SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted input that is incorporated into a SQL command, giving the attacker arbitrary control over the back-end database and effectively elevating their privileges on the farm. Only SharePoint Server Subscription Edition builds below 16.0.20326.20190 are affected, the attack requires a valid account on the target instance (CVSS PR:L) and no user interaction, so anonymous internet exploitation is not possible; environments already at or above the patched build are not exposed. Microsoft has shipped a fix and no public exploit code has been identified at time of analysis, with CISA SSVC recording Exploitation as none and Automatable as no, making this a credible but not emergency-tier priority that should be fixed on a normal patch cycle - the high CVSS score of 8.8 reflects total loss of confidentiality, integrity and availability once the injection is successfully driven.
Arbitrary code execution is possible in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) through an incorrect authorization check (CWE-863) that lets a low-privileged actor perform actions beyond their granted permissions and reach code execution, with no user interaction required. Rated CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the flaw is network-reachable and low-complexity, but the PR:L vector means the attacker must already hold a low-privilege position relative to ColdFusion - a valid low-level account or access to a reachable authenticated interface - rather than being fully anonymous; the changed scope indicates impact can extend beyond the initially vulnerable component. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the independent assessment rates it a genuine high-priority finding rather than an inflated score, so it warrants prompt patching given the code-execution impact.
Path traversal (CWE-22) in Microsoft Dynamics 365 Business Central lets an authenticated, low-privileged user escape an intended restricted directory through network-reachable functionality, with high confidentiality and integrity impact and a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The required precondition is a valid low-privilege account, so anonymous exploitation is not indicated, and no user interaction or special configuration is needed once that access exists; the exact vulnerable feature or endpoint is not identified in the available description. At time of analysis there is no CISA KEV entry and no public exploit code identified, and no EPSS score was supplied, so this should be treated as a high-severity, patch-now issue driven by its privilege-escalation potential rather than by observed exploitation.
Path traversal in Microsoft Dynamics Business Central (CWE-22) allows an authenticated user holding only low-level privileges to escape an intended directory boundary and elevate privileges over the network, carrying a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity and availability impact and no user interaction required. Because the vector requires PR:L, anonymous remote attackers cannot exploit this alone - the realistic threat is insiders or holders of compromised low-privilege accounts who already possess valid credentials plus network reach to the Business Central application endpoint. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the sole supplied reference is Microsoft's MSRC update guide, which is the authoritative source for fix details.
Remote code execution in OpenSSH for Windows (the Microsoft OpenSSH server component) can be triggered over the network by an unauthenticated attacker with no user interaction, according to the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N and a 9.8 base score. The flaw is a use-after-free that can lead to memory corruption and potential code execution or denial of service, but exposure is limited to Windows hosts where the optional OpenSSH Server feature is installed and listening, typically on TCP/22. No public exploit identified at time of analysis, and confidence is limited by single-source reporting; defenders should treat any network-exposed Windows sshd listener as high risk and restrict or firewall the SSH port pending patching.
Windows CD-ROM Driver (cdrom.sys) contains a buffer over-read (CWE-126) that can disclose kernel memory and, per the vendor's threat model, be exploited by an unauthenticated remote attacker to elevate privileges on unpatched Windows 10, Windows 11, and Windows Server builds. Our independent assessment keeps AV:N/PR:N/UI:N but raises attack complexity to High and reduces integrity/availability impact to Low, because exploitation requires reaching the driver's input-handling path and the over-read primitive mainly yields disclosure rather than guaranteed code execution; CISA SSVC records no observed exploitation, no public exploit identified at time of analysis, and EPSS is low at 0.89% (58th percentile). Microsoft has released fixed builds, so affected systems should be patched per the MSRC advisory.
Reflected cross-site scripting in the Vitess vttablet and vtcombo /twopcz HTTP debug endpoint allows a remote, unauthenticated attacker (per the supplied CVSS vector, PR:N) to inject script into the response by supplying crafted Action and dtid form values, which twopczHandler writes into a text/html response without HTML escaping. Successful exploitation requires operator interaction - a targeted operator must open the attacker-crafted request in a browser - after which the script runs with the vttablet debug origin and can read same-origin diagnostic endpoints exposing query, transaction, environment, variable, or profiling data present in that deployment. Affected deployments are those running Vitess before 23.0.5 or 24.0.x before 24.0.2 where the debug endpoint is reachable under the default allow-all ACL; no public exploit code was identified at time of analysis and there is no CISA KEV entry, and the supplied 9.8 score overstates impact because the assessed vector requires user interaction and bounds integrity impact to the reflected page content.
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-privileged SharePoint account to run code in the server's context and elevate privileges, with low attack complexity and no user interaction required. The flaw is rooted in improper control of code generation (CWE-94) inside SharePoint, and the assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that the authentication prerequisite is the primary barrier - an outside attacker must first obtain or compromise a low-privileged credential, after which confidentiality, integrity, and availability are all fully impacted. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, so this should be treated as a high-priority patch item rather than an actively exploited emergency; the specific vulnerable endpoint is not named in the description and should be confirmed against the Microsoft MSRC advisory.
Remote code execution in SAP S/4HANA's Manage Substitution/Validation Rules allows an authenticated attacker who already holds rule-maintenance business authorizations to submit crafted rule definitions that the rule-processing logic interprets as executable ABAP, resulting in full compromise of the affected system with high impact to confidentiality, integrity and availability (CVSS 9.9, Scope:Changed). Reaching the vulnerable code path requires an account provisioned with substitution/validation rule creation or maintenance privileges, so the practical barrier is authorization scope rather than authentication alone. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the vendor advisory (SAP Security Note 3805589) should be treated as urgent given the code-injection primitive and the privileged business role required.
Code execution risk in the Windows CD-ROM Driver arises when the driver processes attacker-controlled disc-image or CD-ROM data, leading to an untrusted pointer dereference (CWE-822) on affected Windows 10, Windows 11, and Windows Server builds. Microsoft has released fixed builds for every listed branch, and the available data shows no public exploit or observed in-the-wild exploitation, with EPSS at 0.84% (57th percentile); the vendor vector is 9.8, but the independent assessment rates AC:H because the network delivery path to the driver is not described and SSVC marks exploitation as none and automatable as no. The priority label is act_now, and the technical impact is total.
Heap-based buffer overflow in the Windows WebDAV component allows remote attackers to elevate privileges and potentially achieve full compromise of confidentiality, integrity and availability (CVSS 9.8). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is network-based with no authentication and no user interaction required, and the affected scope covers Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core installations, below the per-branch fixed builds published by Microsoft. The signals are strongly mixed: there is no CISA KEV entry and SSVC records Exploitation: none with Automatable: no, so no public exploit has been identified at time of analysis, and EPSS is modest at 0.84% (57th percentile); nevertheless technical impact is rated total and the vuln.today decision label is act_now with a vendor-released patch available. Whether exploitation requires an enabled, reachable WebDAV listener rather than a client-side connect-back is not described in the available sources.
Code injection in SQL Server Management Studio and Visual Studio Tools for Applications hosts allows remote, unauthenticated attackers to execute arbitrary code in the security context of the user who opens a crafted project, script, or database object. Rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), exploitation is gated by user interaction, so it depends on social-engineering a developer or DBA into opening attacker-supplied content rather than a zero-click or server-side trigger. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; the risk profile makes this a credible patch priority rather than an emergency.
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) allows a low-privileged SharePoint user to run arbitrary code on the server over the network. Per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), the attacker must already hold valid credentials for a SharePoint account - the vulnerable code path is not reachable by unauthenticated users - but no victim interaction is required, and the impact on confidentiality, integrity, and availability is total. The status of this vulnerability at the time of analysis is that no public exploit code has been identified; it is not listed in CISA KEV, so confirmed in-the-wild exploitation has not been established, though the low attack complexity and the common exposure of internet-facing SharePoint portals with broadly provisioned accounts make it a high-priority patch target.
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.20190) allows a low-privileged account holder to send crafted input over the network and corrupt heap memory, potentially gaining full control of the server's confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires only a valid low-privileged SharePoint account plus network reachability to the server - no user interaction - so any farm that issues accounts to untrusted or external users should treat this as high priority. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published a fixed build via its update guide (MSRC advisory CVE-2026-88163), making patching the straightforward path to closure.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.20326.20190, where a heap-based buffer overflow (CWE-122) can be triggered over the network by an attacker holding valid low-privilege credentials, with no user interaction required. A vendor patch is available, and intelligence sources indicate no public exploit identified at time of analysis and SSVC exploitation: none, so this is a credible but not emergency-tier priority primarily constrained by the authentication requirement.
SAP NetWeaver Visual Composer fails to enforce sufficient authorization checks within certain portal functionality, allowing a low-privileged authenticated user to invoke internal operations against a preconfigured remote system; depending on how that remote connection is configured, the attacker could fully compromise the destination system, with high impact on confidentiality, integrity, and availability. The flaw carries a CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting the scope change that carries impact from the vulnerable portal into the connected remote system. Exploitation requires a valid low-privileged portal session (not anonymous access) plus an existing preconfigured remote destination reachable through Visual Composer, and there is currently no public exploit identified at time of analysis.
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowing an attacker holding a valid low-privileged account to fully compromise the confidentiality, integrity, and availability of the affected deployment. On-premises installations are affected: SharePoint Server Subscription Edition below build 16.0.20326.20190, plus SharePoint Server 2019 and SharePoint Enterprise Server 2016, all of which are reachable over the network with the attacker needing only PR:L credentials and no victim interaction (AV:N/AC:L/PR:L/UI:N). There is no public exploit identified at time of analysis and CISA's SSVC assessment marks the issue as not automatable, so while impact is rated total, the authentication prerequisite and lack of automation keep this an above-average-priority rather than emergency-level issue; Microsoft has published a vendor fix.
Remote code execution in the Windows Presentation Foundation (WPF) component of Microsoft .NET and .NET Framework allows an unauthorized remote attacker to run arbitrary code after a victim interacts with a crafted XPS document. The flaw is an improperly implemented security check for URI handling (CWE-358): WPF's XPS hyperlink navigation can bypass its URI restrictions and reach an attacker-controlled ObjectDataProvider, resulting in code execution in the context of the hosting application. Affected runtimes include .NET 8 before 8.0.32, .NET 9 before 9.0.21, .NET 10 before 10.0.13, .NET 11 before 11.0.0-rc.2, multiple .NET Framework 3.5/4.6.2/4.7.x/4.8/4.8.1 builds, and Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4; vendor patches are available and there is no public exploit identified at time of analysis, with exploitation gated by mandatory user interaction (UI:R) and SSVC Automatable set to no.
Cross-site scripting (CWE-79) in the ASP.NET Core Blazor WebAssembly Server hosting component allows an unauthenticated, network-based attacker to execute arbitrary script in a victim's browser session by getting attacker-influenced input rendered into a web page without proper HTML neutralization. Affected are applications built on Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.0 through <10.0.13, as well as apps produced by the vulnerable Microsoft Visual Studio 2026 18.10.x (<18.10.4) and Visual Studio 2022 17.14.x (<17.14.42) toolchains. Exploitation is not automatable per CISA SSVC and requires mandatory user interaction (CVSS UI:R) - the victim must load or interact with the crafted content - and no public exploit code or active exploitation has been identified at time of analysis; vendor patches are available, so risk is primarily to unpatched, internet-facing Blazor WebAssembly deployments.
Remote code execution in ASP.NET Core via a code-injection flaw (CWE-94) allows an unauthenticated, network-based attacker to execute arbitrary code when a victim user interacts with crafted content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation requires an ASP.NET Core application that routes attacker-controlled input through a dynamic code-generation or evaluation path; the user interaction requirement (UI:R) is a significant limiting factor, preventing fully autonomous or wormable exploitation. No public exploit code was identified at the time of analysis, and the specific framework API or configuration exposing the injectable path is not described in the available data and should be confirmed against the Microsoft MSRC advisory.
Heap-based buffer overflow in the Windows SMB Client lets remote attackers elevate privileges on affected Windows hosts by compelling the target's SMB client to connect to an attacker-controlled server. The vulnerability carries a 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N), though it is a client-side direction flaw: the attacker must induce an outbound SMB connection rather than reach a listening service, and the sources do not describe the trigger, so the true degree of coercion or user interaction is unverified. CISA SSVC rates exploitation as 'none' with Automatable 'no' and total technical impact, EPSS is modest at 0.77% (55th percentile), and no public exploit code has been identified at time of analysis; Microsoft has released fixes.
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote low-privilege authenticated attacker to abuse an incorrect authorization check and gain elevated privileges. The flaw is network-reachable with low complexity and no user interaction, and it can result in high confidentiality, integrity, and availability impact (CVSS 8.8, PR:L). No public exploit was identified at time of analysis and CISA SSVC records exploitation as none and automatable as no; the vendor patch is available, and patched builds are not exploitable.
OS command injection in reNgine (through v2.2.0 and master commit de4199222cca5618f1255930ce78987e47d43a99) lets a user with scan engine configuration privileges inject arbitrary shell commands through the custom_headers field, executing them in the context of the reNgine server when the fetch_url or dir_file_fuzz tasks run. The input CVSS score of 9.8 assumes an unauthenticated attacker, but that overstates reachability: the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, since exploiting it requires an authenticated reNgine account able to create or edit scan engines, followed by starting a scan using the poisoned engine. Exploitation yields full confidentiality, integrity and availability impact on the host, and while a third-party GitHub repository referencing this CVE exists, EPSS is low at 0.74% (54th percentile) and there is no KEV listing; no public exploit code is confirmed in the provided data.
Out-of-bounds write in Microsoft .NET 8.0, 9.0, 10.0, 11.0, and Visual Studio 2022/2026 can allow an unauthenticated remote attacker to execute code when a victim processes crafted input, per CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). This is a genuinely high-priority, patch-worthy flaw but with important caveats that lower its real-world urgency relative to its 8.8 CVSS: exploitation requires user or application interaction to process the malicious input, and no public exploit has been identified at time of analysis. Vendor-released patches are available as .NET 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2, plus Visual Studio 17.14.42 and 18.10.4.
Remote code execution in Microsoft .NET allows an unauthenticated attacker to execute arbitrary code when a legitimate user opens or loads crafted content that triggers an out-of-bounds write in the runtime. The flaw affects a broad range of .NET Framework versions (3.5 through 4.8.1), modern .NET 8.0, 9.0, 10.0, and 11.0 preview, plus Visual Studio 2022 and 2026. No public exploit code or active exploitation has been identified at time of analysis, and CISA SSVC rates the issue as non-automatable, though the mandatory user interaction and wide deployment make patching critical for unpatched systems.
An origin-validation bypass in the Legacy Update ActiveX control (versions 1.12.0 through 1.13.1) allows a malicious webpage opened in Internet Explorer to call control methods that should have been blocked, letting the page enumerate update and system information, install updates without consent, display dialogs, or trigger a restart when a reboot is already pending. The flaw stems from the IsPermitted method returning S_OK for any hostname that is not on the permitted list instead of failing with E_ACCESSDENIED, and it requires the victim to visit an attacker-controlled page on a host where the vulnerable control is registered. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released Legacy Update 1.13.2 with a fix that sets E_ACCESSDENIED on non-permitted origins.
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a low-privileged account escalate to full control over the affected farm, with high impact to confidentiality, integrity, and availability (CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable over the network with low complexity and no user interaction, but it is not pre-authentication - an attacker must first obtain or already possess valid SharePoint credentials. Affected are deployments of SharePoint Server Subscription Edition 16.0.0 prior to build 16.0.20326.20190; patched builds are not exploitable. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none, and Microsoft has released a vendor fix, so this is a high-priority but not emergency patch.
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding only low-privilege credentials to elevate privileges over the network without any user interaction. The flaw is a privilege context switching error (CWE-270) affecting 16.0.0 builds below 16.0.20326.20190, and a vendor patch is available through the Microsoft Security Response Center. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable, so while technical impact is total, the practical risk is elevated rather than emergency-tier.
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-privilege account escalate to higher privileges over the network, because a SharePoint function performs an action without the required authorization check. Affected deployments are Subscription Edition builds below 16.0.20326.20190; patched builds are not exploitable. This is a credible mid-tier priority rather than a drop-everything emergency: exploitation requires an authenticated foothold (CVSS PR:L, so authentication requirements are confirmed as authenticated per vector PR:L), no user interaction is needed (UI:N), and CISA's SSVC assessment records exploitation as none and the flaw as not automatable, so no public exploit was identified at time of analysis and the barrier to mass exploitation is high. A vendor patch is available from Microsoft.
Privilege escalation in Microsoft SharePoint lets an authenticated, low-privileged user send crafted requests over the network and gain high-integrity read and write access across the affected deployment, yielding a CVSS v3.1 base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid credentials on the target farm, so anonymous or fully unauthenticated attackers cannot trigger it; the realistic threat population is existing users, compromised accounts, or attackers who can self-register on internet-exposed farms. No CISA KEV entry and no public exploit code were identified at time of analysis, and no EPSS score was supplied - although external intelligence is sparse, the low attack complexity, network reachability, and lack of user interaction make this a genuine prioritisation item for SharePoint administrators.
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that lacks a proper authorization check, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N) without any user interaction. Only attackers who already hold a valid low-tier SharePoint account - a standard site member, guest, or compromised credential - can exploit this over the network; a fully unauthenticated outsider cannot. No public exploit code and no CISA KEV entry were identified at time of analysis, but the missing-authorization pattern is attractive for lateral escalation once a foothold exists, making multi-tenant, extranet, and internet-facing SharePoint deployments with liberal low-privilege account provisioning the highest-risk environments.
Privilege escalation in Microsoft SharePoint allows an authenticated attacker with low-level privileges to gain elevated access over the network without user interaction. The vulnerability arises from improper access control (CWE-284) and is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), enabling high impact to confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV as actively exploited.
Command injection in MobSF v4.5.2 allows an attacker with access to the instance-and, for the /api/v1/scan path, a valid MobSF REST API key-to execute arbitrary shell commands via the /download_data/ endpoint, the /api/v1/scan REST API, or the Dynamic Analyzer ADB integration module (tests_common.py). The independent assessment scores this CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rather than the 9.8 in the input because API-key authentication is enforced and the ADB path requires an active Android emulator or device. No public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.71% (52nd percentile); MobSF is typically deployed internally, which reduces remote unauthenticated exposure.
Command injection in Visual Studio Code 1.0.0 through 1.141.0 allows an unauthenticated remote attacker to execute arbitrary code in the context of the editor when a developer opens attacker-controlled content such as a malicious workspace, folder, repository, or project configuration file. Exploitation depends on user interaction (a victim must open the crafted project), but is otherwise low-complexity with high confidentiality, integrity, and availability impact; no public exploit code has been identified at the time of analysis. Microsoft has released a vendor fix in Visual Studio Code 1.141.1.
Unauthenticated remote code execution affects the Windows DNS Server role across Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) as well as Windows 10 versions 1607 and 1809, driven by a heap-based buffer overflow (CWE-122) that a network attacker can trigger by sending crafted DNS messages to an affected host. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation is remote, unauthenticated, low-complexity and requires no user interaction once the DNS Server service is installed and reachable - making internet-exposed, forwarding or recursive resolvers the highest-risk deployments, while purely internal-only resolvers simply narrow the attacker population to those with network access. This is a genuine top-tier priority rather than a high-score-but-low-risk artifact, though no public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); Microsoft has released fixes through the MSRC update guide, so the primary exposure is unpatched hosts rather than a lack of remediation.
Use-after-free in Windows Network Load Balancing (NLB) lets an unauthenticated attacker positioned on the same adjacent network segment execute arbitrary code, with high confidentiality, integrity and availability impact (CVSS 8.8, AV:A/AC:L/PR:N/UI:N). Only systems with the optional NLB clustering role installed and configured are exposed; affected platforms include Windows 10 1607/1809 and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; EPSS is 0.65% (50th percentile), and CISA SSVC records exploitation as none with total technical impact and automatable behavior.
SQL injection in Microsoft Configuration Manager (MECM) lets an authenticated attacker with low-privilege network access execute arbitrary SQL against the site database and thereby elevate privileges, with high confidentiality, integrity, and availability impact (CVSS 8.8). The CVSS vector (AV:N/AC:L/PR:L/UI:N) means exploitation requires a pre-existing valid account on the network - fully unauthenticated attackers cannot reach the flaw - but no user interaction or special complexity is needed once such credentials or an authenticated session exist. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no active exploitation, while vendor patches for all affected builds are available.
Remote, low-complexity code execution is possible in Adobe Commerce, Adobe Commerce B2B and Magento Open Source through an incorrect authorization flaw (CWE-863) rated CVSS 9.8, allowing an attacker to act with the privileges of the current request context and escalate to arbitrary code execution without user interaction. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes network-reachable exploitation requiring no prior privileges, which is the strongest signal in the available data. No public exploit code and no CISA KEV entry were identified at time of analysis, and Adobe's only provided reference is advisory APSB26-153; defenders should note Adobe's wording about 'the context of the current user,' which may indicate an existing session or request context is required even though the vector claims PR:N.
Remote code execution in Visual Studio Code versions 1.0.0 through 1.141.1 allows an unauthenticated, network-positioned attacker to execute arbitrary code when a victim opens attacker-controlled content (e.g., a crafted workspace, folder, or repository), due to improper output encoding/escaping (CWE-116). Exploitation requires user interaction, and no public exploit code has been identified at time of analysis. The vendor has released a patch in version 1.141.1.
Authentication bypass in Microsoft .NET allows an unauthenticated, remote attacker to forge a cryptographic signature and have it accepted by applications that rely on the framework's signature-verification routines, potentially leading to unauthorized access or token misuse. The JWT Attack tag points to a token-signature validation weakness; exploitation requires the target application or user to process the attacker-supplied signed token (UI:R), which limits reachability for purely passive endpoints. Affected versions include .NET 10.0 before 10.0.402, .NET 11.0 before 11.0.100-rc.2, and the listed Visual Studio 2022 17.14.x/2026 18.10.x builds; vendor patches are available, and no public exploit identified at time of analysis.
Improper authentication in IBM MCP Context Forge prior to 1.0.2 allows remote, unauthenticated attackers to forge HS256-signed JWTs using a JWT_SECRET_KEY shipped in mcpgateway/config.py and .env.example, gaining full platform-administrator access without a database account. The attack requires two conditions to hold simultaneously: the gateway must still use the known shipped signing key, and the platform-admin bootstrap must be active (REQUIRE_USER_IN_DB=false with the token subject set to PLATFORM_ADMIN_EMAIL); because the documented production default for REQUIRE_USER_IN_DB is true, strictly default production deployments are protected, as are operators who rotated the secret before upgrading. Where both conditions are met, forged administrator tokens survive password rotation, account deletion, and session revocation, enabling administrative disclosure, modification, and service disruption; no public exploit code has been identified at time of analysis and the issue is fixed in 1.0.2.
Directory traversal in the iKuai8 management interface shipped on the IK-Q3000 Enterprise-grade Wi-Fi 6 router lets an attacker escape the intended file path and execute arbitrary code on the device; affected builds are Enterprise Edition <= iKuai8_3.7.23_Enterprise Build 202606021825 and Free Edition <= iKuai 8_4.0.304-beta. The CVE record scores this 9.8 with a PR:N vector (unauthenticated), but the public disclosure is explicitly titled 'authorized' path traversal and our independent assessment rates it PR:L, so a valid authenticated management session is most likely a prerequisite and is the key factor limiting real-world exploitation. There is no CISA KEV entry and no public exploit identified at time of analysis, and EPSS is low at 0.45% (38th percentile); exposure is further gated by network reachability to the router's administrative web service, so units with management bound to an internal/LAN interface are materially less exposed.
Path traversal in Fortinet FortiSIEM 7.5.0 can let a remote unauthenticated attacker execute unauthorized code or commands by sending specially crafted packets to the affected service. The CVSS vector shows network exploitation with low complexity, no privileges, and no user interaction, producing high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified in the provided intelligence; consult Fortinet advisory FG-IR-26-180 for the authoritative affected-version and remediation details.
Missing authorization in Visual Studio Code allows code execution in the context of the editor's local user when a victim opens attacker-controlled content, such as a malicious workspace, repository, or file; the flaw affects versions from 1.0.0 up to but not including 1.141.1. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) shows no prior authentication is needed on the target, but successful exploitation still hinges on the mandatory user-interaction step, and the resulting impact stays within the user's own session rather than crossing a privilege or scope boundary. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a credible patch-priority for developer endpoints rather than a drop-everything internet-facing emergency; Microsoft rates the fix as available.
Privilege escalation in HTMLy 3.1.1 allows a remote attacker to elevate from a low-privileged account or session to administrative control by abusing the get_feed function in the admin.php component. The supplied CVSS 3.1 score is 9.8 with PR:N, but the independent assessment applies PR:L because CWE-269 privilege-escalation issues realistically require some existing access; no CISA KEV or confirmed active exploitation is provided, and no public exploit was identified at time of analysis. Exposure is limited to HTMLy 3.1.1 installations where the admin interface is reachable, and keeping admin.php off the public internet substantially reduces risk.
Unauthenticated read, modification, and permanent deletion of stored credential records in Rapid7 Metasploit Framework through 6.5.4 is possible whenever the optional msf-ws REST API is running and network-reachable, because the PUT update_credential and DELETE delete_credentials handlers for /api/v1/credentials omit the warden.authenticate! call that every other route in Msf::WebServices::CredentialServlet performs before processing. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) is consistent with this: the two affected routes are reachable by unauthenticated remote attackers and allow full compromise of confidentiality and integrity of the credential store, which holds passwords, hashes, and private keys captured during shared team engagements. The practical limiting factor is deployment mode rather than the flaw itself - msf-ws is an optional component that must be explicitly started and exposed (default listener 0.0.0.0:8080), so Metasploit installations that never run the web service are not exposed; there is no public exploit identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV).
Unauthenticated access to administrative API endpoints in Esri Portal for ArcGIS can let remote attackers reach /portaladmin/local functionality that should require authentication, potentially exposing portal administration with high confidentiality, integrity, and availability impact. Exploitation is conditional - the independent assessment rates CVSS 3.1 as AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning high impact but dependent on unspecified portal configuration conditions, while the vendor input vector is 9.8 with AC:L - and no public exploit has been identified at time of analysis. Affected product is Portal for ArcGIS, tracked by CPE cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*; consult Esri's September 2026 bulletin for exact affected versions and fixes.
Unauthenticated remote code execution affects the SKYWORTH SK-WR6640X (AX1800M) Wi-Fi 6 dual-band fiber router running firmware V1.0.3, allowing a network-reachable attacker to run arbitrary code with full confidentiality, integrity and availability impact (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). Because the name of the vulnerable endpoint, protocol or feature is not disclosed, the practical limiting factor is reachability rather than credentials: on typical home deployments the affected service is LAN-facing, and only internet-facing management, a port-forward, or an exposed management interface would place it within reach of a remote attacker. Assessment signals are mixed - a maximum-severity score and a public disclosure write-up from the PRISMI-Team coexist with a low EPSS of 0.24% (14th percentile), no confirmed actively exploited (CISA KEV) status, and no public exploit code identified at time of analysis.
Authentication token leakage in GitLab CE/EE (all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2) allows an authenticated user who controls a Kubernetes agent to redirect the Kubernetes proxy to an unintended server, exposing sensitive authentication tokens. Exploitation requires user interaction and only affects instances using the GitLab Kubernetes agent/proxy integration; publicly available exploit code exists. This moderate-severity issue (CVSS 5.8) is not a top-tier emergency but should be patched by affected deployments.
Protection-mechanism bypass in Mozilla Firefox's DOM: Core & HTML component affects all versions prior to Firefox 158: attacker-controlled web content can defeat a security mitigation, but only after the victim loads the crafted page, which is the limiting prerequisite the CVE record's UI:N metric understates. Our assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) caps realistic impact at low confidentiality and integrity with no availability effect, well below the 9.8 headline score, and the bypass on its own defeats a mitigation rather than directly compromising the system, so meaningful impact likely requires chaining with a separate vulnerability. No public exploit code and no CISA KEV entry are associated with this CVE, and EPSS is just 0.20% (9th percentile), yet the vuln.today decision label is act_now - these sharply conflicting signals should be reconciled before prioritization rather than acted on by score alone.