Remote code execution in Windows Remote Desktop Services is possible through a use-after-free (CWE-416) in the RDP component, rated CVSS 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). An unauthenticated remote attacker can achieve high confidentiality, integrity, and availability impact, but exploitation is not reliable: the attacker must satisfy a race or heap-grooming condition (AC:H), and a victim must initiate or accept a Remote Desktop connection to an attacker-controlled endpoint (UI:R). No public exploit code is identified at time of analysis, CISA SSVC records exploitation as none, and Microsoft has released patches; hosts without the Remote Desktop/RDS role enabled are not exposed, so risk is concentrated on internet- or untrusted-network-facing RDP deployments.
Remote code execution in Microsoft's Windows Remote Desktop Client stems from a use-after-free (CWE-416) triggered when the client processes crafted data supplied by an RDP server. An unauthenticated attacker can exploit this over a network only by inducing a user to connect to an attacker-controlled or compromised RDP server - for example by opening a malicious .rdp file or link - after which heap corruption can lead to code execution in the context of the client. The CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting required user interaction and high attack complexity; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', no public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed actively exploited (CISA KEV). Vendor patches are available, so the practical risk is concentrated in unpatched Windows clients exposed to untrusted RDP endpoints.
Remote code execution affects the Windows Remote Desktop Client (mstsc) across a wide range of supported desktop and server builds, allowing an attacker who controls or manipulates an RDP endpoint to execute code in the context of the connecting user. The flaw is a use-after-free (CWE-416) rated CVSS 7.5; exploitation requires the victim to actively initiate an RDP session outward to the hostile server (UI:R), and high attack complexity (AC:H) reflects dependence on heap/race conditions rather than a deterministic trigger - no authentication is required of the attacker (PR:N). No public exploit code has been identified at time of analysis and CISA's SSVC records Exploitation=none with no KEV listing, so risk is driven by the breadth of affected Windows builds and the total technical impact should the memory-corruption primitive be reliably converted into code execution.
Outbound RDP sessions from the Windows Remote Desktop Client can be turned against the client itself: when a user connects to an attacker-controlled, compromised, or man-in-the-middle'd RDP server, crafted response data triggers a use-after-free (CWE-416) that can lead to code execution on the victim's machine, with total technical impact if the memory corruption is reliably steered. The attacker needs no credentials on the client (PR:N) and can operate remotely over the network (AV:N), but exploitation is gated by mandatory user interaction (the user must actively initiate the session, UI:R) and high attack complexity (AC:H) reflecting the precision required to trigger and control the freed allocation. Microsoft rates this CVSS 7.5 and has released vendor patches; there is no public exploit identified at time of analysis and no evidence of exploitation - CISA's SSVC assessment records Exploitation: none and Automatable: no.
A use-after-free (CWE-416) in the Windows Remote Desktop Client (mstsc.exe / RDP client stack) allows remote code execution in the security context of the connecting user when that user establishes an outbound RDP session to an attacker-controlled or compromised RDP server. Exploitation is unauthenticated with respect to the client (CVSS 3.1 PR:N) but requires user interaction (UI:R) and is rated high attack complexity (AC:H), because the attacker must deliver crafted server-side RDP protocol data and win a race condition over the freed object; the resulting impact is full compromise of confidentiality, integrity and availability within the user's own security scope (S:U, no privilege escalation to SYSTEM). Microsoft has released a vendor patch covering Windows 10, Windows 11 and Windows Server 2012 through 2025, exploitation has not been observed by CISA SSVC assessment (Exploitation: none, Automatable: no), and no public exploit code was identified at the time of analysis.
Use-after-free (CWE-416) in the Windows Remote Desktop Client (mstsc) allows remote code execution on a Windows client that connects out to a malicious or compromised RDP server, affecting all supported Windows 10, Windows 11, and Windows Server builds below the fixed patch levels listed in Microsoft's advisory. Exploitation is not opportunistic: it follows a reverse-RDP pattern in which the victim must initiate the session (UI:R) against attacker-controlled server infrastructure, and public exploitation is not confirmed - CISA SSVC records exploitation as 'none' and no public exploit code has been identified at time of analysis. The negotiated CVSS of 7.5 is driven by high attack complexity (AC:H), reflecting the heap-state and timing control needed to win the use-after-free race, while requiring no privileges on the victim (PR:N) and impacting confidentiality, integrity, and availability equally.
Remote code execution in the Microsoft Remote Desktop Client (CWE-416) occurs when a user initiates an RDP connection to an attacker-controlled or compromised server that returns crafted responses, causing the client to reuse a freed memory object. The CVSS vector (AV:N/AC:H/PR:N/UI:R) shows an unauthenticated attacker is required to hold no credentials on the victim host, but must convince the user to start the session and satisfy high-complexity heap-timing conditions for reliable exploitation; impact is confined to the connecting user's security context with no privilege escalation implied. Exploitation only triggers on a client that actively connects outbound, and no public exploit identified at time of analysis.
Integer overflow (CWE-190) in the CAI Content Credentials SDK lets unauthenticated remote attackers crash applications that parse externally supplied media or embedded Content Credentials manifests, producing a denial-of-service condition. Affected deployments are those that invoke the SDK against untrusted input - for example services that automatically ingest and verify uploaded or fetched media - while systems that only process trusted, internally generated assets are far less exposed. The vulnerability is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), requires no user interaction, causes availability loss only (no disclosure or modification), and no public exploit code has been identified at time of analysis; the vendor advisory is Adobe APSB26-163.
Integer overflow (CWE-190) in Microsoft Word's document parsing can allow an unauthenticated, network-delivered attacker to execute code in the context of the victim by convincing them to open a specially crafted Word document. Exploitation requires user interaction (UI:R) and high attack complexity (AC:H), and impact is confined to the user's Word process (scope unchanged). No public exploit identified at time of analysis, making this a moderately high but not top-tier priority for most organizations.
Heap-based buffer overflow in Microsoft Access enables unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted database file. Exploitation is non-trivial due to high attack complexity (AC:H) and requires user interaction (UI:R), but successful exploitation grants code execution with the user's privileges. No public exploit code has been identified at time of analysis, and a vendor patch is available via the Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft PowerPoint allows unauthenticated remote attackers to execute arbitrary code when a victim opens a specially crafted presentation file, but exploitation requires user interaction and reliable heap corruption against modern memory-safety mitigations (AC:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is considered moderate-to-high due to the social engineering delivery and Protected View defenses that can impede successful attacks. This vulnerability affects Microsoft Office PowerPoint installations that have not received the update referenced in the Microsoft Security Update Guide.
Heap-based buffer overflow in Microsoft Office Access allows an unauthenticated remote attacker to execute code in the security context of the user who opens a specially crafted Access database file. Exploitation is not autonomous despite the AV:N vector: the attacker must deliver the malformed file and persuade the victim to open it (UI:R), and reliable code execution further depends on heap-layout grooming to control the corrupted allocation (AC:H), so any code that runs inherits only the opening user's privileges (S:U). No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the assessed risk is mixed-priority given the mandatory user interaction and high attack complexity.
Out-of-bounds access in libwebsockets' LEJP incremental JSON parser allows unauthenticated remote attackers to crash the process via crafted JSON that exceeds the parser's fixed-size path index or stack arrays. Affected are applications that call lejp_parse on untrusted input; publicly available exploit code exists, though exploitation is deployment-dependent and impact is limited to denial of service (no code execution or data disclosure). The root cause is an off-by-one error in lib/misc/lejp.c, where boundary checks are performed after incrementing the index.
Denial of service in mp4v2 2.0.0 lets a remote, unauthenticated attacker crash any process that parses an attacker-supplied MP4 file, because MP4File::GenerateTracks() in src/mp4file.cpp passes a NULL handler-type string straight into strcmp() without a check (CWE-476). Impact is availability-only - no code execution, privilege escalation, or data exposure - but the defect is trivially automatable (CISA SSVC: automatable yes, technical impact partial) and publicly available exploit code exists, with no CISA KEV designation. EPSS and NVD enrichment were not provided in the available data, so no quantitative exploit-likelihood score is asserted here. In server-side pipelines that ingest untrusted MP4s the exposure is genuinely remote and unauthenticated; for interactive clients it reduces to a user opening a malicious file.
Microsoft QUIC (MsQuic) can be made to bypass a security feature over the network because a security-relevant variable is initialized to an insecure default (CWE-453), producing a CVSS 7.5 condition with no confidentiality impact, limited integrity impact and full availability impact (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H). The issue is unauthenticated and requires no user interaction, but is only reachable on hosts that actually run a network-exposed QUIC listener - HTTP/3 or SMB over QUIC - and the high attack complexity reflects a timing/transient-state prerequisite the attacker cannot directly control. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the MSRC update guide is the authoritative source for affected builds and fixes.
Denial-of-service in the CAI Content Credentials SDK allows remote unauthenticated attackers to exhaust system resources by supplying crafted Content Credentials data to an application that parses or verifies it. The issue is availability-only (CVSS 3.1 7.5, CWE-400) with no confidentiality or integrity impact, and no public exploit has been identified at time of analysis. Deployments that do not expose SDK-backed parsing to untrusted input face substantially lower real-world risk.
Denial of service in the CAI Content Credentials SDK allows remote, unauthenticated attackers to exhaust system resources by supplying crafted Content Credentials data (such as C2PA manifests or embedded asset metadata) for parsing or verification, with no user interaction required. The CVSS 3.1 base score of 7.5 is driven entirely by availability impact (C:N/I:N/A:H) under a fully remote, low-complexity vector (AV:N/AC:L/PR:N/UI:N), meaning integrity and confidentiality are unaffected. Risk is contingent on exposure: only applications or services that actually ingest untrusted Content Credentials input through a reachable interface are at risk, and no public exploit has been identified at time of analysis. Note that no KEV listing or public proof-of-concept is present in the available intelligence, so the practical threat is best characterized as a reliable availability-degradation vector once a vulnerable processing path is reachable rather than as an observed attack campaign.
Application denial-of-service in the Adobe CAI Content Credentials SDK lets unauthenticated remote attackers exhaust system resources by supplying crafted media files or embedded C2PA/Content Credentials manifests that reach the SDK's parsing or verification path, degrading or halting the consuming application (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/A:H; 7.5 High). Impact is confined to availability - no code execution, privilege escalation, or data disclosure - and real-world risk is heavily gated by exposure, since a service must actually ingest untrusted Content Credentials input for the flaw to be reachable; deployments that only process trusted first-party content or run the SDK offline in batch mode face substantially reduced risk. No public exploit identified at time of analysis.
Unauthenticated denial of service in Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) allows a remote attacker to crash the application by sending crafted input that the server fails to validate properly. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials and no victim interaction are required against a reachable instance, and the impact is confined to availability (C:N/I:N/A:H) - the practical worst case is a service outage rather than data exposure or code execution. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the dominant risk factor is exposure, since internet-facing or otherwise attacker-reachable ColdFusion instances are at risk while internally segmented deployments sharply reduce reachability.
Blind SQL injection in the Link Whisper Free WordPress plugin (versions through 0.9.7) allows an attacker who already holds a high-privilege, authenticated WordPress session to inject SQL through an unneutralized plugin input, reading database contents back through boolean- or time-based inference. Exploitation requires the plugin to be installed and active plus high-privilege access (PR:H in the CVSS vector), so anonymous visitors cannot reach it; the assessed impact is high confidentiality loss with limited integrity effect, making this a moderate-priority issue rather than an urgent one. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited (no CISA KEV listing).
Blind SQL injection in the PluginUs.Net WOLF bulk-editor WordPress plugin, affecting all versions through 1.1.1, allows an attacker who already holds high-privilege authenticated access to the WordPress site to inject arbitrary SQL through the plugin's bulk-editing input and infer database contents indirectly. Because the injection is blind, extraction is slower and no victim user interaction is required; the practical exposure is limited by the PR:H prerequisite, meaning an administrator-level account or an account with access to the WOLF bulk-editor interface is required before exploitation is possible. No public exploit code was identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided, and the overall priority is moderate rather than emergency.
Improper input validation in Adobe's CAI Content Credentials SDK (advisory APSB26-163) lets remote attackers bypass a security feature and obtain unauthorized write access, effectively allowing modification or forgery of protected content-credential data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) means the flaw is network-reachable, low complexity, unauthenticated, and requires no user interaction, so any application or service that embeds the SDK and exposes its input-processing path to untrusted input is in scope. Impact is confined to integrity (I:H) with no confidentiality or availability loss, and no public exploit code or CISA KEV entry was identified at time of analysis.
Improper input validation in the CAI Content Credentials SDK lets remote, unauthenticated attackers bypass the SDK's security control and obtain unauthorized write access to content-credential data, per Adobe advisory APSB26-163. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) indicates a network-reachable, low-complexity flaw requiring no authentication and no user interaction, with impact confined to integrity - confidentiality and availability are unaffected. Only applications that embed a vulnerable version of the SDK and expose its input-processing/validation path to network-supplied content are affected, and no public exploit code was identified at time of analysis.
Improper input validation in the Adobe CAI Content Credentials SDK lets remote attackers bypass a security feature and gain unauthorized write access to content-credential processing. The flaw is network-reachable, low-complexity, requires no authentication (PR:N) and no user interaction (UI:N), yielding a CVSS 3.1 score of 7.5, but the scored impact is integrity-only (C:N/I:H/A:N) rather than code execution or data disclosure. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; exploitation is contingent on a deployed application embedding the SDK and exposing its C2PA manifest parsing/validation path to attacker-supplied input.
Incorrect authorization in Adobe ColdFusion 2023 (up to and including update 2023.0.25) and ColdFusion 2025 (up to and including update 2025.0.13) lets remote, unauthenticated attackers read contents of sensitive memory without any user interaction. The flaw is rated 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is classified as an authentication bypass (CWE-863), so confidentiality of server-side data is the primary exposure rather than code execution or data modification. No public exploit code or exploitation telemetry has been identified at time of analysis, and no CISA KEV entry is associated, so the practical risk is governed mainly by whether a vulnerable, internet-facing ColdFusion instance is reachable.
A heap-based buffer overflow in Microsoft PowerPoint allows an unauthenticated attacker to execute arbitrary code in the security context of a user who opens a specially crafted presentation file, with impact rated to confidentiality, integrity, and availability all High. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 for Windows, and Office 365 / Office LTSC 2021 and 2024 for Mac; exploitation requires the victim to open the malicious file (UI:R) delivered out-of-band via email, chat, or web download, and the high attack complexity metric reflects additional attacker-side prerequisites such as winning a specific heap memory layout. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limits on exploitation remain the required user interaction plus Protected View and Mark-of-the-Web protections applied to files from untrusted sources.
A signature-verification bypass in the CAI Content Credentials SDK allows an unauthenticated, network-reachable attacker to submit content or a token bearing a forged or tampered cryptographic signature that the SDK's verifier accepts, yielding unauthorized write access to systems that rely on that verification as a trust decision. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) the attack needs no credentials and no user interaction, and the assessment confines impact to integrity only, with no confidentiality or availability loss. The practical exposure is narrow but real: only deployments that actually consume the SDK to validate signatures or claims as a security control are affected, and no public exploit code was identified at time of analysis, so this is a genuine integrity issue rather than an acute emergency.
Improper verification of cryptographic signatures in the CAI Content Credentials SDK allows unauthenticated remote attackers to supply forged or improperly signed content credentials that the SDK accepts as authentic, bypassing the security check and gaining unauthorized write access to whatever the SDK's verification verdict gates. The CVSS 3.1 base score is 7.5 (High) under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - an integrity-only signature-verification bypass (CWE-347) with no confidentiality or availability impact, requiring no authentication and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; real-world risk is highest in deployments that make publishing, authorization, or authenticity decisions solely on the SDK's verification result, and negligible where that result is not treated as a trust boundary.
Improper verification of cryptographic signatures in Adobe's CAI Content Credentials SDK allows remote, unauthenticated attackers to submit a forged or tampered Content Credentials manifest that the SDK accepts as valid, bypassing a security feature and granting unauthorized write access to credential data (CWE-347; CVSS 3.1 7.5). Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, no credentials and no user interaction are required, and the impact is integrity-only, with confidentiality and availability unaffected; in practice exploitation depends on the vulnerable SDK version being deployed and the consuming application treating signature verification as a trust boundary. This is a moderate-priority integrity issue rather than a top-tier emergency, and no public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Signature-verification bypass in Adobe Content Credentials SDK allows unauthenticated, network-based attackers to forge or tamper with signed content credentials, bypassing integrity checks to gain unauthorized write access. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) indicates a low-complexity flaw with no user interaction and a pure integrity impact. No public exploit code has been identified at time of analysis, but risk is elevated for applications that rely on the SDK's verification result as a trust or authorization decision. Confirm vulnerable SDK versions against Adobe APSB26-163.
Improper access control in the CAI Content Credentials SDK allows remote, unauthenticated attackers to bypass a security check and gain unauthorized write access, with no user interaction required (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). The impact is scoped entirely to integrity - the assessed vector shows no confidentiality or availability effect - so practical exposure depends on how much a deploying application trusts Content Credentials data for provenance or security decisions. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; Adobe advisory APSB26-163 is the authoritative source for affected and fixed SDK versions.
Improper access control in the Adobe CAI Content Credentials SDK lets unauthenticated, network-reachable attackers bypass a security check and obtain unauthorized write access to content-credential (provenance) data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) confirms the flaw needs no credentials and no user interaction, and that impact is confined to integrity - there is no confidentiality or availability effect. The practical exposure hinges on integration: this is an SDK, so reachability and real-world impact depend entirely on whether the host application exposes the affected access-controlled operation to attacker-controlled input; no public exploit code and no confirmed active exploitation were identified at time of analysis.
A use-after-free in the Windows Bluetooth Service allows an unauthenticated attacker within Bluetooth radio range to execute code on affected Windows 10, Windows 11, and Windows Server hosts where Bluetooth is enabled and the service is running - the default state on most laptops, tablets, and Bluetooth-equipped desktops. Affected builds span Windows 10 1809/21H2/22H2, Windows 11 23H2 through 26H1/26H2, and Windows Server 2019/2022/2025 (including Server Core) below the fixed build numbers listed in EUVD data. No authentication (PR:N) or user interaction (UI:N) is required, but exploitation carries High attack complexity (AC:H) because the attacker must reliably win a memory-timing race, which limits reliability and makes automated or at-scale remote attacks impractical; no public exploit has been identified at time of analysis, CISA's SSVC rates exploitation as none and automatable as no, and vendor patches are available.
A heap-based buffer overflow in the Windows Reliable Multicast Transport Driver (RMCAST) allows an unauthenticated attacker positioned on the same adjacent network segment to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server hosts. The assessed vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5) reflects total loss of confidentiality, integrity, and availability if exploitation succeeds, but high attack complexity and the adjacency prerequisite mean exploitation depends on favorable heap layout/memory-grooming conditions and cannot be reliably automated (SSVC Exploitation: none, Automatable: no). There is no public exploit identified at time of analysis and no evidence of active exploitation; a vendor patch is available from Microsoft, making timely but non-emergency patching the appropriate response.
Denial of service in GNOME Remote Desktop (gnome-remote-desktop) as shipped in Red Hat Enterprise Linux 8, 9, and 10 allows an unauthenticated remote attacker to pin the daemon's event-loop thread at high CPU by sending traffic to a TLS-enabled VNC listener, causing the service to stop making forward progress. The defect is in the VNC TLS I/O handlers, which treat retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) with an unbounded busy loop instead of returning control to the event loop, so the thread spins indefinitely rather than waiting for socket readiness. No public exploit code exists and there is no confirmed active exploitation, and practical exposure is bounded: the VNC backend must be running with a TLS listener reachable over the network, a configuration that is not enabled by default on typical RHEL installs and is far more common on desktops than on servers.
Denial of service in IBM WebSphere Application Server 8.5 and 9.0, and in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10, allows remote unauthenticated attackers to disrupt availability by sending crafted serialized data to the product's messaging service. The root cause is insecure deserialization (CWE-502) in the messaging component, rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so impact is confined to availability - confidentiality and integrity are not affected. Per the assessed vector, no credentials or user interaction are required once the messaging endpoint is reachable, but the vulnerable code path is only exercised where the messaging engine (SIB/JMS) is enabled and accepting input; environments that disable it or restrict it to trusted networks are materially less exposed. There is no public exploit identified at time of analysis, and this CVE is not listed as confirmed actively exploited (CISA KEV).
Privilege elevation in Microsoft Exchange Server lets an authenticated low-privilege attacker forge or tamper with a signed security token that the server improperly validates, achieving full compromise of confidentiality, integrity, and availability on the affected build (CVSS 3.1 base 7.5, CWE-347). The flaw affects Exchange Server 2016 CU23 (below 15.01.2507.077), Exchange Server 2019 CU14 (below 15.02.1544.050) and CU15 (below 15.02.1748.055), and Exchange Server Subscription Edition RTM (below 15.02.2562.056); fully patched builds are not exploitable. Exploitation requires a pre-existing low-privilege identity on the server plus conditions outside the attacker's control (AC:H), CISA's SSVC rates exploitation as none and automatable as no, and no public exploit identified at time of analysis.
Improper certificate validation in the CAI Content Credentials SDK enables a network-positioned attacker who can intercept TLS connections to bypass security features and gain unauthorized write access. Exploitation requires a man-in-the-middle (MITM) position to supply a forged or invalid certificate that the SDK accepts; the assessed CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, and although the input CVSS 7.5 vector lists AC:L, our assessment raises attack complexity because the MITM prerequisite limits opportunistic mass exploitation. No user interaction or credentials are needed once the MITM position is obtained. No public exploit identified at time of analysis.
Use-after-free in Microsoft's Network Policy Server (NPS) allows an unauthenticated attacker on an adjacent network to execute arbitrary code in the context of the NPS service. Only Windows hosts that have the NPS role installed and reachable as a RADIUS/authentication server are exposed - hosts without NPS enabled cannot be triggered. Practical exploitation is constrained by high attack complexity (AC:H), since reliably winning the race/heap-shaping window is difficult, and no public exploit has been identified at time of analysis; Microsoft has released vendor patches, CISA's SSVC assessment rates exploitation as none and automatable as no, and EPSS/KEV data were not provided for this CVE.
Cross-origin redirect handling in the dio_http2_adapter plugin for Dart/Flutter copies sensitive request headers to a different origin, leaking Authorization, Cookie, Cookie2, Proxy-Authorization, Proxy-Authenticate, and WWW-Authenticate values to any server an application is redirected to. All versions from 1.0.0 up to (but excluding) 2.8.0 are affected, and only applications that use Http2Adapter (an optional HTTP/2 plugin, not Dio's default adapter) while sending credentialed requests and following redirects - which is on by default - are exposed; the attacker must control or compromise the contacted server or sit on-path to return the cross-origin Location header. The issue is unauthenticated from the attacker's perspective (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, 7.5, confidentiality-only impact) and there is no public exploit identified at time of analysis and no CISA KEV listing; the vendor-released patch is http2_adapter 2.8.0.
Remote code execution in Microsoft SQL Server 2022 and 2025 arises from a stack-based buffer overflow (CWE-121) that is triggered when a client connects to an attacker-controlled SQL Server endpoint and the malicious response overflows a fixed-size stack buffer. The vulnerability is unauthenticated from the attacker's side (PR:N) but requires victim-side interaction (UI:R) and high attack complexity (AC:H), so it is a moderate-priority issue rather than a mass-exploitation emergency; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation. Affected builds are SQL Server 2022 GDR below 16.0.1210.3 and CU27 below 16.0.4305.5, plus SQL Server 2025 GDR below 17.0.1145.4 and CU9 below 17.0.5015.4, with vendor-released patches available from Microsoft.
Unauthenticated remote denial of service affects SAP NetWeaver and SAP Web Dispatcher deployments in which the Internet Communication Manager (ICM) internal protocol component can be reached by an attacker; a specially crafted request carrying invalid field values triggers an integer underflow (CWE-191) that corrupts memory handling and crashes the affected process. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning any network-reachable instance is exposed with no credentials or user interaction required, but the consequence is strictly service disruption - there is no confidentiality or integrity impact and no demonstrated path to data disclosure, tampering, or code execution. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied; the practical risk driver is therefore exposure of the ICM/Web Dispatcher protocol endpoint rather than active exploitation, with internet-facing systems materially more at risk than segmented internal ones.
IBM WebSphere Application Server - Liberty (20.0.0.12 through 26.0.0.10) can be driven into a denial-of-service condition by a remote attacker whose request raises an uncaught exception, degrading availability with no confidentiality or integrity impact. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, privileges or user interaction are required - the only prerequisite is network reachability to an affected Liberty instance, and the exact endpoint or feature that triggers the fault is not described in the available sources. Exploitation has not been confirmed (CISA SSVC: Exploitation none) and no public exploit code has been identified; EPSS is low at 0.32% (23rd percentile), and the CISA SSVC assessment rates automation as possible but technical impact as partial, so prioritization within a weekly patch cycle is appropriate rather than emergency action.
Improper certificate validation in the CAI Content Credentials SDK allows remote, unauthenticated attackers to bypass security features and gain unauthorized write access (CVSS 7.5, High). Exploitation requires the attacker to present a forged or untrusted certificate that the SDK incorrectly accepts, and no user interaction is needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Improper certificate validation in Adobe's CAI Content Credentials SDK (Content Credentials SDK) allows remote, unauthenticated attackers to bypass certificate trust checks and gain unauthorized write access, effectively letting them forge or tamper with signed Content Credentials data with no user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5). Impact is bounded to integrity - no confidentiality or availability effect - and only deployments that actually invoke the SDK to validate Content Credentials certificates are exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; exploitation in practice requires the attacker to supply crafted signed content or hold a man-in-the-middle position on the certificate validation path.
Improper certificate validation (CWE-295) in the CAI/Adobe Content Credentials SDK allows an unauthenticated remote attacker to have forged or self-signed signing certificates accepted during C2PA manifest verification, bypassing the provenance trust check and enabling unauthorized write (integrity) impact - CVSS 3.1 base 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. No user interaction is required, but exploitation is not automatic: the attacker must get crafted content into a workflow that validates it with the vulnerable SDK, or occupy a trust/transport position from which a malicious certificate is presented, which is narrower in practice than the network-vector score implies. There is no CISA KEV listing and no public exploit identified at time of analysis; impact is confined to integrity, with no confidentiality or availability loss indicated.
Local privilege escalation in WSUS (Windows Server Update Services) allows an authenticated low-privileged attacker with local access to elevate privileges by exploiting incorrect default permissions (CWE-276). The vulnerability has a Microsoft-assigned CVSS 3.1 score of 7.5 (AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H), indicating high attack complexity and required user interaction, but it can lead to full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and a patch is available per the Microsoft advisory.
Denial of service is possible in libwebsockets because the LEJP JSON parser's pre-patch bounds checks in lib/misc/lejp.c permit a one-past-the-end write into the fixed-size ctx->i[] and ctx->st[] arrays when deeply nested JSON is parsed. The flaw is remotely reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), but the affected target is the main-branch commit 106d542c rather than a confirmed released version, and exploitability depends entirely on whether the host application routes attacker-controlled JSON into lejp_parse(); impact is limited to availability (a crash), with no code execution or data disclosure indicated. EPSS is 0.29% (20th percentile), the issue is not in CISA KEV, and no public exploit has been identified at time of analysis, although upstream fixes exist in commits 736a4a2 and c404a20.
An off-by-one heap buffer overflow in libconfini 1.16.4's bundled example utility load_ini_buffer (examples/utilities/load_ini_buffer.h) can crash the process that embeds it, producing a denial of service. The flaw is only reachable when consuming software actually compiles and feeds attacker-influenced input to that example utility; it is not reachable through the core libconfini parsing API alone, and impact is availability-only with no code execution or data disclosure indicated. Exploitation requires an unauthenticated network-reachable path into the affected utility (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L per independent assessment, versus the submitter's N/A:H rating), and no public exploit has been identified; EPSS is 0.29% (20th percentile), consistent with a low-to-moderate real-world priority.
Use-after-free in the Windows Bluetooth Port Driver (bthport.sys) lets an attacker positioned within Bluetooth radio range of an unpatched Windows host elevate privileges, with no authentication and no user interaction required (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5 High). Real-world risk is constrained by high attack complexity - the attacker must reliably win a non-deterministic race in driver memory handling - and by the prerequisites of physical proximity and an active Bluetooth stack; CISA's SSVC assessment records no observed exploitation and no automatable path (Technical Impact: total). Microsoft has published vendor patches, and no public exploit code has been identified at time of analysis.