Missing authorization checks in Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 allow authenticated users with low privileges to call certain endpoints directly and read data beyond what their assigned role permits. The flaw is confidentiality-only (CWE-862, missing authorization): the CVSS v4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:H/VI:N/VA:N) and the independent assessment (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 7.1) agree that no data modification or denial of service is possible and that network access plus a valid low-privilege ERPNext account is required, with no user interaction. There is no public exploit identified at time of analysis, though the realistic threat population is insiders, compromised credentials, or environments that issue low-trust/portal logins, so the practical risk is moderate-priority exposure of sensitive ERP records rather than unauthenticated compromise.
Missing authorization checks in Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 allow an authenticated user holding only a low-privileged role to bypass role-based access control and read financial data by issuing direct requests to specific endpoints. The affected vector is network-reachable with low complexity but requires a valid account (PR:L), and the impact is limited to read-only confidentiality loss - no data modification or denial of service is possible. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so it is a moderate-priority broken access control flaw rather than an emergency; patched instances and deployments restricted to trusted users carry substantially reduced practical risk.
Missing role-based authorization enforcement in Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 lets any authenticated user read financial data that their assigned role should not permit. Because the vulnerable endpoints can be requested directly over the network with any valid low-privilege account and require no user interaction or non-default configuration, the practical risk is malicious insiders or attackers operating with stolen, shared, or weak credentials rather than anonymous outsiders. Impact is confidentiality-only (no data modification or availability loss), and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released fixed versions 15.121.3 and 16.35.0.
Missing authorization checks in Frappe ERPNext before 16.34.0 allow any authenticated user to read financial records - accounting, ledger and invoice data - that their assigned role should not permit, resulting in a confidentiality-only breach. Exploitation requires only a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 7.1) and network reachability to the instance; no admin rights, user interaction, or special configuration are needed, which scopes the practical risk toward insiders or attackers holding stolen or self-registered low-trust accounts. No public exploit code has been identified at time of analysis, and CVE-2026-109614 is not confirmed actively exploited (CISA KEV); it is assessed as a credible but moderate-priority issue rather than a critical emergency.
SurrealDB deployments before 3.3.0 allow an authenticated caller who holds table-level WRITE permission but is denied SELECT on specific fields to read those hidden field values anyway, by issuing JSON Patch 'copy' or 'move' operations whose pointers are resolved against the unreduced record before field-level permission filtering is applied. The same weakness lets an attacker use PATCH 'test' operation mismatch errors as a boolean disclosure oracle to confirm the contents of SELECT-restricted fields. The issue is rated CVSS 7.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N, and a 3.1-equivalent assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), making it a credible but moderate-priority confidentiality flaw rather than an emergency; no public exploit identified at time of analysis, and it does not affect unauthenticated attackers or deployments that do not rely on field-level SELECT restrictions as a security boundary.
Authenticated users of LogicalDOC Community Edition (versions through 9.3) can bypass folder-level access controls and download the full contents of any restricted folder as a ZIP archive by calling the /zip-export servlet with an arbitrary folderId parameter. Exploitation requires only a valid low-privilege session (CVSS 3.1 PR:L, C:H/I:N/A:N), and because folder IDs are sequential numeric identifiers they can be enumerated, so the practical barrier is low for any user holding an account. The vulnerability is not confirmed as actively exploited (CISA KEV) and no public exploit code was identified at time of analysis, but a vendor fix is available; the impact is limited to confidentiality (document disclosure) with no write or availability effect, making this a moderate-priority information-exposure issue rather than an emergency.
Missing authorization checks in Frappe ERPNext allow an authenticated user to create and modify records beyond what their assigned role permits, giving high integrity impact with no confidentiality or availability effect. Exploitation requires a valid ERPNext login with at least low privileges (CVSS PR:L), so fully unauthenticated outsiders cannot abuse it, and only deployments running versions before 15.119.0 or 16.x before 16.31.0 are affected. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, making this a moderate-priority integrity and access-control problem whose realistic risk is concentrated among insiders or anyone holding standard user credentials.
Missing authorization in Frappe ERPNext document-creation endpoints (all versions before 15.121.0, and 16.x before 16.34.0) lets any authenticated low-privileged user - a portal, employee, or customer self-service account - create documents against records beyond their permitted role, bypassing role-based access controls. Impact is confined to integrity: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) and our independent CVSS 3.1 assessment of 7.1 (I:H, C:N, A:N) both show unauthorized document creation with no data disclosure or service disruption. No public exploit code has been identified at time of analysis and no CISA KEV listing is present, while vendor-released fixes exist in ERPNext 15.121.0 and 16.34.0.
Broken object-level authorization in Shaark 1.2.13 through 1.2.44 lets any authenticated non-admin user overwrite or delete other users' links, stories, chests, and albums by sending PUT or DELETE requests to /api/{link,story,chest,album}/{id} with sequential numeric IDs, because the API controllers load records with findOrFail() and never verify that the underlying post belongs to the calling user. Integrity impact is high (content can be modified or destroyed, including private items) while confidentiality is not affected and availability impact is limited; exploitation requires a valid low-privilege account on a multi-user instance, and the attacker must be able to obtain one via open registration or an existing tenant. This is a genuine but moderate-priority IDOR-class flaw (CWE-639); no public exploit code or confirmed in-the-wild activity was identified at time of analysis, and single-user or self-only deployments have no victim content to target.
SQL injection in LibreNMS before 26.9.0 allows an authenticated user at any privilege level to read arbitrary database tables - including the users.password hash column - by passing an array-valued notification_id parameter to notifications.inc.php instead of a scalar. The injected values break query construction in the notifications subsystem, and because extracted data is persisted into notifications_attribs and surfaced through the normal web interface, a low-privileged account can retrieve the results without any further foothold. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); the primary constraint on exploitation is the need for a valid LibreNMS login, which matches the PR:L rating in the assessed vector (CVSS 3.1 7.1, confidentiality High, integrity Low).
An out-of-bounds write in the language-processing functionality of Progress MarkLogic Server lets an authenticated remote user with only low-level privileges crash or destabilize the server and, more narrowly, modify limited data. Only MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) confirms availability is the dominant impact while confidentiality is untouched and integrity impact is limited. The mandatory pre-existing authenticated session is the primary limiting factor, so the realistic threat is an insider or an attacker who already holds valid credentials, and no public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing per-document authorization checks in the ConvertPdf servlet of LogicalDOC Community Edition through 9.3 allow any authenticated user to download PDF documents - and every stored version of them - from folders they are not permitted to access. An attacker with a low-privileged account can enumerate the sequential docId parameter and combine it with the version parameter to pull PDFs outside their permission scope; no administrative rights, user interaction, or non-default configuration are required, though valid credentials are mandatory since the flaw is not reachable unauthenticated. Impact is confined to confidentiality (bulk disclosure of restricted PDF content and revision history), with no write, modification, or denial-of-service capability; no public exploit identified at time of analysis and no CISA KEV listing.
FreeRDP clients before 3.0.0 and in the 3.6.0-before-3.32.0 range can be coerced by a malicious RDP server into painting uninitialized heap memory onscreen or into aborting the client process via crafted WBT_TILE_FIRST and WBT_TILE_UPGRADE progressive codec messages. This client-side uninitialized heap read (CWE-908) occurs because the tile->current buffer is allocated without zeroing, and exploitation requires the victim to connect to an attacker-controlled or man-in-the-middle RDP server while the session negotiates the RemoteFX/progressive codec. No public exploit identified at time of analysis, and confirmed active exploitation has not been reported; the CVSS 4.0 score is 7.1 (High), driven primarily by availability impact (client abort) with a low, opportunistic confidentiality impact.
Authenticated low-privileged users can create documents beyond their permitted roles in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0, because certain document-creation endpoints omit the role-based authorization checks the Frappe permission model normally enforces. The flaw is a CWE-862 missing authorization issue scored CVSS 4.0 7.1 (an independent CVSS 3.1 assessment also returns 7.1), with high integrity impact and low confidentiality impact, requiring only a valid low-privilege account (PR:L) and no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, but deployments that permit self-registration or issue portal/customer accounts widen the realistic attacker pool.
Frappe ERPNext fails to enforce permission checks on certain inventory-record endpoints, letting any authenticated user - regardless of assigned role - modify stock and inventory data they should not be able to touch. The flaw affects releases before 15.110.0 and 16.x before 16.21.0, requires a valid ERPNext session (CVSS PR:L, not anonymous), and impacts data integrity only: there is no disclosure of records and no denial of service. It is a moderate-priority authorization defect rather than a critical emergency, and no public exploit code has been identified at time of analysis; vendor fixes are available in 15.110.0 and 16.21.0. EPSS and CISA KEV data were not provided, so active exploitation is not confirmed.
Missing authorization checks in Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 let an authenticated, low-privileged user reach specific endpoints that modify production records and change data beyond the scope of their assigned role. Because the flaw is an integrity-only problem (CVSS:4.0 7.1; VI:H, VC:N, VA:N), attackers cannot read protected data or disrupt availability - they can only tamper with production/manufacturing records they should not be able to touch. Exploitation requires a valid low-privileged account and knowledge of the affected endpoint paths (PR:L per the assessed CVSS:3.1 vector); no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, making this a genuine but moderate-priority issue rather than a critical emergency.
ERPNext instances before 15.115.0 (15.x) and before 16.26.0 (16.x) allow authenticated low-privileged users to modify inventory records through endpoints that omit role-based authorization checks (CWE-862), carrying a CVSS 4.0 base score of 7.1 (High) and an assessed CVSS 3.1 integrity-only impact. Exploitation requires a valid low-privilege ERPNext account and network access, with no confidentiality or availability impact per the vector; no public exploit identified at time of analysis. Vendor-released fixes are 15.115.0 and 16.26.0, and instances at or above those versions are not affected.
Missing authorization checks in Frappe ERPNext versions before 16.14.0 allow authenticated users to modify master data records that lie outside their assigned role, giving them write access they were never granted. The CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VI:H) confirms the issue is network-reachable but requires at least a low-privileged account; only data integrity is affected, with no confidentiality or availability impact. Per our assessment this is a legitimate but moderate-priority access-control gap rather than a critical emergency, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Upgrading to 16.14.0 removes the condition entirely.
Missing authorization checks in Frappe ERPNext allow an authenticated low-privileged user to invoke status-modification endpoints that omit proper role enforcement, altering record status and business data beyond the attacker's assigned role. Affected versions are ERPNext before 15.121.0 and 16.x before 16.34.0; exploitation requires a valid ERPNext account with at least low privileges (CVSS PR:L) and is reachable over the network, but carries no confidentiality or availability impact, making it primarily an integrity-focused insider or post-account-compromise escalation path. No public exploit code has been identified and the issue is not confirmed as actively exploited (no CISA KEV listing); EPSS data was not available in the provided intelligence. Vendor-released fixes are available in 15.121.0 and 16.34.0.
Authenticated low-privileged users can modify documents and data beyond their assigned role permissions in Frappe ERPNext before 15.119.1 and in 16.x before 16.32.0, because certain endpoints fail to enforce proper permission checks (CWE-862, Missing Authorization). The issue is rated CVSS 4.0 7.1 (CVSS:3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) - integrity-only impact with no confidentiality or availability effect - and exploitation requires a valid ERPNext session for a low-privileged account plus knowledge of the specific unguarded endpoints, so it is not reachable by anonymous or unauthenticated attackers. There is no CISA KEV listing and no public exploit identified at time of analysis; realistic risk is confined to malicious insiders or attackers who already hold low-privilege credentials, and vendor-released fixes are available in 15.119.1 and 16.32.0.
Authenticated low-privileged users on IBM Planning Analytics 2.0 and 2.1 can delete folders and applications belonging to other users because the platform enforces access control at the wrong functional level. The flaw carries a CVSS v3.1 score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H), with the risk driven almost entirely by the high availability impact of destroyed workspaces rather than by any data disclosure. No public exploit code has been identified at time of analysis, and exploitation requires a valid account on a network-reachable instance, making this most realistically an insider or compromised-credential threat.
A crafted license plate value submitted through the bulk license plate search feature of Flock's Night Shift hosted service can be used to inject SQL, allowing an authenticated user of one customer organization to read license plate recognition records and other data belonging to other customer tenants; data modification was not possible. Exploitation requires a valid tenant account on the hosted platform (PR:L per the assessed vector), so this is not an unauthenticated attack. Flock discovered the flaw through internal security review, remediated it server-side on 2026-08-12, and states no customer action is required; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and because the fix was applied to the hosted platform the issue is no longer exploitable. The vendor-assigned CVSS 4.0 score is 7.1, while the independent assessment rates it CVSS 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting high confidentiality impact confined to cross-tenant read access.
SQL injection in Tuleap Enterprise Edition 17.5 allows an authenticated attacker with only low-level privileges to inject arbitrary SQL and gain read access to the underlying Tuleap database, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, 7.1) indicating high confidentiality impact but no integrity or full availability loss. Because exploitation requires a valid session (PR:L) and no user interaction, the practical risk is concentrated in internet-facing or broadly provisioned instances rather than being an emergency for every deployment; there is no public exploit identified at time of analysis and no confirmed active exploitation. This is a credible but moderate-priority issue whose urgency depends on how freely accounts can be obtained on the affected instance.
Broken object-level authorization in Telegram-Stremio through 5.1.0 lets an attacker who holds a valid low-privilege API token read arbitrary Telegram chat messages - including private channels, groups, and Saved Messages - by setting a global routing flag in the stream_handler endpoint and enumerating sequential, unsigned msg_id values that the application only obfuscates with its encode_string/decode_string routines. The separate thumb_handler endpoint performs no token validation at all, so thumbnails from those same chats are disclosed without any authentication, widening the exposure beyond the token-gated path. Publicly available exploit code exists (a public PoC gist) and VulnCheck has published an advisory, but no CISA KEV entry confirms active exploitation and no vendor-released patch was identified at time of analysis; the assessed impact is confidentiality-only (high), with no integrity or availability effect.
Out-of-bounds write in libnfs through 6.0.2 lets an attacker-controlled or man-in-the-middled NFS/RPC server corrupt memory in a client application linked against the library: the ZDR decoders libnfs_zdr_bytes(), libnfs_zdr_string() and libnfs_zdr_array() do not honour the caller-supplied maxsize, so a wire-declared length larger than the caller's preallocated buffer is accepted and copied past its end. The assessed CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H, i.e. an unauthenticated remote server can trigger it but the victim must first connect to that server (UI:R), and impact is limited to integrity plus high availability loss rather than data disclosure. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the flaw only affects callers that pass a non-zero, non-~0 maxsize with their own fixed-size storage, since zero/0xFFFFFFFF lengths remain intentionally unbounded.
Nginx UI deployments that use Casdoor OAuth/SSO for authentication can issue a valid application session for an attacker-chosen identity on versions prior to 2.4.1, because the OAuth 'state' value is a fixed constant (the configured Casdoor application name) and the callback never binds it to the browser session that started the login. An unauthenticated attacker who persuades a victim to open a crafted Casdoor authorization link can have the victim's browser complete the attacker-controlled authorization flow, after which the callback mints an Nginx UI session for the identity returned by that authorization code - yielding high confidentiality impact with limited integrity impact (CVSS 3.1 7.1, AV:N/AC:L/PR:N/UI:R). The flaw is conditionally gated: it only applies to instances with Casdoor OAuth configured and requires victim interaction, so it is a genuine authentication-bypass issue rather than a universally exploitable one; no public exploit code was identified at time of analysis, and a vendor-released patch in version 2.4.1 is available.
Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 create certain log files with overly permissive operating-system permissions, allowing a local, already-authenticated low-privilege user on the server host to read or alter log data (CWE-732). Exploitation requires local OS access to the MarkLogic host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and is not remotely reachable, so the practical risk is moderate and concentrated on multi-tenant or multi-user hosts where untrusted local accounts exist; no public exploit identified at time of analysis. Notably, the vendor fix only corrects the default permissions for newly created and rotated logs, so previously written log files on an upgraded host remain permissively accessible until an administrator manually remediates them.
SQL injection in Frappe ERPNext releases before 15.98.0 and 16.x before 16.6.0 lets remote attackers who already hold a valid application session inject crafted input into a subset of endpoints and manipulate backend database queries, reading sensitive records the account would not otherwise be able to access. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the primary limiting factor is authentication: a low-privilege ERPNext account is required, but no user interaction and no non-default configuration are needed, so default deployments on the affected versions are exposed to any logged-in user. Impact is confined to confidentiality - no integrity or availability effect - which keeps this a credible but moderate-priority issue rather than an emergency; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing). Exposure is highest for internet-facing ERPNext instances that offer self-service registration or lightly provisioned accounts.
Missing authorization checks in Frappe ERPNext 15.x before 15.113.0 and 16.x before 16.24.0 allow any authenticated user to call affected endpoints that omit role validation and read financial records their assigned permissions do not cover. Exploitation requires a valid ERPNext session (CVSS PR:L), so the practical threat is a low-privilege insider, malicious employee, or compromised portal account rather than an anonymous internet attacker, and the outcome is limited to data disclosure with no modification or service disruption. No public exploit code has been identified at time of analysis, and the issue is assessed as a moderate-priority confidentiality exposure rather than a critical emergency.
SQL injection in Frappe ERPNext before 15.102.0 and in the 16.x line before 16.11.0 lets an authenticated, low-privilege user manipulate database queries through endpoints that fail to validate input, exposing sensitive records held in the ERP database. The gating factor is the credential requirement: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the corroborating CVSS 3.1 assessment both indicate exploitation requires a valid low-privilege ERPNext session, so risk scales with the number of low-trust accounts on an instance and whether that instance is internet-facing. Impact is confined to confidentiality (VC:H with VI:N and VA:N) - this is a read/data-exfiltration flaw rather than database takeover or service disruption - and no public exploit code has been identified at time of analysis.
Authenticated low-privileged users in Frappe ERPNext (all versions before 15.119.0, and 16.x before 16.31.0) can read valuation and stock-costing data beyond what their assigned role permits, because specific endpoints fail to enforce authorization checks. Exploitation requires a valid low-privileged account (PR:L per the CVSS 4.0 vector) and network access to the application; the assessed impact is confidentiality-only (CVSS:3.1 C:H/I:N/A:N), so this is primarily an insider or compromised-account risk in multi-user or multi-tenant deployments rather than an unauthenticated intrusion path. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though a vendor security advisory and a third-party (VulnCheck) advisory are available.
SQL injection in Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 allows an authenticated attacker holding a low-privilege account to read sensitive information from the backend database by sending crafted requests to specific endpoints that fail to validate input. The assessed impact is confidentiality-only (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor CVSS 4.0 base 7.1), meaning data extraction rather than integrity or availability loss, and exploitation is gated by the need for a valid ERPNext session and reachability of the affected endpoints. No public exploit code has been identified at time of analysis and there is no KEV listing, but the low complexity of the attack and the availability of vendor advisories mean patched versions should be applied promptly.
Missing authorization enforcement in Frappe ERPNext endpoints lets authenticated low-privileged users read personal data beyond the scope their assigned role permits, affecting releases before 15.120.0 and 16.x before 16.33.0. The flaw is network-reachable and requires only a valid session for a minimal role, as reflected in the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N with confidentiality-only impact (C:H, I:N, A:N) and a CVSS 4.0 base score of 7.1; unauthenticated attackers cannot exploit it. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is a moderate-priority access-control defect rather than a critical remote-code compromise, with the main risk being unauthorized disclosure of employee, customer, or contact records held in the ERP.
Missing authorization checks in Frappe ERPNext before 15.121.3 and in 16.x before 16.35.0 allow any authenticated user - including a low-privilege or self-registered account - to send requests to certain endpoints and modify data beyond what their assigned role permits. Authentication is mandatory (PR:L in the assessed vector), so anonymous remote exploitation is not possible; risk is concentrated in deployments with many distinct user roles, untrusted or self-registered users, or exposure to credential compromise. There is no public exploit identified at time of analysis and no CISA KEV entry, and the vendor has released fixed versions in the 15.x and 16.x lines.
Temporal Server's multi-cluster namespace replication logic fails to reject inbound replication tasks targeting local (non-global) namespaces, letting a party that operates or compromises a registered peer cluster overwrite local namespace state - including the built-in temporal-system namespace - without any credential on the receiving cluster. The receiving side only checks that the supplied namespace identifier matches an existing record, then rewrites state, description, owner, retention, archival settings, cluster list, and (when the task carries a higher failover version) the active cluster; an attacker can therefore mark a namespace Deprecated, make the peer its active cluster, and shorten retention so new Workflow starts fail. Exploitation is gated on a multi-cluster deployment with at least one remote cluster registered with connection enabled (a single-cluster or no-remote-cluster setup is not exposed), and the assessed CVSS:3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L - high privileges are required in the sense of holding the trusted peer position, which is the dominant real-world constraint. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; vendor-released fixes exist in Temporal Server v1.30.8, v1.31.4, and v1.32.1.
A heap/stack-adjacent buffer overflow in Kamailio's optional sipt module lets remote, unauthenticated attackers crash the SIP server by sending crafted SIP-T/ISUP messages. The flaw lives in isup_get_calling_party() (and the sibling called/redirecting/redirection parses) in src/modules/sipt/ss7_parser.c, where a declared ISUP parameter length is copied into a fixed 26-byte static buffer without being checked against the actual packet length; affected releases are Kamailio up to and including 6.0.7 and 6.1.3. Per independent assessment the realistic impact is availability only (CVSS:3.1 C:N/I:N/A:L), not code execution, and exploitation requires the non-default sipt module to be loaded and its parsing functions invoked from kamailio.cfg on attacker-supplied SIP traffic; vendor-released patches exist in 6.0.8/6.1.4 (commit 3667bebf8d0bea07ed16218fd921d07db87aeb21, PR #4905), and no public exploit was identified at time of analysis.
Insecure deserialization in Project MONAI's nnUNetV2Runner (versions 1.2.0 up to but not including 1.6.1) lets an attacker who can write to a nnU-Net results directory tamper with inference_information.json and redirect the postprocessing_file field to a malicious Python pickle anywhere on the filesystem, which is then unpickled when predict_ensemble_postprocessing runs, giving arbitrary code execution in the MONAI process. Exploitation is local and requires pre-existing low-privilege filesystem write access plus a legitimate operator subsequently invoking the runner (passive user interaction), so it is a shared-host/multi-tenant concern rather than an internet-facing remote threat; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. The path-confinement fix and a pickle opt-in gate (MONAI_ALLOW_PICKLE) are available from the vendor as of MONAI 1.6.1, with an associated upstream commit.
An out-of-bounds write in the native library libsamsungtts.so, part of the Samsung Text-to-Speech engine shipped on Samsung Android builds, allows code running locally on the device to corrupt memory and achieve arbitrary code execution in the TTS process context. The vulnerable component is reachable without special privileges or user interaction (CVSS 4.0 PR:N/UI:N), but the attack vector is local (AV:L), so the attacker must already have a malicious or compromised app or local process able to invoke the TTS engine and supply crafted input; there is no remote/network exploitation path. Samsung addresses the flaw in the SMR Oct-2026 Release 1 maintenance update, and no public exploit code has been identified at time of analysis.
Out-of-bounds write in Samsung's libsmkvextractor.so media-extraction library allows arbitrary code execution on Samsung mobile devices running firmware prior to SMR Oct-2026 Release 1. Exploitation requires local access - an attacker must already hold a foothold on the device or get a crafted MKV/Matroska media file into a local parsing path - yet the CVSS 4.0 vector requires no privileges and no user interaction (AV:L/PR:N/UI:N), and our independent CVSS 3.1 assessment (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) rates the impact as high integrity, low confidentiality, and low availability. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV.
Heap buffer overflow in FreeRDP 3.0.0 through 3.31.x allows an attacker who controls a physical smartcard token to corrupt heap memory during PKCS#11 smartcard logon, potentially achieving code execution with the privileges of the FreeRDP client. The flaw is in collect_keys(), which enumerates public key objects across PKCS#11 slots into a fixed 64-entry array without bounds checking; a token exposing more than 64 keys with attacker-controlled CKA_ID and CKA_LABEL values overflows the array. Exploitation requires PKCS#11 smartcard authentication to be configured, physical presentation of the malicious token, and user-initiated logon, and no public exploit code or active exploitation is known at time of analysis; this is a constrained, physically proximate issue rather than a mass-exploitation priority.
Stack exhaustion in the ImageMagick MSL decoder affects 6.x before 6.9.13-57 and 7.x before 7.1.2-32, allowing remote, unauthenticated attackers to crash the image-processing process by supplying a set of crafted MSL images whose cross-references drive the decoder's recursion past its stack limit; the result is availability-only denial of service with no confidentiality or integrity impact. Reachability is conditional: MSL is a scripting pseudo-coder rather than a normal raster format, so the target application must actually pass attacker-controlled MSL input to ImageMagick, and MSL is commonly disabled or restricted through the security policy.xml, which both the vendor advisory and independent analysis identify as the primary limiting factor. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis; vendor patches are available as fixed releases 6.9.13-57 and 7.1.2-32.
Repeated processing of attacker-supplied JNG images by ImageMagick before 6.9.13-57, or 7.x before 7.1.2-32, leaves temporary files on disk, letting unauthenticated remote attackers gradually exhaust storage and degrade service availability. The effect is cumulative rather than immediate: a single crafted file leaks only a small amount of disk, so meaningful impact requires many submissions and depends on the host's free space and temporary-directory quotas. Vendor patches exist for both release lines (6.9.13-57 and 7.1.2-32), and no public exploit code or confirmed actively exploited (CISA KEV) status was identified at time of analysis; the CVSS 4.0 score of 6.9 reflects low availability impact only, with no confidentiality or integrity effect.
A memory leak in ImageMagick's SVG encoder (WriteSVGImage) causes allocated memory to be unreleased when crafted images drive the encoder into specific error paths, allowing repeated processing of such images to exhaust available memory and degrade or halt the service. Affected are releases before 6.9.13-57 (6.x) and 7.x before 7.1.2-32, and exploitation requires the target deployment to actually write or convert images to SVG output, not merely read SVG input. The issue is availability-only (no confidentiality or integrity impact), no public exploit code has been identified at time of analysis, and vendor patches are available.
Absolute path traversal in the SiYuan kernel's private plugin HTTP server (SiYuan 3.7.0 through 3.8.5) allows an attacker-supplied kernel plugin to read any file readable by the SiYuan process, including the API token and conf.json, by returning an absolute path in its handler's ResponseFile.Path that the kernel passes unvalidated to gin's Context.File. The plugin's private endpoint requires no authentication or privileges to reach (PR:N), but the CVSS 4.0 vector carries UI:A and our assessment confirms the decisive precondition is user action: a victim must install and load a malicious third-party kernel plugin, so a default installation is not exposed on its own. No public exploit identified at time of analysis and the issue is not in CISA KEV; vendor-released patch is SiYuan 3.8.6, which rejects any path resolving outside the workspace.
Memory exhaustion in SurrealDB 3.1.0 through 3.2.x lets a Surrealism module crash the entire server, denying service to every namespace and database it hosts. The flaw is that host-side buffering of module stdout/stderr output is unbounded and bypasses the configured per-module memory limit, so a module that writes output without newline characters grows the host buffer until memory is depleted. It is confirmed as a privilege-gated issue: an attacker must hold Owner-level rights to install the malicious module (CVSS vector PR:H), and no public exploit code or active exploitation has been identified at time of analysis; instances that do not use Surrealism modules are not exposed.
Malformed XMP metadata profiles in ImageMagick builds from 7.1.1-7 up to (but not including) 7.1.2-32 cause a heap buffer over-read that lets an attacker read past the end of an allocated buffer and typically crash the process. The flaw sits in the XMP profile synchronization code and is reachable by unauthenticated remote attackers (CVSS:4.0 PR:N/UI:N) whenever a service parses an untrusted image - upload handlers, thumbnailers, format converters, PDF/report generators, or any pipeline using an affected library build. Impact is limited to availability (VC:N/VI:N/VA:L, independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), so the realistic outcome is a denial-of-service crash rather than code execution or confirmed data disclosure; no public exploit code or CISA KEV entry has been identified at time of analysis, and a vendor patch is available.
Account enumeration in Cockpit CMS 2.14.1 allows unauthenticated remote attackers to identify valid usernames and email addresses by measuring response-time differences at the /auth/check login endpoint. The flaw is an incomplete timing fix: existing accounts trigger two bcrypt operations while non-existent accounts trigger only one, producing a statistically observable signal. The independent assessment rates this as a genuine-but-moderate information disclosure with no public exploit identified at time of analysis, and an upstream fix commit is available.
Unauthenticated remote attackers can invoke specific Frappe ERPNext endpoints that fail to enforce authorization checks, allowing them to create records and enumerate availability even when an administrator has disabled the corresponding feature. The flaw affects ERPNext before 15.110.0 and 16.x before 16.21.0, is classified as CWE-862 (missing authorization), and carries a moderate risk profile (6.9 CVSS v4.0; independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) with impact bounded to low-integrity and low-availability effects and no data disclosure, code execution, or privilege escalation. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; exploitation is nonetheless trivial for any network-reachable instance because no authentication, user interaction, or special conditions are required.
Arbitrary local file read in Craft CMS 4.0.0 through 4.18.6 and 5.0.0 through 5.10.13 lets a user who can set an entry-type title format - directly or by applying project config - abuse the Twig create('DOMDocument').loadHTMLFile() chain to read files from the server filesystem and surface their contents to non-admin users who can view the affected entries. The vulnerability stems from Craft's create() class blocklist omitting the DOMDocument class, and it is limited to confidentiality impact (CVSS 6.9, PR:H, C:H/I:N/A:N) because the attacker must already hold a high-privilege configuration capability rather than anonymous access. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority information-disclosure issue rather than an emergency, and it matters most in multi-role deployments where the configuring user is distinct from and more privileged than the entry-viewing users who receive the leaked file contents.
ImageMagick releases before 6.9.13-57 and 7.x before 7.1.2-32 expose a single uninitialized byte of process memory through the internal PostScript (PS) decoder, allowing unauthenticated remote attackers who can submit a crafted PS file to read one byte of stale heap contents via the decoded ICC profile. The root cause is an off-by-one in ReadPSInfo in coders/ps.c, where the ICC profile string length is set to the decoded length plus one, so the buffer is one byte longer than the data written into it. Exploitation requires that the application actually routes attacker-supplied PostScript into ImageMagick and that the resulting output (for example the generated image or its ICC profile) is returned to the attacker; no public exploit code or confirmed active exploitation was identified at time of analysis, and the practical impact is capped at a single byte per request with no integrity or availability effect, making this a low-to-moderate priority issue despite the 6.9 CVSS 4.0 base score.