Unauthenticated remote attackers can bypass a security feature in Adobe's CAI Content Credentials SDK and gain unauthorized write access, a 7.5-rated integrity flaw confirmed by Adobe PSIRT. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no credentials and no user interaction are required; the practical precondition is that an application embeds the SDK on a network-reachable code path that processes untrusted, externally supplied content. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the medium-to-high severity and the SDK's role in provenance validation make it a priority for integrations that ingest third-party content.
Improper input validation in the CAI Content Credentials SDK allows a remote, unauthenticated attacker to feed crafted input into the SDK's processing path and bypass its integrity and security checks, resulting in unauthorized write access to Content Credentials data. Adobe PSIRT rates the issue CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning no privileges, no authentication, and no user interaction are required, and the impact is confined to integrity - forged or tampered provenance data - with no direct confidentiality or availability loss. Exposure is the limiting factor: since the SDK is a specialized provenance component, real risk depends on whether a downstream application actually accepts untrusted input through the vulnerable code path; there is no public exploit identified at time of analysis and no evidence of active exploitation.
Heap-based buffer overflow in OpenSSH for Windows - the optional OpenSSH client/server component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 - can allow code execution in the context of the vulnerable process, with the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (reported score 7.5) reflecting full confidentiality, integrity and availability impact. Exploitation is unauthenticated (PR:N) but is gated by two concrete limiters: User Interaction is Required (UI:R), implying a victim must actively initiate or accept the vulnerable SSH operation rather than being hit passively, and Attack Complexity is High (AC:H), meaning the attacker must satisfy a non-trivial precondition such as a specific heap or memory layout. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA SSVC Exploitation: none; KEV: no), and CISA's SSVC also rates the flaw as not automatable, although technical impact is assessed as total - on balance the signals point to a serious-but-not-emergency priority for hosts running the OpenSSH feature.
Heap-based buffer overflow in the Windows iSCSI Initiator component allows a remote unauthenticated attacker to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems, provided the target actually uses iSCSI and a user or administrator initiates or accepts a connection to an attacker-controlled iSCSI target (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5). The user-interaction requirement and High attack complexity - the attacker must also satisfy memory-layout or timing conditions to convert the overflow into reliable code execution - sharply limit the practical attack surface to environments that deploy iSCSI storage. Vendor-released patches are available from Microsoft, CISA's SSVC decision framework rates exploitation as none and automatable as no, and no public exploit identified at time of analysis.
Use-after-free in Microsoft's Remote Desktop Client (mstsc) allows an attacker who controls an RDP server to execute arbitrary code on the machine of any user who connects to it, with high confidentiality, integrity and availability impact (CVSS 7.5; AV:N/AC:H/PR:N/UI:R). Exploitation is not a passive drive-by: the victim must launch the client and initiate or accept the RDP connection to the attacker-controlled or compromised server, and the High attack complexity reflects the heap grooming or race conditions needed for reliable code execution. No public exploit has been identified at time of analysis, and CISA's SSVC assessment records Exploitation=none and Automatable=no, so wormable or mass automation is not expected; the realistic risk is confined to environments whose users connect to untrusted or externally controlled RDP endpoints.
Heap-based buffer overflow in Windows Media can result in remote code execution when a victim opens, previews, or otherwise processes a maliciously crafted media file, letting an attacker corrupt heap memory and run code in the context of the media-handling process. The vulnerability carries a CVSS base score of 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H): attackers need no authentication, but successful exploitation depends on user interaction with a crafted file and on high attack complexity, meaning heap-state or race conditions must be satisfied and reliability is reduced. Affected systems include Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025; Microsoft has published vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Use-after-free in the Windows Remote Desktop Client lets an unauthenticated attacker execute arbitrary code on a connecting client by luring a user into initiating an RDP session to an attacker-controlled or compromised server. The vector is network-reachable with no privileges required (PR:N), but practical exploitation depends on the victim starting the outbound connection (UI:R) and on the attacker winning a specific memory-state or timing condition (AC:H), which is consistent with CISA's SSVC rating of non-automatable and no observed exploitation. No public exploit code has been identified at time of analysis and Microsoft has published fixed builds covering all affected Windows 10, Windows 11 and Windows Server platforms; because the trigger is client-initiated rather than a passive listening service, the realistic delivery paths are malicious .rdp files, crafted links, or a hijacked RDP endpoint.
A use-after-free (CWE-416) in the Microsoft Windows Remote Desktop Client allows an unauthenticated attacker to execute code on a victim's machine when that user initiates an outbound connection to an attacker-controlled RDP server. The flaw is client-side rather than a remotely reachable service bug: the attacker must control the server endpoint and also win a race condition inherent to the use-after-free (AC:H), while the victim must open a crafted .rdp file or otherwise accept the connection (UI:R), which is why the CVSS 3.1 base score sits at 7.5 even though a successful exploit yields full confidentiality, integrity and availability impact. Vendor-released patches are available, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none and automatable as no, so this is a moderate-priority issue rather than an urgent one.
Use-after-free in the Windows Remote Desktop Client allows a malicious or compromised RDP server to execute code on a Windows machine that connects to it, affecting builds across Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025. Exploitation is client-side: an attacker must induce a victim to open a crafted .rdp file or otherwise initiate an outbound RDP session, and with AC:H plus mandatory UI:R, reliable code execution depends on winning a heap race rather than a single deterministic response, so mass opportunistic exploitation is unlikely while targeted social-engineering delivery is plausible. No public exploit identified at time of analysis; CISA's SSVC rates exploitation as none and automation as not automatable, and the PR:N vector means the victim need not authenticate to the attacker.
A use-after-free (CWE-416) in the Windows Remote Desktop Client lets an attacker who controls or compromises an RDP server execute arbitrary code on the connecting client, as described in Microsoft's MSRC advisory for CVE-2026-69998. Exploitation is not passive: the victim must actively initiate an RDP session to the hostile endpoint (UI:R), and the unauthenticated attacker (PR:N) must still win a memory-management race or reliably groom the freed heap object to convert the corruption into code execution (AC:H), giving a CVSS 3.1 base score of 7.5. All supported Windows client and server builds below the patched build levels are affected; there is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV), and CISA SSVC records exploitation as none and automatable as no, so the practical risk is driven by social engineering of an outbound RDP connection plus patch lag.
Use-after-free memory corruption in the Microsoft Windows Remote Desktop Client (mstsc.exe) can let an unauthenticated remote attacker execute arbitrary code on a vulnerable client, but only after the victim initiates an outbound RDP connection to an attacker-controlled, compromised, or spoofed RDP server. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.5) confirms the mandatory user interaction and high attack complexity, and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no'; no public exploit code has been identified at time of analysis. Microsoft has released fixes via the MSRC update guide, so the practical risk is moderate and concentrated on hosts that routinely open RDP sessions to untrusted or third-party endpoints.
Use-after-free in the Windows Remote Desktop Client allows a malicious or compromised RDP server to corrupt memory and execute code on the machine that connects to it (CVSS 7.5, C:H/I:H/A:H, SSVC Technical Impact 'total'). The attack is client-initiated and outbound - it requires the victim to establish an RDP session to the hostile endpoint (UI:R) and a favorable memory/race condition to be won (AC:H) - so it does not target a listening RDP service, and no privileges are required on the client (PR:N, unauthenticated). Current intelligence indicates no public exploit code and no confirmed active exploitation (CISA SSVC Exploitation: none; Automatable: no), while Microsoft has released a vendor patch, making this a high-impact-but-not-urgent issue at time of analysis.
Code execution in the Windows Remote Desktop Client (mstsc) is possible when a user initiates an outbound RDP session to a malicious or attacker-controlled server, triggering a use-after-free that can be leveraged for arbitrary code in the client's context. Affected are unpatched Windows client and server builds below their fixed versions - including Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012/2012 R2/2016/2019/2022/2025 - while the attacker requires no credentials (PR:N) and the flaw cannot be triggered against a listening host without the victim's outbound connection (UI:R). Exploitation is rated high-complexity (AC:H) because the attacker must reliably win the heap/timing-dependent memory corruption condition; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and Microsoft has released patched builds.
Use-after-free memory corruption in the Windows Remote Desktop Client allows an unauthenticated remote attacker to execute code in the context of the connecting user, but only after the victim initiates an outbound RDP session to an attacker-controlled or compromised server. Microsoft rates the issue 7.5 (High) under CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting a total loss of confidentiality, integrity, and availability that is tempered by high attack complexity and mandatory user interaction. CISA's SSVC assessment records exploitation as 'none' and no public exploit identified at time of analysis; Microsoft has released fixed builds through its update guide.
Remote code execution in Windows Remote Desktop Services is possible through a use-after-free (CWE-416) in the RDP component, rated CVSS 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). An unauthenticated remote attacker can achieve high confidentiality, integrity, and availability impact, but exploitation is not reliable: the attacker must satisfy a race or heap-grooming condition (AC:H), and a victim must initiate or accept a Remote Desktop connection to an attacker-controlled endpoint (UI:R). No public exploit code is identified at time of analysis, CISA SSVC records exploitation as none, and Microsoft has released patches; hosts without the Remote Desktop/RDS role enabled are not exposed, so risk is concentrated on internet- or untrusted-network-facing RDP deployments.
Remote code execution in Microsoft's Windows Remote Desktop Client stems from a use-after-free (CWE-416) triggered when the client processes crafted data supplied by an RDP server. An unauthenticated attacker can exploit this over a network only by inducing a user to connect to an attacker-controlled or compromised RDP server - for example by opening a malicious .rdp file or link - after which heap corruption can lead to code execution in the context of the client. The CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting required user interaction and high attack complexity; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', no public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed actively exploited (CISA KEV). Vendor patches are available, so the practical risk is concentrated in unpatched Windows clients exposed to untrusted RDP endpoints.
Remote code execution affects the Windows Remote Desktop Client (mstsc) across a wide range of supported desktop and server builds, allowing an attacker who controls or manipulates an RDP endpoint to execute code in the context of the connecting user. The flaw is a use-after-free (CWE-416) rated CVSS 7.5; exploitation requires the victim to actively initiate an RDP session outward to the hostile server (UI:R), and high attack complexity (AC:H) reflects dependence on heap/race conditions rather than a deterministic trigger - no authentication is required of the attacker (PR:N). No public exploit code has been identified at time of analysis and CISA's SSVC records Exploitation=none with no KEV listing, so risk is driven by the breadth of affected Windows builds and the total technical impact should the memory-corruption primitive be reliably converted into code execution.
Outbound RDP sessions from the Windows Remote Desktop Client can be turned against the client itself: when a user connects to an attacker-controlled, compromised, or man-in-the-middle'd RDP server, crafted response data triggers a use-after-free (CWE-416) that can lead to code execution on the victim's machine, with total technical impact if the memory corruption is reliably steered. The attacker needs no credentials on the client (PR:N) and can operate remotely over the network (AV:N), but exploitation is gated by mandatory user interaction (the user must actively initiate the session, UI:R) and high attack complexity (AC:H) reflecting the precision required to trigger and control the freed allocation. Microsoft rates this CVSS 7.5 and has released vendor patches; there is no public exploit identified at time of analysis and no evidence of exploitation - CISA's SSVC assessment records Exploitation: none and Automatable: no.
A use-after-free (CWE-416) in the Windows Remote Desktop Client (mstsc.exe / RDP client stack) allows remote code execution in the security context of the connecting user when that user establishes an outbound RDP session to an attacker-controlled or compromised RDP server. Exploitation is unauthenticated with respect to the client (CVSS 3.1 PR:N) but requires user interaction (UI:R) and is rated high attack complexity (AC:H), because the attacker must deliver crafted server-side RDP protocol data and win a race condition over the freed object; the resulting impact is full compromise of confidentiality, integrity and availability within the user's own security scope (S:U, no privilege escalation to SYSTEM). Microsoft has released a vendor patch covering Windows 10, Windows 11 and Windows Server 2012 through 2025, exploitation has not been observed by CISA SSVC assessment (Exploitation: none, Automatable: no), and no public exploit code was identified at the time of analysis.
Use-after-free (CWE-416) in the Windows Remote Desktop Client (mstsc) allows remote code execution on a Windows client that connects out to a malicious or compromised RDP server, affecting all supported Windows 10, Windows 11, and Windows Server builds below the fixed patch levels listed in Microsoft's advisory. Exploitation is not opportunistic: it follows a reverse-RDP pattern in which the victim must initiate the session (UI:R) against attacker-controlled server infrastructure, and public exploitation is not confirmed - CISA SSVC records exploitation as 'none' and no public exploit code has been identified at time of analysis. The negotiated CVSS of 7.5 is driven by high attack complexity (AC:H), reflecting the heap-state and timing control needed to win the use-after-free race, while requiring no privileges on the victim (PR:N) and impacting confidentiality, integrity, and availability equally.
Remote code execution in the Microsoft Remote Desktop Client (CWE-416) occurs when a user initiates an RDP connection to an attacker-controlled or compromised server that returns crafted responses, causing the client to reuse a freed memory object. The CVSS vector (AV:N/AC:H/PR:N/UI:R) shows an unauthenticated attacker is required to hold no credentials on the victim host, but must convince the user to start the session and satisfy high-complexity heap-timing conditions for reliable exploitation; impact is confined to the connecting user's security context with no privilege escalation implied. Exploitation only triggers on a client that actively connects outbound, and no public exploit identified at time of analysis.
Integer overflow (CWE-190) in the CAI Content Credentials SDK lets unauthenticated remote attackers crash applications that parse externally supplied media or embedded Content Credentials manifests, producing a denial-of-service condition. Affected deployments are those that invoke the SDK against untrusted input - for example services that automatically ingest and verify uploaded or fetched media - while systems that only process trusted, internally generated assets are far less exposed. The vulnerability is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), requires no user interaction, causes availability loss only (no disclosure or modification), and no public exploit code has been identified at time of analysis; the vendor advisory is Adobe APSB26-163.
Integer overflow (CWE-190) in Microsoft Word's document parsing can allow an unauthenticated, network-delivered attacker to execute code in the context of the victim by convincing them to open a specially crafted Word document. Exploitation requires user interaction (UI:R) and high attack complexity (AC:H), and impact is confined to the user's Word process (scope unchanged). No public exploit identified at time of analysis, making this a moderately high but not top-tier priority for most organizations.
Heap-based buffer overflow in Microsoft Access enables unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted database file. Exploitation is non-trivial due to high attack complexity (AC:H) and requires user interaction (UI:R), but successful exploitation grants code execution with the user's privileges. No public exploit code has been identified at time of analysis, and a vendor patch is available via the Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft PowerPoint allows unauthenticated remote attackers to execute arbitrary code when a victim opens a specially crafted presentation file, but exploitation requires user interaction and reliable heap corruption against modern memory-safety mitigations (AC:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is considered moderate-to-high due to the social engineering delivery and Protected View defenses that can impede successful attacks. This vulnerability affects Microsoft Office PowerPoint installations that have not received the update referenced in the Microsoft Security Update Guide.
Heap-based buffer overflow in Microsoft Office Access allows an unauthenticated remote attacker to execute code in the security context of the user who opens a specially crafted Access database file. Exploitation is not autonomous despite the AV:N vector: the attacker must deliver the malformed file and persuade the victim to open it (UI:R), and reliable code execution further depends on heap-layout grooming to control the corrupted allocation (AC:H), so any code that runs inherits only the opening user's privileges (S:U). No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the assessed risk is mixed-priority given the mandatory user interaction and high attack complexity.
Denial of service in mp4v2 2.0.0 lets a remote, unauthenticated attacker crash any process that parses an attacker-supplied MP4 file, because MP4File::GenerateTracks() in src/mp4file.cpp passes a NULL handler-type string straight into strcmp() without a check (CWE-476). Impact is availability-only - no code execution, privilege escalation, or data exposure - but the defect is trivially automatable (CISA SSVC: automatable yes, technical impact partial) and publicly available exploit code exists, with no CISA KEV designation. EPSS and NVD enrichment were not provided in the available data, so no quantitative exploit-likelihood score is asserted here. In server-side pipelines that ingest untrusted MP4s the exposure is genuinely remote and unauthenticated; for interactive clients it reduces to a user opening a malicious file.
Out-of-bounds access in libwebsockets' LEJP incremental JSON parser allows unauthenticated remote attackers to crash the process via crafted JSON that exceeds the parser's fixed-size path index or stack arrays. Affected are applications that call lejp_parse on untrusted input; publicly available exploit code exists, though exploitation is deployment-dependent and impact is limited to denial of service (no code execution or data disclosure). The root cause is an off-by-one error in lib/misc/lejp.c, where boundary checks are performed after incrementing the index.
Microsoft QUIC (MsQuic) can be made to bypass a security feature over the network because a security-relevant variable is initialized to an insecure default (CWE-453), producing a CVSS 7.5 condition with no confidentiality impact, limited integrity impact and full availability impact (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H). The issue is unauthenticated and requires no user interaction, but is only reachable on hosts that actually run a network-exposed QUIC listener - HTTP/3 or SMB over QUIC - and the high attack complexity reflects a timing/transient-state prerequisite the attacker cannot directly control. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the MSRC update guide is the authoritative source for affected builds and fixes.
Denial-of-service in the CAI Content Credentials SDK allows remote unauthenticated attackers to exhaust system resources by supplying crafted Content Credentials data to an application that parses or verifies it. The issue is availability-only (CVSS 3.1 7.5, CWE-400) with no confidentiality or integrity impact, and no public exploit has been identified at time of analysis. Deployments that do not expose SDK-backed parsing to untrusted input face substantially lower real-world risk.
Denial of service in the CAI Content Credentials SDK allows remote, unauthenticated attackers to exhaust system resources by supplying crafted Content Credentials data (such as C2PA manifests or embedded asset metadata) for parsing or verification, with no user interaction required. The CVSS 3.1 base score of 7.5 is driven entirely by availability impact (C:N/I:N/A:H) under a fully remote, low-complexity vector (AV:N/AC:L/PR:N/UI:N), meaning integrity and confidentiality are unaffected. Risk is contingent on exposure: only applications or services that actually ingest untrusted Content Credentials input through a reachable interface are at risk, and no public exploit has been identified at time of analysis. Note that no KEV listing or public proof-of-concept is present in the available intelligence, so the practical threat is best characterized as a reliable availability-degradation vector once a vulnerable processing path is reachable rather than as an observed attack campaign.
Application denial-of-service in the Adobe CAI Content Credentials SDK lets unauthenticated remote attackers exhaust system resources by supplying crafted media files or embedded C2PA/Content Credentials manifests that reach the SDK's parsing or verification path, degrading or halting the consuming application (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/A:H; 7.5 High). Impact is confined to availability - no code execution, privilege escalation, or data disclosure - and real-world risk is heavily gated by exposure, since a service must actually ingest untrusted Content Credentials input for the flaw to be reachable; deployments that only process trusted first-party content or run the SDK offline in batch mode face substantially reduced risk. No public exploit identified at time of analysis.
Unauthenticated denial of service in Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) allows a remote attacker to crash the application by sending crafted input that the server fails to validate properly. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials and no victim interaction are required against a reachable instance, and the impact is confined to availability (C:N/I:N/A:H) - the practical worst case is a service outage rather than data exposure or code execution. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the dominant risk factor is exposure, since internet-facing or otherwise attacker-reachable ColdFusion instances are at risk while internally segmented deployments sharply reduce reachability.
Blind SQL injection in the Link Whisper Free WordPress plugin (versions through 0.9.7) allows an attacker who already holds a high-privilege, authenticated WordPress session to inject SQL through an unneutralized plugin input, reading database contents back through boolean- or time-based inference. Exploitation requires the plugin to be installed and active plus high-privilege access (PR:H in the CVSS vector), so anonymous visitors cannot reach it; the assessed impact is high confidentiality loss with limited integrity effect, making this a moderate-priority issue rather than an urgent one. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited (no CISA KEV listing).
Blind SQL injection in the PluginUs.Net WOLF bulk-editor WordPress plugin, affecting all versions through 1.1.1, allows an attacker who already holds high-privilege authenticated access to the WordPress site to inject arbitrary SQL through the plugin's bulk-editing input and infer database contents indirectly. Because the injection is blind, extraction is slower and no victim user interaction is required; the practical exposure is limited by the PR:H prerequisite, meaning an administrator-level account or an account with access to the WOLF bulk-editor interface is required before exploitation is possible. No public exploit code was identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided, and the overall priority is moderate rather than emergency.
Improper input validation in Adobe's CAI Content Credentials SDK (advisory APSB26-163) lets remote attackers bypass a security feature and obtain unauthorized write access, effectively allowing modification or forgery of protected content-credential data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) means the flaw is network-reachable, low complexity, unauthenticated, and requires no user interaction, so any application or service that embeds the SDK and exposes its input-processing path to untrusted input is in scope. Impact is confined to integrity (I:H) with no confidentiality or availability loss, and no public exploit code or CISA KEV entry was identified at time of analysis.
Improper input validation in the CAI Content Credentials SDK lets remote, unauthenticated attackers bypass the SDK's security control and obtain unauthorized write access to content-credential data, per Adobe advisory APSB26-163. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) indicates a network-reachable, low-complexity flaw requiring no authentication and no user interaction, with impact confined to integrity - confidentiality and availability are unaffected. Only applications that embed a vulnerable version of the SDK and expose its input-processing/validation path to network-supplied content are affected, and no public exploit code was identified at time of analysis.
Improper input validation in the Adobe CAI Content Credentials SDK lets remote attackers bypass a security feature and gain unauthorized write access to content-credential processing. The flaw is network-reachable, low-complexity, requires no authentication (PR:N) and no user interaction (UI:N), yielding a CVSS 3.1 score of 7.5, but the scored impact is integrity-only (C:N/I:H/A:N) rather than code execution or data disclosure. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; exploitation is contingent on a deployed application embedding the SDK and exposing its C2PA manifest parsing/validation path to attacker-supplied input.
Incorrect authorization in Adobe ColdFusion 2023 (up to and including update 2023.0.25) and ColdFusion 2025 (up to and including update 2025.0.13) lets remote, unauthenticated attackers read contents of sensitive memory without any user interaction. The flaw is rated 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is classified as an authentication bypass (CWE-863), so confidentiality of server-side data is the primary exposure rather than code execution or data modification. No public exploit code or exploitation telemetry has been identified at time of analysis, and no CISA KEV entry is associated, so the practical risk is governed mainly by whether a vulnerable, internet-facing ColdFusion instance is reachable.
A heap-based buffer overflow in Microsoft PowerPoint allows an unauthenticated attacker to execute arbitrary code in the security context of a user who opens a specially crafted presentation file, with impact rated to confidentiality, integrity, and availability all High. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 for Windows, and Office 365 / Office LTSC 2021 and 2024 for Mac; exploitation requires the victim to open the malicious file (UI:R) delivered out-of-band via email, chat, or web download, and the high attack complexity metric reflects additional attacker-side prerequisites such as winning a specific heap memory layout. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limits on exploitation remain the required user interaction plus Protected View and Mark-of-the-Web protections applied to files from untrusted sources.
A signature-verification bypass in the CAI Content Credentials SDK allows an unauthenticated, network-reachable attacker to submit content or a token bearing a forged or tampered cryptographic signature that the SDK's verifier accepts, yielding unauthorized write access to systems that rely on that verification as a trust decision. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) the attack needs no credentials and no user interaction, and the assessment confines impact to integrity only, with no confidentiality or availability loss. The practical exposure is narrow but real: only deployments that actually consume the SDK to validate signatures or claims as a security control are affected, and no public exploit code was identified at time of analysis, so this is a genuine integrity issue rather than an acute emergency.
Improper verification of cryptographic signatures in the CAI Content Credentials SDK allows unauthenticated remote attackers to supply forged or improperly signed content credentials that the SDK accepts as authentic, bypassing the security check and gaining unauthorized write access to whatever the SDK's verification verdict gates. The CVSS 3.1 base score is 7.5 (High) under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - an integrity-only signature-verification bypass (CWE-347) with no confidentiality or availability impact, requiring no authentication and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; real-world risk is highest in deployments that make publishing, authorization, or authenticity decisions solely on the SDK's verification result, and negligible where that result is not treated as a trust boundary.
Improper verification of cryptographic signatures in Adobe's CAI Content Credentials SDK allows remote, unauthenticated attackers to submit a forged or tampered Content Credentials manifest that the SDK accepts as valid, bypassing a security feature and granting unauthorized write access to credential data (CWE-347; CVSS 3.1 7.5). Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, no credentials and no user interaction are required, and the impact is integrity-only, with confidentiality and availability unaffected; in practice exploitation depends on the vulnerable SDK version being deployed and the consuming application treating signature verification as a trust boundary. This is a moderate-priority integrity issue rather than a top-tier emergency, and no public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Signature-verification bypass in Adobe Content Credentials SDK allows unauthenticated, network-based attackers to forge or tamper with signed content credentials, bypassing integrity checks to gain unauthorized write access. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) indicates a low-complexity flaw with no user interaction and a pure integrity impact. No public exploit code has been identified at time of analysis, but risk is elevated for applications that rely on the SDK's verification result as a trust or authorization decision. Confirm vulnerable SDK versions against Adobe APSB26-163.
Improper access control in the CAI Content Credentials SDK allows remote, unauthenticated attackers to bypass a security check and gain unauthorized write access, with no user interaction required (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). The impact is scoped entirely to integrity - the assessed vector shows no confidentiality or availability effect - so practical exposure depends on how much a deploying application trusts Content Credentials data for provenance or security decisions. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; Adobe advisory APSB26-163 is the authoritative source for affected and fixed SDK versions.
Improper access control in the Adobe CAI Content Credentials SDK lets unauthenticated, network-reachable attackers bypass a security check and obtain unauthorized write access to content-credential (provenance) data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) confirms the flaw needs no credentials and no user interaction, and that impact is confined to integrity - there is no confidentiality or availability effect. The practical exposure hinges on integration: this is an SDK, so reachability and real-world impact depend entirely on whether the host application exposes the affected access-controlled operation to attacker-controlled input; no public exploit code and no confirmed active exploitation were identified at time of analysis.
A use-after-free in the Windows Bluetooth Service allows an unauthenticated attacker within Bluetooth radio range to execute code on affected Windows 10, Windows 11, and Windows Server hosts where Bluetooth is enabled and the service is running - the default state on most laptops, tablets, and Bluetooth-equipped desktops. Affected builds span Windows 10 1809/21H2/22H2, Windows 11 23H2 through 26H1/26H2, and Windows Server 2019/2022/2025 (including Server Core) below the fixed build numbers listed in EUVD data. No authentication (PR:N) or user interaction (UI:N) is required, but exploitation carries High attack complexity (AC:H) because the attacker must reliably win a memory-timing race, which limits reliability and makes automated or at-scale remote attacks impractical; no public exploit has been identified at time of analysis, CISA's SSVC rates exploitation as none and automatable as no, and vendor patches are available.
A heap-based buffer overflow in the Windows Reliable Multicast Transport Driver (RMCAST) allows an unauthenticated attacker positioned on the same adjacent network segment to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server hosts. The assessed vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5) reflects total loss of confidentiality, integrity, and availability if exploitation succeeds, but high attack complexity and the adjacency prerequisite mean exploitation depends on favorable heap layout/memory-grooming conditions and cannot be reliably automated (SSVC Exploitation: none, Automatable: no). There is no public exploit identified at time of analysis and no evidence of active exploitation; a vendor patch is available from Microsoft, making timely but non-emergency patching the appropriate response.
Denial of service in GNOME Remote Desktop (gnome-remote-desktop) as shipped in Red Hat Enterprise Linux 8, 9, and 10 allows an unauthenticated remote attacker to pin the daemon's event-loop thread at high CPU by sending traffic to a TLS-enabled VNC listener, causing the service to stop making forward progress. The defect is in the VNC TLS I/O handlers, which treat retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) with an unbounded busy loop instead of returning control to the event loop, so the thread spins indefinitely rather than waiting for socket readiness. No public exploit code exists and there is no confirmed active exploitation, and practical exposure is bounded: the VNC backend must be running with a TLS listener reachable over the network, a configuration that is not enabled by default on typical RHEL installs and is far more common on desktops than on servers.
Denial of service in IBM WebSphere Application Server 8.5 and 9.0, and in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10, allows remote unauthenticated attackers to disrupt availability by sending crafted serialized data to the product's messaging service. The root cause is insecure deserialization (CWE-502) in the messaging component, rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so impact is confined to availability - confidentiality and integrity are not affected. Per the assessed vector, no credentials or user interaction are required once the messaging endpoint is reachable, but the vulnerable code path is only exercised where the messaging engine (SIB/JMS) is enabled and accepting input; environments that disable it or restrict it to trusted networks are materially less exposed. There is no public exploit identified at time of analysis, and this CVE is not listed as confirmed actively exploited (CISA KEV).