Unauthenticated remote code execution affects the SKYWORTH SK-WR6640X (AX1800M) Wi-Fi 6 dual-band fiber router running firmware V1.0.3, allowing a network-reachable attacker to run arbitrary code with full confidentiality, integrity and availability impact (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). Because the name of the vulnerable endpoint, protocol or feature is not disclosed, the practical limiting factor is reachability rather than credentials: on typical home deployments the affected service is LAN-facing, and only internet-facing management, a port-forward, or an exposed management interface would place it within reach of a remote attacker. Assessment signals are mixed - a maximum-severity score and a public disclosure write-up from the PRISMI-Team coexist with a low EPSS of 0.24% (14th percentile), no confirmed actively exploited (CISA KEV) status, and no public exploit code identified at time of analysis.
Protection-mechanism bypass in Mozilla Firefox's DOM: Core & HTML component affects all versions prior to Firefox 158: attacker-controlled web content can defeat a security mitigation, but only after the victim loads the crafted page, which is the limiting prerequisite the CVE record's UI:N metric understates. Our assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) caps realistic impact at low confidentiality and integrity with no availability effect, well below the 9.8 headline score, and the bypass on its own defeats a mitigation rather than directly compromising the system, so meaningful impact likely requires chaining with a separate vulnerability. No public exploit code and no CISA KEV entry are associated with this CVE, and EPSS is just 0.20% (9th percentile), yet the vuln.today decision label is act_now - these sharply conflicting signals should be reconciled before prioritization rather than acted on by score alone.
Firefox builds prior to 158 mishandle a pointer in the DOM Notifications component, producing undefined behavior that attacker-controlled web content can drive into memory corruption, with possible disclosure of data and, at the high end of the assessed range, code execution in the browser. The attack is remote and needs no credentials, but it is not something an attacker can send at a server: the victim must load a malicious or compromised page in an affected Firefox version, which the independent assessment reflects by requiring user interaction. No public exploit code has been identified at time of analysis, EPSS sits at 0.19% (8th percentile) and the issue is not in CISA KEV, yet vuln.today labels it act_now on the strength of the 9.8 severity and the type of primitive involved.
A logic error in the Xen hypervisor's re-worked mitigation for Zenbleed (CVE-2023-20593 / XSA-433) leaves the AMD DE_CFG 'chicken-bit' workaround unset precisely when it is required, potentially allowing a guest to leak stale vector-register data across privilege boundaries on AMD Zen2 hosts. Only systems running a Xen build that contains the reworked workaround (addressed by XSA-515) on vulnerable AMD Zen2 processors are affected, and the attacker must already have code execution inside a guest domain on that same host. This is a local, microarchitectural-timing-dependent issue with no public exploit identified at time of analysis and a low EPSS score (0.16%), so the 9.8 network-vector CVSS rating supplied in some feeds materially overstates the real exposure. Per the authoritative assessment, the true profile is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N.
Privilege escalation in Adobe Experience Manager (AEM) allows an authenticated, low-privileged user - an author or contributor-level account - to abuse an Improper Restriction of XML External Entity Reference (XXE, CWE-611) in XML parsing and thereby read local files and reach internal resources well beyond their intended permissions, crossing a security boundary as reflected by the scope-changed CVSS 9.6 rating. The vector is network-reachable with no user interaction required (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), so the only real precondition is obtaining valid low-tier credentials, which makes author instances and deployments with broadly provisioned low-privilege accounts the highest-risk exposure. No public exploit code has been identified at time of analysis, and builds updated past the affected ranges are not exploitable.
RClone Manager versions prior to 0.2.7 start their bundled local rclone rcd engine on 127.0.0.1:51900 without authentication and with a wildcard CORS origin, so any web page the user visits while the daemon is running can issue cross-origin requests to that local API using the user's operating-system privileges. An attacker who convinces a user to open a malicious or compromised page can therefore read configured storage credentials and potentially access, modify, upload, or exfiltrate locally stored files and files reachable through the user's configured remotes; the advisory's possible command-execution impact is unconfirmed. Exploitation requires the local engine to be actively running and the user to load attacker-controlled content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6); there is no public exploit identified at time of analysis, and the vendor-released patch is 0.2.7.
Incorrect authorization in Adobe ColdFusion 2023 (through update 2023.0.25) and ColdFusion 2025 (through update 2025.0.13) allows an authenticated low-privileged attacker to bypass security controls and gain unauthorized write access, enabling modification of protected resources. The CVSS vector indicates network reachability, low attack complexity, no user interaction, and a changed scope, with the primary impact being high integrity loss and low confidentiality loss; no public exploit code or active exploitation has been identified at the time of analysis. This is assessed as a genuinely high-priority issue due to the ease of exploitation once a low-privilege foothold is obtained.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) stems from an incorrect authorization flaw (CWE-863) in a component that is restricted to the administrative network zone by default, letting an attacker who can reach that zone bypass authorization checks and execute code in the context of the current user without authentication or user interaction. The 9.6 CVSS score reflects a scope-changed (S:C) impact in which the compromised component can affect resources beyond its own security boundary, but the adjacent-network vector (AV:A, PR:N, UI:N) means the real-world exposure hinges on segmentation: organizations that properly firewall the ColdFusion administrative interface from ordinary users are largely insulated, while flat networks, exposed admin interfaces, or an existing internal foothold remove the only barrier. No public exploit code or confirmed active exploitation was identified at time of analysis.
A use-after-free in Mozilla Firefox's Networking component can be escalated into a sandbox escape, meaning a malicious page can corrupt freed memory and break out of the browser's content-process sandbox to reach higher-privileged code. Affected are Firefox builds prior to 158 and Firefox ESR builds prior to 153.5; no authentication is required, but exploitation depends on the victim navigating to attacker-controlled web content (UI:R), consistent with the assessed CVSS:3.1 vector of 9.6 and the SSVC 'not automatable' rating. Vendor-released patches exist in Firefox 158 and Firefox ESR 153.5; at time of analysis there is no public exploit identified, no CISA KEV listing, and no confirmed in-the-wild activity.
Sandbox escape and site-isolation bypass in Mozilla Firefox allow unauthenticated remote attackers to break the browser's security boundary by triggering a use-after-free in the Networking component. Affected are Firefox versions before 158 and Firefox ESR before 153.5; exploitation requires the victim to load attacker-controlled web content, meaning no autonomous trigger exists. No public exploit identified at time of analysis, though the 9.6 CVSS score and total technical impact warrant urgent patching.
Heap buffer overflow in ANGLE, Chrome's graphics translation layer, allows a remote attacker to potentially execute arbitrary code outside the browser sandbox on Android. Chrome on Android builds prior to 155.0.8059.79 are affected, and the attack requires no authentication (PR:N) but does require the victim to render attacker-controlled web content (UI:R), with a CVSS base score of 9.6 and a scope change indicating sandbox-escape impact. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and SSVC rates exploitation as 'none' with automatable 'no', although technical impact is rated total and Google classifies the issue as Critical (Chromium security severity: Critical).
Mozilla Firefox before 158 contains a site-isolation weakness in the DOM Web Authentication component that can let attacker-controlled web content bypass intended authorization boundaries, with high confidentiality and integrity impact. Exploitation requires the victim to interact with malicious or compromised web content (UI:R); the attacker needs no authentication, and no public exploit code was identified at time of analysis, with EPSS at 0.22% (12th percentile). Mozilla fixed the issue in Firefox 158, and the referenced advisories should be used to confirm update paths.
Use-after-free in the Chrome Browser process before version 155.0.8059.79 allows a remote attacker to execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. Google rates this Chromium security severity Critical, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects confirmed high confidentiality, integrity and availability impact with a sandbox-escape scope change; only user interaction - opening the malicious page - is required, and no authentication or prior access is needed. At the time of analysis there is no CISA KEV listing and no public exploit code identified, although weaponization of Chrome browser-process use-after-frees is a realistic near-term concern given the sandbox-escape payoff. Vendor patch: Google shipped a fix in the 155.0.8059.79 stable channel release.
Use-after-free in Google Chrome's FileSystem component (CWE-416) lets an unauthenticated remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in any build prior to 155.0.8059.79. The 9.6 CVSS score is driven by the scope change (S:C) that models the sandbox escape plus high confidentiality, integrity and availability impact, yet exploitation requires mandatory user interaction (UI:R) and CISA's SSVC rates the attack non-automatable with exploitation status 'none', while Google itself assigns only Medium severity - sharply conflicting signals that should be reconciled before prioritization. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Remote code execution outside the sandbox in Google Chrome allows an unauthenticated attacker to execute arbitrary code on a victim's system by convincing them to open a crafted HTML page that loads a malicious PDF, affecting Chrome versions prior to 155.0.8059.79 on all platforms. This is a use-after-free (CWE-416) in the PDF component with a Critical Chromium severity and an assessed CVSS of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Exploitation requires user interaction, and no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile), and the vendor has released a patch (155.0.8059.79).
A use-after-free in the Core component of Google Chrome allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Affected builds are those prior to 155.0.8059.79, per the vendor advisory (EUVD's affected-version data lists the same 155.0.8059.79 threshold). Exploitation requires unauthenticated remote delivery with user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) and is rated Critical by Chromium; there is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis, though the SSVC Technical Impact rating of "total" and the scope-changing (S:C) sandbox-escape impact make prompt patching important. Note a platform discrepancy: the description specifies Chrome on Android while the cited vendor reference is a desktop stable-channel update, so the exact affected platform should be confirmed against the advisory.
Use-after-free in Google Chrome's network component allows remote attackers to execute arbitrary code outside the sandbox by delivering crafted network traffic to versions prior to 155.0.8059.79. Exploitation requires a victim to interact with attacker-influenced content (UI:R) but no authentication (PR:N), and the vulnerability carries a CVSS score of 9.6 (Critical). Although no public exploit code or active exploitation has been identified at time of analysis, the severity and potential for full system compromise warrant immediate patching.
Sandbox escape in Mozilla Firefox before 158 and Firefox ESR before 153.5 stems from uninitialized memory handling in the DOM Web Serial component. Unauthenticated remote attackers can induce a victim to load crafted web content that triggers the flaw and escapes the browser sandbox, with high confidentiality, integrity, and availability impact; user interaction is required. The issue is rated CVSS 9.6, but EPSS is only 0.19% and no public exploit was identified at time of analysis.
A sandbox escape in Mozilla Firefox's Networking component allows unauthenticated remote attackers to break out of the browser's security sandbox and potentially execute code on the host when a victim loads attacker-controlled web content. The vulnerability stems from incorrect boundary conditions (CWE-119) and carries a CVSS score of 9.6, though exploitation requires user interaction (UI:R) and the sandbox escape alone must be chained with a separate content-process code-execution primitive for full host compromise. No public exploit code has been identified, and the EPSS score is low at 0.19% (8th percentile); patched versions are Firefox 158 and Firefox ESR 153.5.
A sandbox escape in Mozilla Firefox's DOM Content Processes component lets a remote, unauthenticated attacker break out of the content-process sandbox if a victim merely renders attacker-controlled web content in any Firefox build prior to 158 (CVSS 3.1 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Because the score is scope-changed, a successful escape grants impact outside the sandboxed content process - high confidentiality, integrity and availability effects on the host rather than on the page alone - but in practice the escape generally has to be paired with a separate content-process code-execution flaw to convert the boundary crossing into full code execution. There is no confirmed active exploitation (the issue is not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.19% (8th percentile), and the mandatory user interaction of loading the malicious page is the main practical constraint on real-world exploitation.
Sandbox escape in Mozilla Firefox on Windows (Widget: Win32) lets attacker-controlled web content break out of the browser sandbox when chained with a separate content-process compromise, yielding high confidentiality, integrity, and availability impact. It affects Firefox builds before 158 and Firefox ESR before 153.5, with a CVSS 3.1 score of 9.6 that requires user interaction (UI:R) but no authentication (PR:N). No public exploit was identified at time of analysis, and EPSS is low at 0.16% (5th percentile), so the high severity and low observed exploitation signals diverge sharply.
Sandbox escape in Google Chrome desktop builds prior to 155.0.8059.79 allows an attacker who can already run a program on the target host to abuse an incorrect authorization check in Chrome's Updater component and execute arbitrary code outside the browser sandbox, with high impact to confidentiality, integrity and availability plus a scope change across the sandbox boundary. The independent assessment scores this CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, meaning a pre-existing low-privileged local foothold and user interaction are both required, and CISA's SSVC rates the issue non-automatable, so opportunistic mass exploitation is unlikely. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has shipped a vendor patch in Chrome 155.0.8059.79.
A double-free in Dragonfly's RDB stream loader (OpaqueObjLoader::CreateStream in src/server/rdb_load.cc) lets a remote, unauthenticated attacker corrupt the allocator, crash the server, and potentially execute code as the Dragonfly service account by sending a crafted serialized stream to the RESTORE command. All Dragonfly builds prior to the 1.40 fix are affected, and exposure is highest because Dragonfly ships with authentication disabled by default (no requirepass or ACLs), so network reachability to the client port is the only real precondition (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; the upstream advisory scores it 9.6 with an AV:A/S:C vector). No public exploit code was identified at time of analysis and the issue is not tied to a CISA KEV entry, but the trigger is a single crafted RESTORE payload and the upstream fix has not yet been mapped to a published release, so unpatched, internet-reachable instances should be considered urgent.
Arbitrary file overwrite in Wazuh Manager (3.9.0 through versions prior to 4.14.8) lets an attacker who already controls an enrolled cluster worker node corrupt protected master-side files - including ossec.conf and agent.conf - by abusing a trailing-slash basename path-validation bypass and the lack of extra_valid enforcement in MasterHandler.process_files_from_worker. Because the manager runs as root and pushes configuration out to its fleet, the overwritten files escalate into root-level remote code execution on the manager and on every connected agent, which is why the vulnerability carries a CVSS 4.0 base score of 9.4 (independent CVSS 3.1 assessment: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The PR:H prerequisite is the key limiter: the attacker must already control a worker node that is enrolled and syncing with the master, so this is not anonymously reachable from the internet, standalone (non-clustered) managers do not expose the vulnerable path, and no public exploit code had been identified at time of analysis.
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU families allows an attacker to have malicious JavaScript run in the browser session of a plant engineer who imports a booby-trapped CSV trace file. The flaw is CWE-79: visual-marker data inside imported CSV trace files is not validated or sanitized before it is rendered on the controller's Trace page, so script embedded in that field executes in the web-server origin once the file is opened. Exploitation is not autonomous - per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) it is unauthenticated at the network layer but requires user interaction (UI:R) and a victim holding the 'Read diagnostics' function right, and the resulting script can perform PLC operations through the web server limited to that user's authorization; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). The severity is high (CVSS 4.0 base 9.4; assessed 3.1 10.0 with scope change) because a successful script can reach high-integrity PLC operations from the controller's own trusted web session.
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows a remote attacker to place persistent JavaScript into a vulnerable form field, which then executes in the browser of any user who browses to the page rendering that field - per the vendor vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (9.3), the injection step is unauthenticated, but the victim must subsequently visit the affected page, so this cannot fire fully automatically. Because the scope is changed (S:C) and confidentiality and integrity impacts are both High, a successful exploit can cross a trust boundary and yield session or account control over the victim rather than merely degrading the page, though availability is unaffected. There is no confirmed active exploitation (the issue is not in CISA KEV) and no public exploit identified at time of analysis; no EPSS score was supplied with this dataset, so that signal is unavailable.
Incorrect privilege assignment in Docker Hub's account-to-organization conversion feature lets an authenticated user bind a personal access token they control to a different Docker Hub account without the token secret ever being rotated or revoked. The unchanged PAT then continues to authenticate successfully - now as the recipient user - granting pull, push, and delete operations, within its existing scopes, across every repository that user can access, including organization repositories. Docker rates this 9.4 under CVSS 4.0 and our independent assessment characterizes it as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, but exploitation is not unauthenticated: the attacker must already hold a valid Docker Hub account and a PAT, and the damage is bounded by that token's scopes; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1500 Software Controller CPUs lets attacker-controlled JavaScript execute in a privileged operator's browser session after that user is social-engineered into importing a crafted trace file and its unsanitized comment fields are rendered on the Trace page (reported CVSS 4.0 base 9.4; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Because the script runs inside the victim's authenticated session, it can perform PLC operations through the same web server within the scope of that user's authorization, so impact is bounded by the victim's privileges rather than by the attacker's. Exploitation is gated by user interaction and by a reachable/enabled CPU web server, and the victim must already hold the 'Read diagnostics' function right; no public exploit code or CISA KEV entry is associated with this CVE in the available data (no public exploit identified at time of analysis).
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely related ET 200SP, Drive Controller, Open Controller and S7-1500 Software Controller) CPU causes attacker-supplied JavaScript to execute inside the victim engineer's authenticated browser session and can issue PLC operations within that user's own authorization scope. Exploitation is not automated and not a mass-exploitation threat: it requires the CPU web server to be enabled, a victim who holds the 'Read diagnostics' function right, and successful social engineering into a manual file import (UI:A per the CVSS vector, which also carries PR:N, meaning the attacker needs no credentials of their own). The severity is high (CVSS 9.4 in the vendor's CVSS 4.0 assessment; our independent 3.1 assessment scores it AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but this is a genuine high-severity issue rather than an imminent mass-exploitation threat - no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was provided in the source data.
Stored cross-site scripting (XSS) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows an attacker who can write to a vulnerable form field to persist malicious JavaScript that executes in a victim's browser when that page is rendered, potentially hijacking an admin or shopper session and gaining elevated access or control over the victim's account. The vendor vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, 9.3 Critical) is driven by the scope change and high confidentiality/integrity impact, but the attack is not self-contained: it requires a second victim (UI:R) to browse the page that renders the payload, and our independent assessment assumes a low-privileged writer account (PR:L) rather than the vendor's unauthenticated (PR:N) reading, which must be confirmed against APSB26-153. No CISA KEV entry and no public exploit code were identified at time of analysis; availability is unaffected (A:N), so impact is bounded to the confidentiality and integrity of the victim's session and account data.
Reflected cross-site scripting in Adobe Experience Manager allows remote attackers to inject malicious scripts into a web page, requiring user interaction (UI:R) and no authentication (PR:N), which could lead to session hijacking or privilege escalation if the victim is an authenticated AEM author or administrator. Affected deployments include AEM 6.5 up to 6.5.25, AEM as a Cloud Service up to 2026.9.28187, and AEM 6.5 LTS up to SP3. The vendor assigned a CVSS of 9.3, but our independent assessment scores it lower (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) because confidentiality and integrity impacts are limited; no public exploit has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager allows attackers to inject malicious scripts into vulnerable form fields, which execute in a victim's browser when they visit the poisoned page, potentially leading to session hijacking or elevated access. Affected versions include AEM 6.5 LTS up to SP3 and AEM 6.5 up to 6.5.25. The vendor CVSS score is 9.3 (PR:N), but independent assessment indicates the injection step may require access to a form-authoring or submission surface (PR:L) and victim interaction is mandatory; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5 LTS (through SP3) and AEM 6.5 (through 6.5.25) lets an attacker persist a malicious JavaScript payload into a vulnerable form field, which then executes in the browser of any user who views the page rendering that field, yielding high confidentiality and integrity impact with a scope change into the victim's session. Adobe rates this Critical at CVSS 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), while independent assessment scores it lower on the privilege axis at PR:L, reflecting the practical requirement that the attacker be able to submit or store content before triggering execution; all versions converge on UI:R, since the payload remains dormant until a victim browses the affected page. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the high CVSS score and the authoring-console reachability of AEM make prompt patching per Adobe advisory APSB26-152 advisable.
Unauthenticated remote code execution affects Omnispace Agora Project deployments running versions before 26.10.0, where attacker-controlled values are written unescaped into the PHP configuration file config.inc.php through the installer paths File::updateConfigFile() and DbInstall::dbControl(), and where an SQL injection enabled by PDO::ATTR_EMULATE_PREPARES (which permits stacked queries) lets an attacker re-trigger the installer and inject arbitrary PHP that executes on the underlying host. Exploitation requires only a reachable vulnerable instance with no credentials or user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; vendor score 9.3 under CVSS v4.0), and no public exploit code has been identified at time of analysis, so risk is concentrated in internet-facing, unpatched installations.
Unauthenticated remote code execution in Xorbits Xoscar through 0.11.2 lets any attacker who can reach the actor-pool TCP channel run arbitrary code as the server process, because the receive path hands raw network bytes straight to cloudpickle.loads() before the message type is validated. The CVSS 4.0 vector (AV:N/PR:N/UI:N, 9.3) confirms the bug is remotely reachable and requires no credentials or user interaction, so any deployment exposing an actor pool on a routable interface is exposed at default configuration; impact is worst where the process runs as root, typical of GPU-node deployments. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exposure is bounded by network reachability - installations that bind the actor-pool port to localhost or keep it on an isolated segment are not remotely exploitable.
Unauthorized SCIM API access in Perforce Helix Authentication Service (HAS) versions 2022.1 through 2025.2 arises from a shipped default bearer token that the installer and configuration script fail to rotate, enabling remote, unauthenticated attackers who know the token to perform user and group provisioning operations. Chaining this with CVE-2026-61834 in the scim-patch dependency allows server-side prototype pollution and, under Node.js 24/Express with specific gadget chains, remote code execution. The underlying defect is removed in HAS 2026.1; no public exploit code has been identified at time of analysis.
Reflected cross-site scripting in TanStack Start server functions lets an unauthenticated attacker craft a server-function URL that causes the application's own origin to return attacker-controlled HTML, which executes in the browser of any visitor who opens that URL and can then read same-origin data or issue requests with the victim's authority. The flaw affects @tanstack/start-server-core from 1.143.12 through versions before 1.169.39, plus @tanstack/react-start before 1.168.60, @tanstack/solid-start before 1.168.57, and @tanstack/vue-start before 1.168.56 (TanStack Router before release-2026-09-30-1747). Exploitation is unauthenticated (PR:N) but requires victim interaction (UI:R) - the target must open the attacker-supplied URL - and no public exploit code or active exploitation has been identified at time of analysis, so the 9.3 score reflects the high confidentiality and integrity impact of the same-origin script injection rather than confirmed in-the-wild attacks.
Unauthenticated remote attackers can bypass the security controls that are supposed to be enforced during session establishment with an OpenText EnCase SAFE Agent, allowing an unauthorized connection to be created to the agent without any credential or user interaction (CVSS 4.0 base score 9.3; vector reports PR:N, UI:N, AT:N). The affected deployments are OpenText Endpoint Investigator, Endpoint Forensics & Response, Information Assurance, and Endpoint Security installations that embed the SAFE Agents component, with default agents whose listening interface is reachable from an untrusted network facing the greatest risk. No public exploit code has been identified and the flaw is not confirmed as actively exploited (CISA KEV), but the pre-authentication, network-reachable bypass with full confidentiality, integrity, and availability impact makes this a genuine high-priority issue rather than a high-CVSS paper tiger.
Arbitrary file read and write on the Metabase server is possible through H2-backed native queries and actions in Metabase 1.55.0 up to (but not including) 1.58.16, 1.59.13, 1.60.9, and 1.61.4. An authenticated user who has been granted permission to run native SQL queries or SQL actions can embed host-facing H2 built-in functions such as FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, and LINK_SCHEMA inside otherwise ordinary SELECT/CALL statements, allowing them to read or overwrite files on the Metabase host or attach external databases; because Metabase's default bundled sample database is H2, this attack surface is present in default installations without any extra configuration. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the fixed versions are published and the vulnerable privilege is a common analyst-level grant, making this a genuine high-priority issue rather than an inflated score.
Unauthenticated remote command execution in Commvault CVFS, the file system component shipped with Commvault Grid (HyperScale X) deployments and exposed through Commvault Cloud, allows a network-reachable attacker to execute commands on the underlying system with high impact to confidentiality, integrity, and availability - Commvault scores it 9.3 under CVSS 4.0. Per the vendor CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) the issue is remotely triggerable without credentials or user interaction, which makes any internet- or broadly reachable CVFS endpoint a priority exposure; the advisory does not name the specific feature, protocol endpoint, or configuration path that must be reached. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and a fixed maintenance release is available from Commvault.
A path traversal flaw in Adobe ColdFusion's Remote Development Services (RDS) component allows arbitrary file system read outside the intended directory scope, exposing configuration files, credential stores and source code on servers where RDS is reachable. Affected builds are ColdFusion 2023 up to and including 2023.0.25 and ColdFusion 2025 up to and including 2025.0.13; per the CVSS vector (PR:N/UI:N) no credentials or user interaction are required once RDS is accessible, so the practical gate is deployment mode rather than authentication. Adobe scores this 9.3 Critical (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), but our reassessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N because RDS is network-reachable on exposed servers while the integrity and availability components are not supported by the path-traversal-to-file-read primitive; no public exploit code and no confirmed active exploitation were identified at time of analysis, and real-world exposure is limited to dev, staging or legacy servers that have left RDS enabled (Production Secure Profile disables it automatically).
Local privilege escalation in Colorful iGameCenter 2.0.0.82 allows an attacker who already holds a low-privileged session on the host to gain full control of the machine by abusing the AMDRyzenMasterDriver.sys kernel driver. The driver's Dispatch Handler passes an attacker-supplied SystemBuffer straight into MmMapIoSpace, so a crafted IOCTL lets a user-mode caller map arbitrary physical memory, breaking the kernel/user boundary and yielding high confidentiality, integrity, and availability impact across the security scope. Exploitation is strictly local (the assessed vector is AV:L/AC:L/PR:L/UI:N/S:C with all impacts High), no public exploit code has been identified at time of analysis, and the vendor was contacted but did not respond, so no vendor patch is confirmed.
Cross-site scripting in Microsoft Exchange Server (CWE-79) lets an unauthenticated, network-positioned attacker inject script that executes in the browser context of an Exchange web user, enabling spoofing of trusted Exchange/OWA content and access to data and actions available to that victim's session. The flaw carries a 9.3 CVSS base score (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N): no attacker credentials are required, but exploitation depends on the targeted user rendering the crafted content, so it cannot be triggered silently or automatically. Every deployment running below the fixed builds - Exchange Server 2016 CU23, 2019 CU14 and CU15, and Subscription Edition RTM - is exposed; no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records no observed exploitation activity and no automatable attack path.
Privilege escalation in Dockhand before 1.0.50 allows an attacker who holds administrative rights in a different tenant of a shared OIDC provider such as Microsoft Entra ID to obtain Dockhand administrator access by recreating the group Dockhand maps to its admin role and signing in, because the application fails to validate the OIDC iss, aud, nonce, and exp claims. The issue is rated CVSS 4.0 9.2 (critical) on network reach, no privileges required on Dockhand itself, no user interaction, and full confidentiality, integrity, and availability impact once admin access is obtained, though exploitation requires a shared multi-tenant IdP deployment and knowledge of the mapped group name, so single-tenant or isolated IdP deployments are not affected. No public exploit identified at time of analysis and the vulnerability is not in CISA KEV; a vendor patch is available in 1.0.50.
Arbitrary code execution is achievable in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source by an attacker who already holds a high-privilege backend account, exploiting an improper input validation flaw (CWE-20) that a single crafted, network-delivered request can trigger without any user interaction. The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects complete compromise of confidentiality, integrity, and availability with a changed scope, but the PR:H metric means the attacker must first obtain administrative or equivalently privileged credentials - stolen admin or API credentials, or a pre-existing privileged foothold. Adobe reported the issue directly (APSB26-153); no public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV) at time of analysis, so the practical risk is concentrated in organizations whose admin panels are internet-exposed with weak credential controls.
Arbitrary code execution in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an unauthenticated remote attacker to execute code in the context of the ColdFusion service account. The flaw is a code-injection issue (CWE-94) rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no credentials, no user interaction, and no unusual complexity are needed - only network reachability of a vulnerable instance. No public exploit code or confirmed active exploitation was identified at time of analysis, but given the severity and the historical targeting of ColdFusion, this warrants expedited patching.
Arbitrary code execution in Adobe Experience Manager (AEM) allows an attacker with a high-privilege account (e.g., administrator or author-level) to run malicious code on the server, potentially affecting resources beyond the vulnerable component due to changed scope. The improper input validation flaw (CWE-20) affects AEM as a Cloud Service ≤2026.9.28187, AEM 6.5 ≤6.5.25, and AEM 6.5 LTS ≤6.5 LTS SP3, and requires network access but no user interaction. No public exploit or active exploitation has been identified at time of analysis; patches are available per the Adobe advisory (apsb26-152).
FearlessCMS 0.1.2b and earlier lets an authenticated administrator supply an arbitrary Git repository URL to the dashboard updater (admin/updater-handler.php → perform_update → update.sh), which clones the repository and overwrites the live plugins/, admin/, and includes/ directories without validating the repository's identity, signatures, or contents. Because router.php allows existing PHP files under plugins/ to be executed by the PHP built-in development server - the project's documented run mode - the injected update content runs as arbitrary PHP under the web server account and can persist as a backdoor, yielding full compromise of confidentiality, integrity, and availability. Exploitation is gated on high-privilege (administrator) authentication and affects only versions at or below 0.1.2b; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was provided.
Access control bypass in IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 allows an unauthenticated remote attacker to call gRPC service methods while evading configured Liberty access controls. This is a genuine high-priority issue by multiple signals, with CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), but practical impact is deployment-specific: it matters mainly where gRPC services are deployed and method-level access controls are relied upon. No public exploit identified at time of analysis and no CISA KEV confirmation was provided.
Authentication bypass in Omnispace Agora Project before 26.10.0 allows anyone holding a user's stored bcrypt password hash to log in as that user - including administrators - by replaying the hash inside the legacy AGORAP_LOG/AGORAP_PASS cookies, never needing the plaintext password. The flaw maps to CWE-836 (use of a password hash instead of the password) and is scored 9.1 in CVSS 4.0 with PR:N, meaning no application login is required to launch the attack; however, the practical gate is a prerequisite credential disclosure, since the attacker must first obtain a valid hash from the Agora credential store (database compromise, exposed backup, or SQL injection), which is why the AC:H assessment applies. The vendor addressed it in release 26.10.0 (vendor-released patch: 26.10.0); no public exploit code has been identified at time of analysis and no EPSS score was supplied.