Spoofing in Microsoft Active Directory Federation Services (AD FS) lets a remote, unauthenticated attacker forge signed tokens that the service accepts as legitimate, yielding full compromise of confidentiality and integrity (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The flaw is an improper verification of cryptographic signatures (CWE-347) in the AD FS token-validation path, tagged as an authentication bypass/JWT attack, so a crafted SAML/JWT assertion can impersonate any user or relying party - effectively bypassing federation authentication. Only hosts running the AD FS role on unpatched Windows Server builds (2012 through 2025) are exposed; organizations that do not deploy AD FS are not affected. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA SSVC: Exploitation = none, Automatable = yes, Technical Impact = total), but the vulnerability is considered high-priority because exploitation is trivially automatable and impact is total where the role is exposed.
OS command injection in Adobe Experience Manager 6.5 (through 6.5.25) and AEM 6.5 LTS (through SP3) allows an authenticated, low-privileged attacker to run arbitrary operating-system commands in the context of the current user, with changed scope (S:C) meaning the injected command executes outside the application's own security authority on the host. Rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the exploitation bar is low attack complexity with no user interaction; the only meaningful constraint is the need for a valid low-privilege AEM session, which is a very low bar in multi-user AEM author environments where content authors and other non-admin accounts are routinely issued. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); no EPSS score was supplied with the source data. This is a genuine high-priority vulnerability rather than a CVSS-inflated paper risk, and the specific vulnerable feature or injectable parameter is not named in the advisory summary, so patch validation and hunting should be prioritized on affected instances.
Unauthenticated remote code execution in Adobe Experience Manager stems from an incorrect authorization check that lets a remote attacker bypass access controls and execute arbitrary code in the context of the current user, with the changed-scope rating indicating impact can extend beyond the vulnerable component (CVSS 3.1 base 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Every unpatched deployment is in scope: AEM 6.5 up to and including 6.5.25, AEM 6.5 LTS up to and including 6.5 LTS SP3, and AEM as a Cloud Service up to and including 2026.9.28187; no credentials or user interaction are required, and the only practical precondition is that the affected author, publish, or endpoint is reachable from the attacker's network. No public exploit code exists and no confirmed active exploitation (CISA KEV) has been recorded at time of analysis, but the authentication-bypass-to-RCE chain plus the maximum severity score make internet-facing, unpatched instances a top remediation priority rather than a high-score/low-real-risk case.
Unauthenticated remote code execution affects Adobe Experience Manager, specifically AEM as a Cloud Service builds up to and including 2026.9.28187, AEM 6.5 LTS up to and including SP3, and AEM 6.5 up to and including 6.5.25, and is rooted in an incorrect authorization check (CWE-863) that carries a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Because the defective access-control decision itself is the entry point, a remote attacker needs only network reachability, no credentials, and no user interaction, and the changed scope (S:C) means the resulting arbitrary code execution in the current user's context can be leveraged to gain elevated access or control over a victim's account or session beyond the vulnerable component. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated, no-interaction exploitation profile places internet-exposed AEM instances at top-priority risk, with network isolation (VPN, WAF, non-exposed tiers) and the affected-version boundaries as the main mitigating factors.
Unauthenticated remote code execution affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source through improper neutralization of special elements used in a template engine (CWE-1336, server-side template injection). Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C), an attacker can reach the vulnerable template-processing surface over the network without credentials and without any victim interaction, and the scope change (S:C) indicates compromise can extend beyond the vulnerable component into the surrounding account or session context. The score is the maximum possible (10.0) and Adobe has published remediation guidance in APSB26-153; no public exploit code or confirmed active exploitation was identified at time of analysis, so the risk is driven by severity and ease of reachability rather than observed attacks.
Server-side request forgery in Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) allows unauthenticated remote attackers to cause the server to make arbitrary requests, resulting in privilege escalation with the scope changed. This critical vulnerability has a CVSS score of 10.0 and requires no user interaction. No public exploit has been identified at the time of analysis.
Unauthenticated remote code execution affects Adobe Experience Manager as a Cloud Service (0 through 2026.9.28187), AEM 6.5 LTS (through SP3), and AEM 6.5 (through 6.5.25) due to an incorrect authorization check (CWE-863) in a network-reachable component. Because the CVSS vector is PR:N/UI:N, attackers need no credentials and no victim interaction - any internet-facing or otherwise reachable affected instance is directly attackable - and the changed scope (S:C) means a successful exploit can compromise resources beyond the vulnerable component itself, including the victim's account or session and the underlying runtime. At the time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, but the maximum 10.0 base score, the authentication-bypass/RCE tagging from the vendor, and the trivial attack preconditions make this a top-priority remediation item despite the absence of observed exploitation.
Spoofing in Windows Schannel allows an unauthenticated attacker positioned on the network path between a client and server to interfere with TLS session establishment, potentially bypassing authentication and compromising confidentiality and integrity. Microsoft rates this CVSS 9.0, while our independent assessment assigns a modified vector with no availability impact (A:N) and notes that exploitation requires high attack complexity (AC:H) due to the need for a man-in-the-middle position and specific handshake/timing conditions. No public exploit identified at time of analysis.
Unauthenticated account takeover in Dockhand before 1.0.45 lets any remote attacker who can reach the HTTP API reset the password of the administrative or any other user account and seize it outright. The flaw chains two design failures: a global authentication hook that deliberately skips any request path ending in a static-asset extension such as .js - including paths under /api/ - and user-mutation handlers that fail open when no authenticated principal is present, so a single unauthenticated PUT to /api/users/<id>.js rewrites that user's credentials. No authentication, user interaction, or non-default configuration is required, and there is no public exploit code identified at time of analysis; the only real limiting factor is whether an attacker can reach the Dockhand API over the network, since the flaw is rated 10.0 (CVSS 4.0) and scores CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H on independent assessment. Vendor patching is available, making unpatched internet-facing instances the primary exposure.
Unauthenticated remote code execution affects Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13), where the server accepts and stores an uploaded file of a dangerous/executable type and subsequently executes it, giving the attacker code execution in the context of the ColdFusion service account. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 10.0) confirms the flaw is network-reachable, requires no credentials and no user interaction, and has changed scope, so any internet- or network-exposed instance of an affected version that exposes a file-upload-capable endpoint is in scope. At time of analysis, there is no public exploit identified and no confirmation of active exploitation (no CISA KEV listing), but the combination of a 10.0 score, trivial prerequisites, and full confidentiality/integrity/availability impact makes this a top-priority patching target; environments that front ColdFusion with upload filtering or a WAF, or that deny execution in the upload directory, are materially less exposed.
Improper verification of cryptographic signatures in Microsoft Windows Schannel, the operating system's native TLS/SSL provider, allows an unauthenticated attacker who already holds a man-in-the-middle position to spoof a trusted TLS peer and bypass authentication during a handshake. Affected builds include Windows Server 2025 before 10.0.26100.33650, Windows Server 2025 Server Core before the same build, Windows Server 2022 before 10.0.20348.5761, and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 below their respective patched build levels. The 9.0 base score reflects high confidentiality and integrity impact with changed scope, but exploitation carries a high-complexity prerequisite (CVSS AC:H) because the attacker must control or inject into the path between the Windows endpoint and its peer; no attacks require credentials (PR:N) and no user interaction is needed (UI:N). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but vendor patches are available and the affected footprint is broad, so remediation should be treated as high priority.
An insufficiently protected endpoint in Ivanti Neurons Patch for Intune exposes sensitive authentication information to a remote attacker who already holds a valid low-privilege account on the application, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, which limits the confirmed impact to confidentiality. Exploitation is low complexity and requires no user interaction, but it is gated by the need for an authenticated session and by network reachability to the management interface, so organizations that keep the console on a trusted admin network materially reduce exposure. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and the leaked credential material becomes dangerous mainly if it can be reused against the platform or federated services.
Credential disclosure in Ivanti Xtraction (versions before 2026.4) allows an attacker holding a valid low-privileged authenticated account to manipulate a file name or path value the application uses, redirecting application-generated requests to an attacker-controlled endpoint and capturing EPMM connector credentials transmitted by the application. The flaw is network-reachable and requires only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), and because the vulnerable component crosses a trust boundary the scope is changed (S:C) with High confidentiality impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided. Exposure is conditional: the credential-theft path only exists where Xtraction is configured with an EPMM connector that transmits credentials during request processing, so organizations not integrating Xtraction with EPMM are not exposed through this vector.
Server-side request forgery in the SAP Cloud SDK for Python lets remote, unauthenticated attackers redirect OAuth2 token requests to a server they control by manipulating the tenant_subdomain value used to build the token endpoint URL, resulting in exfiltration of the application's OAuth2 client credentials. Exposure is limited to multi-tenant SAP BTP applications that use the SDK for OAuth2 token acquisition and allow attacker influence over the tenant_subdomain input; single-tenant deployments, or those that do not derive the token URL from attacker-supplied data, are not exposed. The vulnerability carries a maximum-severity score of CVSS 10.0, and no public exploit code was identified at time of analysis; no confirmed actively exploited (CISA KEV) status applies.
PreDelete and PostDelete hook creation in Argo CD (2.10.0 through the releases preceding 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2) bypasses AppProject destination and resource authorization checks, so a low-privileged attacker with write access to an Application's Git repository can commit a delete hook that pins a forbidden namespace, cluster server, group, kind, or resource name and have the application-controller create that resource with the destination cluster's credentials when the Application is deleted. The scope change in the assessed vector reflects that the controller acts outside the user's AppProject boundary, so impact can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects spawned by a hook Job, all bounded by the application-controller's own cluster RBAC. No public exploit code has been identified at time of analysis, and the flaw is only meaningful where AppProject destination and resource allow/deny lists are relied upon as a security boundary, which is typical of multi-tenant deployments.
An untrusted pointer dereference (CWE-822) in the Windows Distributed File System (DFS) component allows unauthenticated remote attackers to elevate privileges on affected, unpatched Windows and Windows Server builds, per the CVSS vector AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact (9.8). Every Windows 10 branch (1607 through 22H2), Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 - including Server Core installations - are listed as affected below their respective fixed builds. No public exploit code or active exploitation is confirmed at time of analysis (SSVC Exploitation: none), though EPSS is 1.15% (66th percentile), SSVC Automation: yes and Technical Impact: total, and the priority label is act_now; the practical limiting factor is network reachability of the DFS service.
Unauthenticated network attackers may be able to reach and invoke critical functionality of 'tbc' releases prior to version 1.0 without supplying any credentials, a failure mode classified as missing authentication for a critical function (CWE-306); the unconstrained CVSS 4.0 score of 10.0 and our assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) both indicate complete loss of confidentiality, integrity and availability with a changed security scope. The practical caveat is significant: the CVE description is a placeholder that names no endpoint, protocol, or deployment configuration, so the exact preconditions remain unverifiable and our independent assessment explicitly records that the available signals conflict sharply. Exploitation pressure currently looks low - EPSS is just 0.14% (3rd percentile) and no public exploit has been identified at time of analysis - yet a vendor patch exists and ENISA/EUVD lists every release from 0 up to (but excluding) 1.0 as affected.
Improper input validation in Adobe Experience Manager 6.5 (versions up to and including 6.5.25) allows an attacker who already holds a valid low-privilege account or session to execute arbitrary code in the context of the current user, and because the flaw crosses a security scope boundary it can lead to elevated access or takeover of the victim's account or session. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) confirms the issue is remotely reachable with low attack complexity and no user interaction, but it explicitly requires an authenticated low-privilege position - it is not exploitable by a fully unauthenticated attacker. No public exploit code has been identified at time of analysis and the vulnerability has not been confirmed as actively exploited (no CISA KEV listing); Adobe has published advisory APSB26-152 covering the fix.
Incorrect authorization in Adobe Experience Manager 6.5 (up to and including 6.5.25) and AEM 6.5 LTS (up to and including 6.5 LTS SP3) lets an authenticated attacker who holds only a low-privileged account break out of their assigned permission level and execute arbitrary code as the current user, with a changed scope that can extend the compromise to the victim's account or session. The flaw is remotely reachable, requires no user interaction, and carries a 9.9 CVSS base score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), which our independent assessment confirms is a genuine high-priority issue rather than a CVSS-inflated one. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, although the low-privilege prerequisite means any exposed AEM instance that permits self-registration or has a large internal user base is a realistic target.
Heap-based buffer overflow in Microsoft Outlook allows an unauthenticated remote attacker to execute code over a network by delivering a crafted email message that Outlook processes during parsing or rendering. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) asserts no privileges and no user interaction, implying a zero-click/preview-pane trigger against default configurations; the impact is scoped to installations running the vulnerable builds of Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 365 for Mac, and Office LTSC for Mac 2021/2024. CISA's SSVC assessment reports Exploitation: none and no public exploit code has been identified at time of analysis, but the issue is rated Automatable: yes with Technical Impact: total, and a vendor patch is available - this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case.
Heap-based buffer overflow in Microsoft Outlook lets an unauthenticated remote attacker execute arbitrary code by getting a crafted message processed by a vulnerable client, with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-122 as the root-cause class. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft Office LTSC 2021 before 16.0.14334.20974, and unpatched Microsoft 365 Apps for Enterprise channels; because the assessed vector carries PR:N/UI:N, delivery of a malicious message to the mailbox is sufficient under default configurations, with patch state as the main limiting factor. Vendor-released patch: available from Microsoft per the MSRC update guide; there is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' while flagging the flaw as automatable with total technical impact.
Arbitrary code execution in Adobe ColdFusion 2023 up to 2023.0.25 and ColdFusion 2025 up to 2025.0.13 allows a low-privileged authenticated remote attacker to inject and execute code in the context of the current user without user interaction, with a CVSS score of 9.9 and scope change. The vulnerable component is reachable over the network, but the attacker must already have a low-privileged foothold (PR:L) rather than fully anonymous access. No public exploit identified at time of analysis; patch available per vendor advisory APSB26-144.
Code injection in the Salty Docs documentation build pipeline (saltyorg/docs) lets an attacker-controlled fork pull request execute arbitrary code in the privileged base-repository GitHub Actions workflow that has repository secrets in scope, resulting in disclosure of CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY and a write-capable GITHUB_TOKEN and enabling follow-on compromise of the docs.saltbox.dev deployment. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0) and, per the independent assessment, exploitation is confined to repositories running this specific pre-fix workflow pair - the trigger-pr-build.yml workflow records an untrusted fork commit SHA in the pr_info artifact and build-pr.yml's workflow_run job checks that SHA out before running 'pip install -r requirements.txt'. No public exploit code identified at time of analysis and the issue is not in CISA KEV, but the code path is a genuine CI/CD supply-chain flaw rather than a CVSS-inflated paper risk, so the risk is high for unpatched users of this template. Practical exploitation still requires an attacker to control fork content (malicious setup.py or PEP 517 build hook) rather than merely tampering with artifact metadata, and submitting a fork PR requires a GitHub account even though the vector scores PR:N.
Unauthenticated remote attackers can achieve code execution and privilege escalation against NVIDIA AIStore for Linux by injecting arbitrary Kubernetes host-namespace and container security settings into the legacy ETL Kubernetes PodSpec initialization API, rated CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) because the impact escapes the AIStore workload and extends to the underlying Kubernetes node and cluster. The vector confirms the attack is network-reachable with no privileges or user interaction required, though practical exploitation depends on the legacy ETL/transformation feature being enabled and the ETL API being exposed, and on Kubernetes RBAC and PodSecurity admission being permissive enough for AIStore to actually schedule host-namespaced or privileged pods. At time of analysis there is no confirmed active exploitation (CISA KEV) and no public exploit code identified, but the vendor-reported severity, the scope-changed impact, and CWE-250 (execution with unnecessary privileges) place this in top-priority territory for any cluster running an exposed AIStore ETL endpoint.
Unauthenticated remote code execution in Microsoft Outlook is reachable when a vulnerable build parses attacker-controlled message content that triggers a double free (CWE-415), allowing the attacker to run code in the context of the Outlook process. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft Office LTSC 2021 before 16.0.14334.20974, and unpatched Microsoft 365 Apps for Enterprise builds, per the EUVD affected-version data. The static profile is severe (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but no KEV listing, no EPSS value, and no public exploit code were provided; exploitation status is therefore "no public exploit identified at time of analysis," and a vendor patch is available (exact fixed builds known for the LTSC lines, not resolvable for Microsoft 365 Apps from the supplied input).
Remote code execution in Microsoft Outlook allows unauthenticated attackers to execute arbitrary code by sending a crafted email that triggers a heap-based buffer overflow when the message is parsed. Affected versions include Microsoft 365 Apps for Enterprise, Office LTSC 2024 before 16.0.17932.21056, and Office LTSC 2021 before 16.0.14334.20974. No public exploit identified at time of analysis, but the vulnerability is high severity (CVSS 9.8) and requires no user interaction per the vendor vector, making it a serious risk for unpatched systems.
Remote code execution affects Microsoft Outlook through a stack-based buffer overflow (CWE-121) that a remote attacker can trigger by delivering attacker-controlled content to the victim's Outlook client, with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicating an unauthenticated, no-interaction attack and a maximum impact rating of 9.8 (C:H/I:H/A:H). Impact is total: successful exploitation corrupts stack memory in the Outlook process and can yield code execution in the context of the logged-on user, including full read/write access to mail data and the ability to pivot on the endpoint. No public exploit identified at time of analysis - CISA's SSVC assessment records Exploitation as "none" while rating the attack Automatable (yes) and Technical Impact as total, meaning scalable exploitation is technically feasible once exploit code is developed; patched builds are listed by the vendor for the Windows LTSC lines while several Mac and subscription builds are still tied to pending publication.
Remote code execution in Microsoft Office Word is possible when a crafted document exploits an untrusted pointer dereference (CWE-822), letting an attacker run arbitrary code with the privileges of the user who opens the file. Affected builds are Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise (channel-based, fix delivered through the Microsoft Office security release channel). The input rates this 9.8 with a UI:N vector, but the independent assessment resolves user interaction as required (UI:R) because the victim must open - or conceivably preview - the malicious Word document, and no authentication is required of the attacker (PR:N); that interaction requirement materially lowers real-world risk below what a 9.8 no-interaction score implies, and there is no public exploit identified at time of analysis (CISA SSVC records Exploitation: none, and KEV/PoC signals are absent). Microsoft has released vendor patches, so the exposure window is bounded by patching cadence.
Remote code execution in Microsoft PowerPoint allows unauthenticated attackers to execute arbitrary code with the privileges of the opening user by delivering a specially crafted presentation that must be opened or rendered. Affected builds include Microsoft Office LTSC 2021 before 16.0.14334.20974, LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, and the macOS Office LTSC 2021/2024 and 365 for Mac editions; vendor patches are available. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none', though the raw CVSS score is 9.8 because successful exploitation yields total confidentiality, integrity, and availability impact.
Remote code execution risk in the Windows Partition Management Driver (CVE-2026-97805) stems from an out-of-bounds read that Microsoft rates CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N), meaning an unauthenticated remote attacker with no user interaction could reach the vulnerable code path in unpatched Windows 10, Windows 11, and Windows Server 2012-2025 builds; our independent assessment keeps PR:N/UI:N but raises attack complexity to high (AC:H), since reliably converting a kernel out-of-bounds read into remote code execution is difficult against Windows kernel mitigations such as ASLR and kernel-mode protections, and network reachability of the partition driver path is the practical gate. Microsoft has released fixes per the MSRC advisory; no public exploit identified at time of analysis, and there is no CISA KEV entry.
Arbitrary code execution is possible in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) through an incorrect authorization check (CWE-863) that lets a low-privileged actor perform actions beyond their granted permissions and reach code execution, with no user interaction required. Rated CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the flaw is network-reachable and low-complexity, but the PR:L vector means the attacker must already hold a low-privilege position relative to ColdFusion - a valid low-level account or access to a reachable authenticated interface - rather than being fully anonymous; the changed scope indicates impact can extend beyond the initially vulnerable component. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the independent assessment rates it a genuine high-priority finding rather than an inflated score, so it warrants prompt patching given the code-execution impact.
Remote code execution in OpenSSH for Windows (the Microsoft OpenSSH server component) can be triggered over the network by an unauthenticated attacker with no user interaction, according to the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N and a 9.8 base score. The flaw is a use-after-free that can lead to memory corruption and potential code execution or denial of service, but exposure is limited to Windows hosts where the optional OpenSSH Server feature is installed and listening, typically on TCP/22. No public exploit identified at time of analysis, and confidence is limited by single-source reporting; defenders should treat any network-exposed Windows sshd listener as high risk and restrict or firewall the SSH port pending patching.
Windows CD-ROM Driver (cdrom.sys) contains a buffer over-read (CWE-126) that can disclose kernel memory and, per the vendor's threat model, be exploited by an unauthenticated remote attacker to elevate privileges on unpatched Windows 10, Windows 11, and Windows Server builds. Our independent assessment keeps AV:N/PR:N/UI:N but raises attack complexity to High and reduces integrity/availability impact to Low, because exploitation requires reaching the driver's input-handling path and the over-read primitive mainly yields disclosure rather than guaranteed code execution; CISA SSVC records no observed exploitation, no public exploit identified at time of analysis, and EPSS is low at 0.89% (58th percentile). Microsoft has released fixed builds, so affected systems should be patched per the MSRC advisory.
Reflected cross-site scripting in the Vitess vttablet and vtcombo /twopcz HTTP debug endpoint allows a remote, unauthenticated attacker (per the supplied CVSS vector, PR:N) to inject script into the response by supplying crafted Action and dtid form values, which twopczHandler writes into a text/html response without HTML escaping. Successful exploitation requires operator interaction - a targeted operator must open the attacker-crafted request in a browser - after which the script runs with the vttablet debug origin and can read same-origin diagnostic endpoints exposing query, transaction, environment, variable, or profiling data present in that deployment. Affected deployments are those running Vitess before 23.0.5 or 24.0.x before 24.0.2 where the debug endpoint is reachable under the default allow-all ACL; no public exploit code was identified at time of analysis and there is no CISA KEV entry, and the supplied 9.8 score overstates impact because the assessed vector requires user interaction and bounds integrity impact to the reflected page content.
Remote code execution in SAP S/4HANA's Manage Substitution/Validation Rules allows an authenticated attacker who already holds rule-maintenance business authorizations to submit crafted rule definitions that the rule-processing logic interprets as executable ABAP, resulting in full compromise of the affected system with high impact to confidentiality, integrity and availability (CVSS 9.9, Scope:Changed). Reaching the vulnerable code path requires an account provisioned with substitution/validation rule creation or maintenance privileges, so the practical barrier is authorization scope rather than authentication alone. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the vendor advisory (SAP Security Note 3805589) should be treated as urgent given the code-injection primitive and the privileged business role required.
Code execution risk in the Windows CD-ROM Driver arises when the driver processes attacker-controlled disc-image or CD-ROM data, leading to an untrusted pointer dereference (CWE-822) on affected Windows 10, Windows 11, and Windows Server builds. Microsoft has released fixed builds for every listed branch, and the available data shows no public exploit or observed in-the-wild exploitation, with EPSS at 0.84% (57th percentile); the vendor vector is 9.8, but the independent assessment rates AC:H because the network delivery path to the driver is not described and SSVC marks exploitation as none and automatable as no. The priority label is act_now, and the technical impact is total.
Heap-based buffer overflow in the Windows WebDAV component allows remote attackers to elevate privileges and potentially achieve full compromise of confidentiality, integrity and availability (CVSS 9.8). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is network-based with no authentication and no user interaction required, and the affected scope covers Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core installations, below the per-branch fixed builds published by Microsoft. The signals are strongly mixed: there is no CISA KEV entry and SSVC records Exploitation: none with Automatable: no, so no public exploit has been identified at time of analysis, and EPSS is modest at 0.84% (57th percentile); nevertheless technical impact is rated total and the vuln.today decision label is act_now with a vendor-released patch available. Whether exploitation requires an enabled, reachable WebDAV listener rather than a client-side connect-back is not described in the available sources.
SAP NetWeaver Visual Composer fails to enforce sufficient authorization checks within certain portal functionality, allowing a low-privileged authenticated user to invoke internal operations against a preconfigured remote system; depending on how that remote connection is configured, the attacker could fully compromise the destination system, with high impact on confidentiality, integrity, and availability. The flaw carries a CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting the scope change that carries impact from the vulnerable portal into the connected remote system. Exploitation requires a valid low-privileged portal session (not anonymous access) plus an existing preconfigured remote destination reachable through Visual Composer, and there is currently no public exploit identified at time of analysis.
Heap-based buffer overflow in the Windows SMB Client lets remote attackers elevate privileges on affected Windows hosts by compelling the target's SMB client to connect to an attacker-controlled server. The vulnerability carries a 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N), though it is a client-side direction flaw: the attacker must induce an outbound SMB connection rather than reach a listening service, and the sources do not describe the trigger, so the true degree of coercion or user interaction is unverified. CISA SSVC rates exploitation as 'none' with Automatable 'no' and total technical impact, EPSS is modest at 0.77% (55th percentile), and no public exploit code has been identified at time of analysis; Microsoft has released fixes.
OS command injection in reNgine (through v2.2.0 and master commit de4199222cca5618f1255930ce78987e47d43a99) lets a user with scan engine configuration privileges inject arbitrary shell commands through the custom_headers field, executing them in the context of the reNgine server when the fetch_url or dir_file_fuzz tasks run. The input CVSS score of 9.8 assumes an unauthenticated attacker, but that overstates reachability: the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, since exploiting it requires an authenticated reNgine account able to create or edit scan engines, followed by starting a scan using the poisoned engine. Exploitation yields full confidentiality, integrity and availability impact on the host, and while a third-party GitHub repository referencing this CVE exists, EPSS is low at 0.74% (54th percentile) and there is no KEV listing; no public exploit code is confirmed in the provided data.
An origin-validation bypass in the Legacy Update ActiveX control (versions 1.12.0 through 1.13.1) allows a malicious webpage opened in Internet Explorer to call control methods that should have been blocked, letting the page enumerate update and system information, install updates without consent, display dialogs, or trigger a restart when a reboot is already pending. The flaw stems from the IsPermitted method returning S_OK for any hostname that is not on the permitted list instead of failing with E_ACCESSDENIED, and it requires the victim to visit an attacker-controlled page on a host where the vulnerable control is registered. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released Legacy Update 1.13.2 with a fix that sets E_ACCESSDENIED on non-permitted origins.
Command injection in MobSF v4.5.2 allows an attacker with access to the instance-and, for the /api/v1/scan path, a valid MobSF REST API key-to execute arbitrary shell commands via the /download_data/ endpoint, the /api/v1/scan REST API, or the Dynamic Analyzer ADB integration module (tests_common.py). The independent assessment scores this CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rather than the 9.8 in the input because API-key authentication is enforced and the ADB path requires an active Android emulator or device. No public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.71% (52nd percentile); MobSF is typically deployed internally, which reduces remote unauthenticated exposure.
Unauthenticated remote code execution affects the Windows DNS Server role across Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) as well as Windows 10 versions 1607 and 1809, driven by a heap-based buffer overflow (CWE-122) that a network attacker can trigger by sending crafted DNS messages to an affected host. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation is remote, unauthenticated, low-complexity and requires no user interaction once the DNS Server service is installed and reachable - making internet-exposed, forwarding or recursive resolvers the highest-risk deployments, while purely internal-only resolvers simply narrow the attacker population to those with network access. This is a genuine top-tier priority rather than a high-score-but-low-risk artifact, though no public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); Microsoft has released fixes through the MSRC update guide, so the primary exposure is unpatched hosts rather than a lack of remediation.
Remote, low-complexity code execution is possible in Adobe Commerce, Adobe Commerce B2B and Magento Open Source through an incorrect authorization flaw (CWE-863) rated CVSS 9.8, allowing an attacker to act with the privileges of the current request context and escalate to arbitrary code execution without user interaction. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes network-reachable exploitation requiring no prior privileges, which is the strongest signal in the available data. No public exploit code and no CISA KEV entry were identified at time of analysis, and Adobe's only provided reference is advisory APSB26-153; defenders should note Adobe's wording about 'the context of the current user,' which may indicate an existing session or request context is required even though the vector claims PR:N.
Improper authentication in IBM MCP Context Forge prior to 1.0.2 allows remote, unauthenticated attackers to forge HS256-signed JWTs using a JWT_SECRET_KEY shipped in mcpgateway/config.py and .env.example, gaining full platform-administrator access without a database account. The attack requires two conditions to hold simultaneously: the gateway must still use the known shipped signing key, and the platform-admin bootstrap must be active (REQUIRE_USER_IN_DB=false with the token subject set to PLATFORM_ADMIN_EMAIL); because the documented production default for REQUIRE_USER_IN_DB is true, strictly default production deployments are protected, as are operators who rotated the secret before upgrading. Where both conditions are met, forged administrator tokens survive password rotation, account deletion, and session revocation, enabling administrative disclosure, modification, and service disruption; no public exploit code has been identified at time of analysis and the issue is fixed in 1.0.2.
Directory traversal in the iKuai8 management interface shipped on the IK-Q3000 Enterprise-grade Wi-Fi 6 router lets an attacker escape the intended file path and execute arbitrary code on the device; affected builds are Enterprise Edition <= iKuai8_3.7.23_Enterprise Build 202606021825 and Free Edition <= iKuai 8_4.0.304-beta. The CVE record scores this 9.8 with a PR:N vector (unauthenticated), but the public disclosure is explicitly titled 'authorized' path traversal and our independent assessment rates it PR:L, so a valid authenticated management session is most likely a prerequisite and is the key factor limiting real-world exploitation. There is no CISA KEV entry and no public exploit identified at time of analysis, and EPSS is low at 0.45% (38th percentile); exposure is further gated by network reachability to the router's administrative web service, so units with management bound to an internal/LAN interface are materially less exposed.
Path traversal in Fortinet FortiSIEM 7.5.0 can let a remote unauthenticated attacker execute unauthorized code or commands by sending specially crafted packets to the affected service. The CVSS vector shows network exploitation with low complexity, no privileges, and no user interaction, producing high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified in the provided intelligence; consult Fortinet advisory FG-IR-26-180 for the authoritative affected-version and remediation details.
Privilege escalation in HTMLy 3.1.1 allows a remote attacker to elevate from a low-privileged account or session to administrative control by abusing the get_feed function in the admin.php component. The supplied CVSS 3.1 score is 9.8 with PR:N, but the independent assessment applies PR:L because CWE-269 privilege-escalation issues realistically require some existing access; no CISA KEV or confirmed active exploitation is provided, and no public exploit was identified at time of analysis. Exposure is limited to HTMLy 3.1.1 installations where the admin interface is reachable, and keeping admin.php off the public internet substantially reduces risk.
Unauthenticated read, modification, and permanent deletion of stored credential records in Rapid7 Metasploit Framework through 6.5.4 is possible whenever the optional msf-ws REST API is running and network-reachable, because the PUT update_credential and DELETE delete_credentials handlers for /api/v1/credentials omit the warden.authenticate! call that every other route in Msf::WebServices::CredentialServlet performs before processing. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) is consistent with this: the two affected routes are reachable by unauthenticated remote attackers and allow full compromise of confidentiality and integrity of the credential store, which holds passwords, hashes, and private keys captured during shared team engagements. The practical limiting factor is deployment mode rather than the flaw itself - msf-ws is an optional component that must be explicitly started and exposed (default listener 0.0.0.0:8080), so Metasploit installations that never run the web service are not exposed; there is no public exploit identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV).
Unauthenticated access to administrative API endpoints in Esri Portal for ArcGIS can let remote attackers reach /portaladmin/local functionality that should require authentication, potentially exposing portal administration with high confidentiality, integrity, and availability impact. Exploitation is conditional - the independent assessment rates CVSS 3.1 as AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning high impact but dependent on unspecified portal configuration conditions, while the vendor input vector is 9.8 with AC:L - and no public exploit has been identified at time of analysis. Affected product is Portal for ArcGIS, tracked by CPE cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*; consult Esri's September 2026 bulletin for exact affected versions and fixes.