Missing authorization enforcement in Frappe ERPNext endpoints lets authenticated low-privileged users read personal data beyond the scope their assigned role permits, affecting releases before 15.120.0 and 16.x before 16.33.0. The flaw is network-reachable and requires only a valid session for a minimal role, as reflected in the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N with confidentiality-only impact (C:H, I:N, A:N) and a CVSS 4.0 base score of 7.1; unauthenticated attackers cannot exploit it. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is a moderate-priority access-control defect rather than a critical remote-code compromise, with the main risk being unauthorized disclosure of employee, customer, or contact records held in the ERP.
Missing authorization checks in Frappe ERPNext before 15.121.3 and in 16.x before 16.35.0 allow any authenticated user - including a low-privilege or self-registered account - to send requests to certain endpoints and modify data beyond what their assigned role permits. Authentication is mandatory (PR:L in the assessed vector), so anonymous remote exploitation is not possible; risk is concentrated in deployments with many distinct user roles, untrusted or self-registered users, or exposure to credential compromise. There is no public exploit identified at time of analysis and no CISA KEV entry, and the vendor has released fixed versions in the 15.x and 16.x lines.
Temporal Server's multi-cluster namespace replication logic fails to reject inbound replication tasks targeting local (non-global) namespaces, letting a party that operates or compromises a registered peer cluster overwrite local namespace state - including the built-in temporal-system namespace - without any credential on the receiving cluster. The receiving side only checks that the supplied namespace identifier matches an existing record, then rewrites state, description, owner, retention, archival settings, cluster list, and (when the task carries a higher failover version) the active cluster; an attacker can therefore mark a namespace Deprecated, make the peer its active cluster, and shorten retention so new Workflow starts fail. Exploitation is gated on a multi-cluster deployment with at least one remote cluster registered with connection enabled (a single-cluster or no-remote-cluster setup is not exposed), and the assessed CVSS:3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L - high privileges are required in the sense of holding the trusted peer position, which is the dominant real-world constraint. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; vendor-released fixes exist in Temporal Server v1.30.8, v1.31.4, and v1.32.1.
Insecure deserialization in Project MONAI's nnUNetV2Runner (versions 1.2.0 up to but not including 1.6.1) lets an attacker who can write to a nnU-Net results directory tamper with inference_information.json and redirect the postprocessing_file field to a malicious Python pickle anywhere on the filesystem, which is then unpickled when predict_ensemble_postprocessing runs, giving arbitrary code execution in the MONAI process. Exploitation is local and requires pre-existing low-privilege filesystem write access plus a legitimate operator subsequently invoking the runner (passive user interaction), so it is a shared-host/multi-tenant concern rather than an internet-facing remote threat; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. The path-confinement fix and a pickle opt-in gate (MONAI_ALLOW_PICKLE) are available from the vendor as of MONAI 1.6.1, with an associated upstream commit.
An out-of-bounds write in the native library libsamsungtts.so, part of the Samsung Text-to-Speech engine shipped on Samsung Android builds, allows code running locally on the device to corrupt memory and achieve arbitrary code execution in the TTS process context. The vulnerable component is reachable without special privileges or user interaction (CVSS 4.0 PR:N/UI:N), but the attack vector is local (AV:L), so the attacker must already have a malicious or compromised app or local process able to invoke the TTS engine and supply crafted input; there is no remote/network exploitation path. Samsung addresses the flaw in the SMR Oct-2026 Release 1 maintenance update, and no public exploit code has been identified at time of analysis.
Out-of-bounds write in Samsung's libsmkvextractor.so media-extraction library allows arbitrary code execution on Samsung mobile devices running firmware prior to SMR Oct-2026 Release 1. Exploitation requires local access - an attacker must already hold a foothold on the device or get a crafted MKV/Matroska media file into a local parsing path - yet the CVSS 4.0 vector requires no privileges and no user interaction (AV:L/PR:N/UI:N), and our independent CVSS 3.1 assessment (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) rates the impact as high integrity, low confidentiality, and low availability. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV.
Heap buffer overflow in FreeRDP 3.0.0 through 3.31.x allows an attacker who controls a physical smartcard token to corrupt heap memory during PKCS#11 smartcard logon, potentially achieving code execution with the privileges of the FreeRDP client. The flaw is in collect_keys(), which enumerates public key objects across PKCS#11 slots into a fixed 64-entry array without bounds checking; a token exposing more than 64 keys with attacker-controlled CKA_ID and CKA_LABEL values overflows the array. Exploitation requires PKCS#11 smartcard authentication to be configured, physical presentation of the malicious token, and user-initiated logon, and no public exploit code or active exploitation is known at time of analysis; this is a constrained, physically proximate issue rather than a mass-exploitation priority.