Remote code execution in Windows iSCSI allows unauthenticated attackers to execute code over a network by exploiting a use-after-free (CWE-416) in the processing of crafted iSCSI protocol traffic. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this as critical, but the primary limiting factor is that the Microsoft iSCSI Initiator service and iSCSI Target Server role are not enabled by default, so exposure is largely confined to hosts configured for iSCSI storage such as SAN-backed servers. No public exploit identified at time of analysis, and reliable exploitation would require defeating Windows memory mitigations, raising practical difficulty beyond the AC:L rating.
Remote code execution in Windows iSCSI allows an unauthenticated, network-positioned attacker to trigger an out-of-bounds write and potentially achieve full compromise of confidentiality, integrity, and availability. The vulnerability affects many Windows client and server versions (Windows 10, 11, and Windows Server 2012 through 2025), but exploitation requires the iSCSI service to be enabled and reachable; hosts without that service are not exposed. No public exploit has been identified at time of analysis, though the CISA SSVC framework rates the technical impact as total and the issue as automatable, and a vendor patch is available.
Remote code execution in Windows Libarchive (CVE-2026-69639) affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core installations) at build levels below their fixed revisions, allowing an unauthenticated attacker to corrupt the heap and execute code in the context of whatever process parses a malformed archive. Microsoft scores it 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and has released a patch, and CISA's SSVC evaluation records no observed exploitation, with no public exploit code identified at time of analysis - making this a high-priority but not yet emergency patching item whose real-world severity hinges on whether the affected host exposes a network-reachable, automatic archive-parsing path.
Remote unauthenticated code execution in the Windows iSCSI service (CVE-2026-69634) allows an attacker who can reach the service over the network to trigger a heap-based buffer overflow and run code in the context of the affected Windows component, with full confidentiality, integrity, and availability impact per Microsoft's CVSS 3.1 rating of 9.8 (AV:N/AC:L/PR:N/UI:N). The flaw affects a wide spread of Windows client and server releases, including Windows 10, Windows 11 23H2 through 26H2, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, so mitigation coverage must span legacy and current builds. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV signal is present in the supplied intelligence; the practical risk is concentrated on storage-connected hosts where iSCSI is enabled and reachable from untrusted network segments, since the service is not enabled by default on typical workstations. Vendor patches are available per Microsoft's advisory, and the fixed builds are enumerated below.
Unauthenticated remote code execution in the Windows DHCP Server role lets any attacker who can deliver DHCP protocol traffic to a vulnerable server trigger a use-after-free in the service's message processing and potentially run code in its context. Every supported Windows Server generation is affected when the DHCP Server role is installed - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus the Windows 10 1607 and 1809 client builds that ship the same component - with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirming no credentials and no user interaction are required. Microsoft has released fixes, and no public exploit code or confirmed active exploitation has been identified at time of analysis, but the ease of triggering and the total loss of confidentiality, integrity and availability make unpatched, network-exposed DHCP servers a high-priority patch target.
Heap-based buffer overflow in Microsoft Windows Error Reporting (WER) enables unauthenticated remote code execution across a wide range of Windows 10, Windows 11, and Windows Server builds, per a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). The vector indicates no authentication or user interaction is required and impact is total (C:H/I:H/A:H), but the exact network-facing entry point to WER is not specified in the available data and should be verified against the MSRC advisory, as WER is often a local component. No public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available.
Heap-based buffer overflow in Microsoft XML (MSXML) shipped with supported Windows 10, Windows 11, and Windows Server releases allows remote attackers to execute code in the context of the parsing process if they can deliver crafted XML content to it. The bug carries a 9.8 CVSS score under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires no authentication and no user interaction per the vendor's own scoring, and the affected surface spans every listed build from Server 2012 and 2012 R2 up through Windows 11 26H2 and Windows Server 2025. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', but automatable is rated 'yes' and technical impact 'total', so the absence of observed exploitation should be read as a detection lag rather than a low likelihood. Vendor-released patches are available; applying the listed minimum build versions removes the condition.
Remote code execution in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to trigger a heap-based buffer overflow (CWE-122) and execute arbitrary code with full system impact. The vulnerability is rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation requiring no privileges or user interaction. No public exploit identified at time of analysis, but the profile is consistent with a wormable RCE risk if a network-facing WER path is exposed.
Heap-based buffer overflow in Microsoft Windows Media Player enables remote code execution when the component processes attacker-supplied media content such as a crafted file or network stream. The vendor scoring places this at CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), describing unauthenticated, no-interaction compromise with total confidentiality, integrity, and availability impact; the affected parsing library ships on essentially every Windows 10, Windows 11, and Windows Server build listed below the patched revision, so the exposed install base is extremely broad. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none, while also flagging the flaw as Automatable: yes with Technical Impact: total, meaning exploitation is expected to be trivially repeatable once a working input is produced. The primary practical gating factor is that a victim must open or play the malicious media, so the assessed real-world vector is UI:R even though the vendor vector claims UI:N.
Unauthenticated remote code execution in the Microsoft Failover Cluster Virtual Driver affects Windows Server 2012 through Windows Server 2025 and Windows 10 1607/1809 installations that have the Failover Clustering role enabled, where a double free (CWE-415) during processing of cluster network traffic allows an attacker to corrupt kernel memory and run code with SYSTEM privileges (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). Exposure is conditional rather than universal: the vulnerable driver is only loaded and reachable on clustered nodes, and in well-architected deployments the cluster communication path sits on a dedicated, isolated interconnect, which materially limits remote reach despite the network vector. There is no public exploit identified at time of analysis and no CISA KEV entry, but the vulnerability is fully automatable (SSVC: Exploitation none, Automatable yes, Technical Impact total) and vendor patches are available for all affected builds.
Unauthenticated remote code execution is possible against Windows Failover Cluster through a use-after-free in the cluster service, affecting Windows Server 2019, Windows Server 2022, and Windows Server 2025, including Server Core installations, whenever the Failover Clustering role is installed and running. Signals diverge sharply: Microsoft and NVD publish a 9.8 score with AV:N/AC:L/PR:N/UI:N, while the independent assessment re-scores attack complexity as High (AC:H) because the clustering role is not a default configuration, the service normally lives on segmented management/heartbeat networks rather than exposed public interfaces, and reliably converting a freed object into controlled execution requires precise timing. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as "none" while rating the flaw fully automatable with total technical impact if the service is reachable; if that reachability exists, impact is complete loss of confidentiality, integrity, and availability.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver lets an unauthenticated remote attacker execute code in kernel context on affected default Windows installations, scoring CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). Microsoft has released a vendor patch, and CISA's SSVC assessment rates the flaw as automatable with total technical impact, but no exploitation has been observed and no public exploit code exists - so the practical risk hinges on whether a reachable network path to the driver actually exists, since a storage/volume driver is not inherently internet-facing. Every supported Windows client and server branch from Windows 10 1607 through Windows 11 26H2, plus Server 2012 through Server 2025, is enumerated as affected below the fixed build numbers.
Remote code execution in the Windows DNS Server role is achievable by an unauthenticated, network-positioned attacker who can send crafted DNS traffic to an affected host, as described by an integer underflow (CWE-191) defect in how the service handles attacker-influenced input. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) exploitation is remote, low-complexity, requires no credentials and no user interaction, and yields total loss of confidentiality, integrity and availability on the DNS server - the practical limit being that only Windows systems actually running the DNS Server role (Windows Server 2012 through 2025, plus Windows 10/11 builds where the role is installed) are exposed. Microsoft has released vendor patches through the MSRC update guide and the EUVD advisory maps fixed builds per platform; there is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data. CISA's SSVC assessment records Exploitation: none, Automatable: yes, Technical Impact: total, which supports treating this as a genuine high-priority patching item rather than a high-score-but-low-real-risk case.
Remote code execution in Visual Studio Code (versions 1.0.0 up to but not including 1.141.1) is achievable through a path traversal flaw when a victim opens a crafted workspace, folder, or repository containing malicious pathnames that escape the intended restricted directory. The attack is unauthenticated (PR:N) but requires user interaction (UI:R), and the scope change (S:C) alongside high confidentiality, integrity, and availability impacts yields a CVSS score of 9.6. Microsoft has released a vendor patch (1.141.1); no public exploit code has been identified at time of analysis, though the severity warrants prompt patching.
Request smuggling in the ASP.NET Core Kestrel HTTP/1 server lets a remote, unauthenticated attacker desynchronize HTTP request parsing and tamper with how requests are interpreted by the server and any shared front-end proxy, load balancer, or connection pool. The flaw is triggered when a Kestrel HTTP/1 connection carrying unread request-body bytes is aborted and Kestrel reparses that leftover data as a new request; the vendor rates it Critical at CVSS 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), while the independent assessment applies the same impact but rates attack complexity as High because the abort/timing prerequisite must be met, and the practical blast radius is greatest where connections are reused across tenants. Affected runtimes are ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2, plus Microsoft Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4; a vendor patch is available and there is no public exploit identified at time of analysis.
HTTP request smuggling in ASP.NET Core's Kestrel web server allows unauthenticated remote attackers to desynchronize request parsing and bypass security features by having Kestrel accept newline characters in HTTP/2 request trailers and in values drawn from the dynamic HPACK table rather than rejecting them as malformed. All supported ASP.NET Core release trains are exposed - 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2 - along with bundled Visual Studio 2022 17.14 (<17.14.42) and Visual Studio 2026 18.10 (<18.10.4); realistic impact is highest where a proxy, load balancer, or chained server sits in front of Kestrel and performs its own HTTP/2 parsing. The flaw carries a critical CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is rated with total technical impact under CISA SSVC, but exploitation has not been observed (SSVC Exploitation: none) and no public exploit code has been identified at time of analysis.
Unauthenticated remote code execution in Adobe ColdFusion 2023 (versions up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows any remote attacker who can reach the service to execute arbitrary code under the context of the ColdFusion process, with no user interaction required. The CVSS 3.1 base score is a maximum 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and the Scope:Changed metric indicates the attacker's actions can escape the vulnerable component and affect resources beyond its intended security boundary - typically the underlying JVM or host operating system. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV, so this is a high-severity, top-priority patching case driven by the attack vector and impact ratings rather than by confirmed active exploitation; the practical gating factor is network reachability of the exposed ColdFusion endpoint, with WAF-protected or segmented deployments materially harder to attack.
Spoofing in Microsoft Active Directory Federation Services (AD FS) lets a remote, unauthenticated attacker forge signed tokens that the service accepts as legitimate, yielding full compromise of confidentiality and integrity (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The flaw is an improper verification of cryptographic signatures (CWE-347) in the AD FS token-validation path, tagged as an authentication bypass/JWT attack, so a crafted SAML/JWT assertion can impersonate any user or relying party - effectively bypassing federation authentication. Only hosts running the AD FS role on unpatched Windows Server builds (2012 through 2025) are exposed; organizations that do not deploy AD FS are not affected. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA SSVC: Exploitation = none, Automatable = yes, Technical Impact = total), but the vulnerability is considered high-priority because exploitation is trivially automatable and impact is total where the role is exposed.
OS command injection in Adobe Experience Manager 6.5 (through 6.5.25) and AEM 6.5 LTS (through SP3) allows an authenticated, low-privileged attacker to run arbitrary operating-system commands in the context of the current user, with changed scope (S:C) meaning the injected command executes outside the application's own security authority on the host. Rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the exploitation bar is low attack complexity with no user interaction; the only meaningful constraint is the need for a valid low-privilege AEM session, which is a very low bar in multi-user AEM author environments where content authors and other non-admin accounts are routinely issued. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); no EPSS score was supplied with the source data. This is a genuine high-priority vulnerability rather than a CVSS-inflated paper risk, and the specific vulnerable feature or injectable parameter is not named in the advisory summary, so patch validation and hunting should be prioritized on affected instances.
Deserialization of untrusted data in Microsoft Dynamics Business Central (CVE-2026-100214, CVSS 8.8) allows an authenticated attacker with low privileges to execute arbitrary code over the network - the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates no user interaction, low attack complexity, and high confidentiality, integrity, and availability impact within the vulnerable component. Exploitation is gated by a valid Business Central account (PR:L), so this is not unauthenticated remote code execution, but once a foothold account exists and the deserialization endpoint is network-reachable, exploitation is straightforward. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV entry), making this a credible mid-to-high priority issue rather than an emergency; organizations should confirm the specific affected builds and patched versions against the MSRC advisory.
Unauthenticated remote code execution in Adobe Experience Manager stems from an incorrect authorization check that lets a remote attacker bypass access controls and execute arbitrary code in the context of the current user, with the changed-scope rating indicating impact can extend beyond the vulnerable component (CVSS 3.1 base 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Every unpatched deployment is in scope: AEM 6.5 up to and including 6.5.25, AEM 6.5 LTS up to and including 6.5 LTS SP3, and AEM as a Cloud Service up to and including 2026.9.28187; no credentials or user interaction are required, and the only practical precondition is that the affected author, publish, or endpoint is reachable from the attacker's network. No public exploit code exists and no confirmed active exploitation (CISA KEV) has been recorded at time of analysis, but the authentication-bypass-to-RCE chain plus the maximum severity score make internet-facing, unpatched instances a top remediation priority rather than a high-score/low-real-risk case.
Unauthenticated remote code execution affects Adobe Experience Manager, specifically AEM as a Cloud Service builds up to and including 2026.9.28187, AEM 6.5 LTS up to and including SP3, and AEM 6.5 up to and including 6.5.25, and is rooted in an incorrect authorization check (CWE-863) that carries a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Because the defective access-control decision itself is the entry point, a remote attacker needs only network reachability, no credentials, and no user interaction, and the changed scope (S:C) means the resulting arbitrary code execution in the current user's context can be leveraged to gain elevated access or control over a victim's account or session beyond the vulnerable component. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated, no-interaction exploitation profile places internet-exposed AEM instances at top-priority risk, with network isolation (VPN, WAF, non-exposed tiers) and the affected-version boundaries as the main mitigating factors.
Unauthenticated remote code execution affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source through improper neutralization of special elements used in a template engine (CWE-1336, server-side template injection). Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C), an attacker can reach the vulnerable template-processing surface over the network without credentials and without any victim interaction, and the scope change (S:C) indicates compromise can extend beyond the vulnerable component into the surrounding account or session context. The score is the maximum possible (10.0) and Adobe has published remediation guidance in APSB26-153; no public exploit code or confirmed active exploitation was identified at time of analysis, so the risk is driven by severity and ease of reachability rather than observed attacks.
Server-side request forgery in Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) allows unauthenticated remote attackers to cause the server to make arbitrary requests, resulting in privilege escalation with the scope changed. This critical vulnerability has a CVSS score of 10.0 and requires no user interaction. No public exploit has been identified at the time of analysis.
Unauthenticated remote code execution affects Adobe Experience Manager as a Cloud Service (0 through 2026.9.28187), AEM 6.5 LTS (through SP3), and AEM 6.5 (through 6.5.25) due to an incorrect authorization check (CWE-863) in a network-reachable component. Because the CVSS vector is PR:N/UI:N, attackers need no credentials and no victim interaction - any internet-facing or otherwise reachable affected instance is directly attackable - and the changed scope (S:C) means a successful exploit can compromise resources beyond the vulnerable component itself, including the victim's account or session and the underlying runtime. At the time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, but the maximum 10.0 base score, the authentication-bypass/RCE tagging from the vendor, and the trivial attack preconditions make this a top-priority remediation item despite the absence of observed exploitation.
Spoofing in Windows Schannel allows an unauthenticated attacker positioned on the network path between a client and server to interfere with TLS session establishment, potentially bypassing authentication and compromising confidentiality and integrity. Microsoft rates this CVSS 9.0, while our independent assessment assigns a modified vector with no availability impact (A:N) and notes that exploitation requires high attack complexity (AC:H) due to the need for a man-in-the-middle position and specific handshake/timing conditions. No public exploit identified at time of analysis.
Unauthenticated account takeover in Dockhand before 1.0.45 lets any remote attacker who can reach the HTTP API reset the password of the administrative or any other user account and seize it outright. The flaw chains two design failures: a global authentication hook that deliberately skips any request path ending in a static-asset extension such as .js - including paths under /api/ - and user-mutation handlers that fail open when no authenticated principal is present, so a single unauthenticated PUT to /api/users/<id>.js rewrites that user's credentials. No authentication, user interaction, or non-default configuration is required, and there is no public exploit code identified at time of analysis; the only real limiting factor is whether an attacker can reach the Dockhand API over the network, since the flaw is rated 10.0 (CVSS 4.0) and scores CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H on independent assessment. Vendor patching is available, making unpatched internet-facing instances the primary exposure.
Unauthenticated remote code execution affects Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13), where the server accepts and stores an uploaded file of a dangerous/executable type and subsequently executes it, giving the attacker code execution in the context of the ColdFusion service account. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 10.0) confirms the flaw is network-reachable, requires no credentials and no user interaction, and has changed scope, so any internet- or network-exposed instance of an affected version that exposes a file-upload-capable endpoint is in scope. At time of analysis, there is no public exploit identified and no confirmation of active exploitation (no CISA KEV listing), but the combination of a 10.0 score, trivial prerequisites, and full confidentiality/integrity/availability impact makes this a top-priority patching target; environments that front ColdFusion with upload filtering or a WAF, or that deny execution in the upload directory, are materially less exposed.
Remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authenticated, low-privileged user of a SharePoint deployment send a malicious serialized payload over the network and obtain code execution with high confidentiality and integrity impact, requiring no user interaction from the victim. The issue is a CWE-502 deserialization-of-untrusted-data flaw rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit has been identified at time of analysis; the decisive exposure factor is the PR:L authentication prerequisite, so practical risk concentrates in deployments where low-privilege, guest, or self-service accounts are broadly provisioned or can be obtained through credential compromise.
Improper verification of cryptographic signatures in Microsoft Windows Schannel, the operating system's native TLS/SSL provider, allows an unauthenticated attacker who already holds a man-in-the-middle position to spoof a trusted TLS peer and bypass authentication during a handshake. Affected builds include Windows Server 2025 before 10.0.26100.33650, Windows Server 2025 Server Core before the same build, Windows Server 2022 before 10.0.20348.5761, and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 below their respective patched build levels. The 9.0 base score reflects high confidentiality and integrity impact with changed scope, but exploitation carries a high-complexity prerequisite (CVSS AC:H) because the attacker must control or inject into the path between the Windows endpoint and its peer; no attacks require credentials (PR:N) and no user interaction is needed (UI:N). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but vendor patches are available and the affected footprint is broad, so remediation should be treated as high priority.
An insufficiently protected endpoint in Ivanti Neurons Patch for Intune exposes sensitive authentication information to a remote attacker who already holds a valid low-privilege account on the application, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, which limits the confirmed impact to confidentiality. Exploitation is low complexity and requires no user interaction, but it is gated by the need for an authenticated session and by network reachability to the management interface, so organizations that keep the console on a trusted admin network materially reduce exposure. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and the leaked credential material becomes dangerous mainly if it can be reused against the platform or federated services.
Credential disclosure in Ivanti Xtraction (versions before 2026.4) allows an attacker holding a valid low-privileged authenticated account to manipulate a file name or path value the application uses, redirecting application-generated requests to an attacker-controlled endpoint and capturing EPMM connector credentials transmitted by the application. The flaw is network-reachable and requires only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), and because the vulnerable component crosses a trust boundary the scope is changed (S:C) with High confidentiality impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided. Exposure is conditional: the credential-theft path only exists where Xtraction is configured with an EPMM connector that transmits credentials during request processing, so organizations not integrating Xtraction with EPMM are not exposed through this vector.
Server-side request forgery in the SAP Cloud SDK for Python lets remote, unauthenticated attackers redirect OAuth2 token requests to a server they control by manipulating the tenant_subdomain value used to build the token endpoint URL, resulting in exfiltration of the application's OAuth2 client credentials. Exposure is limited to multi-tenant SAP BTP applications that use the SDK for OAuth2 token acquisition and allow attacker influence over the tenant_subdomain input; single-tenant deployments, or those that do not derive the token URL from attacker-supplied data, are not exposed. The vulnerability carries a maximum-severity score of CVSS 10.0, and no public exploit code was identified at time of analysis; no confirmed actively exploited (CISA KEV) status applies.
Remote code execution in .NET WPF (Microsoft.WindowsDesktop.App.Runtime) allows an unauthenticated attacker to execute code on a victim's Windows system by crafting a malicious XAML/XPS document or serialized payload and convincing the user to open or load it. The vulnerability is a CWE-502 deserialization of untrusted data issue rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); exploitation requires user interaction and is not automatable (SSVC Automatable=no, Exploitation=none). No public exploit code or active exploitation has been identified at time of analysis, though vendor patches are available for all affected .NET and .NET Framework versions.
PreDelete and PostDelete hook creation in Argo CD (2.10.0 through the releases preceding 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2) bypasses AppProject destination and resource authorization checks, so a low-privileged attacker with write access to an Application's Git repository can commit a delete hook that pins a forbidden namespace, cluster server, group, kind, or resource name and have the application-controller create that resource with the destination cluster's credentials when the Application is deleted. The scope change in the assessed vector reflects that the controller acts outside the user's AppProject boundary, so impact can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects spawned by a hook Job, all bounded by the application-controller's own cluster RBAC. No public exploit code has been identified at time of analysis, and the flaw is only meaningful where AppProject destination and resource allow/deny lists are relied upon as a security boundary, which is typical of multi-tenant deployments.
An untrusted pointer dereference (CWE-822) in the Windows Distributed File System (DFS) component allows unauthenticated remote attackers to elevate privileges on affected, unpatched Windows and Windows Server builds, per the CVSS vector AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact (9.8). Every Windows 10 branch (1607 through 22H2), Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 - including Server Core installations - are listed as affected below their respective fixed builds. No public exploit code or active exploitation is confirmed at time of analysis (SSVC Exploitation: none), though EPSS is 1.15% (66th percentile), SSVC Automation: yes and Technical Impact: total, and the priority label is act_now; the practical limiting factor is network reachability of the DFS service.
Unauthenticated network attackers may be able to reach and invoke critical functionality of 'tbc' releases prior to version 1.0 without supplying any credentials, a failure mode classified as missing authentication for a critical function (CWE-306); the unconstrained CVSS 4.0 score of 10.0 and our assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) both indicate complete loss of confidentiality, integrity and availability with a changed security scope. The practical caveat is significant: the CVE description is a placeholder that names no endpoint, protocol, or deployment configuration, so the exact preconditions remain unverifiable and our independent assessment explicitly records that the available signals conflict sharply. Exploitation pressure currently looks low - EPSS is just 0.14% (3rd percentile) and no public exploit has been identified at time of analysis - yet a vendor patch exists and ENISA/EUVD lists every release from 0 up to (but excluding) 1.0 as affected.
Improper input validation in Adobe Experience Manager 6.5 (versions up to and including 6.5.25) allows an attacker who already holds a valid low-privilege account or session to execute arbitrary code in the context of the current user, and because the flaw crosses a security scope boundary it can lead to elevated access or takeover of the victim's account or session. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) confirms the issue is remotely reachable with low attack complexity and no user interaction, but it explicitly requires an authenticated low-privilege position - it is not exploitable by a fully unauthenticated attacker. No public exploit code has been identified at time of analysis and the vulnerability has not been confirmed as actively exploited (no CISA KEV listing); Adobe has published advisory APSB26-152 covering the fix.
Incorrect authorization in Adobe Experience Manager 6.5 (up to and including 6.5.25) and AEM 6.5 LTS (up to and including 6.5 LTS SP3) lets an authenticated attacker who holds only a low-privileged account break out of their assigned permission level and execute arbitrary code as the current user, with a changed scope that can extend the compromise to the victim's account or session. The flaw is remotely reachable, requires no user interaction, and carries a 9.9 CVSS base score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), which our independent assessment confirms is a genuine high-priority issue rather than a CVSS-inflated one. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, although the low-privilege prerequisite means any exposed AEM instance that permits self-registration or has a large internal user base is a realistic target.
Heap-based buffer overflow in Microsoft Outlook allows an unauthenticated remote attacker to execute code over a network by delivering a crafted email message that Outlook processes during parsing or rendering. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) asserts no privileges and no user interaction, implying a zero-click/preview-pane trigger against default configurations; the impact is scoped to installations running the vulnerable builds of Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 365 for Mac, and Office LTSC for Mac 2021/2024. CISA's SSVC assessment reports Exploitation: none and no public exploit code has been identified at time of analysis, but the issue is rated Automatable: yes with Technical Impact: total, and a vendor patch is available - this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case.
Heap-based buffer overflow in Microsoft Outlook lets an unauthenticated remote attacker execute arbitrary code by getting a crafted message processed by a vulnerable client, with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-122 as the root-cause class. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft Office LTSC 2021 before 16.0.14334.20974, and unpatched Microsoft 365 Apps for Enterprise channels; because the assessed vector carries PR:N/UI:N, delivery of a malicious message to the mailbox is sufficient under default configurations, with patch state as the main limiting factor. Vendor-released patch: available from Microsoft per the MSRC update guide; there is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' while flagging the flaw as automatable with total technical impact.
Arbitrary code execution in Adobe ColdFusion 2023 up to 2023.0.25 and ColdFusion 2025 up to 2025.0.13 allows a low-privileged authenticated remote attacker to inject and execute code in the context of the current user without user interaction, with a CVSS score of 9.9 and scope change. The vulnerable component is reachable over the network, but the attacker must already have a low-privileged foothold (PR:L) rather than fully anonymous access. No public exploit identified at time of analysis; patch available per vendor advisory APSB26-144.
Code injection in the Salty Docs documentation build pipeline (saltyorg/docs) lets an attacker-controlled fork pull request execute arbitrary code in the privileged base-repository GitHub Actions workflow that has repository secrets in scope, resulting in disclosure of CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY and a write-capable GITHUB_TOKEN and enabling follow-on compromise of the docs.saltbox.dev deployment. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0) and, per the independent assessment, exploitation is confined to repositories running this specific pre-fix workflow pair - the trigger-pr-build.yml workflow records an untrusted fork commit SHA in the pr_info artifact and build-pr.yml's workflow_run job checks that SHA out before running 'pip install -r requirements.txt'. No public exploit code identified at time of analysis and the issue is not in CISA KEV, but the code path is a genuine CI/CD supply-chain flaw rather than a CVSS-inflated paper risk, so the risk is high for unpatched users of this template. Practical exploitation still requires an attacker to control fork content (malicious setup.py or PEP 517 build hook) rather than merely tampering with artifact metadata, and submitting a fork PR requires a GitHub account even though the vector scores PR:N.
Unauthenticated remote attackers can achieve code execution and privilege escalation against NVIDIA AIStore for Linux by injecting arbitrary Kubernetes host-namespace and container security settings into the legacy ETL Kubernetes PodSpec initialization API, rated CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) because the impact escapes the AIStore workload and extends to the underlying Kubernetes node and cluster. The vector confirms the attack is network-reachable with no privileges or user interaction required, though practical exploitation depends on the legacy ETL/transformation feature being enabled and the ETL API being exposed, and on Kubernetes RBAC and PodSecurity admission being permissive enough for AIStore to actually schedule host-namespaced or privileged pods. At time of analysis there is no confirmed active exploitation (CISA KEV) and no public exploit code identified, but the vendor-reported severity, the scope-changed impact, and CWE-250 (execution with unnecessary privileges) place this in top-priority territory for any cluster running an exposed AIStore ETL endpoint.
Unauthenticated remote code execution in Microsoft Outlook is reachable when a vulnerable build parses attacker-controlled message content that triggers a double free (CWE-415), allowing the attacker to run code in the context of the Outlook process. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft Office LTSC 2021 before 16.0.14334.20974, and unpatched Microsoft 365 Apps for Enterprise builds, per the EUVD affected-version data. The static profile is severe (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but no KEV listing, no EPSS value, and no public exploit code were provided; exploitation status is therefore "no public exploit identified at time of analysis," and a vendor patch is available (exact fixed builds known for the LTSC lines, not resolvable for Microsoft 365 Apps from the supplied input).
Remote code execution in Microsoft Outlook allows unauthenticated attackers to execute arbitrary code by sending a crafted email that triggers a heap-based buffer overflow when the message is parsed. Affected versions include Microsoft 365 Apps for Enterprise, Office LTSC 2024 before 16.0.17932.21056, and Office LTSC 2021 before 16.0.14334.20974. No public exploit identified at time of analysis, but the vulnerability is high severity (CVSS 9.8) and requires no user interaction per the vendor vector, making it a serious risk for unpatched systems.
Remote code execution affects Microsoft Outlook through a stack-based buffer overflow (CWE-121) that a remote attacker can trigger by delivering attacker-controlled content to the victim's Outlook client, with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicating an unauthenticated, no-interaction attack and a maximum impact rating of 9.8 (C:H/I:H/A:H). Impact is total: successful exploitation corrupts stack memory in the Outlook process and can yield code execution in the context of the logged-on user, including full read/write access to mail data and the ability to pivot on the endpoint. No public exploit identified at time of analysis - CISA's SSVC assessment records Exploitation as "none" while rating the attack Automatable (yes) and Technical Impact as total, meaning scalable exploitation is technically feasible once exploit code is developed; patched builds are listed by the vendor for the Windows LTSC lines while several Mac and subscription builds are still tied to pending publication.
Remote code execution in Microsoft Office Word is possible when a crafted document exploits an untrusted pointer dereference (CWE-822), letting an attacker run arbitrary code with the privileges of the user who opens the file. Affected builds are Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise (channel-based, fix delivered through the Microsoft Office security release channel). The input rates this 9.8 with a UI:N vector, but the independent assessment resolves user interaction as required (UI:R) because the victim must open - or conceivably preview - the malicious Word document, and no authentication is required of the attacker (PR:N); that interaction requirement materially lowers real-world risk below what a 9.8 no-interaction score implies, and there is no public exploit identified at time of analysis (CISA SSVC records Exploitation: none, and KEV/PoC signals are absent). Microsoft has released vendor patches, so the exposure window is bounded by patching cadence.
Remote code execution in Microsoft PowerPoint allows unauthenticated attackers to execute arbitrary code with the privileges of the opening user by delivering a specially crafted presentation that must be opened or rendered. Affected builds include Microsoft Office LTSC 2021 before 16.0.14334.20974, LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, and the macOS Office LTSC 2021/2024 and 365 for Mac editions; vendor patches are available. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none', though the raw CVSS score is 9.8 because successful exploitation yields total confidentiality, integrity, and availability impact.
Remote code execution risk in the Windows Partition Management Driver (CVE-2026-97805) stems from an out-of-bounds read that Microsoft rates CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N), meaning an unauthenticated remote attacker with no user interaction could reach the vulnerable code path in unpatched Windows 10, Windows 11, and Windows Server 2012-2025 builds; our independent assessment keeps PR:N/UI:N but raises attack complexity to high (AC:H), since reliably converting a kernel out-of-bounds read into remote code execution is difficult against Windows kernel mitigations such as ASLR and kernel-mode protections, and network reachability of the partition driver path is the practical gate. Microsoft has released fixes per the MSRC advisory; no public exploit identified at time of analysis, and there is no CISA KEV entry.