.