Incorrect authorization in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source lets remote, unauthenticated attackers bypass security controls to gain unauthorized read access plus limited write access, with no user interaction required. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (base 7.2) confirms the attacker needs no credentials and only network reachability to an affected, unpatched instance - typically an internet-facing storefront, REST/GraphQL API, or admin interface - while the changed scope (S:C) indicates the bypass can reach resources outside the vulnerable component's own security boundary. Impact is bounded rather than catastrophic: confidentiality and integrity are Low and availability is None, so this is a security-feature/authorization bypass rather than full administrative takeover or data destruction, and no public exploit code has been identified at time of analysis, making this a genuine but mid-tier priority.
Local privilege escalation in Windows Hyper-V allows an authorized attacker with high privileges on a host where the Hyper-V role is enabled to trigger a heap-based buffer overflow (CWE-122) and potentially corrupt hypervisor memory, leading to elevation of privilege. The attack is local only (AV:L) and requires high privileges (PR:H), user interaction (UI:R), and a difficult-to-achieve precondition (AC:H), with scope change (S:C) indicating potential impact beyond the hypervisor's security context. CISA's SSVC assessment rates Exploitation as none and Automatable as no; no public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch.
SQL injection in Fortinet FortiAnalyzer and FortiManager (including Cloud variants) allows an authenticated attacker to execute arbitrary commands on the underlying system via crafted requests. Affected versions include FortiAnalyzer 7.6.0-7.6.4, 7.4.0-7.4.7, and all 7.2 releases, plus FortiManager 7.6.0-7.6.4, 7.4.0-7.4.6, and all 7.2 releases, as well as FortiAnalyzer Cloud 7.6.2-7.6.4, 7.4.1-7.4.7, 7.2.1-7.2.11 and FortiManager Cloud 7.6.2-7.6.4. The vulnerability requires valid credentials; the provided CVSS vector indicates high privileges (PR:H) while the description and independent assessment suggest low privileges (PR:L) may suffice. No public exploit code or active exploitation is identified at time of analysis, and the risk is considered elevated but not an emergency based on current signals.
Authenticated SQL injection in the Fortinet FortiAnalyzer and FortiManager management platforms allows a logged-in low-privileged user to execute arbitrary commands on the appliance via crafted requests. Affected firmware covers FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7 and all 7.2 releases, plus FortiManager 7.6.0 through 7.6.4, 7.4.0 through 7.4.6 and all 7.2 releases. Exploitation requires a valid account on the management interface - the vendor CVSS vector marks PR:H while the description and independent assessment indicate a low-privileged user suffices - and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so the main risk mitigation is limiting who can reach and authenticate to the management plane.
Stored cross-site scripting (XSS) in the AcyMailing WordPress plugin (versions up to and including 11.1.0) allows unauthenticated attackers to inject malicious scripts via the customField[] parameter of the public frontusers::subscribe endpoint. The injected script executes when a victim accesses the online-archive URL for the poisoned subscriber, potentially including administrators who click a plugin-generated link in the Subscribers → History screen. No public exploit code has been identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Bit Integrations (Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation) through version 2.10.6 lets unauthenticated remote attackers inject arbitrary JavaScript that executes for any user viewing the affected notification page, but only after a site administrator has bound a public Bit Assist webhook trigger to a BuddyBoss 'Send Notification' action, mapped an attacker-controllable form field to the notification_content parameter, and the attacker knows the flow's secret UUID callback URL. Because of those non-default configuration prerequisites the realistic exploitability is materially lower than the raw 7.2 base score suggests, which is why the authoritative assessment rates attack complexity as High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) rather than Low. No public exploit code and no CISA KEV entry were identified at time of analysis.
Cross-site scripting (XSS) in Microsoft SharePoint Server 2019 allows remote attackers to inject malicious scripts into web pages viewed by other users, potentially leading to spoofing or limited data theft. Exploitation requires user interaction (e.g., clicking a crafted link) but no authentication, and it is not automatable. No public exploit code or active exploitation has been identified, and the overall risk is assessed as moderate due to the required victim interaction and limited impact.
Use-after-free in the Windows Enterprise App Management component lets an attacker with valid low-level credentials on a target machine, who can reach that machine over the network, corrupt freed memory and elevate to a higher-integrity context. Exploitation is gated by three limiters recorded in the assessed vector: the attacker must already hold a valid account on the target (PR:L), a victim user must perform an interaction (UI:R), and the memory-reuse race that gives an attacker control of the freed object is non-deterministic (AC:H) - so although the attack vector is network-reachable, real-world reliability and prerequisites keep this a moderate-priority issue rather than an emergency. Microsoft has released fixes in the current Windows cumulative updates, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows an authenticated low-privileged attacker to coerce the application server into issuing requests to internal resources, yielding elevated access and disclosure of data outside the attacker's intended scope. Adobe assigns this a CVSS 3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N); exploitation is non-deterministic because the vendor states success depends on conditions beyond the attacker's control, and it requires an existing foothold as a low-privileged account. There is no public exploit identified at time of analysis and no CISA KEV listing, so the practical risk profile is that of a moderate-severity, post-authentication SSRF rather than a remotely exploitable unauthenticated flaw.
Lenve vhr through commit 03abbd3 exposes BCrypt password hashes, phone numbers, and addresses for all operators to any authenticated user who requests GET /chat/hrs. A low-privileged operator account (CVSS PR:L) is sufficient, making this a confidentiality-only privilege-escalation enabler if weak hashes are cracked offline; the assessed impact is CVSS 7.1 with no integrity or availability impact. No CISA KEV confirmation or public exploit code was identified at time of analysis.
Memory-safety failure in the Windows Bluetooth Port Driver lets a device within Bluetooth radio range trigger out-of-bounds memory access that can escalate to code execution on unpatched Windows 10, Windows 11, and Windows Server hosts with an active Bluetooth radio. Exploitation requires proximity (adjacent network), the victim's Bluetooth to be enabled and in use, some form of user interaction such as accepting or initiating a Bluetooth connection, and high attack complexity reflecting preconditions outside the attacker's control; authentication is not required (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Microsoft has shipped fixes, no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as "none" with the attack assessed as non-automatable, and hosts with Bluetooth disabled are not exposed - making this a moderate rather than top-tier priority despite the 7.1 score and the CVSS "total" technical impact rating on affected devices.
Blind XPath/XML injection in Adobe Experience Manager 6.5 (versions 6.5.0 through 6.5.25) allows a low-privileged, authenticated attacker to bypass security controls and read content they should not be able to access, with limited unauthorized write capability. The flaw is network-reachable, requires no user interaction, and carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), reflecting high confidentiality impact but only low integrity impact and no availability impact; the CVSS vector confirms the attacker must hold a valid low-privileged account (PR:L), so unauthenticated outsiders cannot exploit it directly. No public exploit code or confirmed active exploitation was identified at time of analysis, and Adobe has published a vendor security bulletin (apsb26-152) covering the issue.
Missing authorization in youlai-boot through 2.21.1 lets any authenticated user enable or disable arbitrary accounts - including root and administrator accounts - by sending a PATCH request to /api/v1/users/{userId}/status, because the updateUserStatus handler in UserController omits the @PreAuthorize('@ss.hasPerm('sys:user:edit')') guard applied to its sibling handlers. The practical impact is administrative lockout or the re-enabling of accounts an administrator had deliberately disabled; a valid login is mandatory (PR:L, authenticated per the assessed vector), no victim interaction is required, and no public exploit identified at time of analysis. This is a moderate-priority authenticated access-control flaw rather than a top-tier emergency, with impact limited to account-status toggling (integrity and availability) rather than data disclosure or code execution.
Authenticated users of Wukong AICRM (versions up to and including the 20260610 release) can retrieve the cleartext AI provider API key stored in the CRM's system configuration, because the /systemConfig controller enforces no authorization check on the relevant endpoints. Any low-privilege account can call GET /systemConfig/byType/ai to read the key directly, or post an attacker-controlled apiUrl to /systemConfig/ai/test to have the server forward the stored key to a host the attacker controls. Exploitation requires a valid account (PR:L per the CVSS 4.0 vector) and only works if an AI provider key has actually been configured; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Path traversal in Commvault HyperScale MediaAgents allows an authenticated low-privileged user to read files outside the intended directory over the network, resulting in unauthorized disclosure of data (rated 7.1, confidentiality-only impact with no integrity or availability effect). The flaw requires a valid session to the MediaAgent service (PR:L per the assessed vector), so anonymous internet attackers cannot trigger it - stolen, shared, or insider credentials are the realistic precondition. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Commvault reports that software customers should upgrade to the resolved maintenance release; exact affected versions and deployment modes should be confirmed against advisory CV_2026_10_8.
Authenticated attackers with minimal privileges can disconnect active sessions of other users, including administrators, in Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 due to missing authorization checks on device-disconnection requests, causing a denial of service. The flaw is network-reachable, requires low privileges (PR:L) and no user interaction, and affects only availability (VA:H) with no confidentiality or integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Heap-based buffer overflow in the Windows Internet Connection Sharing (ICS) component allows an authenticated low-privilege attacker positioned on an adjacent network segment to execute arbitrary code on affected hosts, with high confidentiality, integrity, and availability impact per the assessed vector (CVSS 7.1, AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained: ICS must actually be running (it is not enabled by default on mainstream Windows client or server installations), the attacker must already hold low-privileged credentials, must be local/link-local to the target rather than routed over the internet, and must satisfy high-complexity heap-grooming and timing conditions (AC:H). No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); vendor patches are available, so this is a moderately-high-priority but not emergency-tier issue.
An authorization bypass in the Ente server (the self-hosted/cloud 'museum' backend) lets an emergency contact who was already added and accepted by a victim call POST /emergency-contacts/approve-recovery with their own client-supplied user ID and a recovery-session UUID, prematurely moving the victim's emergency recovery session from WAITING to READY, clearing the wait_till value, and skipping the owner-configured notice period to retrieve recovery information. The same insufficiently scoped update pattern affects the reject and stop transitions, so any party who merely knows another user's recovery-session UUID could cancel a session they are not part of. Exploitation requires authenticated access as an established, victim-approved emergency contact and does not create recovery rights over arbitrary accounts; there is no confirmed active exploitation and no public exploit identified at time of analysis, though the vulnerability is scored 7.1 and fixed in server image 2026.07.09.
SQL injection in Adobe Experience Manager 6.5 (through 6.5.25) allows an authenticated, low-privileged attacker to bypass security controls and gain unauthorized read and limited write access to backend data. The flaw is due to improper neutralization of special elements used in SQL commands (CWE-89), and exploitation requires no user interaction. No public exploit code or active exploitation has been identified, and the need for valid low-privilege credentials and the limited version range make this a moderate-priority issue rather than an emergency.
Heap buffer overflow in Wazuh Manager's File Integrity Monitoring alert generation lets an enrolled agent corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage across all monitored endpoints. Affected versions are Wazuh 3.12.0 through 4.14.7, fixed in 4.14.8; the attacker must hold a valid agent enrollment key (PR:L, authenticated), and because FIM/syscheck is enabled by default on agents no special manager-side configuration is required. The vendor CVSS 4.0 score of 7.1 (HIGH) is driven almost entirely by availability impact (VA:H), and no public exploit code has been identified at time of analysis.
FreeRDP 3.0.0 through 3.31.x allows a malicious RDP server to brute-force the smartcard PIN of a connecting client by resetting the per-handle retry counter in the virtual smartcard GIDS implementation. The attack requires the victim to initiate an RDP session to an attacker-controlled server while smartcard redirection is configured (UI:P/UI:R), and no public exploit code has been identified at time of analysis. This is a moderate-priority confidentiality issue (CVSS 4.0 7.1; independent CVSS 3.1 rates impact as C:H only) that can lead to PIN disclosure but not code execution or integrity/availability impact.
A reachable assertion in the FreeRDP client (3.0.0-beta1 through versions prior to 3.32.0) allows a malicious RDP server to crash a connecting client. When the client is built with verbose WinPR assertions enabled and is using smartcard emulation, the emulated SCardStatusA handler forwards a NULL reader-name destination to scard_copy_strings; a server that sends an SCardStatusA request with fmszReaderNamesIsNULL=1 triggers that assertion and aborts the client process. Impact is limited to a client-side denial of service against a single connecting session - no code execution, lateral movement, or credential impact - and exploitation demands both non-default build/runtime settings and a victim who initiates a connection to an attacker-controlled server. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided, but the narrow configuration prerequisites keep real-world urgency low despite the 7.1 CVSS 4.0 score.
Kubeflow Model Registry through 0.3.17 allows an authenticated namespace user with permission to create InferenceService resources to steal the InferenceService controller's ServiceAccount bearer token. The attacker creates an InferenceService with the modelregistry.kubeflow.org/url annotation pointing to an attacker-controlled server; the controller follows the annotation and attaches its token, which the attacker captures and then uses to modify other tenants' InferenceServices cluster-wide. This is a server-side request forgery (CWE-918) requiring low privileges (PR:L) and no user interaction; no public exploit code was identified at time of analysis, and no CISA KEV entry exists.
Authenticated members of fuintCatering can read other members' refund records and the personal data they contain by iterating sequential refundId values against the ClientRefundController refund detail endpoint. The flaw is an insecure direct object reference (CWE-639) present through commit 122c9e6, and because self-registration is open, an attacker only needs a freely obtainable account to harvest buyers' names, national ID numbers, addresses, WeChat openIds, and order details. No public exploit code or confirmed active exploitation was identified at time of analysis; the impact is confidentiality-only - no writing, no system compromise - and exploitation further depends on refund records actually existing to enumerate.
Local tampering and information compromise in Microsoft Windows Error Reporting (WER) allow an authenticated attacker who already holds a low-privileged account and code execution on a Windows host to invoke a critical WER function that performs no authentication or authorization check, yielding high confidentiality and integrity impact with no availability impact (CVSS 7.1, AV:L/PR:L/UI:N). The flaw is not reachable remotely or by unauthenticated users; the mandatory local foothold narrows realistic exploitation to local attackers or post-compromise privilege escalation, which is why the consolidation of signals points to a moderate rather than emergency priority. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released fixed builds covering Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025.
Credential exposure in maku-boot 4.3.0 through 5.0.0 allows any authenticated low-privilege user to read unmasked mail and SMS integration secrets by calling /sys/mail/config/list and /sys/sms/config/list, which lack the required authority checks. The same missing authorization permits abuse of /sys/mail/config/send to send mail to arbitrary recipients. Exploitation requires a valid authenticated session and network access to the management API, and impact is greater where SMTP passwords or Aliyun, Tencent Cloud, Qiniu, or Huawei Cloud access keys are configured; no CISA KEV entry exists and no public exploit identified at time of analysis.
Authenticated sellers on lilishop (PickMall) through 4.4 can overwrite and effectively hijack any other store's product listings by supplying a foreign goodsId to the goods update endpoint, an insecure direct object reference (CWE-639) with an assessed CVSS 3.1 base of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Because the seller-api update handler never verifies that the target goodsId belongs to the caller's own store, a low-privileged seller tenant can replace product details and SKUs and reassign the item to their own store, producing a high-integrity impact with no confidentiality or availability loss. Exploitation requires a valid seller account and prior knowledge of the target product's goodsId; anonymous users cannot reach the endpoint, and no public exploit code has been identified at time of analysis (no CISA KEV entry).
Missing authorization in risesoft WorkFlow-Engine through 9.6.11 allows authenticated low-privileged users to approve or reassign other users' workflow tasks by supplying a known taskId to the complete, completeTask, or reAssign handlers under the /vue/buttonOperation endpoints. The flaw is an IDOR (CWE-639) rated 7.1 under the vendor-supplied CVSS 4.0 vector (our independent CVSS 3.1 assessment is 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), requiring only a valid low-privilege account and knowledge of a target taskId. No public exploit or CISA KEV listing was identified at time of analysis; impact is limited to workflow approval integrity, with no data disclosure or denial of service.
Missing authorization in SmartAdmin through 3.30.0 lets any authenticated low-privileged employee change system-wide level-3 protection settings, disabling login lockout and two-factor login, weakening password rules, and clearing existing lockout records through the unannotated updateConfig and loginFail batchDelete endpoints in AdminProtectController. The prerequisite is an ordinary employee session (CVSS PR:L, no user interaction, network-reachable admin API), so the barrier is the account rather than any special configuration, and default deployments up to v3.30.0 are impacted; no public exploit identified at time of analysis and no CISA KEV listing, and the assessed impact is integrity-only (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), making this a genuine but moderate-priority issue rather than an urgent crisis. No vendor-released patch was identified at time of analysis.
JetLinks Community through 2.10.0 allows an authenticated user holding only query-level access to the transparent-codec resource to overwrite a product's codec provider and configuration via POST /device/transparent-codec/{productId}, because that save handler is missing the @SaveAction authorization annotation the hsweb-based framework uses to gate write operations. Successful abuse hands the attacker control over how transparent (raw pass-through) messages are decoded and encoded for every device belonging to the targeted product, an integrity-only impact with no confidentiality or availability loss (CVSS 4.0 7.1 High, PR:L). Exploitation requires a valid low-privilege account on the affected deployment, the flaw is network-reachable with low complexity, and no public exploit code has been identified at time of analysis with no CISA KEV listing.
Authenticated members of Yshopmall (through version 2.0.0) can exploit an insecure direct object reference (IDOR) in the member address API to read, modify, or delete other members' shipping addresses by simply changing the numeric address id. Because address identifiers are sequential, any registered account holder can enumerate /address/detail/{id}, /address/edit, and /address/del to harvest recipient names, phone numbers, and street addresses, reassign a victim's address to themselves, or wipe records outright. Exploitation requires a valid, low-privileged member session (CVSS 3.1 PR:L, AV:N) and no user interaction; there is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but the reliability of enumeration against default deployments makes it a genuine moderate-priority concern.
Memory exhaustion denial of service in FreeRDP 3.20.1 up to but not including 3.32.0 lets a malicious or compromised RDP server crash connecting clients by abusing drive redirection read requests. Per the CVSS v4 vector (PR:N, UI:P), the attack is remote and the client side of the protocol is unauthenticated, but exploitation is conditional: the victim must be induced to initiate an RDP session to the attacker-controlled server and must have drive redirection (rdpdr) active for the server to issue the offending IRP_MJ_READ requests. Impact is confined to availability (client memory exhaustion and crash) with no confidentiality or integrity effect, and no public exploit identified at time of analysis.
Denial of service in FreeRDP client versions 3.11.0 through 3.31.x allows a malicious or compromised RDP server to abort a connected client process: once the RDPGFX graphics channel negotiates the AVC444 or AVC444v2 codec, the server can send an otherwise in-bounds region rectangle with an odd width, which bypasses the missing even-width validation before YUV444 conversion and trips a CWE-617 reachable assertion. Per the CVSS vector (PR:N, UI:P), the attack requires no authentication on the client side, but the victim must initiate or accept the connection to the hostile server, and the resulting impact is confined to availability of that single client process - no confidentiality or integrity loss and no code execution. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so real-world risk is moderate and bounded by the requirement that the attacker controls the RDP server side.
Denial of service in the FreeRDP RDP client (versions 3.0.0 through 3.31.x) allows a malicious or compromised RDP server to crash a connecting client that has both smartcard emulation and smartcard redirection enabled: the server releases a smartcard-emulation context, establishes a new one, then issues SCardTransmit with the stale card handle, causing the client to look up the deleted parent context and hit a terminating WINPR_ASSERT. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) confirms this is network-reachable and unauthenticated, but it requires the victim to actively initiate a connection outward to the hostile server, and the impact is availability-only (client process abort, no code execution or data disclosure). No public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); exploitation also depends on the non-default smartcard emulation/redirection feature set being enabled.
Denial of service in FreeRDP clients: versions 3.29.0 through 3.31.x contain a double free (CWE-415) in the async-update message proxy that a malicious or compromised RDP server can trigger by sending a point-bearing PolygonSC or PolygonCB order followed by a second polygon order with numPoints set to zero, crashing the connecting client. Exploitation requires the victim to connect to an attacker-controlled server and to have launched the client with the non-default +async-update option, so default client configurations are not exposed; user interaction is needed to initiate the connection, and impact is limited to availability with no code execution, data disclosure, or integrity loss. There is no confirmation of active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis; the observed CVSS 4.0 score of 7.1 is driven by the availability impact.
NULL pointer dereference in FreeRDP's Remote Desktop Gateway (RDG) transport path affects client builds from 2.3.0 up to (but not including) 3.32.0, allowing an attacker who controls or has compromised the RD Gateway to crash a connecting client. The malicious gateway only needs to return an eight-byte, header-only PKT_TYPE_CLOSE_CHANNEL control packet; rdg_process_control_packet forwards the absent payload to rdg_process_close_packet without a NULL check, and the client dereferences it. The attacker must already occupy the gateway position (not an arbitrary remote host) and the user must initiate the outbound RDP session, so this is a bounded, availability-only denial of service - CVSS v4.0 base 7.1, with the independent assessment scoring it AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the gateway-position prerequisite constrains realistic abuse.
FreeRDP clients 2.3.0 through 3.31.x can be hung by a malicious or compromised RD Gateway that returns an incomplete HTTP chunked response and then cleanly closes the TLS connection. The bug is an infinite loop (CWE-835) in http_chuncked_read: zero-byte reads after a truncated chunk-size line or footer keep the decoder thread spinning, causing a client-side denial of service. This is a remote, unauthenticated availability-only issue per the provided CVSS vector (PR:N) but requires the victim to initiate the gateway connection (UI:P/UI:R); no public exploit identified at time of analysis.
FreeRDP clients running versions 3.27.1 through 3.31.x with the non-default Bitmap Cache V3 feature enabled can be crashed by a malicious or compromised RDP server that sends a crafted Cache Bitmap V3 order during connection setup. The NULL pointer dereference occurs because the client bitmap cache is accessed before it is initialized when the CBR3_DO_NOT_CACHE flag is set, leading to a denial-of-service (availability impact only, no confidentiality or integrity loss). Exploitation requires the victim to initiate an RDP connection to an attacker-controlled server and have enabled the Bitmap Cache V3 codec via /cache:codec:<rfx|nsc|jpeg>; default configurations are not affected, and no public exploit code has been identified at time of analysis.
A malicious or compromised RDP server can crash FreeRDP clients versions 3.11.0 up to but not including 3.32.0 when video redirection is enabled, due to an integer overflow in the handling of positive mapped-video coordinates. This moderate-severity denial-of-service requires the victim to connect to the attacker-controlled server and results only in client termination, with no code execution, data disclosure, or integrity loss. No public exploit code has been identified at time of analysis.
A local security-feature bypass in Visual Studio Code (all builds from 1.0.0 up to but not including 1.141.1) lets a low-privileged, already-authorized local attacker violate the editor's privilege boundaries under specific, hard-to-control conditions, with the integrity impact extending beyond VS Code's own security scope. Exploitation is not remotely reachable: it requires local access on the same host (AV:L), an existing low-privilege account (PR:L), a high-complexity precondition such as a race or particular environmental state (AC:H), and a victim action inside the editor (UI:R), which substantially constrains real-world abuse. There is no public exploit identified at time of analysis, no CISA KEV listing, and the vendor has released a patch, so this should be handled as a routine moderate-severity patch priority rather than an emergency.
Wazuh Manager 4.0.0 through 4.14.7 exposes the plaintext authd.pass agent-enrollment password to authenticated low-privileged API users who hold the agent:read permission-including the default readonly role-by querying the unmasked agent configuration endpoint for pseudo-agent ID 000. An attacker with such an API session can recover the secret and enroll rogue agents against the manager where password-based enrollment is configured. No public exploit identified at time of analysis, and CISA KEV does not list this issue; the vendor has released v4.14.8 as the fix.
Denial of service against the QAPI service in Commvault Cloud can be triggered by an authenticated low-privilege user who sends a crafted request that overflows a stack buffer on CommServe, Web Server, Command Center, or Index Server. Per the vendor's advisory, exploitation is limited to service availability - there is no data disclosure, data tampering, or code execution impact (CVSS:4.0 vector VC:N/VI:N/VA:H, score 7.1), and the independent CVSS:3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) agrees that only availability is affected. Valid credentials are mandatory and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority availability issue rather than an emergency, but Commvault has directed customers to a resolved maintenance release.
An authorization bypass in SAP ABAP Platform lets a low-privileged, authenticated user open the session manager in single transaction mode - including through the Fiori Launchpad (FLP) - and then send crafted requests that defeat restrictions the platform had previously enforced correctly. The weakness is a regression: an underlying SAP API change reintroduced a flaw that had already been fixed, so only ABAP Platform deployments carrying that regressed API (and not yet covered by SAP Note 3626303) are exposed. Impact is rated 7.1 with high integrity and low confidentiality consequences and no availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N); valid low-privilege credentials are mandatory, so this is an authenticated privilege-escalation-style issue rather than a pre-auth intrusion path, and no public exploit identified at time of analysis.
MongoDB Server sharded clusters running versions 9.0 before 9.0.4 or 8.3.0 before 8.3.13 allow an authenticated user with write privileges on a regular collection to bypass authorization checks for internal system namespaces by submitting a bulk write operation through the mongos router. This incorrect authorization (CWE-863) can result in unauthorized writes to system namespaces, with an impact ranging from low integrity to high availability depending on the namespace targeted. No public exploit identified at time of analysis; vendor patches are available in MongoDB Server 9.0.4 and 8.3.13.
Null pointer dereference in MongoDB Server's collection validation feature enables an authenticated user with write access to crash the mongod process, producing a denial-of-service condition. The attacker must be able to create or modify a collection validator (for example via create or collMod with a validator document containing the mishandled expression); the crash is then triggered when a document is inserted into that collection and evaluated against the validator. Impact is limited to availability - no confidentiality or integrity loss - and the issue is most exploitable in shared or multi-tenant deployments where write and schema-validation privileges are broadly granted; no public exploit code was identified at time of analysis, and this is a moderate-severity availability issue rather than a widespread emergency.
Memory exhaustion in MongoDB Server lets an authenticated user with only read-only privileges crash the mongod process by running an aggregation query whose $match stage nests internal schema-validation operators against documents containing array fields. Because those operators are accepted in user-supplied query filters despite being intended for server-side $jsonSchema validation, the match expression evaluator expands every combination of array elements without an adequate resource limit, so memory grows until mongod is OOM-killed. Impact is availability only - no data disclosure or modification - and the issue requires an authenticated account (CVSS PR:L) plus the right document shape, so it is a genuine but moderate-priority DoS rather than an emergency; no public exploit code or confirmed active exploitation has been identified at time of analysis, and CVSS 4.0 scores it 7.1 (attack vector network, high availability impact).
A null pointer dereference in Commvault's CvFWD network routing service crashes affected components, producing a denial-of-service condition limited to availability. The flaw is remotely reachable over the network but requires a low-privilege authenticated account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, assessed 7.1 severity), with no confidentiality or integrity exposure - no data is read, modified, or exfiltrated. Commvault has published a security advisory (CV_2026_10_5) directing customers to a resolved maintenance release covering CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the available intelligence. Because the impact is availability-only and gated behind authentication, the realistic risk is moderate rather than emergency-grade, though environments that expose CvFWD broadly or tolerate unplanned service restarts should prioritize patching.
An out-of-bounds write in Commvault's CvFWD network-communication daemon allows a low-privilege authenticated attacker who can reach the service over the network to crash it, producing a denial of service against the affected Commvault component. The flaw is availability-only (CVSS 4.0 7.1, VA:H with VC:N/VI:N) and offers no path to data disclosure or code execution; it affects Commvault Cloud deployments, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale, until the resolved maintenance release is applied. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
An integer overflow in CvFWD, the Commvault network-forwarding daemon used across Commvault Cloud deployments, lets a low-privilege authenticated attacker on the network crash or degrade the forwarding service, producing an availability-only denial of service with no confidentiality or integrity impact. All Commvault components that ship or communicate with CvFWD are in scope - CommServe, Web Server, Command Center, MediaAgents, Clients and HyperScale - so risk is highest in environments where these services are reachable from broad or untrusted network segments rather than restricted management networks. The vendor classifies this as a 7.1 (CVSS 4.0) issue requiring PR:L; there is no public exploit identified at time of analysis and no CISA KEV listing, and EPSS data was not provided, so the practical near-term driver is patch hygiene rather than active exploitation.
Authenticated privilege escalation in Omnispace's Agora Project before 26.10.0 allows any regular, non-administrative member to create new user accounts by directly invoking the user-edit action actionVueEditUser, which is missing the editRight() function-level authorization check that guards comparable administrative actions. The flaw is reachable over the network by an attacker who already holds a valid member login (CVSS vector PR:L, no user interaction required) and results in high integrity impact and limited confidentiality exposure, with the practical risk concentrated in self-registration-enabled, shared or multi-tenant deployments where member accounts are easy to obtain. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available in version 26.10.0, and the VulnCheck advisory classifies the weakness as broken function-level authorization (Authentication Bypass / Privilege Escalation).