Local information disclosure in the Windows AppX Deployment Service permits an authenticated local attacker to read file contents outside their own privilege boundary by inducing the service to follow a crafted symbolic link or directory junction. Affected platforms are Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 (including Server Core) at builds below the fixed levels published in the Microsoft update guide. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as none and automation as not automatable, so this is a low-priority issue whose CRITICAL-looking confidentiality rating (C:H) is heavily offset by the local, authenticated, high-complexity exploitation prerequisites.
Information disclosure in the Windows Graphics Kernel affects a broad range of supported Windows releases, from Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2 through 26H2) to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. An attacker who already holds an authenticated local session (CVSS AV:L, PR:L, UI:N) and can run code on the host may drive the graphics kernel into a use-after-free condition and read the contents of freed kernel memory, disclosing potentially sensitive information; impact is limited to confidentiality (C:H) with no integrity or availability effect, and the high attack complexity (AC:H) reflects a non-deterministic memory-reuse race that CISA's SSVC assessment mirrors with Exploitation=none and Automatable=no. At CVSS 4.7 this is a low-to-moderate priority item rather than a critical emergency: no public exploit identified at time of analysis, no CISA KEV listing, no remote or unauthenticated path, and Microsoft has shipped a vendor patch for every affected build.
Information disclosure in the Windows Kernel (CVE-2026-70077) allows a locally authenticated attacker who already holds low-privileged code execution on the host to read kernel memory by winning a race condition in a use-after-free path. Exposure is broad - the vulnerable component ships in every supported Windows 10 and Windows 11 release and in Windows Server 2012 through Server 2025, including Server Core installations - but the attack requires prior local access (PR:L, AV:L) and reliable triggering is non-trivial because of the race (AC:H), and the outcome is limited to confidentiality (C:H with I:N/A:N). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; vendor patches are available, so this should be treated as a moderate-to-low priority hardening item rather than an emergency.
Information disclosure in the Windows Kernel lets an attacker who already holds local, authenticated low-privilege access on a Windows host read past the bounds of a kernel buffer and leak adjacent kernel memory, but only when a hard-to-control precondition such as a race window or a specific kernel memory layout is satisfied. All currently supported Windows 10, Windows 11 and Windows Server builds below the patched levels listed in Microsoft's advisory are affected; the defect can neither modify data nor crash the system, so its impact is confined to confidentiality (C:H/I:N/A:N, CVSS 4.7). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no EPSS score was supplied with this record - the limiting factors are the local-access prerequisite and the complex triggering condition, making this a low-to-moderate priority despite the notable 'Windows Kernel' target.
An out-of-bounds read (CWE-125) in the Windows Key Storage Provider (KSP) allows a locally authenticated attacker with high attack complexity to disclose potentially sensitive memory contents, though the impact is limited to confidentiality (CVSS 4.7, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). All supported Windows releases from Server 2012 R2 through Server 2025 and Windows 10/11 are affected until patched to the fixed builds listed in the Microsoft advisory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. This is a low-to-moderate priority issue despite the memory-safety class.
Local information disclosure in Microsoft's Windows Network File System (NFS) server component allows an authenticated local attacker with low-level privileges to read memory contents the process should not expose, via an untrusted pointer dereference (CWE-822) rated CVSS 3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw requires the Windows NFS server role/feature to be installed and running, which is not enabled by default, and high attack complexity suggests a race or specific memory-timing condition that is not reliably reproducible; there is no integrity or availability impact. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), so this is a moderate-severity, low-priority issue for most environments. Vendor-released patches are available for all affected Windows builds.
Information disclosure in the Windows Desktop Window Manager (dwm.exe) allows a locally authenticated attacker holding only low-level user privileges to read memory beyond an intended buffer inside the compositor process, potentially exposing data belonging to the DWM session. Exploitation is not straightforward: it requires an existing local foothold and the high attack complexity indicated by the CVSS vector (AV:L/AC:H/PR:L/UI:N) means success likely depends on winning a race or hitting a specific memory state that the attacker cannot reliably control. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' (Automatable: no), and the issue is confined to confidentiality impact (C:H/I:N/A:N); Microsoft has released fixes for all affected Windows branches, making this a low-priority local information-disclosure flaw that is best addressed through routine patch cycles.
Information disclosure in the Windows ALPC (Advanced Local Procedure Call) subsystem allows a locally authenticated, low-privileged attacker to read sensitive system information that should not be reachable from their privilege level. The flaw carries a CVSS v3.1 base score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning exploitation requires an existing interactive session on the host plus a non-trivial race or state precondition, and yields confidentiality impact only - no integrity or availability effect. Affected builds span Windows 10 21H2/22H2/1809, Windows 11 23H2 through 26H2, and Windows Server 2019/2022/2025; a vendor patch is available through the Microsoft Update Guide, and there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Local file tampering through a relative path traversal flaw in Windows WinINet (wininet.dll) requires an attacker to already hold authenticated, low-privileged access to the machine and to satisfy a high-complexity precondition, so it cannot be triggered remotely and carries no confidentiality or availability impact. All supported Windows client and server branches are affected - Windows 10 and 11 releases plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - up to the fixed build numbers published in Microsoft's update guide. No public exploit code has been identified, CISA's SSVC assessment records exploitation as 'none', and Microsoft rates the issue Medium (CVSS 4.7), making it a routine patch-cycle item rather than an emergency.
Windows SmartScreen on Windows 11 (versions 23H2, 24H2, 25H2 and 26H1) can be driven into disclosing local information through a time-of-check time-of-use (TOCTOU) race condition, but only by an attacker who already holds a low-privileged, authenticated local session (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7). The high attack complexity is the dominant constraint: the attacker must reliably win a narrow, non-deterministic timing window that they do not control, which is why CISA's SSVC assessment records Exploitation=none and Automatable=no, and no public exploit code was identified at time of analysis. Impact is limited to confidentiality on the local host, with no remote path, no privilege escalation, and no integrity or availability effect; a vendor patch is available via the Microsoft MSRC update guide, and this should be treated as a low-to-moderate priority fix rather than an emergency despite the CRITICAL-looking confidentiality sub-score.
Tampering with device-management configuration on Windows is possible because the Windows Modern Device Management (MDM) stack fails to enforce an authentication/authorization check on a critical function (CWE-306). Exploitation requires an attacker to already hold authenticated local access (CVSS PR:L) on an affected Windows 10, Windows 11, or Windows Server host, and the high attack complexity rating (AC:H) indicates an additional constraint such as specific system state, ordering, or a timing window the attacker cannot fully control; the resulting impact is limited to integrity (I:H) with no confidentiality or availability effect. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' with 'not automatable', and no KEV listing applies, so this should be treated as a moderate, post-foothold local tampering issue rather than a remotely exploitable emergency; a vendor patch is available.
Local information disclosure in the Microsoft Windows Ancillary Function Driver for WinSock (afd.sys) is caused by a use-after-free condition reached through a race in socket handling, allowing an attacker who can already log on to a host and execute code to read kernel memory that they should not be able to access. Exploitation is confined to an authenticated local attacker (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 4.7) who must win a non-deterministic kernel race, so repeated timing attempts are typically required and reliability is limited; there is no remote network path and no cross-component scope change. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial, so despite the HIGH confidentiality label the real-world priority is low-to-moderate.
Local tampering in the Windows Projected File System (ProjFS) component allows an authenticated, low-privileged attacker who already holds a foothold on the machine to win a time-of-check time-of-use race and alter data the component is handling. The flaw is scored CVSS v3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) - it is not remotely reachable, requires local authenticated access, and is gated by high attack complexity, so success depends on repeatedly hitting a narrow race window rather than a single deterministic action, with the only impact being a high integrity/tampering effect and no confidentiality or availability loss. No public exploit has been identified at time of analysis - there is no CISA KEV listing, and CISA's SSVC assessment rates exploitation as 'none' and the issue as not automatable - while Microsoft has published a fix, making this a low-to-moderate priority patching item rather than an emergency.
Local tampering of Windows Modern Device Management (MDM) state is possible on affected Windows 10, Windows 11, and Windows Server builds, because a TOCTOU race condition (CWE-367) lets an attacker who already holds an authenticated low-privileged local account alter a resource in the window between its validation and its use. Exploitation is non-deterministic and typically requires many attempts (CVSS 4.7, AV:L/AC:H/PR:L/UI:N), there is no remote vector and no user-interaction requirement, and impact is confined to integrity (I:H) with no confidentiality or availability effect. Microsoft has shipped fixes and CISA's SSVC assessment records no observed exploitation and no automatable path, so this ranks as a genuinely low-priority issue; no public exploit code has been identified at time of analysis.
Information disclosure in the Windows Win32 Kernel Subsystem stems from a time-of-check time-of-use (TOCTOU) race condition (CWE-367) that lets a local attacker with existing low-privileged code execution leak kernel memory contents. The issue rates only CVSS 4.7 (AV:L/AC:H/PR:L/UI:N, C:H/I:N/A:N) because seizing the narrow check-to-use window is difficult and non-deterministic; CISA's SSVC assessment scores Exploitation as 'none' and Automatable as 'no', and no public exploit code has been identified at time of analysis. Every in-support Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025 build below its respective patched build number is affected, and Microsoft has published fixes via its update guide.
Page reference leaks in the Xen hypervisor's grant-table cache-flush handling (GNTTAB_cache_flush) allow an attacker who already controls a guest domain on an x86 host running Xen 4.5 through 4.20 to gradually exhaust host memory, most likely resulting in denial of service against Domain 0 (and therefore potentially the entire host) or against another domain. The defect sits on an error path that was added by the XSA-232 (CVE-2017-14318) NULL-pointer fix but never updated to release a page reference when the referenced page belongs to a special system domain such as DOM_IO or DOM_COW; per the vendor advisory there is no known mitigation other than applying the patch, and no public exploit identified at time of analysis. Authentication requirements are confirmed from the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H), which requires local guest-level privileges and a high degree of timing/conditions to trigger.
Read access-control bypass in obsidian-tc before version 1.3.1 allows an authenticated MCP client to read files inside a denied vault folder by following an in-vault symlink that sits under an allowed glob. The server's folder ACL is evaluated against the lexical (pre-resolution) request path while the filesystem resolves the symlink to its real target, so the two checks disagree and the denied content is served. Exploitation is constrained: the symlink must already exist in the vault (planted out-of-band, since obsidian-tc does not create it), the attacker needs local access and an authenticated session (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7), and the flaw cannot escape the vault root - it is strictly an intra-vault ACL-scope bypass with confidentiality-only impact. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; version 1.3.1 canonicalizes ACL checks through symlink resolution to close it.
Crashing of the clevis-pkcs11-afunix-socket-unlock daemon in the clevis PKCS#11 pin allows a local attacker to cause a boot-time denial of service on hosts that rely on clevis for LUKS disk decryption. When a client connects to the daemon's AF_UNIX data socket without binding a client address, an integer underflow in the getpeername() result handling corrupts memory (CWE-787) and terminates the daemon, so LUKS unlock never completes and the system cannot finish booting. The issue is availability-only (CVSS 3.1 base 4.7, AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), affects clevis on Red Hat Enterprise Linux 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, and no public exploit has been identified at time of analysis; the vulnerable configuration is a non-default deployment choice and not present in a stock RHEL install.
Improper authorization checks in SAP S/4HANA's Linear Asset Management RAP business object allow an authenticated, low-privilege user with local/interactive access to modify associated business object data for which they lack authorization, producing a high integrity impact with no confidentiality or availability impact (CVSS 4.7). Exploitation requires high attack complexity and specific runtime or data-association conditions, and no remote or unauthenticated path is described; no public exploit identified at time of analysis. SAP has assigned CWE-862 and published remediation guidance via SAP Security Note 3799621.
An out-of-bounds read in the Microsoft Windows Storage Port Driver (CWE-125) lets an attacker who already has physical access to a device read past the end of a buffer and disclose kernel memory contents to an unauthorized party. Every supported Windows client and server build from Windows 10 1607 and Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 is affected, as tracked in EUVD-2026-100340, and because the vector is AV:P the flaw cannot be reached remotely - it is confined to lost, stolen, or unattended hardware and evil-maid style scenarios. Microsoft has released a vendor patch, there is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as none and the issue as non-automatable, making this a genuinely low-priority item despite the CVSS confidentiality rating of High.
Physical attackers can read out-of-bounds kernel memory through the Windows RNDIS (Remote NDIS) driver, which mishandles attacker-supplied RNDIS protocol data presented over USB. Affected systems are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations. The CVSS vector is AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (4.6), so no authentication or user interaction is needed once the attacker has physical access, but remote or network-based exploitation is not possible and impact is confined to information disclosure with no code execution, integrity, or availability effect; there is no public exploit identified at time of analysis and CISA SSVC records Exploitation: none with Automatable: no, so this is a genuinely low-priority issue despite the HIGH confidentiality rating. Practical risk is limited to kiosks, shared or unattended machines, and evil-maid scenarios where an untrusted party can plug in a device.
Path traversal in Fossify File Manager through 1.6.2 allows a crafted ZIP archive to write files outside the chosen extraction folder by exploiting an unanchored startsWith check in DecompressActivity. Exploitation requires the victim to manually extract the malicious archive (UI:R, AV:L), limiting impact to file creation or overwrite in directories writable by the app; no public exploit code or active exploitation has been identified, and no authentication is required per the CVSS vector (PR:N).
Cache poisoning in GitLab CE/EE allows an authenticated user, on deployments running a specific caching configuration, to corrupt cached page content that is subsequently served to other users because cache keys are constructed improperly. Affected versions are all releases from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 on both Community and Enterprise editions; exploitation requires a valid account (PR:L), a non-default deployment/caching setup, high attack complexity (AC:H), and victim interaction (UI:R), yielding only limited confidentiality, integrity, and availability impact (CVSS 4.6). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), so this is best treated as a low-priority, targeted-scenario issue rather than a broadly exploitable one.
Improper certificate validation in Windows Hello lets an attacker who already holds high local privileges on an affected Windows host bypass the feature's certificate-based authentication check, exposing credential material that Windows Hello would otherwise protect (confidentiality impact only). The defect is strictly local - there is no network attack path and no user interaction is required - and it affects Windows 10, Windows 11 and Windows Server builds below their respective patched levels, including Windows 11 24H2 (below 10.0.26100.9711) and Windows Server 2025 (below 10.0.26100.33650). Exploitation has not been observed: CISA's SSVC assessment records exploitation status 'none' and automatable 'no', and no public exploit code has been identified at time of analysis, making this a moderate-severity issue best handled by routine patching rather than emergency response.
Secure Boot integrity bypass in Windows 10, Windows 11, and Windows Server 2016 through 2025 lets an authenticated local attacker with administrator or SYSTEM privileges load a boot component that Secure Boot should reject, because the boot chain fails to properly check certificate and bootloader revocation (CWE-299). The issue is rated CVSS 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) - it requires pre-existing high privilege and Secure Boot enabled, and it can only undermine boot-chain integrity, with no confidentiality or availability loss. No public exploit identified at time of analysis, and Microsoft has shipped vendor patches; see remediation for exact fixed builds.
Time-of-check time-of-use race condition in Microsoft Windows Virtualization-Based Security (VBS) Enclave lets an attacker who already holds high local privileges bypass a security feature on the affected host, resulting in an integrity/security-feature bypass (CWE-367) rather than data disclosure, code execution, or denial of service. Only systems that actually use VBS Enclaves are in scope, and because exploitation requires PR:H local access plus successful timing of a race window, the issue is rated low severity (CVSS 4.4) with no public exploit identified at time of analysis. Vendor patches are available and this should be handled through routine Windows update cycles rather than emergency response.
Insufficient input validation in SAP UI5 allows an authenticated, low-privileged user to submit crafted content that is later rendered in another user's browser, producing a low-impact client-side injection (CVSS 4.4, Medium) that can affect the confidentiality and integrity of the victim's session but not availability. Exploitation is substantially constrained: the assessed vector (AV:N/AC:H/PR:L/UI:R/S:C) requires a valid low-privilege account, the application to be running in one of the specific non-default configurations where validation is inadequate, and a victim to actively open or render the view containing the attacker-supplied content. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exact vulnerable configuration is addressed in SAP Note 3799054.
Heap-based buffer overflow in NVIDIA Warp crashes the host process when a user locally opens, imports, or runs a crafted simulation or data payload, producing a denial-of-service condition. The flaw is only reachable with local processing of attacker-controlled input plus user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, 4.4 Medium), so it cannot be triggered across the network and no path to code execution or data disclosure has been demonstrated - impact is confined to availability. No public exploit code identified at time of analysis, and the issue is not listed in CISA KEV, so there is no confirmed active exploitation.
Sensitive information exposure in the Ad Inserter - Ad Manager & AdSense Ads plugin for WordPress lets any authenticated user at subscriber level or above pull diagnostic and environment data out of the site through the plugin's ai_wp_footer_hook code path, affecting all releases up to and including 2.8.18. The leaked material spans the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and every post meta value - including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the main constraint is the account requirement, so sites that allow open subscriber self-registration have a materially larger exposure surface than sites that restrict registration to trusted users.
SFTPGo versions 2.5.0 through 2.7.5 allow an authenticated user with copy permission to bypass file pattern filters because these filters are evaluated only on the copy destination, enabling read access to denied files and reproduction of restricted content via recursive directory copies. The hide policy is also bypassed, as files that appear missing to stat and directory listings can still be copied. Fixed in 2.7.6; no public exploit identified at time of analysis. CVSS 4.3 reflects limited confidentiality impact since home-directory boundaries, virtual-folder layout, per-directory permissions, and access to other accounts remain enforced.
Information disclosure in IBM WebSphere Application Server - Liberty (versions 17.0.0.3 through 26.0.0.9) lets a principal holding only the read-only Reader role send a crafted request to the version-information retrieval path and cause an uncaught exception, rooted in an integer overflow flaw (CWE-190), that exposes version data. Rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the impact is limited to low-sensitivity information disclosure with no stated effect on integrity or availability, and exploitation is not remote-unauthenticated - the attacker must already possess or have compromised a low-privilege authenticated account. No public exploit code and no CISA KEV entry were identified at the time of analysis.
Information disclosure in obsidian-tc (versions prior to 1.3.1) allows an authenticated caller of the MCP server to infer or read note data that falls outside their configured read access-control list. The flaw affects deployments that rely on a read whitelist to segregate vault notes: tasks_filter returns group counts aggregated over the unfiltered task set, makemd_query passes unfiltered sibling result fields through, and list_templates exposes template paths and parsed user-function bodies without a read-whitelist check, so an authenticated caller with PR:L privileges can obtain path-attributable metadata, aggregate counts, and template content from notes they are not permitted to read. The impact is confidentiality-only (CVSS 3.1 base 4.3, C:L, no integrity or availability effect), and no public exploit identified at time of analysis; the vendor released version 1.3.1 to correct the behavior.
Authenticated users of GitLab Enterprise Edition who hold a specific granular permission can obtain a GitLab Duo Agent Platform token that bypasses configured governance controls, due to the application relying on untrusted input when making a security decision. Only GitLab EE installations running the Duo Agent Platform with governance controls in place are affected, specifically versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2; GitLab Community Edition is not affected, and unauthenticated or arbitrary low-privilege accounts cannot exploit the issue. GitLab has released fixes in 19.2.8, 19.3.5, and 19.4.2, and no public exploit code was identified at time of analysis - this is a medium-severity, lower-priority issue rather than an urgent threat.
Improper privilege assignment in GitLab Enterprise Edition lets an authenticated user who holds a custom role carrying compliance framework administration permissions configure and execute a specially crafted compliance pipeline across the projects of a group, effectively running pipeline content in projects beyond the scope their role was meant to grant. Affected deployments are GitLab EE from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2; the practical impact is limited to integrity (CVSS 4.3, C:N/I:L/A:N) and depends on a non-default configuration in which a custom role and compliance framework administration have been deliberately assigned and the group uses compliance pipelines. No public exploit code or confirmed active exploitation was identified at time of analysis, and this is a low-to-moderate priority issue rather than a high-urgency one.
Authenticated administrators on the local network of NETGEAR CBR40, R7000, R7000P, and RAX40 routers can execute unauthorized commands via insufficient input validation in the NTP time server setting, affecting only router integrity (no confidentiality or availability impact). This medium-severity vulnerability (CVSS 4.0 base 4.3) requires the attacker to already possess administrator credentials and be connected to the router's local network, making it a post-compromise integrity concern rather than a remote attack vector. No public exploit code or active exploitation has been identified, and NETGEAR has released firmware updates to address the issue.
A use-after-free in Chrome's Bindings component allows a remote attacker to read memory inside the renderer sandbox by convincing a victim to load a crafted HTML page in any Chrome build prior to 155.0.8059.79. Exploitation requires user interaction (UI:R) and is confined to the sandboxed renderer process - the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, score 4.3) reflects limited confidentiality impact only, with no integrity or availability effect and no sandbox escape, code execution, or privilege gain. Despite Google's 'High' Chromium severity label, there is no public exploit identified at time of analysis, EPSS is only 0.17% (6th percentile), and CISA's SSVC assessment rates exploitation as 'none' and the issue as not automatable, making this a low real-world priority that is mitigated by Chrome's rapid automatic update mechanism. A vendor patch is available (Chrome 155.0.8059.79).
An authenticated low-privileged user can access sensitive information beyond their authorized scope in SAP HANA's 'Display Product Catalog Based on Customs Declaration' application due to insufficient authorization checks (CWE-863). The vulnerability is network-accessible but requires a valid account and results in partial confidentiality impact only, with no effect on integrity or availability (CVSS 4.3). No public exploit code or active exploitation has been identified at time of analysis.
An authenticated attacker with low privileges can bypass access controls in the WordPress plugin Download Monitor integration for WooCommerce versions up to 1.0.3, leading to unauthorized access to limited confidential information. This moderate-severity missing authorization flaw (CWE-862) requires a valid logged-in account and does not allow data modification or service disruption; no public exploit code has been identified at the time of analysis. The plugin must be installed alongside WooCommerce, and only sites running this specific integration are affected.
An uninitialized-variable read in the ThirdParty lzma_sdk component bundled with Google Chrome versions prior to 155.0.8059.79 can expose memory contents inside the browser sandbox when a victim opens a crafted file that is processed through the LZMA/7-Zip decompression code path. The attacker is remote and unauthenticated per the CVSS vector (AV:N/AC:L/PR:N), but must persuade the user to open the malicious file (UI:R), and the resulting impact is limited to partial confidentiality loss (C:L) with no code execution, integrity, availability, or sandbox-escape effect (S:U). Real-world risk is low: a vendor-released patch exists (155.0.8059.79), EPSS is 0.16% (5th percentile), the CISA SSVC assessment records exploitation as none and the attack as not automatable, and no public exploit identified at time of analysis.
A heap use-after-free in KeePassXC's legacy KeePass1/KDB import path can crash the application and permit a limited, attacker-influenced write when a user actively imports a crafted, unlockable .kdb file; all builds prior to 2.8.0-beta1 are affected. The flaw is local-only and requires the victim to manually run the legacy import against an attacker-supplied database, so normal day-to-day use of KeePassXC without importing untrusted KDB files is not exposed. Severity is modest - CVSS 4.0 base 4.3 (Medium) and an assessed CVSS 3.1 vector of AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H (impact skewed to availability, with only low integrity impact and no confidentiality loss) - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Insufficient input validation in the LAN Setup feature of the NETGEAR R7300DST router allows an authenticated administrator connected to the local network to perform unauthorized actions on the router, primarily unauthorized configuration changes. Exploitation requires the attacker to already hold administrator credentials and to be on the adjacent/local network (the management interface is not treated as internet-routable), and the assessed impact is integrity-only - no confidentiality loss, no availability loss, and no user interaction by a victim. NETGEAR reports the issue was reproduced only against a simulated build of the router software and has not been confirmed on physical production R7300DST hardware; no public exploit code or confirmed active exploitation has been identified, and a vendor patch is available.
This is a low-priority issue despite being vendor-reported: authenticated administrators on the local network can make unauthorized configuration changes through insufficient validation in the NETGEAR R7300DST PPPoE Setup feature. The impact is integrity-only, with no confidentiality or availability effect, and exploitation requires valid admin credentials plus LAN/adjacent-network reachability rather than internet exposure. No public exploit identified at time of analysis, and the flaw has only been demonstrated against a simulated firmware build, not physical production hardware.
Adobe Commerce, along with Magento Open Source and Adobe Commerce B2B, contains an improper input validation vulnerability that allows an authenticated low-privilege attacker to bypass security features and gain unauthorized read access. The flaw is network-reachable, requires no user interaction, and is limited to confidentiality impact (read-only) with a CVSS score of 4.3, making it a moderate-severity, lower-priority issue. No public exploit code or confirmed active exploitation has been identified in the available intelligence.
Information disclosure in the Mozilla Firefox Storage: IndexedDB component allows attacker-controlled web content to read data it should not be able to access, affecting Firefox versions prior to 158 and Firefox ESR versions prior to 153.5. Exploitation requires the victim to browse to or interact with a malicious or compromised page that exercises IndexedDB, as reflected by the UI:R flag in the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N vector; the attacker needs no authentication, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and the issue as non-automatable. Impact is limited to partial confidentiality loss (C:L) with no integrity or availability effect, making this a low-to-moderate severity issue rather than a top remediation priority.
Information disclosure in the WebRTC: Networking component of Mozilla Firefox lets attacker-controlled web content coax limited data out of the browser, affecting all builds prior to Firefox 158. Exploitation is remote and requires no attacker credentials, but it mandates user interaction (CVSS UI:R) and yields only a partial confidentiality leak (C:L with no integrity or availability impact), which keeps realistic risk low despite the Medium 4.3 score. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' and automatable as 'no', and upgrading to Firefox 158 fully removes the condition.
Information disclosure in the Networking: Cache component of Mozilla Firefox allows remote attackers to expose a limited amount of browser-cached data when a victim interacts with attacker-controlled web content; the issue is fixed in Firefox 158, and installations prior to that version are affected. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms this is unauthenticated but requires user interaction, with only low confidentiality impact and no integrity or availability effect. There is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none and automatable as no, making this a genuinely low-priority issue despite the ubiquity of the browser.
Information disclosure in Firefox's Networking component allows a remote attacker to expose a limited amount of confidential data through a crafted web page, provided the victim interacts with that content (UI:R); no authentication or user privileges are required (PR:N) and default Firefox configurations are affected. The flaw is fixed in Firefox 158 and Firefox ESR 153.5, and carries a moderate CVSS score of 4.3 with only partial technical impact per CISA's SSVC assessment. There is no indication that the issue is being actively exploited and no public exploit code has been identified at the time of analysis.
Information disclosure in the Networking component of Mozilla Firefox can leak some confidential information to remote, unauthenticated attackers who persuade a victim to load attacker-controlled web content, as successful exploitation depends on user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). The flaw affects Firefox builds prior to 158 and Firefox ESR builds prior to 153.5, and its impact is capped at partial confidentiality loss with no integrity or availability effect (CVSS 4.3). There is no public exploit identified at time of analysis, CISA's SSVC framework rates exploitation as 'none' and automatable as 'no', and the issue is not listed in CISA KEV, making this a low-to-moderate priority item best resolved through routine browser updating.
Information disclosure in Mozilla Firefox's built-in PDF Viewer (pdf.js) allows a remote, unauthenticated attacker to expose limited browser-context data by convincing a victim to open and render a crafted PDF document; the attack succeeds only through the required user interaction of loading the malicious file. The issue is rated CVSS 3.1 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) with scope-unchanged, confidentiality-only impact, and is tracked as EUVD-2026-98504 under CWE-200; there is no public exploit identified at time of analysis and CISA SSVC records no exploitation activity. Vendor-released patches are available in Firefox 158 and Firefox ESR 153.5, and the affected population is Firefox releases prior to 158 and Firefox ESR prior to 153.5.
Incorrect authorization in Windows Hyper-V (CWE-863) on multiple Windows 10, Windows 11, and Windows Server versions could let an attacker who already holds high privileges on a guest or host bypass a Hyper-V security feature when positioned on the same adjacent network, but the attacker cannot read data or cause availability loss in the assessed vector. No public exploit code was identified at time of analysis, and all available signals - including the SSVC exploitation decision of 'none' and the high attack complexity - indicate low real-world risk despite Hyper-V’s security-sensitive role.