DOM-based cross-site scripting in Adobe Experience Manager 6.5 through 6.5.25 allows a low-privileged authenticated attacker to execute malicious JavaScript in a victim's browser session when the victim is socially engineered into visiting a crafted webpage while having an active AEM session. This moderate-severity, low-urgency issue requires user interaction and low-level privileges (CVSS PR:L), and no public exploit identified at time of analysis. Adobe has released a fix in version 6.5.26 per advisory APSB26-152.
DOM-based cross-site scripting in Adobe Experience Manager 6.5 (all releases up to and including 6.5.25) lets a low-privileged authenticated attacker inject and execute malicious JavaScript in a victim's browser by manipulating the DOM environment of a crafted page the victim is induced to visit. Because the CVSS vector carries PR:L and UI:R, exploitation requires an existing low-privilege foothold in AEM plus deliberate victim interaction, and the resulting impact is limited to Low confidentiality and Low integrity with no availability effect (the changed scope S:C means the script executes in the victim's browser context rather than the server's). This is a moderate-severity (CVSS 5.4) issue with no public exploit identified at time of analysis and no confirmed active exploitation, so it warrants routine patch-cycle handling rather than emergency response.
DOM-based cross-site scripting in Adobe Experience Manager 6.5 (all releases up to and including 6.5.25) lets a low-privileged attacker inject and execute arbitrary JavaScript in a victim's browser within the security context of the affected AEM instance, with a scope change (S:C) meaning the exploited component and the impacted component are different. At CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) the issue is held back by two prerequisites: the attacker must already hold low-level privileges on the instance (PR:L) and a victim must be socially engineered into visiting a crafted page or URL that manipulates the client-side DOM (UI:R), with only partial confidentiality and integrity impact and no availability impact. No public exploit code has been identified at time of analysis and there is no provided evidence of active exploitation (no CISA KEV listing); realistic exposure is greatest on internet-reachable AEM author or publish instances where low-privilege accounts exist.
DOM-based cross-site scripting in Adobe Experience Manager lets an attacker with low-privileged authenticated access craft a page that executes malicious JavaScript in a victim's browser session when that victim visits it. The issue affects AEM 6.5 LTS through 6.5 LTS SP3 and AEM 6.5 through 6.5.25, and the assessed vector (CVSS 5.4, S:C) indicates the payload can reach outside the vulnerable component's own security context, although confidentiality and integrity impact are both rated Low with no availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the mandatory victim interaction plus the attacker-authentication requirement keep realistic priority moderate rather than emergency.
DOM-based cross-site scripting in Adobe Experience Manager 6.5 through 6.5.25 allows an attacker holding a low-privileged authenticated account to craft a page that, when a victim visits it, runs malicious JavaScript in the context of the victim's browser session against the AEM UI. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, score 5.4) confirms the path is network-reachable and low-complexity but requires both that low-privilege account and victim user interaction, with impact capped at low confidentiality and integrity loss and no availability impact - the scope change (S:C) meaning the executed script reaches beyond the vulnerable AEM component into the victim's session. There is no public exploit code identified and no confirmed active exploitation (CISA KEV) at time of analysis, so this is a moderate-priority hardening item rather than an emergency patch cycle.
DOM-based cross-site scripting in Adobe Experience Manager 6.5 (0 through 6.5.25) and AEM 6.5 LTS (0 through 6.5 LTS SP3) allows an attacker to run arbitrary JavaScript in the browser context of an AEM user by steering them to a crafted page or URL that manipulates the client-side DOM, an issue rated CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Because the assessed vector carries PR:L and UI:R, a realistic attack needs a low-privileged authenticated AEM session plus victim interaction, which significantly narrows exposure compared with an anonymous, no-click flaw. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a medium-severity, non-urgent issue whose practical value to an attacker is limited to script execution and session/content manipulation inside the AEM origin rather than server-side compromise or denial of service.
DOM-based cross-site scripting in Adobe Experience Manager 6.5 LTS (through SP3) and Adobe Experience Manager 6.5 (through 6.5.25) lets an attacker execute arbitrary JavaScript inside a victim's browser session by manipulating the page DOM, yielding low confidentiality and integrity impact and a changed scope (S:C). Exploitation requires an authenticated low-privileged account (CVSS PR:L) and active victim interaction (UI:R), since the target must be lured to an attacker-crafted webpage, so the issue cannot be automated or run unattended. No public exploit code has been identified and there is no evidence of active exploitation - CISA's SSVC assessment records exploitation as 'none' and technical impact as 'partial' - making this a moderate rather than high-priority issue.
Memory-corruption flaws in Mozilla Firefox's JavaScript JIT compiler can be triggered when a user loads attacker-controlled web content, allowing partial memory disclosure or corruption. The issue is unauthenticated from the network perspective but requires user interaction (CVSS UI:R), and no public exploit code has been identified at time of analysis; EPSS is low at 0.25%. It is fixed in Firefox 158 and Firefox ESR 153.5.
Stored cross-site scripting in blob42 gosuki (all versions up to and including commit 6e2bf34) allows an authenticated attacker (low-privilege, PR:L per the CVSS vector) to inject a crafted bookmark URL or DisplayURL value that executes arbitrary JavaScript in a victim's browser when the local bookmark list page is rendered. The vulnerability is rated CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, CWE-79), with EPSS at 0.23% (13th percentile), no CISA KEV entry, and no public exploit identified at time of analysis. Impact is confined to the victim's browser session (low confidentiality and integrity, no availability effect), and exploitation depends on malicious bookmark data being stored and then viewed by a user in the affected web interface.
Missing auth_time validation in auth0.js 9.12.0 up to (but not including) 10.3.0 lets an integrating application accept an ID token that represents an authentication event older than the maxAge window it requested from authorize(), weakening the freshness guarantee behind step-up or re-authentication flows. The impact is bounded rather than catastrophic: an attacker must already hold or leverage a valid-but-stale authentication session (CVSS PR:L, assessed as AC:H with no confidentiality impact and limited integrity impact), and only applications that actually pass maxAge to authorize() and rely on that value are affected. Okta PSIRT has published a vendor fix, available in auth0.js 10.3.0 and later, and no public exploit code has been identified at time of analysis.
Mozilla Firefox's Enterprise Policies component can be bypassed by remote, unauthenticated attackers who persuade a managed user to load crafted content, allowing that content to evade administrator-configured restrictions with limited confidentiality and integrity impact (CVSS 5.4). Only Firefox installations actively managed through policies.json, Windows GPO, or macOS configuration profiles are meaningfully exposed, since unmanaged installations have no enterprise policy to circumvent. No public exploit code has been identified at time of analysis, and EPSS is low at 0.20% (9th percentile).
Information disclosure in the Windows Remote Desktop Protocol lets an authenticated remote attacker trigger an out-of-bounds read and leak memory contents over the network, with affected builds spanning Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025. Exploitation requires the target's RDP service to be enabled and network-reachable plus valid credentials (PR:L, consistent with Microsoft's 'authorized attacker' wording), and a high-complexity precondition outside the attacker's control must also be satisfied (AC:H), which is why the CVSS score is held to 5.3 even though the confidentiality impact alone is rated High. Impact is confined to information disclosure - no integrity or availability effect - and no public exploit has been identified at time of analysis; Microsoft has published an update-guide entry and vendor patches are available.
Incorrect boundary conditions in Mozilla Firefox's Graphics: Canvas2D component allow a remote, unauthenticated attacker to corrupt memory when a victim loads attacker-controlled web content, yielding low-level confidentiality and integrity impact with no availability effect (CVSS 5.4, AV:N/AC:L/PR:N/UI:R/C:L/I:L/A:N). Only browsers below Firefox 158 and Firefox ESR below 153.5 are affected; exploitation is bound by mandatory user interaction, since the victim must actually navigate to or open a page that exercises the 2D canvas rendering path. No public exploit code has been identified at time of analysis and the EPSS score is low at 0.19% (8th percentile), consistent with the assessment that this is a moderate-severity memory-safety issue rather than an urgent-priority threat.
Privilege escalation in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.9) allows an authenticated low-privileged user to bypass authorization checks and carry out management operations beyond their assigned role, but only on servers where the optional restConnector-2.0 feature has been explicitly enabled. It carries a medium CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) as a CWE-863 improper authorization flaw, meaning credentials are required, no user interaction is needed, and impact is limited to low confidentiality and integrity loss with no availability impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exposure is meaningfully limited because a bare default server.xml does not enable this connector.
Cross-site scripting in the Symantec Endpoint Detection and Response (SEDR) Console prior to version 4.13 lets an authenticated, low-privileged console user inject script that is then rendered and executed in another user's session, potentially exposing console functionality and information normally restricted to that victim. Exploitation is not unauthenticated: it requires a valid low-privileged account (PR:L) and a second user to interact with the crafted content (UI:R), with impact confined to in-session confidentiality and integrity and no availability effect (CVSS:3.1 base 5.4, Medium). No public exploit identified at time of analysis, and no active exploitation is indicated.
An integer overflow (CWE-190) in Firefox's Layout: Text and Fonts component can be triggered when a user renders attacker-controlled web content containing malformed text or font data, potentially causing memory-safety corruption in the browser process. The vulnerability affects Firefox builds prior to version 158 and Firefox ESR builds prior to 153.5, is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R), but requires the victim to load the crafted page, and its assessed impact is bounded to low confidentiality and integrity effects with no availability impact (score 5.4). Exploitation is not confirmed in the field: there is no CISA KEV listing and no public exploit identified at time of analysis, and the EPSS score of 0.15% (4th percentile) indicates a low predicted likelihood of exploitation activity.
Authenticated cross-site scripting in HCL Connections allows a low-privileged logged-in user to place script into content that then executes in another user's browser, enabling theft of cookie-based session credentials and takeover of the victim's account. Exploitation requires a valid authenticated account on the deployment (PR:L) plus victim interaction with the crafted page or link (UI:R), and impact is limited to the victim's browser session with no availability impact; the vendor and independent analysis both rate this moderate at CVSS 3.1 base 5.4. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the affected feature is not individually named in the advisory text.
Incorrect privilege assignment in Huawei openUBMC causes the SNMP pseudo-identity group (special_users, including the SNMPv1_v2c pseudo-user) to be granted the complete nine-privilege set, so an attacker who already holds valid low-privilege SNMP credentials can drive mapped backend operations as an administrative identity. The flaw sits in route_mapper/account.lua, where get_user_privilege returns full privileges for the SNMP caller identity rather than the caller's actual role; exploitation requires network-reachable SNMP (SNMPv1/v2c community string or SNMP user) and is bounded to operations exposed through the SNMP-to-backend route mapping. It is rated medium severity (CWE-266) with no confirmed active exploitation and no public exploit identified at time of analysis, so it should be treated as a privilege-escalation hardening issue rather than an emergency.
Incorrect boundary conditions in Mozilla Firefox's Layout component prior to version 158 allow remote, unauthenticated attackers to cause low-severity confidentiality and integrity impact by enticing a user to render attacker-controlled web content; the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) confirms that user interaction is mandatory and that availability is not affected. No public exploit code has been identified and there is no CISA KEV entry at time of analysis, while the EPSS score is low at 0.15% (4th percentile), consistent with a moderate, not urgent, priority. The flaw is a memory-buffer boundary error (CWE-119) fixed in Firefox 158.
Cross-site scripting in applications based on SAP GUI for HTML on SAP NetWeaver Application Server ABAP lets an authenticated attacker (PR:L) inject malicious content through functionality that does not sufficiently sanitize user-supplied input, with the script executing in a second user's browser once that victim interacts with the poisoned content (UI:R). The flaw is rated CVSS 5.4 (CWE-79), with scope change and low confidentiality/integrity impact and no availability impact; SAP is the reporting vendor and has published Security Note 3671819. There is no public exploit identified at time of analysis and no CISA KEV listing, so this should be treated as a medium-severity, credentialed-to-credentialed escalation path rather than an internet-facing emergency.
Denial of service in the Windows Kernel can be triggered by an unauthenticated, network-based attacker who convinces a user to interact with crafted content, exploiting an out-of-bounds read (CWE-125). The vulnerability has a CVSS 3.1 score of 5.3 with availability-only impact (A:H; C:N/I:N); no data exposure or code execution is possible. No public exploit code has been identified at time of analysis, and CISA SSVC indicates no active exploitation, making real-world priority low. Microsoft has released patches.
Security feature bypass in the Windows Key Distribution Center (KDC) lets an authenticated, low-privileged principal in an Active Directory domain bypass an authorization check on a domain controller reachable over the network. Exploitation is not remote-unauthenticated: it requires valid low-privileged domain credentials (PR:L) plus network reach to a DC running the Kerberos KDC role, and the high attack complexity (AC:H) means success hinges on specific, attacker-uncontrolled conditions rather than a deterministic request, with no user interaction required. Impact is limited to confidentiality (C:H/I:N/A:N) and the flaw affects only KDC-bearing hosts, not standalone or workgroup Windows machines; Microsoft has released patched builds, no public exploit code has been identified at time of analysis, and CISA SSVC rates the issue non-automatable with no observed exploitation, making this a moderate-severity, lower-priority item despite touching a security-critical component.
InstallShield 2025 R2 and earlier can resolve bundled prerequisite installers from an unsecured, attacker-writable location when a compressed Basic MSI Setup.exe is launched from that directory, allowing a local attacker who pre-plants a malicious prerequisite to escalate privileges once an administrator runs the installer. This is a medium-severity local privilege escalation in the CWE-426 untrusted search path class (CVSS 4.0 base 5.4; independent CVSS 3.1 assessment AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H), and no public exploit code or confirmed active exploitation was identified at the time of analysis. Only compressed Basic MSI setups that include Prerequisites are affected, and exploitation requires both local write access to the setup location and an administrator-driven launch.
A use-after-free in Mozilla Firefox's JavaScript/WebAssembly engine can be triggered when a user loads attacker-controlled web content containing crafted WebAssembly, allowing the attacker to corrupt memory and potentially read or alter data in the browser process. Affected are Firefox releases prior to 158; exploitation is remote and requires no authentication (PR:N) but does require user interaction (UI:R), since the victim must navigate to or render the malicious page, and WebAssembly is enabled by default so no non-default configuration is needed. Impact is scoped to partial confidentiality and integrity loss (C:L/I:L, A:N) rather than confirmed code execution, and no public exploit has been identified at time of analysis; Mozilla addressed the flaw in Firefox 158 and the issue is rated moderate priority rather than an emergency.
Use-after-free in Mozilla Firefox's DOM: Workers component allows remote attackers to trigger memory corruption and potential information disclosure in Firefox versions before 158 and Firefox ESR before 153.5 when a victim loads attacker-controlled web content that exercises the Workers API. This moderate-severity issue requires user interaction (UI:R) but no authentication (PR:N), and no public exploit code has been identified at time of analysis per CISA SSVC. The assessed vector is AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating limited confidentiality and integrity impact and no availability impact.
Firefox builds prior to version 158 carry a use-after-free in the JavaScript/WebAssembly (WASM) component that lets attacker-supplied web content corrupt memory inside the browser process, producing limited confidentiality and integrity effects (CVSS 5.4, C:L/I:L/A:N, S:U). Exploitation is unauthenticated (PR:N) but requires the victim to actively load attacker-controlled content that reaches the WASM code path (UI:R), so an idle or abandoned browser cannot be attacked and the flaw is not automatable for worm-style mass exploitation (SSVC Automatable=no). Independent signals rate real-world priority as low: CISA SSVC records Exploitation=none, and no public exploit code has been identified at time of analysis, leaving this a moderate-severity memory-safety bug best addressed by routine patching rather than emergency response.
A use-after-free (CWE-416) in Firefox's JavaScript WebAssembly component lets remote, unauthenticated attackers trigger memory corruption with low confidentiality and integrity impact (CVSS 5.4) when a victim loads attacker-supplied WASM/JS content in any build prior to Firefox 158. Exploitation is constrained by a mandatory user-interaction requirement - the target must open or render a malicious page or document - and by the absence of any availability impact, indicating a bounded disclosure/corruption primitive rather than full system compromise. CISA's SSVC evaluation rates exploitation as none and automatable as no, and no public exploit code has been identified at time of analysis; Mozilla fixed the flaw in Firefox 158.
A use-after-free in Mozilla Firefox's Storage Bucket File System allows an unauthenticated remote attacker to corrupt memory or disclose information by convincing a victim to load crafted web content that exercises the Origin Private File System (OPFS) API. The flaw affects Firefox versions prior to 158 and Firefox ESR versions prior to 153.5, and exploitation requires user interaction while being complicated by heap state and timing, resulting in only low confidentiality, integrity, and availability impact. No public exploit code has been identified, and CISA's SSVC assessment rates exploitation as none with partial technical impact, making this a moderate-severity, low-priority issue despite the underlying memory-corruption class.
A use-after-free in Mozilla Firefox's Audio/Video Playback component allows unauthenticated remote attackers to cause partial memory disclosure and memory corruption when a victim loads crafted media content, affecting Firefox versions prior to 158 and Firefox ESR versions prior to 153.5. Exploitation requires user interaction - the victim must visit a malicious or compromised page whose crafted media is processed by the playback pipeline - so this is best suited to targeted or opportunistic drive-by delivery rather than automated mass exploitation (CISA SSVC Automatable=no, Technical Impact=partial). Vendor-released patches exist in Firefox 158 and Firefox ESR 153.5, and no public exploit code or confirmed active exploitation was identified at time of analysis; impact is bounded by the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) with no availability impact and no confirmed path to full code execution from the available data.
Use-after-free in Mozilla Firefox's DOM Animation component allows remote attackers to corrupt memory by getting a victim to render attacker-controlled web content in a browser build prior to Firefox 158. The flaw is unauthenticated (PR:N) but requires user interaction (UI:R), since the victim must visit or render the crafted page and let it exercise animation handling; there is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation=none with Automatable=no, so mass or automated exploitation is not expected. Impact is capped at partial confidentiality and integrity loss (CVSS 5.4, C:L/I:L/A:N), typically leaking data from freed memory or corrupting it, rather than a guaranteed full compromise.
Use-after-free in Mozilla Firefox's DOM: Core & HTML component allows unauthenticated remote attackers to trigger memory corruption when a victim loads attacker-controlled web content, yielding limited confidentiality and integrity impact. Affected versions are Firefox before 158 and Firefox ESR before 153.5, with fixes available in Firefox 158 and Firefox ESR 153.5. No public exploit identified at time of analysis, and CISA SSVC records exploitation as none, automatable as no, and technical impact as partial, consistent with a moderate-severity memory-safety issue rather than reliable code execution.
Use-after-free in Firefox's DOM WebIDL bindings (CVE-2026-109717) lets a remote, unauthenticated attacker corrupt memory when a victim loads attacker-controlled or attacker-influenced web content that reaches the affected binding code path; the CVSS UI:R metric means the user must visit a malicious or compromised page, and no special browser configuration is required. Impact is bounded to low confidentiality and low integrity with no availability impact per the vendor-rated vector, and there is no public exploit identified at time of analysis - CISA's SSVC records Exploitation: none, Automatable: no, and Technical Impact: partial. The flaw is fixed in Firefox 158 and Firefox ESR 153.5, making this a routine browser update-cycle item rather than an emergency patch.
Use-after-free in Mozilla Firefox's Crash Reporting component lets a remote, unauthenticated attacker corrupt memory when a victim loads attacker-controlled web content, producing the low confidentiality and integrity impact captured by the assessed CVSS 5.4 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). Only Firefox builds before 158 and Firefox ESR builds before 153.5 are affected, and the flaw is fixed in those releases. There is no public exploit identified at time of analysis (SSVC exploitation: none; not automatable), and the mandatory user-interaction requirement keeps realistic risk moderate, making this a normal-patch-cycle item rather than an emergency.
Use-after-free in Mozilla Firefox's Graphics: Canvas2D component (CWE-416) allows a remote, unauthenticated attacker to corrupt memory and potentially disclose information when a victim loads attacker-controlled web content, requiring user interaction (UI:R) but no credentials (PR:N). The flaw affects Firefox builds before 158 and Firefox ESR builds before 153.5 and carries a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), with partial confidentiality and integrity impact but no availability impact. No public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates Exploitation as 'none' and Automatable as 'no'.
Use-after-free in Mozilla Firefox's DOM Streams component allows a remote, unauthenticated attacker to corrupt memory in the content process when a victim renders attacker-controlled web content, yielding limited information disclosure and limited data integrity impact (CVSS 5.4, C:L/I:L/A:N). All builds prior to Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5 are affected, and exploitation is gated by mandatory user interaction (UI:R) plus the heap-timing precision needed to win a use-after-free race. No public exploit code has been identified at time of analysis, no CISA KEV listing applies, and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this is not an active-exploitation priority despite the memory-corruption class.
Use-after-free in Mozilla Firefox's JavaScript JIT compiler allows remote, unauthenticated attackers to corrupt browser memory by enticing a victim into loading attacker-controlled web content, producing limited information disclosure and limited integrity impact with no availability effect (CVSS 5.4, UI:R, S:U). Exploitation requires the target to visit or be redirected to a malicious page while JIT compilation is enabled, which is the default configuration, and the impact stays confined to the browser process. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and vendor-released fixes ship in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.
Use-after-free in Mozilla Firefox's DOM Animation component lets a remote attacker corrupt memory by having a victim load attacker-controlled web content, yielding limited information disclosure and limited integrity impact rather than code execution. Exploitation requires user interaction (UI:R) but no authentication and no non-default browser configuration, so default installations below the fixed builds are affected; the attack is not automatable per CISA SSVC (Automatable=no, Exploitation=none), and no public exploit identified at time of analysis. Vendor-released patch: Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5 - only versions below those builds remain exposed.
Use-after-free in Mozilla Firefox's Audio/Video component (CWE-416) permits unauthenticated remote attackers to trigger memory corruption, leading to limited information disclosure or low-integrity effects (CVSS 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), when a victim loads crafted media in an unpatched browser. Affected versions are Firefox before 158 and Firefox ESR before 115.43 and 153.5; no public exploit code has been identified at time of analysis, and CISA's SSVC assessment notes exploitation has not been observed and the flaw is not reliably automatable. The required user interaction and partial impact keep real-world urgency low, making this a moderate patch-management item rather than an emergency.
Use-after-free in Mozilla Firefox's SVG rendering component allows remote attackers to cause memory corruption leading to partial information disclosure or limited integrity impact when a user opens a crafted SVG document. Affected versions include Firefox prior to 158 and Firefox ESR prior to 115.43 and 153.5. Exploitation requires user interaction (UI:R), is not automatable, and no public exploit code has been identified; vendor patches are available.
Use-after-free in Mozilla Firefox's DOM: Core & HTML component allows remote attackers to trigger memory corruption when a victim loads attacker-controlled web content, requiring user interaction (UI:R) with no authentication or prior privileges needed (PR:N). Any default Firefox installation that browses to a malicious or compromised page is in scope, but the impact ceiling is limited to partial confidentiality and integrity loss with no availability impact (C:L/I:L/A:N), and Mozilla has already shipped fixes in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. There is no public exploit identified at time of analysis, exploitation is not automatable per SSVC (Exploitation: none, Automatable: no, Technical Impact: partial), and this is a moderate-severity, low-real-world-priority issue despite belonging to the memory-corruption class (CWE-416).
Use-after-free in Mozilla Firefox's XML component can be triggered by unauthenticated remote attackers when a victim loads attacker-controlled web content containing crafted XML, leading to limited information disclosure or integrity impact. This moderate-severity flaw (CVSS 5.4) requires user interaction (UI:R) and does not allow full code execution or denial of service per the assessed vector; no public exploit has been identified and CISA SSVC rates exploitation as none. The issue is fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.
Memory-safety flaws in Mozilla Firefox's Graphics: Text component allow remote attackers who convince a user to load crafted web content to trigger a use-after-free, potentially exposing or corrupting data in the browser's process memory. Impact is bounded to limited confidentiality and integrity effects with no availability loss (CVSS 5.4, C:L/I:L/A:N), and exploitation is limited to unpatched builds (versions before Firefox 158, ESR before 115.43, and ESR before 153.5) that render the malicious payload during normal browsing. No public exploit code has been identified at time of analysis and the CISA SSVC assessment rates exploitation as 'none', making this a moderate memory-safety fix to fold into routine browser patching rather than an emergency action.
Use-after-free in Mozilla Firefox's Storage: IndexedDB component (CWE-416) allows a remote, unauthenticated attacker to corrupt browser memory when a victim loads attacker-controlled web content that drives the IndexedDB API, yielding partial confidentiality and integrity impact (CVSS 3.1 base 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). The mandatory user interaction (UI:R) is the controlling barrier: the flaw cannot be triggered against a passive or idle target, and IndexedDB is enabled by default so no special configuration is required once a victim visits or interacts with a malicious or compromised page. Only Firefox builds prior to 158 and ESR builds prior to 115.43 and 153.5 are affected; no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' with non-automatable, partial technical impact, and the independent assessment keeps this at low real-world priority rather than an urgent threat.
ThemeGrill's User Registration WordPress plugin (versions up to and including 5.2.8) fails to enforce authorization checks on one of its endpoints, letting a low-privilege authenticated user perform actions that should be restricted. Exploitation requires a valid session (CVSS PR:L), but because the plugin's core purpose is open self-service registration, an attacker can typically create the necessary account themselves - no user interaction is needed and the attack is remote and low-complexity. Impact is limited to integrity and availability of the affected functionality (I:L/A:L, no confidentiality impact), rated CVSS 5.4; no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-site request forgery (CSRF) in the ThemeGrill User Registration WordPress plugin through version 5.2.8 allows remote attackers to trick a logged-in privileged user into performing unintended actions, with low integrity and availability impact (CVSS 5.4). Exploitation requires an active authenticated WordPress session and successful social engineering to load attacker-controlled content (UI:R), as reflected in the CVSS vector (PR:N, UI:R). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the independent assessment rates this as a moderate-severity, low-priority issue for most defenders.
FluentBoards through version 2.1.0 contains a missing authorization flaw that allows an authenticated low-privilege WordPress user to perform actions outside their intended role, with limited confidentiality and integrity impact. The plugin must be installed and active, and the assessed CVSS vector requires PR:L, so this is not an unauthenticated bypass. No public exploit code or confirmed active exploitation was identified in the provided intelligence; the primary source is the Patchstack advisory.
Path traversal in MosaicML Composer 0.32.1 and earlier allows an attacker who supplies a crafted checkpoint archive to write files outside the intended extraction directory when the victim loads that checkpoint, because the tarball.extractall routine in composer/utils/checkpoint.py does not sanitize archive entry paths (CWE-22). The attack is remote and, per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P), requires only passive user interaction - someone must ingest an untrusted checkpoint, for example one pulled from a model hub, shared storage, or a supply-chain source; the independent assessment corroborates this as CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, i.e., limited integrity and availability impact with no confidentiality loss. No public exploit code was identified and the issue is not in CISA KEV, so this is a medium-severity (base 5.3) supply-chain hygiene problem rather than an actively exploited emergency; teams that only load internally generated, trusted checkpoints are not realistically exposed.
Denial of service in ESA's SLE API for Java (all versions prior to 5.1.7) allows an unauthenticated remote client of the SLE listening service to crash or degrade the service by sending a crafted ISP1 TML/PDU message whose 4-byte big-endian body-length field drives an unbounded byte-array allocation. Because the CVSS vector is PR:N/UI:N and no non-default feature toggle is required, any network-reachable instance in a standard configuration is exposed; however, the practical attacker set is narrowed by the fact that SLE endpoints are typically confined to space-agency ground-segment operational networks rather than the public internet. The flaw is fixed in 5.1.7, and no public exploit code was identified at time of analysis.
Authenticated denial of service in Microsoft SQL Server lets a low-privileged database account reachable over the network drive unbounded resource consumption (CWE-770), degrading or stalling query processing and server availability for other sessions. Affected builds are SQL Server 2019 CU32 below 15.0.4500.2, SQL Server 2019 GDR below 15.0.2200.2, and SQL Server 2025 CU8. Rated CVSS 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires valid low-privileged SQL Server credentials plus non-trivial triggering conditions implied by the high attack complexity; no public exploit code has been identified, no CISA KEV listing exists, and the SSVC assessment records exploitation as 'none' and automatable as 'no'.
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated, low-privileged user to perform actions beyond their granted permissions over the network (CVSS 4.3, CWE-863) on builds below 16.0.20326.20190. Exploitation is constrained by the mandatory pre-existing valid account on the farm, and the impact is limited to a low integrity effect with no confidentiality or availability loss and no scope change. No public exploit code exists and the issue is not confirmed as actively exploited (CISA KEV); this is a moderate, vendor-patchable elevation-of-privilege issue rather than an emergency.