Origin-validation bypass in Microsoft .NET 8.0, 9.0, 10.0 and 11.0 (plus bundled Visual Studio 2022 17.14 and Visual Studio 2026 18.10 builds) lets an unauthenticated remote attacker defeat a built-in security feature when a victim interacts with attacker-supplied cross-origin content, producing integrity-only impact (CVSS 6.5, I:H with no confidentiality or availability loss). The mandatory user-interaction step (UI:R) and the fact that exploitation depends on the application actually relying on the affected origin-checking feature keep this at moderate severity; there is currently no public exploit identified at time of analysis, CISA SSVC records exploitation as none and automation as no, and EPSS/KEV data is absent. Vendor patches are available (MSRC advisory msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96238).
Cross-site scripting (XSS) in Microsoft SharePoint Server 2019 allows remote attackers to inject malicious scripts into web pages viewed by other users, potentially leading to spoofing or limited data theft. Exploitation requires user interaction (e.g., clicking a crafted link) but no authentication, and it is not automatable. No public exploit code or active exploitation has been identified, and the overall risk is assessed as moderate due to the required victim interaction and limited impact.
A local security-feature bypass in Visual Studio Code (all builds from 1.0.0 up to but not including 1.141.1) lets a low-privileged, already-authorized local attacker violate the editor's privilege boundaries under specific, hard-to-control conditions, with the integrity impact extending beyond VS Code's own security scope. Exploitation is not remotely reachable: it requires local access on the same host (AV:L), an existing low-privilege account (PR:L), a high-complexity precondition such as a race or particular environmental state (AC:H), and a victim action inside the editor (UI:R), which substantially constrains real-world abuse. There is no public exploit identified at time of analysis, no CISA KEV listing, and the vendor has released a patch, so this should be handled as a routine moderate-severity patch priority rather than an emergency.
A denial-of-service condition in ASP.NET Core allows an unauthenticated, remote attacker to exhaust server CPU by submitting HTTP form data in many small increments, causing Microsoft.AspNetCore.WebUtilities FormPipeReader to repeatedly rescan the entire buffered request body. The flaw (CWE-407, inefficient algorithmic complexity) affects applications running ASP.NET Core 8.0.0-8.0.31, 9.0 before 9.0.21, and 10.0 before 10.0.13, as well as Microsoft Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4, and carries a CVSS 3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Only availability is impacted - there is no data disclosure or modification - and the high attack-complexity rating reflects the need for an incrementally delivered body rather than a single malformed request. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial.
Information disclosure in .NET's System.Net.Http affects applications that use SocketsHttpHandler with an authenticating proxy, because the Proxy-Authorization header is retained when an outbound request is redirected and is then sent to the redirect destination, exposing Basic proxy credentials to a server the attacker can observe or control. Affected runtimes are .NET 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13 and 11.0 before 11.0.0-rc.2, with Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4 shipping the same component; the CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (5.9), reflecting high attack complexity rather than any authentication requirement. There is no public exploit identified at time of analysis - CISA's SSVC assessment rates exploitation as none and automatable as no - but the severity comes from a leaked credential, not from any integrity or availability impact, and the exposure is limited to the proxy secret rather than general application data.
Improper restrictions on internal APIs and file paths in Siemens Industrial Edge deployments - the Industrial Edge Device Kits for arm64 and x86-64 from V1.5 through V1.28, Industrial Edge Cloud Device (IECD), Industrial Edge Own Device (IEOD), Industrial Edge Virtual Device (IEVD), SCALANCE LPE9413/LPE9433, SIMATIC IoT2050 variants and the SIMATIC IPC BX-21A/BX-39A/BX-59A, IPC127E, IPC227E, IPC227G, IPC427E and IPC847E edge devices - allow an authenticated remote user to reach internal endpoints and resources beyond their intended authorization and read sensitive internal information, which in the worst case can be leveraged to facilitate unauthorized access to the system. The vendor score is CVSS 6.8 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), a confidentiality-only, scope-changing information-disclosure issue; the independent assessment reproduces the same vector but rates the privilege requirement as PR:L, so treating any authenticated user as a potential attacker is the safer assumption pending Siemens clarification. Exploitation requires network reachability to the device's management/internal API surface plus valid credentials, which in typical OT architectures confines risk to segmented industrial networks; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, making this a moderate-priority hardening item rather than an emergency patch.
Out-of-bounds memory reads in Siemens Desigo PXC building-automation controllers (all versions >= V2.3) and Capital Embedded AR Classic (431-422 all versions; R20-11 versions before V2303) allow an unauthenticated, remote attacker who can reach the device's packet-processing/communication service to read memory outside the intended packet boundaries by sending a malformed packet. Per the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (score 5.3), the impact is limited to low confidentiality loss - no integrity or availability impact, and no code execution - because the flaw is a pure out-of-bounds read (CWE-125). There is no public exploit identified at time of analysis and no CISA KEV listing; the practical risk is governed by network exposure of these typically segmented OT/building-management interfaces.
Unauthenticated remote attackers can delete and rebuild the shared product search index in FJ-OMS oms-erp through PRE by calling the public /v1/goods/sku/es-test maintenance endpoint in the skyer-goods microservice, degrading search availability for all tenants. This missing authentication flaw (CWE-306) requires only network reachability to the exposed endpoint, with no credentials or user interaction needed. No public exploit identified at time of analysis; the impact is limited to search index availability and integrity, and the index can be restored via reload.
Unrestricted file upload in phpwcms up to and including 1.9.49 and 1.12.3 lets an unauthenticated remote attacker upload files with server-executable extensions (for example .phtml, .phar, .pht, or .cgi) through the cnt23 article content form, because the pre-patch 'Extension Check' relied only on a short blocklist that omitted these variants. The attack requires the site to actually expose a front-end article content form (cnt23) with file upload enabled; impact ranges from arbitrary file storage to remote code execution depending on server configuration, since the content/form/.htaccess rule that denies PHP execution is enforced by Apache but ignored by Nginx and other servers. No public exploit identified at time of analysis, and there is no KEV listing, though the vulnerability is remotely reachable without credentials. Vendor-released patches are available in versions 1.9.50 and 1.12.4.
Denial of service in the ConnectBot cbssh/sshlib SSH client library (all versions through 0.3.0) lets a malicious or compromised SSH server crash the client process by returning a small malformed packet whose inner length or element-count fields are far larger than the containing packet. The Kaitai Struct Java runtime allocates an array using the attacker-declared length before it notices the input is truncated, producing excessive allocation and an uncaught OutOfMemoryError that terminates the host application; a second, narrower path exists through malformed SSH-agent messages, but only when SSH agent forwarding is enabled. The vulnerable client must initiate a connection to the hostile server (user interaction), which is the main limiting factor; there is no confidentiality or integrity impact, no authentication is required on the general transport path (CVSS 4.0 vector PR:N, UI:A), and no public exploit code was identified at time of analysis. The issue is fixed in version 0.3.1 and is not confirmed as actively exploited (CISA KEV).
Authenticated path traversal in Wazuh Manager versions 4.1.1 up to (but not including) 4.14.8 lets an attacker who already holds the shared cluster key - effectively a compromised or attacker-controlled cluster worker - pass traversal sequences as a filename to the get_list_file helper and read arbitrary files readable by the wazuh service account, including client.keys and an ossec.conf that may itself contain the cluster key. The access vector is network-based but gated behind high privileges (CVSS 4.0 PR:H, assessed as CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), so only multi-node clustered deployments where a worker node or the shared cluster key has been compromised are meaningfully exposed; single-node installs without cluster workers are not. There is no write, modify, or availability impact, and no public exploit identified at time of analysis - this is a moderate, authentication-gated information-disclosure issue rather than a drop-everything priority.
Razorpay IFSC Ruby gem through version 2.0.62 is affected by a server-side request forgery (SSRF) vulnerability. Unauthenticated remote attackers can supply a crafted IFSC code to IFSC.find or IFSC#get - such as a network-path reference (//evil.host) or an absolute URI - that Ruby's URI.join resolves as a new host, redirecting API requests to internal or attacker-chosen hosts and returning parsed response fields. Exploitation requires the consuming application to pass untrusted input directly to these methods; impact is limited to low confidentiality (CVSS 4.0 base 6.9) with no write or availability effect, and no public exploit has been identified at time of analysis.
FreeRDP's freerdp-proxy component (versions 3.17.1 up to but not including 3.32.0) can be induced to read heap memory out of bounds by a malicious or man-in-the-middle-controlled backend RDP server, which sends a DRDYNVC CREATE_REQUEST_PDU whose channel name is not NUL-terminated. The unbounded snprintf in DynvcTrackerHandleCreateBack then walks past the allocated buffer, leaking adjacent heap contents into proxy log output or crashing the process; only the proxy's own backend connection path is exposed, so environments that connect solely to fully trusted RDP servers are not practically at risk. No public exploit has been identified at time of analysis, EPSS is not elevated, and the issue is not listed in CISA KEV; impact is bounded to memory disclosure and denial of service rather than code execution.
Missing authorization checks in B3log Symphony (B3log's Java-based blog/community platform) through version 3.6.4 allow unauthenticated remote attackers to reach administrative routes and perform state-changing actions, including suppressing reports via /admin/report/ignore/{reportId}, deleting unused tags via /admin/tags/remove-unused, and granting points to arbitrary users via /admin/user/{userId}/init-point. The flaw is a code-level default in PermissionMidware.check, which treats any route lacking a permission.rule.url entry as permitted, so no authentication, user interaction, or special configuration is required - only network reachability to the Symphony instance (CVSS v3.1 base 6.9, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Impact is integrity-only, with no confidentiality or availability effect, and no public exploit code has been identified at time of analysis.
Unauthenticated information disclosure in ThriveX-Server through 4.0 lets any remote attacker read non-public article content - including drafts and soft-deleted posts - from the public blog API. The GET /api/article and /api/article/{id} endpoints omit an authorization check on the publication state of the returned record, so an attacker can simply pass isDraft=true or isDel=true as query parameters, or walk sequential article IDs, to retrieve the full title, description and body of articles the operator never intended to publish. The issue requires no credentials, no user interaction and no special configuration (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N, 6.9 Medium; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and there is no public exploit identified at time of analysis and no CISA KEV listing, though a public technical write-up of the disclosure exists and the vulnerable source lines are linked from the advisory.
Unauthenticated remote attackers can defeat the login throttling of the Wazuh Manager REST API in versions 4.0.0 through 4.14.7 by sending parallel requests to the authenticate and run_as endpoints, because each concurrent request evaluates the block check before earlier failures are counted, removing the max_login_attempts ceiling and enabling unlimited password guessing. This is a moderate-priority weakness rather than an outright compromise: it only removes the rate limit, so the attacker must still guess a valid credential, and practical risk is neutralized by strong unique API passwords, network segmentation or IP allow-listing of the API, or upgrading to 4.14.8. No public exploit code and no confirmed active exploitation were identified at time of analysis; vendor-released patch: 4.14.8.
Persistent command execution in Citrix UniconOS lets a locally authenticated low-privilege user plant commands that survive normal operation and execute in a privileged context, giving the attacker sustained access to data and code on the endpoint. The flaw affects UniconOS releases before 2607.2 CR and before 2603 LTSR CU2; it is not remotely exploitable and requires an existing foothold or valid low-privilege credentials on the device, with no user interaction needed. No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and the vendor has released a patch, making this a moderate-risk, locally-scoped issue rather than an urgent widespread threat.
Local privilege escalation in HYPR Passwordless on Windows (all releases before 11.3.3) allows an attacker holding existing low-privileged local access to manipulate a user-controlled key used in an authorization decision, bypassing access checks and reaching resources belonging to other or higher-privileged principals. The vulnerability is an insecure direct object reference (CWE-639) rated CVSS:4.0 base 6.9 (Medium) with a local vector (AV:L, PR:L, UI:N) and high confidentiality impact but only limited integrity and availability impact, meaning the practical worst case is unauthorized disclosure rather than full host takeover. No public exploit code has been identified at time of analysis, and HYPR has addressed the issue in version 11.3.3, so only unpatched installations remain exposed.
Denial of service in the OpenVPN Data Channel Offload driver for Windows (ovpn-dco-win) allows a local attacker to deadlock the kernel driver with a crafted write to the ovpn-dco device, leaving the host unresponsive and typically requiring a reboot to recover. Windows endpoints running ovpn-dco-win 0.6.5 through 1.3.5 or 2.4.0 through 2.8.7 are affected; the assessed vector (CVSS:3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates no privileges are required from the local vantage point, though device-object access controls may in practice restrict who can reach the write path, and there is no confidentiality or integrity impact, no code execution, and no privilege gain. No public exploit code has been identified at time of analysis and the failure mode is availability-only, making this a modest-priority local DoS rather than a remote or wormable issue.
Memory exhaustion in Wazuh agents (versions 3.9.0 through 4.14.7) allows an attacker who already controls the Wazuh manager to OOM-kill wazuh-modulesd on every agent in a targeted group by pushing a small SCA policy containing deeply nested YAML aliases through the merged.mg group-configuration channel. The agent-side yaml2json_node parser performs uncontrolled alias expansion, so the tiny policy expands into a far larger in-memory structure and consumes the agent process's memory. Exploitation is gated on manager control (CVSS 4.0 base 6.9, AV:N/AC:L/PR:H/UI:N/VC:N/VI:N/VA:H) and the impact is availability-only - no confidentiality or integrity effect; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available in Wazuh 4.14.8.
Authentication bypass in Hono 4.12.4 up to (but not including) 4.13.11 lets unauthenticated remote attackers read static files that are supposed to be gated by prefix-mounted middleware: a malformed, double percent-encoded path is matched by the router in its encoded form, so middleware mounted on the decoded prefix never runs while serveStatic still resolves and serves the underlying file. The impact is limited to confidentiality of the exposed static content (assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - no integrity or availability effect), and only deployments that both use serveStatic and rely on prefix-based middleware for access control are meaningfully exposed. No public exploit identified at time of analysis, and the vendor-released fix is Hono 4.13.11.
Resource exhaustion in the Certificate Path Builder of wbond certvalidator 0.11.1 and earlier lets unauthenticated remote attackers degrade availability by supplying crafted X.509 certificate chains for validation, consuming excessive CPU and/or memory (CWE-400, availability-only impact). The flaw is only reachable where a deploying application feeds attacker-controlled certificates into the library - for example mutual-TLS client certificates, PKCS#7 or document-signature verification, or any workflow that validates externally supplied chains - and is not remotely reachable in applications that never process external certificates. No vendor-released patch is available (the vendor was contacted but did not respond), and no public exploit code has been identified at time of analysis; EPSS data was not provided.
Weak authentication in the Network Device Enrollment Service (NDES) component of Active Directory Certificate Services lets an authenticated, network-positioned attacker spoof the enrollment service and obtain or manipulate certificate enrollment data, with high confidentiality and integrity impact but no availability impact (CVSS 6.8, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N). Only Windows Server hosts on which the optional NDES role has been installed and exposed are affected - this is not a default Windows feature - and the high attack complexity means success depends on a specific condition outside the attacker's control rather than a single deterministic request. No public exploit code has been identified and the issue is not listed in CISA KEV, and a vendor patch is available from Microsoft.
Privilege escalation in the Windows Win32 Kernel Subsystem stems from a heap-based buffer overflow (CWE-122) that an attacker with physical access to a target machine can trigger to gain SYSTEM-level privileges; once physical contact is achieved, no authentication or user interaction is required. Microsoft has released vendor patches, and no public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none, automatable: no). Because the attack vector is physical (CVSS AV:P) with a 6.8 score, realistic risk is limited to insiders, shared or kiosk endpoints, and lost or stolen devices rather than remote attackers.
Elevation of privilege in the Microsoft Bluetooth Driver affecting Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2016, 2019, 2022 and 2025 stems from an out-of-bounds read (CWE-125) that a physically present attacker can trigger with no authentication and no user interaction, achieving high impact across confidentiality, integrity and availability (CVSS 6.8). The decisive constraint is the CVSS attack vector AV:P: exploitation requires physical or local hardware-level access to deliver crafted input to the Bluetooth stack, so the flaw is not remotely reachable and CISA's SSVC framework rates it as non-automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and KEV/EPSS signals do not indicate active exploitation; residual risk is concentrated in lost, stolen, unattended, or otherwise physically accessible endpoints rather than in network-exposed systems.
An integer overflow in a Windows Kernel Mode Driver lets an attacker who has physical access to a machine elevate privileges to kernel level, with no authentication or user interaction required. Because the attack vector is physical (CVSS AV:P, PR:N, UI:N), exploitation is confined to hands-on scenarios such as an unattended, locked, or kiosk device, and the CISA SSVC assessment rates it non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. The resulting impact on confidentiality, integrity, and availability is high once triggered, and Microsoft has released patched builds covering Windows 10, Windows 11, and Windows Server editions.
Code execution with full confidentiality, integrity and availability impact is achievable on unpatched Windows systems through a heap-based buffer overflow in the Windows Overlay Filter (WOF), but only for an attacker who already holds physical access to the target machine. The flaw carries a base score of 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): physical access is required, yet once obtained no authentication and no user interaction are needed and attack complexity is low, so any unattended, shared or physically exposed endpoint that processes attacker-supplied input through WOF is at risk. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework rates exploitation as none and automation as not feasible, but Microsoft has published a vendor fix and the technical impact is assessed as total, so the residual risk is concentrated in kiosks, lobby/plant-floor PCs, and other hands-on devices rather than in remotely reachable server fleets.
Code execution in the Windows Overlay Filter (WOF) driver of unpatched Windows 10 (21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2022/2025 allows an unauthenticated attacker to gain full control of confidentiality, integrity, and availability on the affected host, but only if they already hold physical, hands-on access to the device (CVSS AV:P), which caps the base score at 6.8. The root cause is a heap-based buffer overflow (CWE-122) that is reachable with low attack complexity, no privileges (PR:N), and no user interaction (UI:N), so the decisive limiting factor is the physical-access prerequisite rather than any technical barrier. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC Exploitation=none, Automatable=no), and a vendor patch is available, so remote, wormable, or mass-scale abuse is not feasible.
Privilege escalation in the Windows Kernel allows an attacker with physical access to a Windows 11 version 26H1 device to elevate to SYSTEM-level privileges by supplying an untrusted pointer to a kernel routine. Only machines running Windows 11 26H1 builds from 10.0.28000.0 through 10.0.28000.3231 are affected, and the exploit requires hands-on interaction with the hardware (CVSS AV:P), with no authentication or user interaction needed once that access exists. Microsoft has shipped a fix in build 10.0.28000.3231; there is no public exploit code and no evidence of active exploitation (not listed in CISA KEV) at time of analysis, though the EPSS-style urgency is tempered mainly by the physical-access prerequisite, which limits realistic exposure to lost, stolen, unattended, kiosk, or shared hardware rather than remote attack.
Heap-based buffer overflow in the Windows Portable Device (MTP) Driver lets an attacker who can physically attach a crafted MTP peripheral - a smartphone, camera, or rogue USB gadget - corrupt kernel heap memory and elevate privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server hosts. The CVSS vector (AV:P/AC:L/PR:N/UI:N) means no authentication and no user interaction are needed, but the physical-access prerequisite confines realistic risk to attended endpoints, kiosks, shared or public machines, and lost or stolen laptops rather than network-exposed systems. No public exploit code has been identified at time of analysis, and Microsoft has shipped patched builds, so this is a moderate-priority, patch-and-move-on issue rather than an emergency.
Privilege escalation in Windows StorPort allows a physically present attacker to exploit an untrusted pointer dereference in the Windows Storage Port Driver and gain high-integrity kernel-level code execution on unpatched Windows 10, Windows 11, and Windows Server systems. The assessed CVSS 3.1 vector is AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 6.8), meaning physical access is required, no logical authentication or user interaction is needed once that access is obtained, and the impact is high across confidentiality, integrity, and availability. A vendor patch is available; no public exploit code or CISA KEV active-exploitation signal was identified at time of analysis.
Security feature bypass in Windows Remote Desktop allows an on-path attacker who occupies a privileged man-in-the-middle position between an RDP client and server to defeat protections that depend on a broken or risky cryptographic algorithm (CWE-327), potentially exposing the confidentiality and integrity of the session. Exploitation is not a self-contained remote trigger: the victim must actually initiate an RDP session (UI:R) and the attacker must already sit on the network path (AC:H), although no credentials on the target are required (PR:N), which is reflected in the CVSS 3.1 base score of 6.8. Microsoft has released fixes for the affected Windows 10, Windows 11 and Windows Server builds, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Port Driver (CWE-122) lets an attacker who can physically interact with a target machine corrupt kernel pool memory and elevate privileges, with high impact to confidentiality, integrity, and availability (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 6.8). Unpatched Windows 11 builds (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025, including Server Core installations, are affected; no authentication or user interaction is required, but the attack depends absolutely on hands-on physical access, is not remotely reachable, and cannot be automated (SSVC Automatable=no, Exploitation=none). No public exploit identified at time of analysis, no confirmed active exploitation (not listed in CISA KEV), and a vendor patch is available.
Manifest and blob digest verification bypass in the CNCF Distribution registry client (all versions prior to 3.1.2) lets an attacker who controls the registry HTTP response - by operating a malicious or compromised registry, or by holding a TLS-intercepting man-in-the-middle position - substitute attacker-chosen manifest content even when the caller pinned the request by digest, with the forged Docker-Content-Digest header presented as the requested value. The flaw is unauthenticated from the client's perspective (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N, 6.8) and scopes out of the client because the bundled pull-through proxy (registry/proxy/proxymanifeststore.go) can cache and re-serve the substituted manifest to downstream consumers, making this a conditional supply-chain integrity issue rather than a drop-everything emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor-released patch is version 3.1.2.
Stored cross-site scripting in the WP Testimonials WordPress plugin (all versions through 1.4.13) lets an authenticated user holding the Author role or higher persist JavaScript inside testimonial content, which then executes in the browser of any user - including an administrator - who later views the rendered testimonials (assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The plugin not only fails to escape testimonial output but actively reverses WordPress's built-in HTML sanitization when rendering it, so the payload survives despite core protections, and exploitation needs no non-default settings. Impact is gated by the Author-level privilege requirement plus a victim subsequently loading the affected page, so single-author or single-admin sites with no untrusted accounts are materially less exposed; at time of analysis there is no CISA KEV entry and no public exploit code identified, and the flaw was reported to WPScan (tracked as EUVD-2026-98299).
The .NET Client Library for SIMATIC S7 Webserver API (all versions before V3.3.62) fails to redact PLC restore passwords from HTTP error exception messages, causing plaintext credentials to be written into logs and diagnostic output. An authenticated attacker with low-privileged local access to those logs (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 5.5) can recover the restore password and, if it is still valid, use it to perform unauthorized restore or configuration operations against the corresponding SIMATIC S7 PLC. Exploitation is conditional: the vulnerable library must have handled a restore operation that produced an HTTP error, and the resulting diagnostic artifact must be readable by the attacker. No public exploit code has been identified at time of analysis and this CVE has not been confirmed actively exploited (CISA KEV); Siemens has released a fix in V3.3.62.
An out-of-bounds write in the Citrix Workspace app for Windows lets a locally present, low-privileged attacker corrupt memory inside the client process, which the vendor scopes to a high availability impact - realistically a client crash or denial of service rather than code execution or data disclosure. Affected builds are those before 2603.20 CR, before LTSR 2607 Hotfix 1, and before LTSR 2507 CU3 Hotfix 1; fixed installers are available from Citrix, and at time of analysis there is no CISA KEV listing and no public exploit identified. With a CVSS 4.0 base score of 6.8 with a local vector, low privileges and no user interaction, this is a moderate-priority endpoint stability issue rather than a top-priority remote threat.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authenticated attacker who can reach the server from an adjacent network segment make the SharePoint front end issue requests on their behalf, exposing internal services and data (CVSS 5.7, AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, confidentiality-only impact). Low-privilege credentials and adjacency are both mandatory preconditions, so unauthenticated internet-based attackers are excluded, and no user interaction or race conditions are involved. A vendor patch is available, no public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported, making this a patch-management priority rather than an emergency.
Untrusted pointer dereference in the Windows NTFS file system driver allows a locally authenticated attacker who already holds elevated privileges on the host to execute code, with full impact to confidentiality, integrity, and availability of the affected system. Because the attack vector is local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N) and low complexity (AC:L) once those prerequisites are met, the flaw functions as a post-compromise escalation and code-execution primitive rather than an initial-access or remote vector, and it cannot be triggered across the network. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and Microsoft has published fixed builds covering all affected Windows 10, Windows 11, and Windows Server platforms.
Local privilege escalation in the Windows Distributed File System (DFS) lets an authenticated attacker with valid host credentials trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation is local only with no user interaction and, per Microsoft's advisory, requires existing high privileges, so realistic exposure is limited to shared, multi-user, or terminal-server hosts where an untrusted authenticated principal is present. No public exploit code has been identified at time of analysis and CISA's SSVC rates exploitation as none; vendor patches are available.
Heap-based buffer overflow in Microsoft SQL Server lets an attacker who already holds high privileges and local access on the database host run arbitrary code in the context of the SQL Server service. Affected builds are SQL Server 2017, 2019, 2022 and 2025 releases below the fixed GDR and cumulative-update versions documented in the vendor advisory (for example, SQL Server 2022 GDR below 16.0.1210.3 and SQL Server 2019 GDR below 15.0.2200.2). Because exploitation requires pre-existing elevated privileges and a local foothold (CVSS:3.1/AV:L/AC:L/PR:H/UI:N), a remote unauthenticated attacker cannot reach this directly; CISA's SSVC assessment rates it non-automatable with no observed exploitation, and no public exploit code was identified at time of analysis, though the technical impact is rated total once the prerequisites are met. A vendor patch is available and should be applied as routine maintenance rather than emergency response.
Heap-based buffer overflow in Microsoft SQL Server allows an attacker who already holds high-privilege, locally authenticated access to the database engine to execute arbitrary code in the context of the SQL Server process, with high impact to confidentiality, integrity, and availability. Affected builds span SQL Server 2017, 2019, 2022, and 2025 releases below the fixed GDR/CU versions documented in ENISA EUVD-2026-100618, and a vendor patch is available from Microsoft. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation as 'none' with Automatable 'no', and the AV:L/PR:H vector confines realistic abuse to malicious insiders or post-compromise privilege leveraging - a moderate priority rather than an emergency patch.
Denial of service in Microsoft Windows via the IKE Extension (IKEEXT) service, which can be crashed or disrupted when it processes malformed IKE protocol input, causing a buffer over-read (CWE-126). All supported Windows client and server platforms that ship IKEEXT are affected - including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1), and Windows Server 2012 through 2025 - but only systems with IPsec/IKE or Windows VPN functionality active and network-reachable are exposed. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5) indicates an authorized attacker with low-level network access (not anonymous reachability) can cause an availability-only impact; there is no confidentiality or integrity effect and no code execution, and no public exploit has been identified at time of analysis (CISA SSVC: exploitation none, automatable no), making this a moderate-priority patching item rather than an emergency.
An out-of-bounds read in Windows DNS Server allows an authenticated, low-privileged attacker to cause a denial of service (DoS) over the network. The flaw affects Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 and Windows 10 Versions 1607 and 1809 when the DNS Server role is enabled; exploitation requires valid credentials (PR:L) but no user interaction. No public exploit code has been identified, and CISA SSVC rates exploitation as none, yielding a modest, non-urgent risk despite the network attack vector.
An out-of-bounds read in the Windows DNS Server service on affected Windows Server builds permits an authenticated, network-positioned attacker to trigger memory access beyond an allocated buffer, with the vendor's own vector scoring the impact as availability-only (A:H) rather than code execution. Exploitation requires network reachability to a DNS service, low attack complexity, no user interaction, and low-level authorization (PR:L), meaning the attacker must already hold valid credentials or an authorized position rather than being fully anonymous; the vendor-derived description claims possible code execution, but that claim is not supported by the CVSS impact metrics and should be confirmed with Microsoft. No public exploit code has been identified at time of analysis, the CISA SSVC assessment records no known exploitation activity, and the defect is not listed in KEV, so the realistic near-term risk is disruption of DNS resolution on unpatched Windows Server 2022 and Windows Server 2025 hosts.
An authenticated, network-reachable attacker can disclose files outside the intended directory through absolute path traversal in the Windows Encrypting File System (EFS), tracked as CVE-2026-83683. Only unpatched Windows client and server builds are affected - for example Windows 11 24H2 before 10.0.26100.9711, Windows Server 2022 before 10.0.20348.5761, and legacy platforms back to Windows Server 2012 before 6.2.9200.26434. Exploitation requires the attacker to already hold low-privilege authenticated access (CVSS vector PR:L, AV:N), and the impact is limited to confidentiality (C:H with I:N/A:N), so there is no file modification or denial of service; no public exploit has been identified at time of analysis and CISA's SSVC assessment rates the issue non-automatable, making opportunistic mass exploitation unlikely.
Loading an attacker-supplied DER private-key file into the ConnectBot cbssh SSH client library (sshlib) 0.3.0 and earlier can crash the hosting application process: the DER parser accepts oversized long-form length octets, accumulates them into a 32-bit Int where they wrap around, and then allocates arrays sized by the resulting value without checking it against the remaining input. The reachable entry points are SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), and SshSigning.getPublicKey(); the flaw is not reachable from SSH server host keys or agent-forwarding messages, so a malicious SSH server cannot trigger it. Exploitation is local and requires the victim to deliberately open or supply the malicious key file, and the demonstrated impact is availability only - an uncaught OutOfMemoryError that terminates the process - with no code execution, no confidentiality impact, and no usable weakened key demonstrated; no public exploit code or confirmed in-the-wild exploitation is identified at time of analysis, and vendor-released patch version 0.3.1 resolves it.
Denial of service in the Microsoft Windows DNS Server role allows a network-reachable attacker who holds valid low-privilege credentials to crash or destabilize the DNS service on unpatched Windows Server releases from 2012 through 2025, including Server Core installations. Per the assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires authorization on the target - this is explicitly an 'authorized attacker' scenario, not anonymous remote abuse - and the resulting impact is availability only, with no code execution, no data access, and no integrity loss. No public exploit has been identified at time of analysis and CISA's SSVC rates the issue non-automatable with nonexistent observed exploitation, making this a moderate-priority availability bug rather than a critical RCE-class threat.
An out-of-bounds read in the Microsoft Windows DNS Server role lets a remote attacker who already holds a low level of authorization (PR:L, per the assessed CVSS vector) crash or destabilize the DNS service, denying name resolution to clients on the network. The flaw affects unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations), and exploitation requires the DNS Server role to be installed and reachable. Impact is availability-only (C:N/I:N/A:H) with no confidentiality or integrity effect, no public exploit identified at time of analysis, no CISA KEV listing, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no' - a moderate, not top-tier, priority. Microsoft has released fixed builds.
Denial of service in the Windows DNS Server role affects Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations), where an attacker who already holds valid low-privilege credentials (CVSS PR:L) can send specially crafted DNS traffic over the network that triggers an out-of-bounds read (CWE-125) and takes the DNS service down. Impact is availability-only: confidentiality and integrity are both rated None, scope is unchanged, and the CVSS 3.1 score is 6.5. No public exploit has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none and automatable as no, so the practical priority is moderate and driven by the criticality of the DNS role rather than by observed attacks.