Heap-based buffer overflow in the Windows Internet Connection Sharing (ICS) component allows an authenticated low-privilege attacker positioned on an adjacent network segment to execute arbitrary code on affected hosts, with high confidentiality, integrity, and availability impact per the assessed vector (CVSS 7.1, AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained: ICS must actually be running (it is not enabled by default on mainstream Windows client or server installations), the attacker must already hold low-privileged credentials, must be local/link-local to the target rather than routed over the internet, and must satisfy high-complexity heap-grooming and timing conditions (AC:H). No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); vendor patches are available, so this is a moderately-high-priority but not emergency-tier issue.
An authorization bypass in the Ente server (the self-hosted/cloud 'museum' backend) lets an emergency contact who was already added and accepted by a victim call POST /emergency-contacts/approve-recovery with their own client-supplied user ID and a recovery-session UUID, prematurely moving the victim's emergency recovery session from WAITING to READY, clearing the wait_till value, and skipping the owner-configured notice period to retrieve recovery information. The same insufficiently scoped update pattern affects the reject and stop transitions, so any party who merely knows another user's recovery-session UUID could cancel a session they are not part of. Exploitation requires authenticated access as an established, victim-approved emergency contact and does not create recovery rights over arbitrary accounts; there is no confirmed active exploitation and no public exploit identified at time of analysis, though the vulnerability is scored 7.1 and fixed in server image 2026.07.09.
SQL injection in Adobe Experience Manager 6.5 (through 6.5.25) allows an authenticated, low-privileged attacker to bypass security controls and gain unauthorized read and limited write access to backend data. The flaw is due to improper neutralization of special elements used in SQL commands (CWE-89), and exploitation requires no user interaction. No public exploit code or active exploitation has been identified, and the need for valid low-privilege credentials and the limited version range make this a moderate-priority issue rather than an emergency.
Heap buffer overflow in Wazuh Manager's File Integrity Monitoring alert generation lets an enrolled agent corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage across all monitored endpoints. Affected versions are Wazuh 3.12.0 through 4.14.7, fixed in 4.14.8; the attacker must hold a valid agent enrollment key (PR:L, authenticated), and because FIM/syscheck is enabled by default on agents no special manager-side configuration is required. The vendor CVSS 4.0 score of 7.1 (HIGH) is driven almost entirely by availability impact (VA:H), and no public exploit code has been identified at time of analysis.
FreeRDP 3.0.0 through 3.31.x allows a malicious RDP server to brute-force the smartcard PIN of a connecting client by resetting the per-handle retry counter in the virtual smartcard GIDS implementation. The attack requires the victim to initiate an RDP session to an attacker-controlled server while smartcard redirection is configured (UI:P/UI:R), and no public exploit code has been identified at time of analysis. This is a moderate-priority confidentiality issue (CVSS 4.0 7.1; independent CVSS 3.1 rates impact as C:H only) that can lead to PIN disclosure but not code execution or integrity/availability impact.
A reachable assertion in the FreeRDP client (3.0.0-beta1 through versions prior to 3.32.0) allows a malicious RDP server to crash a connecting client. When the client is built with verbose WinPR assertions enabled and is using smartcard emulation, the emulated SCardStatusA handler forwards a NULL reader-name destination to scard_copy_strings; a server that sends an SCardStatusA request with fmszReaderNamesIsNULL=1 triggers that assertion and aborts the client process. Impact is limited to a client-side denial of service against a single connecting session - no code execution, lateral movement, or credential impact - and exploitation demands both non-default build/runtime settings and a victim who initiates a connection to an attacker-controlled server. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided, but the narrow configuration prerequisites keep real-world urgency low despite the 7.1 CVSS 4.0 score.
Kubeflow Model Registry through 0.3.17 allows an authenticated namespace user with permission to create InferenceService resources to steal the InferenceService controller's ServiceAccount bearer token. The attacker creates an InferenceService with the modelregistry.kubeflow.org/url annotation pointing to an attacker-controlled server; the controller follows the annotation and attaches its token, which the attacker captures and then uses to modify other tenants' InferenceServices cluster-wide. This is a server-side request forgery (CWE-918) requiring low privileges (PR:L) and no user interaction; no public exploit code was identified at time of analysis, and no CISA KEV entry exists.
Authenticated members of fuintCatering can read other members' refund records and the personal data they contain by iterating sequential refundId values against the ClientRefundController refund detail endpoint. The flaw is an insecure direct object reference (CWE-639) present through commit 122c9e6, and because self-registration is open, an attacker only needs a freely obtainable account to harvest buyers' names, national ID numbers, addresses, WeChat openIds, and order details. No public exploit code or confirmed active exploitation was identified at time of analysis; the impact is confidentiality-only - no writing, no system compromise - and exploitation further depends on refund records actually existing to enumerate.
Local tampering and information compromise in Microsoft Windows Error Reporting (WER) allow an authenticated attacker who already holds a low-privileged account and code execution on a Windows host to invoke a critical WER function that performs no authentication or authorization check, yielding high confidentiality and integrity impact with no availability impact (CVSS 7.1, AV:L/PR:L/UI:N). The flaw is not reachable remotely or by unauthenticated users; the mandatory local foothold narrows realistic exploitation to local attackers or post-compromise privilege escalation, which is why the consolidation of signals points to a moderate rather than emergency priority. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released fixed builds covering Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025.
Credential exposure in maku-boot 4.3.0 through 5.0.0 allows any authenticated low-privilege user to read unmasked mail and SMS integration secrets by calling /sys/mail/config/list and /sys/sms/config/list, which lack the required authority checks. The same missing authorization permits abuse of /sys/mail/config/send to send mail to arbitrary recipients. Exploitation requires a valid authenticated session and network access to the management API, and impact is greater where SMTP passwords or Aliyun, Tencent Cloud, Qiniu, or Huawei Cloud access keys are configured; no CISA KEV entry exists and no public exploit identified at time of analysis.
Authenticated sellers on lilishop (PickMall) through 4.4 can overwrite and effectively hijack any other store's product listings by supplying a foreign goodsId to the goods update endpoint, an insecure direct object reference (CWE-639) with an assessed CVSS 3.1 base of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Because the seller-api update handler never verifies that the target goodsId belongs to the caller's own store, a low-privileged seller tenant can replace product details and SKUs and reassign the item to their own store, producing a high-integrity impact with no confidentiality or availability loss. Exploitation requires a valid seller account and prior knowledge of the target product's goodsId; anonymous users cannot reach the endpoint, and no public exploit code has been identified at time of analysis (no CISA KEV entry).
Missing authorization in risesoft WorkFlow-Engine through 9.6.11 allows authenticated low-privileged users to approve or reassign other users' workflow tasks by supplying a known taskId to the complete, completeTask, or reAssign handlers under the /vue/buttonOperation endpoints. The flaw is an IDOR (CWE-639) rated 7.1 under the vendor-supplied CVSS 4.0 vector (our independent CVSS 3.1 assessment is 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), requiring only a valid low-privilege account and knowledge of a target taskId. No public exploit or CISA KEV listing was identified at time of analysis; impact is limited to workflow approval integrity, with no data disclosure or denial of service.
Missing authorization in SmartAdmin through 3.30.0 lets any authenticated low-privileged employee change system-wide level-3 protection settings, disabling login lockout and two-factor login, weakening password rules, and clearing existing lockout records through the unannotated updateConfig and loginFail batchDelete endpoints in AdminProtectController. The prerequisite is an ordinary employee session (CVSS PR:L, no user interaction, network-reachable admin API), so the barrier is the account rather than any special configuration, and default deployments up to v3.30.0 are impacted; no public exploit identified at time of analysis and no CISA KEV listing, and the assessed impact is integrity-only (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), making this a genuine but moderate-priority issue rather than an urgent crisis. No vendor-released patch was identified at time of analysis.
JetLinks Community through 2.10.0 allows an authenticated user holding only query-level access to the transparent-codec resource to overwrite a product's codec provider and configuration via POST /device/transparent-codec/{productId}, because that save handler is missing the @SaveAction authorization annotation the hsweb-based framework uses to gate write operations. Successful abuse hands the attacker control over how transparent (raw pass-through) messages are decoded and encoded for every device belonging to the targeted product, an integrity-only impact with no confidentiality or availability loss (CVSS 4.0 7.1 High, PR:L). Exploitation requires a valid low-privilege account on the affected deployment, the flaw is network-reachable with low complexity, and no public exploit code has been identified at time of analysis with no CISA KEV listing.
Authenticated members of Yshopmall (through version 2.0.0) can exploit an insecure direct object reference (IDOR) in the member address API to read, modify, or delete other members' shipping addresses by simply changing the numeric address id. Because address identifiers are sequential, any registered account holder can enumerate /address/detail/{id}, /address/edit, and /address/del to harvest recipient names, phone numbers, and street addresses, reassign a victim's address to themselves, or wipe records outright. Exploitation requires a valid, low-privileged member session (CVSS 3.1 PR:L, AV:N) and no user interaction; there is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but the reliability of enumeration against default deployments makes it a genuine moderate-priority concern.
Memory exhaustion denial of service in FreeRDP 3.20.1 up to but not including 3.32.0 lets a malicious or compromised RDP server crash connecting clients by abusing drive redirection read requests. Per the CVSS v4 vector (PR:N, UI:P), the attack is remote and the client side of the protocol is unauthenticated, but exploitation is conditional: the victim must be induced to initiate an RDP session to the attacker-controlled server and must have drive redirection (rdpdr) active for the server to issue the offending IRP_MJ_READ requests. Impact is confined to availability (client memory exhaustion and crash) with no confidentiality or integrity effect, and no public exploit identified at time of analysis.
Denial of service in FreeRDP client versions 3.11.0 through 3.31.x allows a malicious or compromised RDP server to abort a connected client process: once the RDPGFX graphics channel negotiates the AVC444 or AVC444v2 codec, the server can send an otherwise in-bounds region rectangle with an odd width, which bypasses the missing even-width validation before YUV444 conversion and trips a CWE-617 reachable assertion. Per the CVSS vector (PR:N, UI:P), the attack requires no authentication on the client side, but the victim must initiate or accept the connection to the hostile server, and the resulting impact is confined to availability of that single client process - no confidentiality or integrity loss and no code execution. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so real-world risk is moderate and bounded by the requirement that the attacker controls the RDP server side.
Denial of service in the FreeRDP RDP client (versions 3.0.0 through 3.31.x) allows a malicious or compromised RDP server to crash a connecting client that has both smartcard emulation and smartcard redirection enabled: the server releases a smartcard-emulation context, establishes a new one, then issues SCardTransmit with the stale card handle, causing the client to look up the deleted parent context and hit a terminating WINPR_ASSERT. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) confirms this is network-reachable and unauthenticated, but it requires the victim to actively initiate a connection outward to the hostile server, and the impact is availability-only (client process abort, no code execution or data disclosure). No public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); exploitation also depends on the non-default smartcard emulation/redirection feature set being enabled.
Denial of service in FreeRDP clients: versions 3.29.0 through 3.31.x contain a double free (CWE-415) in the async-update message proxy that a malicious or compromised RDP server can trigger by sending a point-bearing PolygonSC or PolygonCB order followed by a second polygon order with numPoints set to zero, crashing the connecting client. Exploitation requires the victim to connect to an attacker-controlled server and to have launched the client with the non-default +async-update option, so default client configurations are not exposed; user interaction is needed to initiate the connection, and impact is limited to availability with no code execution, data disclosure, or integrity loss. There is no confirmation of active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis; the observed CVSS 4.0 score of 7.1 is driven by the availability impact.
NULL pointer dereference in FreeRDP's Remote Desktop Gateway (RDG) transport path affects client builds from 2.3.0 up to (but not including) 3.32.0, allowing an attacker who controls or has compromised the RD Gateway to crash a connecting client. The malicious gateway only needs to return an eight-byte, header-only PKT_TYPE_CLOSE_CHANNEL control packet; rdg_process_control_packet forwards the absent payload to rdg_process_close_packet without a NULL check, and the client dereferences it. The attacker must already occupy the gateway position (not an arbitrary remote host) and the user must initiate the outbound RDP session, so this is a bounded, availability-only denial of service - CVSS v4.0 base 7.1, with the independent assessment scoring it AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the gateway-position prerequisite constrains realistic abuse.
FreeRDP clients 2.3.0 through 3.31.x can be hung by a malicious or compromised RD Gateway that returns an incomplete HTTP chunked response and then cleanly closes the TLS connection. The bug is an infinite loop (CWE-835) in http_chuncked_read: zero-byte reads after a truncated chunk-size line or footer keep the decoder thread spinning, causing a client-side denial of service. This is a remote, unauthenticated availability-only issue per the provided CVSS vector (PR:N) but requires the victim to initiate the gateway connection (UI:P/UI:R); no public exploit identified at time of analysis.
FreeRDP clients running versions 3.27.1 through 3.31.x with the non-default Bitmap Cache V3 feature enabled can be crashed by a malicious or compromised RDP server that sends a crafted Cache Bitmap V3 order during connection setup. The NULL pointer dereference occurs because the client bitmap cache is accessed before it is initialized when the CBR3_DO_NOT_CACHE flag is set, leading to a denial-of-service (availability impact only, no confidentiality or integrity loss). Exploitation requires the victim to initiate an RDP connection to an attacker-controlled server and have enabled the Bitmap Cache V3 codec via /cache:codec:<rfx|nsc|jpeg>; default configurations are not affected, and no public exploit code has been identified at time of analysis.
A malicious or compromised RDP server can crash FreeRDP clients versions 3.11.0 up to but not including 3.32.0 when video redirection is enabled, due to an integer overflow in the handling of positive mapped-video coordinates. This moderate-severity denial-of-service requires the victim to connect to the attacker-controlled server and results only in client termination, with no code execution, data disclosure, or integrity loss. No public exploit code has been identified at time of analysis.
Wazuh Manager 4.0.0 through 4.14.7 exposes the plaintext authd.pass agent-enrollment password to authenticated low-privileged API users who hold the agent:read permission-including the default readonly role-by querying the unmasked agent configuration endpoint for pseudo-agent ID 000. An attacker with such an API session can recover the secret and enroll rogue agents against the manager where password-based enrollment is configured. No public exploit identified at time of analysis, and CISA KEV does not list this issue; the vendor has released v4.14.8 as the fix.
Denial of service against the QAPI service in Commvault Cloud can be triggered by an authenticated low-privilege user who sends a crafted request that overflows a stack buffer on CommServe, Web Server, Command Center, or Index Server. Per the vendor's advisory, exploitation is limited to service availability - there is no data disclosure, data tampering, or code execution impact (CVSS:4.0 vector VC:N/VI:N/VA:H, score 7.1), and the independent CVSS:3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) agrees that only availability is affected. Valid credentials are mandatory and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority availability issue rather than an emergency, but Commvault has directed customers to a resolved maintenance release.
An authorization bypass in SAP ABAP Platform lets a low-privileged, authenticated user open the session manager in single transaction mode - including through the Fiori Launchpad (FLP) - and then send crafted requests that defeat restrictions the platform had previously enforced correctly. The weakness is a regression: an underlying SAP API change reintroduced a flaw that had already been fixed, so only ABAP Platform deployments carrying that regressed API (and not yet covered by SAP Note 3626303) are exposed. Impact is rated 7.1 with high integrity and low confidentiality consequences and no availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N); valid low-privilege credentials are mandatory, so this is an authenticated privilege-escalation-style issue rather than a pre-auth intrusion path, and no public exploit identified at time of analysis.
MongoDB Server sharded clusters running versions 9.0 before 9.0.4 or 8.3.0 before 8.3.13 allow an authenticated user with write privileges on a regular collection to bypass authorization checks for internal system namespaces by submitting a bulk write operation through the mongos router. This incorrect authorization (CWE-863) can result in unauthorized writes to system namespaces, with an impact ranging from low integrity to high availability depending on the namespace targeted. No public exploit identified at time of analysis; vendor patches are available in MongoDB Server 9.0.4 and 8.3.13.
Null pointer dereference in MongoDB Server's collection validation feature enables an authenticated user with write access to crash the mongod process, producing a denial-of-service condition. The attacker must be able to create or modify a collection validator (for example via create or collMod with a validator document containing the mishandled expression); the crash is then triggered when a document is inserted into that collection and evaluated against the validator. Impact is limited to availability - no confidentiality or integrity loss - and the issue is most exploitable in shared or multi-tenant deployments where write and schema-validation privileges are broadly granted; no public exploit code was identified at time of analysis, and this is a moderate-severity availability issue rather than a widespread emergency.
Memory exhaustion in MongoDB Server lets an authenticated user with only read-only privileges crash the mongod process by running an aggregation query whose $match stage nests internal schema-validation operators against documents containing array fields. Because those operators are accepted in user-supplied query filters despite being intended for server-side $jsonSchema validation, the match expression evaluator expands every combination of array elements without an adequate resource limit, so memory grows until mongod is OOM-killed. Impact is availability only - no data disclosure or modification - and the issue requires an authenticated account (CVSS PR:L) plus the right document shape, so it is a genuine but moderate-priority DoS rather than an emergency; no public exploit code or confirmed active exploitation has been identified at time of analysis, and CVSS 4.0 scores it 7.1 (attack vector network, high availability impact).
A null pointer dereference in Commvault's CvFWD network routing service crashes affected components, producing a denial-of-service condition limited to availability. The flaw is remotely reachable over the network but requires a low-privilege authenticated account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, assessed 7.1 severity), with no confidentiality or integrity exposure - no data is read, modified, or exfiltrated. Commvault has published a security advisory (CV_2026_10_5) directing customers to a resolved maintenance release covering CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the available intelligence. Because the impact is availability-only and gated behind authentication, the realistic risk is moderate rather than emergency-grade, though environments that expose CvFWD broadly or tolerate unplanned service restarts should prioritize patching.
An out-of-bounds write in Commvault's CvFWD network-communication daemon allows a low-privilege authenticated attacker who can reach the service over the network to crash it, producing a denial of service against the affected Commvault component. The flaw is availability-only (CVSS 4.0 7.1, VA:H with VC:N/VI:N) and offers no path to data disclosure or code execution; it affects Commvault Cloud deployments, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale, until the resolved maintenance release is applied. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
An integer overflow in CvFWD, the Commvault network-forwarding daemon used across Commvault Cloud deployments, lets a low-privilege authenticated attacker on the network crash or degrade the forwarding service, producing an availability-only denial of service with no confidentiality or integrity impact. All Commvault components that ship or communicate with CvFWD are in scope - CommServe, Web Server, Command Center, MediaAgents, Clients and HyperScale - so risk is highest in environments where these services are reachable from broad or untrusted network segments rather than restricted management networks. The vendor classifies this as a 7.1 (CVSS 4.0) issue requiring PR:L; there is no public exploit identified at time of analysis and no CISA KEV listing, and EPSS data was not provided, so the practical near-term driver is patch hygiene rather than active exploitation.
Authenticated privilege escalation in Omnispace's Agora Project before 26.10.0 allows any regular, non-administrative member to create new user accounts by directly invoking the user-edit action actionVueEditUser, which is missing the editRight() function-level authorization check that guards comparable administrative actions. The flaw is reachable over the network by an attacker who already holds a valid member login (CVSS vector PR:L, no user interaction required) and results in high integrity impact and limited confidentiality exposure, with the practical risk concentrated in self-registration-enabled, shared or multi-tenant deployments where member accounts are easy to obtain. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available in version 26.10.0, and the VulnCheck advisory classifies the weakness as broken function-level authorization (Authentication Bypass / Privilege Escalation).
Sandbox escape in the Mozilla Firefox Graphics component allows an attacker who can get a victim to render attacker-controlled web content to break out of the browser's content-process sandbox, with Low-rated confidentiality, integrity and availability impact but a changed security scope. Affected are unpatched Firefox builds below 158 and ESR builds below 115.43 and 153.5; no authentication is required, but exploitation is gated by mandatory user interaction (UI:R) such as visiting a crafted page, which precludes zero-click mass exploitation. There is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score is very low at 0.19% (8th percentile), making this a moderate-severity but low-priority issue in practice; vendor-released patches are available.
A JIT compiler miscompilation in Firefox's JavaScript WebAssembly engine (CWE-843 type confusion) can lead to memory corruption and disclosure of sensitive data when a user loads attacker-controlled web content that triggers WASM compilation. Only users on Firefox before 158 or Firefox ESR before 153.5 are exposed; fixed builds are not affected, and exploitation requires user interaction (navigating to a malicious page), with no authentication or special configuration needed. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, and the low EPSS score (0.15%, 4th percentile) plus the UI:R prerequisite place this at moderate rather than emergency priority.
An out-of-bounds write (CWE-787) in AMI Aptio V (APTIOV) BIOS firmware can be triggered by a local attacker who already holds high privileges, potentially corrupting memory inside firmware code paths and enabling buffer overflows, arbitrary code execution, and loss of confidentiality, integrity, and availability. Successful abuse requires local access plus pre-existing administrative or kernel-level privileges, and the high attack complexity means specific state, timing, or configuration preconditions must be met before the write can be controlled, so this is best characterized as a firmware persistence/privilege-escalation primitive rather than an initial-access or remote attack vector. At time of analysis there is no public exploit identified, no CISA KEV listing, and no confirmed exact fix version in the available data, though AMI has issued security advisory AMI-SA-2026002 covering the issue.
Integer overflow in AMI AptioV BIOS firmware, classified as CWE-190, can be triggered by a local high-privileged caller to cause buffer overflows, memory corruption, and potential arbitrary code execution with high impact to confidentiality, integrity, and availability. Exploitation requires local access, an existing administrator/root-level foothold (PR:H), and high attack complexity (AC:H) per the assessed vector AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, so it is not remotely reachable or mass-exploitable. No public exploit was identified at time of analysis, and active exploitation is not confirmed by KEV data; this is a moderate-priority, high-barrier firmware flaw rather than a widespread emergency.
Local capability escalation in the macOS build of the DigiD app (Logius) lets an attacker who already holds user-level code execution on the same Mac inject an arbitrary dynamic library into the DigiD process and run code under the app's identity, reaching DigiD data and cryptographic operations the process would not normally expose - CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The root cause is that the app binary is not signed with the Hardened Runtime flag, so the loader still honours DYLD_INSERT_LIBRARIES; this is a post-compromise escalation primitive, not a remote or initial-access bug, and it grants no privilege beyond the app's own context (S:U) and no availability impact. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); a Hardened-Runtime-signed build blocks the injection path and is available per the vendor advisory pointing at the Mac App Store listing.
Path traversal in Wazuh Manager's delete_rule_file and delete_decoder_file helpers lets an attacker who holds the Wazuh cluster key delete arbitrary files as the wazuh user, including ossec.conf, client.keys, and rule files. Affected versions are 4.1.1 through 4.14.7 (fixed in 4.14.8), tracked by CPE cpe:2.3:a:wazuh:wazuh-manager. Exploitation is not unauthenticated: the CVSS 4.0 vector carries PR:H and the assessed 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, meaning the attacker must already possess the cluster key and be able to invoke the DistributedAPI helpers as a cluster worker, so practical exposure is limited to clustered multi-node Manager deployments where the key has leaked or a worker node is compromised; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Configuration data leakage in Stonewuu ai-fusion-video 1.2.0 and earlier lets any authenticated non-admin user read the api-config get/list and system config endpoints, which return stored AI provider API keys, proxy passwords and mail_password values in plaintext. Because the controller methods (ApiConfigController and SystemConfigController) never verify the caller's role, a low-privilege account is enough to harvest credentials that enable AI-billing abuse and sending mail from the platform's own mail server; the vulnerability is rated CVSS 7.1 (v4.0, PR:L) and an independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. a confidentiality-only exposure that requires credentials to reach. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis and no EPSS value was supplied, which keeps this a genuine but bounded, second-order risk rather than a top-tier emergency.
Local privilege escalation in Microsoft Sysinternals utilities allows an authenticated low-privileged user to trigger an untrusted pointer dereference (CWE-822) and have the affected tool operate with higher integrity than the caller, yielding high integrity and availability impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 7.1). Only Windows systems where an affected Sysinternals utility is present and executable by the attacker are exposed; because the vector is local (AV:L) with PR:L, the attacker must already hold a valid low-privileged local session, which limits mass or remote exploitation. No public exploit code or confirmed active exploitation is identified at time of analysis - no CISA KEV entry and no proof-of-concept were provided - and no EPSS score was supplied, so the practical risk is post-compromise escalation rather than initial access.
Local privilege escalation in Microsoft Sysinternals arises from an untrusted pointer dereference (CWE-822), allowing an attacker with existing low-privileged local access to elevate privileges on a Windows host. The CVSS 3.1 score is 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high impact to confidentiality and integrity but no availability impact and no scope change. There is no remote attack vector, and no public exploit code or confirmed active exploitation has been identified at the time of analysis.
An out-of-bounds read in FreeRDP's smartcard redirection channel (CVE-2026-109677) lets a malicious or compromised RDP server leak heap memory from the connecting client by sending a LocateCardsByATRA request whose cbAtr byte count exceeds the fixed 36-byte rgbAtr/rgbMask buffers. Affected versions are 2.0.0-beta1 through 3.27.x (fixed in 3.28.0), and per the independent assessment the impact is confidentiality-only: the client must initiate the RDP session to the hostile server and must have smartcard device redirection negotiated so the LocateCardsByATRA handler is reachable. Repeated timing-oracle queries can extract memory bit-by-bit to defeat ASLR as a precursor to remote code execution, but no code execution occurs directly; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Hash collisions in the inference request cache of NVIDIA Megatron-LM let an attacker who can already submit inference requests tamper with cached data and obtain partial information about other users' cached requests and responses, yielding a CVSS 7.1 impact (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N). Because the cache key relies on a weak hash (CWE-328), success depends on the attacker engineering colliding inputs against an enabled, shared inference cache, which is why the vector rates complexity as high rather than trivial. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; this is a moderate-severity issue rather than a top-tier emergency, and the NVIDIA product-security advisory is the authoritative source for affected builds and fixed versions.
Local privilege escalation in the Windows Update Orchestrator Service (UsoSvc) on Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 allows an attacker who already holds a standard, low-privileged local account to trigger a use-after-free in the service and elevate to the service's high-privilege (LocalSystem) context. There is no remote or unauthenticated path: the CVSS vector (AV:L/PR:L) confirms the attacker must already be logged on locally with low privileges, and the high attack complexity (AC:H) reflects that success depends on winning a timing-dependent memory-reuse race, which usually requires repeated attempts rather than a single deterministic trigger. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC exploitation: none), and vendor patches are available, so this is a genuine but second-tier priority concentrated on shared, multi-user, or terminal-server hosts where untrusted users hold standard accounts.
Local privilege escalation in the Windows Win32 Kernel Subsystem (win32k) lets an attacker who already holds low-privileged local code execution on a vulnerable host elevate to SYSTEM-level kernel privileges. The flaw is a use-after-free (CWE-416) reachable through the win32k syscall surface, requiring no user interaction but rated high attack complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N) because reliable exploitation depends on winning a race or precisely steering kernel pool reuse, which is probabilistic and may simply crash the machine. All supported Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025, including Server Core) builds below the listed patch levels are affected; there is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA SSVC exploitation assessment: none), but the low-priority-prerequisite/high-impact combination makes it a strong post-compromise escalation primitive wherever local access can be obtained. Vendor patches are available, so risk is concentrated in unpatched fleets rather than in unknown-vulnerability exposure.
Local privilege escalation in the Windows Win32 Kernel Subsystem allows an attacker who already holds authenticated, low-privileged access on a host to reuse freed kernel memory and elevate to a higher privilege level, with the assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicating full loss of confidentiality, integrity and availability once the elevation succeeds. The high attack complexity reflects the race/timing window an attacker must win to reclaim the freed kernel object, and CISA's SSVC assessment records exploitation as 'none' with automation judged infeasible, so no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable). The affected code is present by default across Windows 10, Windows 11 and Windows Server builds, so any environment where untrusted users can run code locally remains exposed until patched.
Local privilege escalation in the Windows Win32 kernel subsystem allows an authenticated attacker who already holds low-privilege code execution on a host to gain SYSTEM-level privileges by triggering a use-after-free (CWE-416) during kernel object reclamation. The weakness is strictly local (AV:L) and high-complexity (AC:H) because the attacker must win a memory-reclamation race, making it a post-access escalation primitive rather than a remote entry point; no public exploit code has been identified at time of analysis (CISA SSVC records Exploitation: none). Every supported Windows 10, Windows 11, and Windows Server build below the fixed revision listed by the vendor is affected, and Microsoft has released patches.
Local privilege escalation in the Windows Win32k kernel subsystem (CVE-2026-70176) allows an authenticated attacker who already holds low-privileged local access on a host to elevate their privileges by triggering a use-after-free in kernel-mode code, rated CVSS 7.0 (High, AV:L/PR:L/AC:H/UI:N). The flaw sits in a component that is present by default in every supported Windows edition and cannot be disabled or removed, so no special configuration is required to reach the vulnerable code; the main obstacle for an attacker is the high attack complexity of the required free/reuse race, which lowers reliability and may force repeated attempts. Microsoft has published a vendor patch, there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, though the ENISA EUVD record and MSRC advisory confirm a wide set of affected Windows 10, Windows 11, and Windows Server 2016-2025 (including Server Core) builds.
Local privilege escalation in the Windows Win32 kernel subsystem allows an authenticated attacker running as a low-privileged user to abuse a use-after-free condition in a kernel object and elevate to full system privileges, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Only specific Windows 11 builds (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 (including Server Core) below Microsoft's fixed builds are affected; exploitation is not remote, requires no user interaction, and hinges on winning a timing-dependent race window, which lowers exploit reliability. No public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and Microsoft has shipped a vendor patch, so fully updated hosts are not exploitable - the overall priority is moderate rather than emergency.