Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the browser's Media component, affecting all desktop Chrome builds prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by getting a victim to load a crafted HTML page; the CVSS vector requires user interaction (UI:R), so there is no zero-click path, and no public exploit has been identified at time of analysis. Impact is scoped to the renderer (S:U), meaning a successful exploit yields code execution within the sandbox rather than host compromise unless chained with a separate sandbox escape; Google classifies the issue as High severity and has shipped a fixed build.
Use-after-free in the DOM component of Google Chrome prior to 155.0.8059.79 allows unauthenticated remote attackers to potentially execute arbitrary code inside the renderer sandbox by convincing a user to load a crafted HTML page (UI:R). With a CVSS score of 8.8, exploitation yields high confidentiality, integrity, and availability impact within the browser process, though full host compromise would require an additional sandbox escape not covered by this CVE. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a patched version.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) is achievable by a low-privileged, locally positioned attacker who abuses an incorrect authorization flaw to escalate into code execution in the context of the current user. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C, score 8.8) shows the barrier is a valid low-privileged account plus local/session reach to the server rather than unauthenticated network access, and no user interaction is needed. No public exploit code or confirmed active exploitation was identified at time of analysis; the practical risk is real but is gated by the authenticated-plus-local prerequisites, keeping it below a pre-authentication remote code execution scenario.
Privilege escalation in Mozilla Firefox's Panning and Zooming component lets an attacker who gets a target to render crafted content cross a privilege boundary inside the browser, with high impact to confidentiality, integrity and availability (CVSS 8.8). Affected builds are Firefox before 158 and Firefox ESR before 153.5, which Mozilla fixed via advisories mfsa2026-106, mfsa2026-108, mfsa2026-109 and mfsa2026-110. Exploitation status: no public exploit identified at time of analysis, and EPSS is low at 0.19% (8th percentile), but the input vector and our independent assessment disagree on the exploit preconditions (PR:L/UI:N versus PR:N/UI:R), so reconcile those signals before prioritization; authentication requirements are not confirmed from available data.
Privilege escalation in Mozilla Firefox's Application Update component allows a locally present, low-privileged attacker to elevate their privileges on the affected host, with the input CVSS 3.1 score of 8.8 (High) reflecting complete confidentiality, integrity, and availability impact. Exploitation requires only low privileges with no user interaction and is limited to unpatched builds prior to Firefox 158 and Firefox ESR 153.5; systems updated to those versions are not affected. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) signal, with the EPSS score remaining low at 0.19% (8th percentile).
Arbitrary code execution in Adobe ColdFusion (2023 at or below 2023.0.25, and 2025 at or below 2025.0.13) arises from an incorrect authorization flaw (CWE-863) that allows a low-privileged, authenticated actor to bypass intended access checks and execute code in the context of the current user, with no user interaction required. The vendor-assigned CVSS 3.1 base score is 8.8 (High) with a changed scope (S:C) and high impact across confidentiality, integrity and availability. The vector specifies a local attack path (AV:L) requiring low privileges (PR:L), which is consistent with the assessment that an attacker must already hold a low-privileged ColdFusion account or session; no public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Xen Hypervisor contains a grant-table race condition (XSA-517) in which a v2-to-v1-to-v2 version transition frees and then reallocates status pages, leaving stale pointers that other grant-table operations can race against. A local, authenticated attacker who controls a guest and can drive that transition may break the guest-to-host boundary, with scope change and high confidentiality, integrity, and availability impact (assessed CVSS 8.8); exploitation requires winning a timing-sensitive race, EPSS is low at 0.18%, and no public exploit identified at time of analysis.
Integer overflow in Mozilla Firefox's Graphics component (CWE-190) can lead to memory corruption and potential remote code execution when a user loads a malicious web page. Affected versions are prior to Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5; exploitation requires user interaction (UI:R) and no authentication. No public exploit code has been identified, and the EPSS score is low at 0.16% (5th percentile), though the vulnerability is rated high severity (CVSS 8.8).
Cross-tenant authorization bypass in Lowcoder (versions 2.1.0 through and including 2.4.10) lets an authenticated administrator or developer from one organization execute a library query that belongs to a different organization by sending a crafted request containing the victim's library-query identifier to the library-query execution endpoint. The flaw yields full confidentiality, integrity, and availability impact against the targeted tenant's query data (CVSS 8.8, PR:L), but only on shared multi-organization deployments where the attacker already holds a privileged account and can determine a valid target identifier. No public exploit code and no CISA KEV activity have been identified at time of analysis, and EPSS is low at 0.16% (5th percentile), so this is a credible but context-dependent priority rather than a mass-exploitation threat.
Privilege escalation in the Xen hypervisor's XPTI (Xen Page Table Isolation) implementation can let an attacker who already controls a 64-bit PV guest on a sufficiently large-memory host break isolation between that guest and the hypervisor. The flaw lies in the page-table shadowing logic: XPTI copies guest root page-table entries via the directmap, but a PV guest's directmap does not necessarily cover all physical memory, so hosts with RAM extending past the 5 TiB boundary (3.5 TiB with CONFIG_BIGMEM=y) can cause the hypervisor to operate on entries it cannot correctly read, resulting in scope-changed high confidentiality, integrity and availability impact. Exploitation is local (AV:L/PR:L), requires PV mode rather than the default HVM/PVH guest types, and XPTI must be active; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and EPSS is low at 0.16% (5th percentile).
Incorrect boundary conditions in Mozilla Firefox's SVG rendering component can be triggered when a user opens a crafted or compromised web page containing malicious SVG content, resulting in memory corruption with high confidentiality, integrity, and availability impact. The flaw affects Firefox versions before 158 and Firefox ESR before 153.5; it requires user interaction (UI:R) but no authentication (PR:N), and no public exploit code has been identified at time of analysis (EPSS 0.16%, 5th percentile).
Privilege escalation in Mozilla Firefox's WebExtensions component allows an extension-level actor to gain capabilities beyond those it was granted, yielding high confidentiality and integrity impact; all Firefox builds prior to version 158 are affected, with the fix delivered in Firefox 158 via Mozilla security advisories mfsa2026-106 and mfsa2026-109. Exploitation requires a low-privileged foothold - in practice an already-installed malicious or compromised browser extension reaching the vulnerable privilege-management code path (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-269) - and no public exploit code has been identified at time of analysis. EPSS is low at 0.16% (4th percentile) and the flaw is not listed in CISA KEV; signals are mixed and point to a moderate, not emergency, priority, with the AV:N rating questionable for an extension-context escalation and worth verifying with Mozilla.
Firefox for iOS versions prior to 157.1 interpolate a page's HTML lang attribute directly into the browser's translation JavaScript, so crafted markup in that attribute executes as code inside Firefox's privileged content world and escapes the page's Content Security Policy - a scope-changing outcome in the independent assessment. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction: the victim must open an attacker-controlled or compromised page and cause the page-translation feature to process it, and CISA's SSVC rates the flaw as not automatable. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV; the vendor fixed it in Firefox for iOS 157.1, so the practical priority is prompt upgrade rather than emergency response.
Incorrect authorization in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an authenticated, locally-positioned low-privileged attacker to execute arbitrary code in the context of another user, with a changed security scope. The flaw maps to CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (base 8.8): exploitation requires an existing low-privilege account or session plus local access to the server or application context, and it needs no user interaction. No public exploit has been identified at time of analysis, and the high confidentiality, integrity and availability impact is bounded by the fact that an external unauthenticated attacker cannot trigger the issue without first obtaining a foothold and valid low-privilege credentials on an unpatched instance.
Incorrect authorization (CWE-863) in Adobe ColdFusion 2023 up to 2023.0.25 and ColdFusion 2025 up to 2025.0.13 allows a low-privileged attacker with local access to execute arbitrary code under the context of the current user without user interaction (CVSS 8.8, scope changed). No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, but the Adobe PSIRT 'Authentication Bypass' tag suggests the authorization barrier may be weaker than the PR:L metric implies-defenders should verify the true prerequisite set in APSB26-144. Organizations running affected builds should treat this as a credible priority while confirming whether any authenticated session is truly required.
Authenticated low-privileged users on Adobe ColdFusion 2023 through 2023.0.25 and ColdFusion 2025 through 2025.0.13 can exploit an incorrect authorization weakness (CWE-863) to execute arbitrary code in the context of the current user, with changed scope extending impact beyond the vulnerable component. The assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (8.8), so an existing low-privileged account is required and no user interaction is needed; the AV:L value suggests local/console-adjacent access even though the supplied tags include Authentication Bypass and RCE. No public exploit was identified at time of analysis; this is a high-severity, high-priority flaw warranting prompt patching, but the attack-vector and tag conflict should be confirmed with Adobe.
Incorrect authorization handling in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an attacker who already holds a low-privileged ColdFusion session or local access to the server to bypass authorization checks and execute arbitrary code in the context of the current user, with no user interaction required. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C) makes clear this is not an anonymous remote flaw despite the 'Authentication Bypass' tag - obtaining a low-privileged account or local foothold is the gating prerequisite, after which complexity is low and impact is high across confidentiality, integrity, and availability with a scope change. There is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited; a vendor fix is available via Adobe advisory APSB26-144, so systems already patched past 2023.0.25 / 2025.0.13 are not affected.
A stack-based buffer overflow in the web service upload-handling code of Siemens APOGEE and TALON building-automation controllers allows an unauthenticated remote attacker to crash the device, producing a denial-of-service condition. Affected platforms include APOGEE PXC Compact and PXC Modular (BACnet all versions before V3.5.7, P2 Ethernet all versions before V2.8.21), TALON TC Compact and TC Modular (BACnet all versions before V3.5.7), and the APOGEE MBC/MEC (PPC) variants in BACnet and P2 Ethernet builds, which are listed as affected in all versions. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but exploitation is trivial from a network standpoint - the CVSS vector confirms PR:N/UI:N with low attack complexity - so any controller whose HTTP upload interface is reachable is at risk. Siemens rates this CVSS 4.0 8.7; our independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Denial of service in the embedded web service of Siemens APOGEE MBC/MEC (PPC), APOGEE PXC Compact/Modular, and TALON TC building-automation controllers, caused by improper validation of multipart input that can crash the service via a stack buffer overflow (CWE-121). An unauthenticated remote attacker with network reachability to the controller's HTTP interface (CVSS PR:N/UI:N) can send a crafted multipart request and take the web service down; the assessed impact is availability-only (C:N/I:N/A:H), with no confidentiality or integrity loss demonstrated. Exploitation is bounded by exposure: these are OT field panels normally expected on segmented building networks, and no public exploit code has been identified at time of analysis - this is a credible OT risk for internet- or IT-reachable controllers, not a confirmed widespread-exploitation emergency. All-version APOGEE MBC/MEC (PPC) models carry the highest residual risk because no fixed version is listed for them, whereas APOGEE PXC Compact/Modular (BACnet) and TALON TC are fixed at V3.5.7 and the P2 Ethernet PXC Compacts at V2.8.21.
Unauthenticated remote attackers can cause a denial of service on Siemens APOGEE MBC/MEC, PXC, and TALON building automation controllers by sending a crafted input that triggers a stack-based buffer overflow (CWE-121) in the device's FTP service. The flaw affects all versions of the MBC and MEC PPC families and PXC/TALON TC models below BACnet V3.5.7 or P2 Ethernet V2.8.21. No public exploit code or confirmed active exploitation has been identified, and the impact is limited to availability (no confidentiality or integrity impact); real-world risk hinges on whether the FTP service is enabled and reachable from an attacker's position on the OT network.
Command permission gate bypass in Mistral Vibe before 2.25.4 lets input processed by the agent cause arbitrary shell command execution with the privileges of the agent's terminal session, while the allowlist gate reports that only a trailing, allowlisted command was run. The bypass hides a command substitution inside a single-quoted variable value that the agent's tree-sitter-bash static parser cannot see, then triggers execution at runtime through bash's ${var@P} prompt-transform operator; the vendor has fixed the misclassification in 2.25.4. Exploitation is conditional rather than opportunistic - an operator must be running an agent session over attacker-controlled content (prompt injection in untrusted files, repositories, web content, or tool output) and a bash shell with promptvars enabled must be in use - and no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated remote attackers can crash Node.js servers running Qwik server-side rendering by sending a crafted resource value that triggers an unhandled promise rejection, affecting @builder.io/qwik before 1.20.0 and @qwik.dev/core before 2.0.0-beta.37. This is an availability-only denial-of-service (CWE-248) assessed at CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), requiring no authentication or user interaction. No public exploit code or CISA KEV status is reported, but a single request can terminate a process under Node.js default unhandled-rejection policy.
Permission validation bypass in Mistral Vibe versions before 2.25.5 allows an attacker who can get crafted text in front of the agent to have arbitrary shell commands executed under the user's own privileges, despite the tool's command allowlist. The flaw is a parser disagreement: tree-sitter-bash truncates a backslash-newline continuation and sees only an allowlisted prefix such as 'cd', while bash joins the lines and runs a materially different command (for example a curl request), so resolve_permission grants ALWAYS for the benign-looking prefix and the hidden command executes. Exploitation requires the allowlist / auto-approval mechanism to be in use and requires the user to direct the agent at malicious input (UI:P per the CVSS 4.0 vector, UI:R in the CVSS 3.1 assessment), so it is not fully autonomous, and no public exploit code or confirmed active exploitation was identified at time of analysis. Vendor-released patch: 2.25.5.
Repeated multipart file uploads to Misskey servers running versions 13.0.0 through 2025.4.1, or 2025.5.0 through 2026.7.0, can exhaust server storage and file descriptors and cause a denial of service, because temporary upload files are not reliably deleted after processing. The vulnerable upload path writes the temp file to disk before authentication is performed, so unauthenticated remote attackers can trigger it, and the behaviour holds regardless of whether federation is enabled. A single request is harmless - the impact is cumulative across sustained uploads - and the issue is resolved in Misskey 2026.7.0; no public exploit code has been identified at time of analysis.
A heap-based buffer overflow in the optional Microsoft Windows Raw Image Extension allows remote code execution in the context of the invoking process when a user opens or previews a crafted RAW image file. Affected versions are 2.1.0.0 up to but not including 2.4.36.0; because exploitation requires user interaction (UI:R) with a malicious file and is not automatable, systems that do not have the extension installed are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.
Use-after-free in the Windows Camera Frame Server Monitor - the default-running component of the Windows 11 and Windows Server camera frame-server stack - permits an unauthenticated (PR:N), zero-interaction (UI:N) attacker to corrupt memory and execute code in a higher-integrity context, yielding full confidentiality, integrity and availability impact (C:H/I:H/A:H, CVSS 8.8). The single meaningful obstacle to exploitation is the adjacency requirement: the CVSS vector is AV:A, so the attacker must already occupy the same layer-2 segment, subnet or local LAN as the target and cannot reach the service directly across the public internet, which substantially narrows the exploitable population to actors who have obtained a local network foothold. Microsoft has shipped fixed builds for every affected Windows 11 and Windows Server branch, and CISA's SSVC assessment records exploitation as 'none' with automatable 'no'; no public exploit code or confirmed active exploitation was identified at time of analysis, leaving the overall priority moderate rather than emergency.
Heap-based buffer overflow in Windows Image Acquisition (WIA) allows an unauthenticated remote attacker to execute arbitrary code on Windows 11 (24H2, 25H2, 26H1, 26H2) and Windows Server 2025 systems, but only after the victim opens or processes a specially crafted image through the WIA component (UI:R), so exploitation requires user interaction rather than being zero-click. CVSS 3.1 scores this 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H / CWE-122), CISA's SSVC rates it Automatable: no with total technical impact, and no public exploit has been identified at time of analysis. Vendor patches are available from Microsoft, making this a high-priority patch-now issue for unpatched builds rather than an emergency driven by active exploitation.
Privilege escalation in Microsoft Exchange Server allows an attacker who already holds valid low-privilege authenticated access to the environment to perform operations well beyond their assigned permissions, achieving high impact to confidentiality, integrity, and availability (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is an incorrect authorization check (CWE-863): the server fails to properly validate whether the caller is entitled to the action being performed, so an 'authorized attacker' - a legitimate but under-privileged account - can elevate privileges over the network without any user interaction. Affected builds are Exchange Server 2016 CU23 before 15.01.2507.077, Exchange Server 2019 CU14 before 15.02.1544.050, Exchange Server 2019 CU15 before 15.02.1748.055, and Exchange Server Subscription Edition RTM before 15.02.2562.056; no public exploit code identified at time of analysis, CISA KEV does not list it, and SSVC records Exploitation as 'none' with Automatable 'no', so the practical gate is the need for a pre-existing authenticated foothold rather than remote unauthenticated mass exploitation. This is a genuinely high-priority vulnerability that warrants prompt patching, though the signals are mixed on urgency.
Heap-based buffer overflow in Microsoft's optional MPEG-2 Video Extension (versions 1.0.0.0 up to but not including 1.2.32.0) allows an unauthenticated attacker to execute code over a network by delivering a specially crafted MPEG-2 media file that a victim opens in an application that invokes the codec. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects a total technical impact offset by a required user interaction: the codec is a deliberate Microsoft Store add-on rather than a default Windows component, so the exposed population is limited to systems where it has been installed, and code executes only in the context of the user who opens the file. CISA's SSVC assessment rates exploitation as none and the flaw as not automatable, and no public exploit has been identified at time of analysis; a vendor patch is available.
Path traversal in on-premises Skype for Business Server (including the Microsoft Lync lineage) lets an attacker who already holds a low-privileged authenticated account on the service send a crafted network request containing an absolute file path and achieve code execution, scoring CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected builds are Skype for Business Server Subscription Edition before 7.0.2046.889, Skype for Business Server 2015 CU13 before 6.0.9319.886, and Skype for Business Server 2019 CU8 before 7.0.2046.583; the PR:L prerequisite means this is not a pre-auth remote exploit, so realistic risk concentrates on insiders or attackers who have already obtained a valid credential or foothold. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none and the flaw as non-automatable, and though no EPSS score was supplied, the total technical impact combined with an available vendor patch makes prompt upgrading the priority. This is a credible, actionable priority rather than an inflated-CVSS artifact.
Remote code execution in Microsoft's HEVC Video Extensions codecs allows an unauthenticated attacker to run arbitrary code on a Windows host when a victim opens or previews a maliciously crafted HEVC-encoded media file. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CVSS 8.8), no credentials are needed, but exploitation is not automatable because it hinges on user interaction (UI:R) and on the optional HEVC codec being installed - it is not present on every Windows system, though it ships preinstalled on many OEM devices, which narrows the exposed population. At time of analysis there is no KEV entry and no public exploit identified, so this is a credible, moderately high priority issue rather than a drop-everything emergency; the CWE-190 integer overflow/wraparound in Windows Codecs Library parsing corrupts memory in a way that can be turned into code execution.
An authenticated local attacker can exploit an untrusted search path in Microsoft .NET Framework to bypass a security feature and potentially execute arbitrary code, affecting versions 3.5, 4.6.2-4.7.2, 4.8, and 4.8.1 not patched to the latest builds. The vulnerability requires local access and the ability to write a malicious file to a directory in the .NET assembly search order, but no user interaction. No public exploit code has been identified, and CISA's SSVC reports no observed exploitation; vendor patches are available.
Type confusion (CWE-843) in Microsoft .NET and Visual Studio allows an unauthenticated remote attacker to elevate privileges when a victim opens, loads, or builds attacker-supplied content in developer tooling, rated CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is not zero-click: an attacker must socially engineer a developer into processing a malicious file, project, or package so the type-confusion code path is reached, and the practical limiting factor remains that user-interaction requirement. No CISA KEV entry, no public exploit code, and no EPSS data were provided at time of analysis, so this is a credible high-priority issue but with important caveats.
Privilege escalation in Mozilla Firefox's WebExtensions component allows remote attackers to reach high confidentiality, integrity, and availability impact inside the browser's privileged context, provided the victim performs an interaction such as visiting attacker-controlled content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8). Unauthenticated attackers can reach the flaw over the network against default installations, but the required user interaction rules out a zero-click drive-by path. All Firefox builds before 158 and Firefox ESR builds before 153.5 are affected; upgrading to 158 or ESR 153.5 removes the condition. There is no public exploit identified at time of analysis and CISA's SSVC decision framework rates exploitation as 'none' and automatable as 'no', making this a genuine high-priority patch item rather than an emergency.
Privilege escalation in the DOM: Navigation component of Mozilla Firefox (prior to 158) and Firefox ESR (prior to 153.5) lets an unauthenticated attacker gain elevated privileges inside the browser when a victim loads attacker-controlled web content, producing high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, CWE-269). The sole gate on exploitation is user interaction (UI:R, PR:N): the victim simply has to render a hostile or compromised page in an unpatched build, with no authentication, special configuration, or local access required. No public exploit code has been identified at time of analysis, and CISA's SSVC triage records exploitation as "none" with technical impact "total" and automatable as "no"; combined with the absence of KEV listing and EPSS data, this reads as a genuinely high-severity but not yet demonstrably exploited issue whose urgency depends on future exploit development. Vendor-released patches are available in Firefox 158 and Firefox ESR 153.5, and upgrading fully removes the exposure.
Privilege escalation and information disclosure in Mozilla's Process Sandboxing component let attacker-controlled web content break out of the Firefox content-process sandbox on unpatched installations - Firefox before 158 and Firefox ESR before 153.5 - with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is remote and requires no attacker authentication, but it is user-driven: the victim must actively load the malicious page, and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a targeted client-side risk rather than a mass-exploitation candidate. There is no public exploit identified at time of analysis, and vendor-released fixes ship in Firefox 158 and Firefox ESR 153.5 (MFSA 2026-106 and MFSA 2026-108).
Authenticated database users can escalate privileges and execute arbitrary operating-system commands on hosts running SIMATIC WinCC V7.5 (all versions), V8.0 before Update 11, and V8.1 before Update 7 because the application assigns excessive permissions to a database role (CWE-266). Exploitation requires a remote attacker to already hold valid database credentials and network reachability to the WinCC database service, but no user interaction is needed; no public exploit code has been identified at time of analysis. Siemens rates the issue 8.7, and while the impact is high, our independent assessment classifies it as a credible operational-technology priority rather than an emergency because the prerequisite of authenticated database access and network segmentation limits the realistic attack surface.
Rapyd Admin 9.0.0 through 9.19.x lets an authenticated company member holding the default `customer` role hijack arbitrary accounts through the Livewire `UsersModalEditEmbed` component: `editUser`, `save` and `deleteUser` trust a user id supplied by the browser and validate only a permission, so a low-privileged member can reset an owner's or super admin's password, promote themselves to `owner`, and delete users. Exploitation requires a logged-in account with the default `customer` role (which carries `edit own users`) and predictable sequential user ids - per the vendor changelog public self-registration is open, so any attacker can obtain that role, and no other non-default configuration is needed. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); vendor-released fix: 9.20.0 (the changelog attributes the security release to 9.19.0).
Unauthenticated resource exhaustion and outbound request amplification in Misskey's fetch-rss API affect versions 12.112.1 through releases prior to 2026.7.0. Any remote attacker can repeatedly call the publicly reachable endpoint, which in affected versions had no rate limiting, no response-size cap, and no concurrency bound, forcing the instance to open unbounded outbound HTTP connections and perform synchronous XML parsing; this drains instance CPU, memory, and socket resources, can be used as an amplification vector against third-party servers, and can probe network-reachable services even when federation is disabled. CVSS 4.0 scores the flaw 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N, high availability impact with limited scope change), no public exploit code or CISA KEV entry was identified at time of analysis, and the issue is fully remediated by upgrading to 2026.7.0.
Missing authorization in Wukong AICRM through 20260610 allows any authenticated user, without administrator privileges, to invoke user, role, department, and agent administration APIs and take over the administrator account. By sending a POST to /managerUser/updateUser, an attacker with any valid low-privileged account can reset the admin password and assign themselves the 'all' role, achieving full administrative control. The flaw is rated CVSS 8.7 (High) with network reachability, low attack complexity, and no user interaction; no CISA KEV entry was present and no public exploit identified at time of analysis.
Path traversal in the Siemens .NET Client Library for the SIMATIC S7 Webserver API (all versions prior to V3.3.61) lets a remote attacker who controls or man-in-the-middles the server that the client downloads tickets from specify a crafted filename and thereby write arbitrary files outside the intended download directory. Integrity impact is high (VI:H) while confidentiality and availability impacts are none, consistent with the vendor's CVSS 4.0 base score of 8.7; the CVSS vector indicates no privileges (PR:N) or user interaction (UI:N) are required, so the only real prerequisite is that the attacker already occupies the server/MITM position relative to the victim client. The additional ability to replace existing files is limited to deployments where file overwriting is enabled. No public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation.
Unauthenticated retrieval of complete customer order records from fuint's /clientApi/order/detail endpoint exposes buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes to any remote attacker who can reach the application, and because orderId values are sequential the entire order table can be enumerated in bulk. The endpoint performs no Access-Token check whatsoever (CWE-306; CVSS 4.0 8.7, assessed CVSS 3.1 7.5 with PR:N, confidentiality-only impact), so no credentials, user interaction, or non-default configuration are required against builds at or before commit 4c4bc8a. No vendor-released patch was identified at time of analysis and no public exploit code was identified; a public technical writeup describing the unauthenticated IDOR is referenced in the advisory links, and practical risk is bounded mainly by how widely the affected fuint instance is exposed rather than by any exploitation difficulty.
Authenticated space administrators in Omnispace Agora Project releases before 26.10.0 can escalate to full general-administrator privileges by abusing the user-import flow, where caller-controlled agoraFields[] names are used directly as SQL column identifiers without validation. An attacker who already holds space-administrator rights can inject privileged column names such as generalAdmin, or use backtick-injection to escape the identifier context, and thereby set administrative flags on records processed by the import. The issue is tracked as CWE-89 and rated 8.7 under CVSS 4.0 (CVSS:3.1 equivalent AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H in our independent assessment); no public exploit code has been identified at time of analysis, and the flaw is fixed in Agora Project 26.10.0, making this a credible but not emergency-tier priority.
Unauthenticated path traversal in Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 lets any network-reachable attacker read arbitrary files from the server by placing parent-directory ('../') segments in the fullPath and fileName parameters of the fileManager /rest/retrieveFileStream endpoint, which is unauthenticated by design and backed by the Y9FileController.retrieveFileStream handler. Because the traversable location includes application configuration such as application.yml, successful exploitation exposes database, Redis and Nacos credentials - high confidentiality impact with no write or code-execution component. Both the vendor-source reference and the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N vector (7.5) confirm no authentication or user interaction is required; no public exploit identified at time of analysis, though a public technical write-up describing the traversal is referenced by VulnCheck.
SQL injection in the firmware-upload filename handling of Siemens RUGGEDCOM CROSSBOW (all versions prior to V6.0) lets an authenticated attacker who holds firmware-upload privileges run arbitrary SQL commands against the product's underlying database, giving high confidentiality, integrity, and availability impact to the CROSSBOW server itself (CVSS 4.0 base 8.7; assessed CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not pre-authentication: valid credentials with the specific firmware-upload right are mandatory, and the injected payload must be placed in the uploaded file's name rather than its contents, while no second-party user interaction is required. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing), and because CROSSBOW is a specialized OT access-management server normally deployed on segmented management networks, this is a credible but not top-tier priority.
SQL injection in the Value field of notification conditions handled by the Notification Profile configuration in RUGGEDCOM CROSSBOW (all versions before V6.0) allows an authenticated, suitably privileged user to execute arbitrary SQL commands against the product's underlying database. The flaw is network-reachable with no user interaction required, but it is gated by the privilege prerequisite - only accounts that can reach the Notification Profile configuration workflow can trigger it - so unauthenticated outsiders cannot exploit it directly; there is no public exploit identified at time of analysis. Siemens has published advisory SSA-508506 and V6.0 is the fixed release; given the high confidentiality, integrity, and availability impact on the CROSSBOW database and its OT-context role, this is a credible, actionable patch priority rather than an inflated alert.
Authenticated SQL injection in Siemens RUGGEDCOM CROSSBOW (all versions prior to V6.0) allows a user with the specific privileges needed to use the Bulk Import/Export workflow to execute arbitrary SQL commands against the underlying database via unsanitized facility name fields. The vulnerability is network-reachable, low-complexity, and requires no user interaction, but it is access-gated: a valid privileged account is mandatory, so an attacker lacking that workflow privilege cannot reach the vulnerable code. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published an advisory (SSA-508506) addressing the issue.
Authenticated privilege escalation in youlai-boot through version 2.21.1 lets any logged-in user grant administrator-equivalent permissions to their own role by sending a PUT request to /api/v1/roles/{roleId}/menus with arbitrary menu and button permission IDs, after which the application refreshes its Redis-backed permission cache so the elevated rights apply immediately, without re-login or administrator approval. The vulnerability is a missing authorization check (CWE-862) on a role-permission assignment endpoint rather than a memory-safety or injection flaw; exploitation requires a valid authenticated session (CVSS 4.0 PR:L, assessed CVSS:3.1 base 8.7, AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H), and the built-in GUEST test account shipped with default or demo deployments is explicitly sufficient. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, though a public technical writeup and the upstream fix commit are available, making this a credible, non-theoretical risk within youlai-boot deployment niches rather than a mass-exploitation threat.
Improper resolution of path equivalence (CWE-41) in Visual Studio Code allows an unauthenticated local attacker to bypass a security feature, likely Workspace Trust or restricted mode, by convincing a victim to open and interact with a crafted workspace or folder. The vulnerability requires user interaction and high attack complexity, and while it has a CVSS score of 7.7 (High), it is a moderate-priority developer-workstation issue rather than an internet-facing emergency. No public exploit code has been identified at time of analysis, and the exact affected versions should be confirmed via the linked Microsoft advisory.
Unauthenticated file disclosure in Omnispace Agora Project before version 26.10.0 allows any remote attacker who can reach the MobileFileDownload route to retrieve files they are not authorized to access. The route treats md5(filename) as a capability token rather than performing a real access-control check, and because MD5 is deterministic and unsalted, an attacker who guesses or otherwise learns a stored filename can compute a valid token and download the file. No credentials or user interaction are required (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), CISA's SSVC assessment records exploitation as none observed while noting the attack is automatable with partial technical impact, and no public exploit code has been identified at time of analysis; the practical constraint is how guessable the target filenames are. A vendor patch is available in release 26.10.0.