Crashing ImageMagick's PostScript decoder is achievable with a crafted PostScript or EPS file: in ImageMagick versions from 7.1.1-31 up to but not including 7.1.2-32, the PostScript coder (coders/ps.c) dereferences a NULL profile pointer once a resource policy limit is reached during decoding, terminating the process and denying service to any application, pipeline, or web service that converts untrusted images. The issue is remotely reachable without authentication or user interaction (CVSS 4.0 base 6.3; independently assessed as availability-only under CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), and no public exploit code was identified at the time of analysis. Impact is confined to a process crash - there is no disclosure, modification, or code execution.
Code injection through crafted MVG (Magick Vector Graphics) drawing files can reach ImageMagick's PostScript rendering path, where an attacker-controlled font name is embedded into a generated PostScript stream and handed to a Ghostscript delegate. The flaw affects ImageMagick 6.x before 6.9.13-57 and 7.x before 7.1.2-32 and is reachable by unauthenticated remote attackers (PR:N, UI:N) who can cause a malicious MVG file to be decoded, but only when ImageMagick is built with a PostScript renderer and the text-rendering call actually takes the RenderPostscript path rather than FreeType (attack requirements: present). Resulting impact is limited to integrity and availability of the conversion process (no confidentiality loss); there is no public exploit identified at time of analysis, and the vendor rates the issue medium at CVSS 4.0 base 6.3, so it is a moderate, conditional priority rather than an emergency.
Unauthenticated attackers can read internal Elixir terms from ash_typescript RPC error responses by deliberately provoking errors that the library's error builder has no dedicated clause for, affecting versions 0.1.0 through 0.19.0. Two RPC request paths trigger the leak: a struct-typed action argument carrying an invalid nested value that pushes a raw Ash.Type cast error into the builder, and field selection on a generic action returning a primitive that causes the full Ash.Info.Manifest.Type struct to be embedded into the response. The issue is a medium-severity CWE-209 information disclosure (CVSS 4.0 6.3; independent 3.1 assessment AV:N/AC:H/PR:N/UI:N/C:L), no public exploit code has been identified at time of analysis, and a vendor patch is available in ash_typescript 0.19.1.
LDAP injection (CWE-90) in Frappe Framework allows unauthenticated remote attackers to manipulate directory queries by injecting crafted LDAP filter syntax through unsanitized endpoint parameters, with an impact limited to information disclosure (VC:L, VI:N, VA:N). The flaw affects Frappe releases before 14.99.2 and 15.x releases before 15.86.0, and is rated 6.3 under CVSS 4.0 (AV:N/AC:L/AT:P/PR:N/UI:N); exploitability is conditional because the instance must have LDAP integration actively configured, which is the attack requirement reflected by AT:P. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
GraphQL schema disclosure in Parse Server allows unauthenticated attackers who hold the public Application ID and client key to recover private class and field names by replaying an introspection operation cached in Apollo Server's automatic persisted query (APQ) registry, because the server's introspection restriction is enforced only against operation text sent with the request and not against operations resolved from the cache. Exploitation is not autonomous: it requires the GraphQL API to be enabled and network-reachable and, critically, that a master- or maintenance-key client has already executed and cached an introspection query, so the attacker replays that privileged cached entry rather than submitting introspection text directly - a prerequisite captured as Attack Requirements: Present in the CVSS 4.0 vector and reflected in an independent rescoring of AV:N/AC:H. Impact is limited to information disclosure (no data modification, no code execution, no server compromise); no public exploit code was identified at time of analysis.
Path traversal in Nginx UI (0xJacky) before 2.4.3 allows an authenticated user who can create or modify an automatic backup to write backup archive files - and, when the backup is configured as an encrypted configuration backup, the adjacent encryption key file - outside the validated storage directory, with the privileges of the Nginx UI process. Exploitation requires a valid Nginx UI account with backup-management permissions (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, 6.3 per the independent assessment) and only takes effect when the configured automatic backup actually runs; the attacker influences the generated archive/key filename rather than arbitrary file content. The issue is fixed in version 2.4.3, and no public exploit code was identified at time of analysis.
Zebra versions prior to 6.4.0 improperly validate the integrity of gossiped blocks, allowing an unauthenticated inbound peer to force the node to drop legitimate new blocks without penalizing the attacker. By rewriting a genuine block's coinbase scriptSig to height 1 while preserving the valid ZIP-244 block hash, an attacker can trigger a behind-tip drop before consensus validation, delaying tip discovery for mining backends. No public exploit code has been identified at time of analysis, and the effect is limited to availability with no code execution or data disclosure.
Zcash Zebra nodes before 6.4.0 can be stalled during synchronization by unauthenticated network peers that serve forged block bodies carrying valid header hashes. Attackers can flip authorizing-only bytes such as the coinbase scriptSig, forcing the node to waste computational resources on full Sapling, Orchard, and Ironwood proof verification for up to a 67-second sync stall. This moderate-severity availability issue has no public exploit identified at time of analysis and requires no authentication (PR:N), but the attacker must be a connected peer during a sync operation.
Local information disclosure in IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 allows an attacker who already has access to the host to read sensitive data by abusing a service account that was configured with excessive permissions. The flaw is a privilege-assignment problem (CWE-250) rather than a memory-safety or injection bug: because the service account holds rights beyond what it needs, anything reachable by that account - files, directories, or configuration - becomes reachable to a local user. Impact is confidentiality-only (C:H with I:N/A:N on CVSS 3.1, base 6.2, AV:L/AC:L/PR:N/UI:N), so no tampering or denial of service is involved, there is no network attack path, and there is no public exploit identified at time of analysis; IBM has published a fix referenced in advisory node/7291755.
GV-E-Map Server V18.2.0A ships with a plaintext database password hard-coded into a distributed application component, so anyone who can read the shipped binary or inspect the running process memory on the host can recover the credential and use it against the back-end database. The weakness is CWE-798 (hard-coded credentials) with a CVSS 3.1 base score of 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning local access with no privileges required but no network-facing trigger; the exposure is therefore sharply limited to attackers who already hold a local foothold or operator-level filesystem/memory access. No public exploit identified at time of analysis, and the issue is not reported as actively exploited in the source data.
Heap buffer overflow in FreeRDP's RDP license negotiation path lets a malicious or man-in-the-middle RDP server corrupt client heap memory when a 32-bit FreeRDP client (3.0.0 through the 3.31.x line, fixed in 3.32.0) connects to it and receives a crafted SERVER_LICENSE_REQUEST carrying an oversized scopeCount that defeats the length check. A successful attack can crash or destabilize the client (denial of service) and could potentially lead to code execution in the client's context, but exploitation requires the victim to initiate an outbound RDP session to an attacker-controlled endpoint and the integer truncation only manifests on 32-bit builds, not 64-bit ones. No public exploit identified at time of analysis; the vendor fix is shipped in FreeRDP 3.32.0, and the assessed risk vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H.
Stored cross-site scripting in QGIS Server's WFS3 (OGC API Features) HTML renderer allows an attacker who can write feature attributes into a published writable vector layer to inject markup or script that executes in the QGIS Server origin when a victim opens an items or feature HTML page. Affected releases are QGIS Server versions prior to 3.44.12 and the 4.x line from 4.0.0 through 4.2.3; exploitation requires the WFS3/OGC API Features interface to be enabled and serving HTML, a writable published layer the attacker can populate (for example through WFS-T transactions), and a user who actually views the crafted page. The vendor rates this CVSS 6.1 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while our independent assessment applies the same score but a PR:L vector because the attacker must hold write access to a published layer; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Cross-site scripting in Progress MarkLogic Server lets a remote, unauthenticated attacker execute arbitrary script in the browser of an authenticated MarkLogic user - typically an administrator or developer working in the web-based Admin or Query console - after that user clicks a crafted link or loads attacker-supplied content. Only 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected; the flaw is rated CVSS 3.1 base 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the required victim interaction and the need for an existing authenticated session being the main limiting factors. Successful exploitation could drive unauthorized actions or expose information accessible to that authenticated user, and no public exploit code has been identified at time of analysis.
CSV export formula injection in OTRS (7.0.X, 8.0.X, and 2023.X through 2026.X before 2026.7.X, plus legacy ((OTRS)) Community Edition 6.x and products derived from it) lets attacker-influenced text that lands in ticket or contact fields be written into exported CSV files as spreadsheet formulas starting with =, +, -, or @, so that opening the export in Excel or similar software can cause unintended actions, information disclosure, or invocation of external functionality inside the spreadsheet client. Rated CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), the issue is unauthenticated from the network perspective per the vector, since a payload can arrive through external channels such as inbound email routed into an OTRS queue rather than requiring a valid account; the real limiting factors are that an export workflow must actually be used and the recipient must generally confirm one or more spreadsheet security-warning dialogs before a formula executes. Only the victim's spreadsheet application is affected, no code executes on the OTRS server, and no public exploit identified at time of analysis with no CISA KEV listing.
Samsung Flow builds prior to 4.9.22.4 contain an improper authentication weakness that lets an attacker on an adjacent wireless network reach sensitive information exchanged or stored by the app. Exploitation is unauthenticated and requires no user interaction (CVSS 4.0 PR:N/UI:N), but the vector also requires a specific precondition (AT:P) and proximity, so a successful attempt depends on timing or an active pairing/connection state rather than being reliably repeatable on demand. Severity is moderate (6.1 base) and no public exploit code or confirmed active exploitation was identified at time of analysis; realistic risk is constrained by the adjacent-network vector and the conditional attack requirement.
Untrusted external web-link handling in IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 Interim Fix 2 allows a remote, unauthenticated attacker to craft a link that can expose sensitive information or trigger unauthorized actions inside a victim's browser (CWE-1022). The flaw cannot be triggered server-side or automatically: it requires the victim to click an attacker-supplied link that resolves through the application's untrusted external reference, so the practical barrier is social engineering rather than authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1). Impact is confined to the victim's browser context rather than the Db2 Recovery Expert host, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
An open redirect in Thelia's address-creation workflow (versions up to and including 2.6.0) lets an attacker craft a URL that carries an arbitrary external destination in the 'next' parameter; once the victim completes the 'Add New Address' form, the application redirects them to that attacker-controlled site. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N) but requires the victim to both open the crafted link and successfully submit the form (UI:R), and it produces no server-side compromise - impact is limited to confidentiality and integrity at low severity with changed scope. EPSS is only 0.18% (7th percentile), and no public exploit code or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 lets an unauthenticated attacker inject arbitrary JavaScript into the product's Web UI, which then executes in the browser of a logged-in user within a trusted session and can lead to credential or session disclosure. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) shows the attacker does not need to authenticate, but a victim with an active session must be induced to trigger the reflected payload, making user interaction the primary limiting factor and the practical risk moderate-to-low. No public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available (CWE-79).
Reflected cross-site scripting in IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 allows an unauthenticated attacker to embed arbitrary JavaScript in the Web UI, which executes in the browser of a victim operator who interacts with the crafted content and can lead to disclosure of credentials from a trusted session. The flaw is rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning no attacker authentication is needed but the payload only fires after a legitimate user opens or interacts with the injected content, so this is not a drive-by, self-propagating compromise. Exploitation status is assessed as no public exploit identified at time of analysis, with no CISA KEV listing; the practical exposure is limited by the mandatory user interaction, the narrow deployment base of this recovery tooling, and the fact that only the specific 5.5 IF 2 build is in scope.
Reflected cross-site scripting in IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 Web UI allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's trusted session, potentially leading to credential disclosure. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); no public exploit was identified at time of analysis. A vendor patch is available, and successful exploitation requires a logged-in operator to interact with attacker-supplied input.
Reflected cross-site scripting in Thelia versions up to 2.6.0 allows remote attackers to execute arbitrary JavaScript in the context of an authenticated user's session by crafting a link with a malicious 'next' parameter. The flaw arises from improper escaping of double quotes in the Smarty templates address.html and address-update.html, requiring the victim to click the link while logged in. No public exploit code or active exploitation has been identified at time of analysis; EPSS estimates a 0.16% probability of exploitation in the next 30 days, and the CVSS score is 6.1 (moderate).
Samsung Internet versions prior to 30.0.5.24 are susceptible to script injection due to improper input validation, allowing unauthenticated remote attackers to compromise confidentiality of user data (CVSS 4.0 base 6.0). Exploitation requires passive user interaction (e.g., visiting a malicious page), and the assessed impact is limited to confidentiality (VC:H, VI:N, VA:N). The flaw was confirmed by Samsung's product security team; no public exploit has been identified at time of analysis.
Temporal Server's Scheduler V2 callback handling fails to bind internal completion callbacks to the namespace that attached them, so an authenticated caller with write permission in one namespace can forge the reserved temporal://internal callback and alter schedule state in a different namespace. To succeed an attacker must already know the target namespace identifier, the schedule identifier, and the identity and timing of a currently running scheduled action, which makes this a targeted integrity attack rather than mass exploitation; the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N. Scheduler V2 is disabled by default, so default deployments are not exposed, though schedules created while it was enabled remain targets even after the feature is turned off, and no public exploit code was identified at time of analysis.
Client-side heap buffer overflow in FreeRDP 3.10.0 through 3.32.2 allows a malicious RDP peer to crash the connecting client by sending an oversized CF_DIB clipboard image whose conversion to PNG triggers an out-of-bounds memcpy once an internal realloc() call fails. The impact is availability-only (no code execution or data disclosure), which is why the issue is rated MEDIUM (CVSS 6.0) despite the memory-corruption class; the client is reached unauthenticated over the network, but the victim must actually interact with the clipboard transfer and the overflow only fires when a memory-allocation failure occurs, so the bug is not deterministic. There is no public exploit identified at time of analysis and no CISA KEV listing, and the affected range is limited to FreeRDP 3.10.0-3.32.2 with the client clipboard path as the attack surface.
Out-of-bounds write in FreeRDP clients running versions before 3.32.0 allows a malicious or compromised RDP server to corrupt client memory when the victim explicitly connects using the non-default /video (MS-RDPEGT) option. The server supplies a signed geometry origin with a negative topLevelLeft value that is stored unchecked in an unsigned surface coordinate, causing the blit clamp in gdiVideoShowSurface() to wrap in 32-bit arithmetic and be skipped, which can result in an out-of-bounds write of decoded H.264 picture data or an abort of the client. No public exploit code or confirmed active exploitation has been identified at time of analysis, and although the CVSS 4.0 base score is 6.0, real-world risk is reduced because /video is off by default and the attack is a reverse server-to-client scenario requiring the user to initiate the connection to the attacker's server.
Craft CMS versions 5.0.0 through 5.10.13 contain a missing authorization flaw in AppController::actionSwitchToLicensedEdition() that allows an authenticated low-privileged user - such as a registered front-end account - to invoke the edition-switching action route and persistently downgrade the site's edition in project config, a change administrators cannot revert from the control panel. Exploitation requires a valid account (PR:L) plus the precondition that the installed edition does not match the licensed edition, and the outcome is limited to integrity and availability of the edition configuration rather than code execution or data disclosure. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, so this is assessed as a genuine but moderate-priority issue rather than an emergency; sites that do not provision low-privileged or self-registering user accounts are not practically exposed.
Malicious or compromised RDP servers can crash FreeRDP-based clients (versions 3.9.0 through 3.31.x) that use Remote Credential Guard by sending crafted, unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq messages, that trigger an out-of-bounds read in the NDR scalar readers. The flaw is remotely reachable without authentication (PR:N in the assessed vector) but requires the victim to initiate the RDP session and have Remote Credential Guard enabled, in addition to high attack complexity and a specific unaligned-payload precondition. No public exploit code has been identified at time of analysis, and the primary impact is denial of service through client process crashes rather than code execution or data disclosure. This is assessed as a moderate-risk, low-urgency issue; however, a user-interaction requirement is present because the client must actively connect to the attacker's server.
Denial of service in FreeRDP client versions 3.9.0 through 3.31.x (all releases before 3.32.0) lets a malicious or compromised RDP server crash the connecting client by sending a CreateApReqAuthenticatorReq containing a truncated KERB_RPC_INTERNAL_NAME structure, which drives the RDPEAR NDR reader's cleanup path into a NULL pointer dereference (CWE-476). Exploitation is client-side and inverted: an unauthenticated remote attacker must lure a victim into initiating an RDP session against a server they control and that session must reach the RDPEAR Kerberos remote-credential exchange, so user interaction is required and the outcome is limited to a client crash with no confidentiality or integrity loss (CVSS 4.0 base 6.0). No public exploit code and no confirmed active exploitation were identified at time of analysis, and clients that only connect to trusted internal RDP servers are at substantially lower risk.
Use-after-free in FreeRDP's rdpsnd audio channel can crash the client: a malicious or compromised RDP server disconnects the session while asynchronous Wave2 audio playback is still draining queued PDUs, and the disconnect path frees the audio formats and device structures without joining play_thread, leaving the playback path dereferencing freed heap memory. Affected are FreeRDP client builds from 2.1.0 up to but not including 3.32.0 that negotiate the static rdpsnd channel; exploitation is non-deterministic and requires the victim to initiate the connection to an attacker-controlled server (UI:P) with the race window landing on the disconnect, so the outcome is a client-side denial of service rather than code execution. No public exploit identified at time of analysis (no CISA KEV listing).
The Gleam build tool (versions 0.32.4 up to but not including 1.19.2) derives the on-disk build directory for each dependency from the Hex release metadata 'app' (OTP application name) field without validating it, so a malicious package publisher could set that field to a traversal or absolute path such as ../../../../target and cause Gleam to delete an arbitrary directory outside the project build tree. The deletion happens only in the dependency-failure cleanup path: when a dependency fails to compile, Gleam calls remove_dir_all on the resolved build directory, meaning the attacker-controlled package must fail to build and the developer must actively run gleam build, check, run, test, or export (CVSS 4.0 5.9; assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H). Impact is limited to availability (data/directory loss) - no attacker code runs, even for what appears to be a pure Gleam package - and there is no public exploit identified at time of analysis; the vendor has released fixes.
Improper TLS server-certificate validation in hex_core (0.1.0 through versions before 0.20.0) lets an attacker who already holds an on-path/Man-in-the-Middle position impersonate hex.pm, repo.hex.pm, or any other repository or API endpoint to any Erlang/Elixir program using the library's built-in hex_http_httpc adapter selected by hex_core:default_config/0. The adapter is affected when it cannot obtain a CA trust store: all HTTPS requests fall back to insecure ssl defaults on Erlang/OTP 24 (public_key:cacerts_get/0 does not exist), hex_core before 0.11.0 never set ssl options at all, and on OTP 25 the fallback triggers whenever the OS certificate store cannot be loaded - although the CVSS 4.0 vector still requires user interaction because a Hex fetch must actually be triggered, and OTP 26+ verifies certificates by default even without the fix. No confirmed in-the-wild exploitation and no public exploit code were identified at time of analysis, and the primary risk is data/registry-response disclosure and package-fetch integrity (CWE-295, tagged Information Disclosure) rather than remote code execution.
Heap memory corruption in psqlODBC versions before 18.00.0005 can be triggered when an application binds 32,769 or more parameters on a single SQL statement via SQLBindParameter. An attacker who controls the parameter count-for example through an untrusted 'IN (?, ?, ...)' list-can wrap the driver's signed 16-bit binding counter, causing a massive out-of-bounds write of zeros that crashes the application or leaves it running with a corrupted heap. No public exploit code has been identified at time of analysis, and exploitation requires a vulnerable application pattern where parameter counts are derived from untrusted input; the flaw is availability-only (CVSS 5.9).
Improper certificate validation in Hex (the Elixir/Erlang package manager client, versions 0.20.2 through 2.5.1) allows a man-in-the-middle attacker to impersonate a Hex host under a narrow set of conditions: the attacker must intercept the victim's HTTPS traffic, must hold a certificate for the target host issued by a CA present in Hex's bundled CA store, and the victim must have pointed cacerts_path (HEX_CACERTS_PATH) at a custom store that deliberately excludes that CA. Under those preconditions the attacker can present a chain that reaches a bundled CA and have it accepted, defeating the operator's explicit trust configuration and potentially exposing package metadata, tarballs, and credentials transmitted to the impersonated host, although hostname verification still applies and reduces the attack surface. Assessed risk is medium (CVSS 4.0 base 5.9; CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N) and is constrained by the non-default configuration requirement and the privileged network position needed; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. A vendor patch is available in Hex 2.5.2.
Memory corruption in the Zephyr RTOS Bluetooth host ATT transmit path can be triggered by a peer in Bluetooth radio range whenever an application issues an ATT Signed Write Command over an unencrypted link. In chan_send(), the BT_ATT_OP_SIGNED_WRITE_CMD branch unrefers a net_buf it does not own after bt_smp_sign() fails (no local CSRK exists for the peer - a state the remote peer controls by pairing without requesting the signing key, pairing with No Bonding, staying unpaired, or keeping the link unencrypted); the callers honor the opposite ownership contract, so the already-freed buffer is re-queued, dereferenced and freed a second time, corrupting the ATT TX FIFO, deferred-destroy and pool free lists, while a related retry path can append a second 12-octet signature into a pooled buffer sized for one. Exploitation requires the deprecated, non-default CONFIG_BT_SIGNING build option plus a victim application that actually performs signed writes, giving CVSS 5.9 (AV:A/AC:H/PR:N, no confidentiality impact, high availability impact, low integrity impact); a vendor fix commit and GHSA-p3r4-qw98-j59m are available, and no public exploit was identified at time of analysis.
Loading an attacker-supplied read-only dictionary (.rws) file in GNU Aspell through 0.60.8.2 can corrupt heap memory, yielding reliable denial of service and potentially code execution. The root cause is a heap-based buffer overflow write (CWE-122) triggered by a signed-integer overflow in String::reserve(), which lets a crafted 32-bit length field in the .rws header (for example lang_name_size = 0x7FFFFFFF, paired with the valid endian marker 12345678) bypass the capacity check so attacker-controlled data is written past an undersized allocation. Exploitation is local in nature - there is no network-service trigger - and requires the victim to actively load the malicious dictionary, such as by running 'aspell dump master <file>'; no public exploit code was identified and there is no confirmed active exploitation at time of analysis, so this is assessed as a moderate-priority issue despite the RCE tag.
Local information disclosure in Samsung Internet lets an attacker who already has access to the device read sensitive data through an improper access control weakness in all versions prior to 30.0.5.6. Samsung rates it CVSS 4.0 5.9 (AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N), and our independent assessment agrees: medium severity, local-only reach, confidentiality impact only, with no integrity or availability effect. No public exploit identified at time of analysis, so this is a moderate-priority patching item rather than an urgent one; the attack requires local access plus a specific precondition (AT:P) rather than working against every default invocation, but once met it needs no authentication or privileges (PR:N) and no user interaction (UI:N). Updating to 30.0.5.6 or later removes the flaw.
Zephyr RTOS Bluetooth Mesh nodes built with the default Access-layer delayed-message feature can be persistently muted by a mesh peer that is already provisioned into the same network and within Bluetooth radio range. By flooding the victim with requests that elicit segmented responses while withholding Segment Acknowledgments, the attacker forces bt_mesh_delayable_msg_manage() down an error path that returns a message context to neither the free nor the busy list, permanently shrinking the default four-entry context pool until every reply from Configuration Server, Health Server and application server models fails with -ENOMEM and is silently dropped. The impact is availability-only (CVSS 5.7, CWE-772, authenticated/PR:L and adjacent/AV:A per the assessed vector); the defect is cleared only by a reboot, the upstream fix is a committed source change, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Cleartext transmission and storage of private task content and connected issue-provider credentials in Super Productivity 17.3.0 through 18.13.0 occurs because the SuperSync end-to-end-encryption setup invokes sync(true) before the user has set an encryption password, so the operation-upload path pushes and persists all operations in plaintext. Affected data can include reusable issue-provider passwords, API tokens, and app passwords in addition to task text; users who finish E2EE setup have the plaintext operations deleted, but users who abandon the password-setting step can leave that data stored on the sync backend indefinitely, and the Disable SuperSync action does not remove plaintext already uploaded. Exploitation is not confirmed as actively exploited and no public exploit code has been identified at time of analysis; realizing the exposure requires the incomplete-setup condition plus read access to the server-side sync storage or the user's sync account, consistent with an authenticated (PR:H) attacker and attack-requirements-present (AT:P) profile. This is a genuine but moderate-priority confidentiality flaw, and the available signals are internally consistent rather than conflicting.
Path traversal in the mistral.rs inference server (mistralrs-server-core) through version 0.9.3 lets a remote, unauthenticated attacker direct where the server writes its calibration importance matrix by supplying a non-bare save_cimatrix value to the POST /calibration/apply endpoint. The pre-patch code passed the client-supplied string straight into PathBuf::from with no validation, so values containing '/', '\\', or '../' escape the server's working directory; impact is limited to placing/overwriting the server-generated .cimatrix file at an attacker-chosen path (no attacker-controlled file contents, no direct code execution), assessed as CVSS:3.1 6.9-level moderate risk. Publicly available exploit code exists, the vendor has released a patch in version 0.9.4 (commit 8c81056712709b4845ec6d9531e4d35bab4a367c, PR #2445), and there is no indication of confirmed active exploitation (not in CISA KEV).
Server-side request forgery in EricLBuehler mistral.rs 0.9.3 and earlier allows remote unauthenticated attackers to bypass the private-IP guard used by the server's media-source fetcher, causing the server to request internal addresses such as loopback, link-local, or cloud metadata endpoints. The flaw lives in the is_global_ip/reject_private_ip logic in mistralrs-server-core/src/media_source.rs, which failed to decode IPv6 transition-address forms (IPv4-mapped, IPv4-compatible, 6to4, and NAT64) that embed an internal IPv4 address, so those addresses were judged global and fetched. Publicly available exploit code exists, and the issue is rated CVSS 4.0 6.9 (our independent assessment is a lower-severity SSRF with low confidentiality impact and no integrity or availability impact); no confirmed active exploitation (CISA KEV) was identified at time of analysis. Exploitation is only meaningful where remote media-URL fetching is enabled and reachable internal services exist.
Server-side request forgery (SSRF) in Ollama versions up to 0.34.1 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal hosts via cross-host redirects during model pulls. A malicious or compromised registry can redirect manifest or blob requests to internal addresses, potentially exposing limited sensitive information. Publicly available exploit code exists, and the issue is fixed in version 0.34.2 by enforcing a same-host-only redirect policy by default.
SQL injection in the Forgot Password handler (source/authprocessing.php) of krupalshah EmployeeRecruitmentSystem lets remote, unauthenticated attackers inject SQL through the 'fpemail' parameter submitted to the forgot-password request. The application is an obscure, unversioned project tracked only by commit hash (up to 922ff6d208278282e7c8e36d70d9ae356adec9fe), it is no longer maintained, and the vendor was contacted early but never responded, so no fixed release exists or is expected. Exploit details have been disclosed publicly and exploit code is publicly available (CVSS 4.0 vector carries E:P), which raises the likelihood of opportunistic scanning against any internet-exposed instance; the independent assessment rates real-world impact as low-priority overall because deployment of this unmaintained application is minimal.
Improper access control in IBM i 7.3, 7.4, 7.5, and 7.6 allows a local attacker who already holds a valid account on the system to trigger a denial-of-service condition, while the supplied impact metrics also point to a low-severity information exposure. The issue carries a moderate CVSS score of 5.3, and there is no CISA KEV listing, no EPSS score provided, and no public exploit code identified at time of analysis, so this should be treated as a low-urgency, locally-privileged defect rather than an active threat. Defenders should note that the published vector (AV:N/PR:N, C:L, A:N) contradicts both IBM's own 'local attacker' description and our assessed vector (AV:L/PR:L), and also fails to express an availability impact despite the denial-of-service wording - this is a data-quality conflict that should be resolved with IBM before assuming network-facing exposure.
Information disclosure in UNISOC modem (baseband) firmware allows a local, low-privileged attacker to read sensitive data that is captured in modem crash dumps without filtering of sensitive fields. Exploitation requires the attacker to already have local code execution on an affected device - for example an installed malicious app or a local process with access to the dump - with no remote vector (AV:L, PR:L) and no user interaction (UI:N). Rated CVSS 5.5 with confidentiality-only impact, this is a moderate-severity local exposure rather than an urgent remote-exploitation priority; no public exploit code has been identified at time of analysis, and the specific affected firmware/chipset versions are not specified in the available data.
Denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 can be triggered by an authenticated, low-privileged user (PR:L) submitting a specially crafted query that references a Materialized Query Table, causing a stack-based buffer overflow (CWE-121) that crashes the database engine. IBM has released a patch; no public exploit identified at time of analysis, and impact is limited to availability with no data disclosure or modification. Note that IBM's CVSS vector indicates local access (AV:L), while the query-execution nature suggests a remote authenticated client may be able to trigger the flaw, pending confirmation with the vendor.
Improper validation of the frequency index passed to the Unisoc kernel apsys DVFS driver (CVE-2026-87765, CVSS 3.1 5.5) lets local code that already holds low-level privileges on the device select an out-of-range operating point, resulting in an out-of-bounds read of the driver's frequency/voltage tables or corruption of the power-management hardware registers, which can destabilize or crash the system. Impact is limited to availability (C:N/I:N/A:H) - no confidentiality or integrity loss is described - and the assessed vector AV:L/AC:L/PR:L/UI:N means there is no remote or unauthenticated path; an attacker must already be able to invoke the DVFS driver interface locally. Exploitation signals are weak: no public exploit code exists and there is no confirmed active exploitation (not listed in CISA KEV), and no EPSS score was supplied, so this should be treated as a moderate-severity, low-priority issue remediated through vendor firmware/driver updates rather than emergency action.
Direct HTTP requests to the db/matrimony.sql database dump in code-projects Matrimonial System 1.0 expose the application's schema and stored records to unauthenticated remote attackers (CVSS 4.0 base 5.5; assessed CVSS 3.1 5.3, CWE-425). The weakness is forced browsing: the SQL dump ships inside the web-accessible document root, so a predictable GET to the file returns it as a static asset with no authentication required (CVSS vector PR:N). Publicly available exploit code exists - the reporter published a proof-of-concept walkthrough on GitHub - but there is no CISA KEV listing, and impact is limited to confidentiality (VC:L) with no integrity or availability effect; the product's very small deployment footprint is the main practical limiter.
Authenticated administrators of Thelia 2.6.0 and earlier can achieve remote code execution by injecting malicious Smarty expressions into email templates, which execute with web process privileges when previewed or rendered. The vulnerability requires high-privilege back-office access, but successful exploitation enables arbitrary OS command execution and file read/write. No active exploitation has been confirmed and no public exploit code is currently identified.
Authenticated template injection in Thelia versions up to and including 2.6.1 lets a logged-in user with access to Smarty template-name handling point the engine at an arbitrary absolute filesystem path, which can result in server-side template injection and, in some deployments, remote code execution. The flaw is post-authentication (CVSS vector PR:L) and the RCE outcome is conditional: it depends on Smarty loading/compiling the referenced file without an effective security policy and on a suitable file existing at the referenced path, so impact is not guaranteed on every installation. No public exploit code and no active exploitation were identified at time of analysis (EPSS 0.40%, ~32nd percentile), and no vendor-released fixed version was confirmed from the provided references (CERT/CC advisory VU#162329; CVE-2026-103537).
Cross-site scripting in IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated remote user to inject arbitrary script into content that is later rendered by another user's browser, because user-supplied input is not properly validated before being included in a page. Exploitation is not automatic: an attacker must already hold an authenticated session on the system and a separate victim must view or interact with the injected output, so this is not a default-configuration, unauthenticated remote exploit. IBM has published a fix through its support portal, and no public exploit code or confirmed active exploitation was identified at time of analysis.