Broken access control in SAP CLA Assistant lets any authenticated low-privilege user read the CLA signature records of an organisation they do not administer by supplying that organisation's ID to the admin API endpoint that retrieves signature records; the missing authorization check on the ID-based lookup path exposes contributor names and other signature metadata (CVSS 3.1 score 6.5, CWE-862 Missing Authorization, confidentiality-only impact). Exploitation requires a valid authenticated session with limited privileges and knowledge or enumeration of a valid organisation ID, so it is a targeted information-disclosure issue rather than an unauthenticated compromise. No public exploit identified at time of analysis, and no evidence of active exploitation.
Denial of service in the Okta RADIUS Agent (versions 2.17.5 up to but not including 2.28.0) lets an attacker on an adjacent network segment stall the packet parser by sending a RADIUS packet whose Vendor-Specific attribute contains a sub-attribute declaring a length of zero. The unvalidated zero length drives the parser into an unbounded loop (CWE-835), consuming worker threads until new RADIUS authentication requests can no longer be serviced. The CVSS 3.1 score is 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the affected agent typically fronts VPN and MFA authentication, so a successful trigger can block new logins on that segment until the service is restarted or patched.
Unauthenticated token disclosure in self-hosted Plane deployments before version 1.4.0 lets a remote attacker fetch a pending workspace invitation's secret token from the WorkspaceJoinEndpoint (GET api/workspaces/{slug}/invitations/{pk}/join/) and redeem it, joining the workspace under the role assigned to that invitation (CVSS 6.5, AV:N/AC:L/PR:N/UI:N). The pre-fix WorkSpaceMemberInviteSerializer returned the 'token' and 'invite_link' fields on a read-only, unauthenticated GET, so the only practical prerequisites are knowing or enumerating a valid workspace slug and a pending invite's primary key; the resulting access is bounded to the invited role rather than full administrative takeover. No public exploit code has been identified at time of analysis, and the issue is fixed in Plane 1.4.0, making this a moderate, real-but-not-urgent finding for teams running outdated self-hosted instances.
A use-after-free in Zephyr RTOS's Bluetooth Classic Hands-Free Profile Audio Gateway (HFP AG) lets an adjacent Bluetooth peer crash or hang the entire device, producing a denial of service. The flaw is reachable only in builds where CONFIG_BT_HFP_AG is enabled (a profile Zephyr marks experimental and ships disabled by default) and where the application implements the optional asynchronous get_ongoing_call callback; a Hands-Free unit sends AT+CIND? during Service Level Connection setup, then tears down and re-opens the HFP RFCOMM DLC on the same ACL link within the ~10-second timeout window, deterministically reusing the same static pool slot while ag->ongoing_call_work is still armed and linked into the kernel timeout list. The repeated memset and k_work_init_delayable corrupt the kernel timeout dlist under an interrupts-locked announce loop, causing a fault or system hang; no attacker-controlled data is written, so code execution is not demonstrated. No public exploit code or in-the-wild exploitation was identified at time of analysis, and the exposed population is sharply limited by the non-default experimental configuration and physical Bluetooth proximity.
Malformed raw DHCP packets can crash the udhcpc DHCP client shipped in BusyBox, causing denial of service and loss of network connectivity on the affected device until the client restarts or reacquires a lease. The flaw is reachable by any attacker with presence on the same Layer-2 segment as the victim (CVSS 3.1 AV:A/AC:L/PR:N/UI:N, 6.5 Medium) and requires no authentication and no user interaction; the assessed impact is availability-only (A:H) with no confidentiality or integrity loss. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation, and the adjacency requirement sharply limits the attacker population to those already on the local network, Wi-Fi, or VLAN. The first-sentence risk framing is that this is a moderate, availability-only vulnerability whose signals are internally consistent rather than conflicting.
Unauthenticated account creation in Esri Portal for ArcGIS allows remote attackers to register new portal accounts even when self-service signup has been explicitly disabled (disableSignup=true), by manipulating the signup workflow exposed through the portal's sharing endpoint. The flaw is reachable over the network with no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), which makes internet-exposed portals - and especially those whose operators deliberately disabled self-service registration for security reasons - the most realistic targets; the practical impact is bounded by whatever content and privileges a default new member receives. This is a moderate-severity authorization weakness (CWE-863) rather than a top-tier emergency, with a limited integrity impact and no confirmed confidentiality or availability impact; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, so it is not confirmed as actively exploited.
Information disclosure in Google Chrome's password manager allows unauthenticated remote attackers to leak sensitive credentials from users who are socially engineered into loading a crafted HTML page. Affected are Chrome versions prior to 155.0.8059.79; the issue is confirmed via vendor advisory with a patch available. Exploitation requires user interaction and has not been observed in active campaigns, with an EPSS score of only 0.17% (6th percentile), indicating a moderate-priority risk that does not rise to emergency status.
Stored cross-site scripting in SAP Manufacturing Integration and Intelligence (MII) lets an authenticated, low-privileged attacker persist malicious content that is later rendered and executed in the browser of an authenticated victim who opens the affected page. Scored CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw requires a valid low-privileged MII account to plant the payload plus victim navigation to the tainted page, so exploitation is limited to the victim's browser context: session information access, modified page content, and local disruption of the application, not server compromise. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-site request forgery in AuthTake Technology Inc.'s Authtake application (v1.3 up to but not including v1.4) lets remote attackers forge requests through a logged-in victim's session, a weakness the TR-CERT advisory characterizes as enabling encryption brute forcing. Rated CVSS 3.1 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, the flaw is integrity-only - no confidentiality or availability impact - and requires the victim to hold an active authenticated session and be tricked into loading attacker-controlled content; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local information disclosure in Microsoft's Windows Subsystem for Linux (WSL2) allows an already-authenticated local user on a Windows host running WSL2 builds earlier than 3.0.1 to read residual memory contents left by an uninitialized resource (CWE-908). The flaw is not remotely reachable and requires no user interaction, but it is gated behind local authenticated access (CVSS PR:L) and the presence of the opt-in WSL2 feature, and it affects confidentiality only - integrity and availability are untouched, with the leaked data being opportunistic rather than precisely attacker-controlled. There is no public exploit identified at time of analysis (CISA SSVC exploitation: none), and patch availability per vendor advisory makes this a patch-management priority rather than an emergency.
Server-side request forgery in the Azure Arc Connected Machine Agent (versions 1.0.0 up to but not including 1.68) lets an already-authenticated, low-privilege actor induce the agent to fetch attacker-influenced URLs, reaching internal or cloud-metadata endpoints and returning data that can be used to elevate privileges over the network. The issue is confidentiality-only per the assessed vector (C:H/I:N/A:N) and requires network reach plus an existing low-privilege foothold - an unauthenticated attacker cannot exploit it - and no user interaction is needed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and vendor patching to agent 1.68 or later removes the exposure.
An out-of-bounds read in Microsoft Office Excel lets an unauthenticated remote attacker disclose memory contents by convincing a victim to open a specially crafted spreadsheet (CVSS 3.1 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Affected builds are Microsoft Office LTSC 2021 before 16.0.14334.20974, Microsoft Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise; patched builds are not vulnerable. The impact is confined to information disclosure with no integrity or availability effect, and there is no public exploit identified at time of analysis - CISA's SSVC assessment records Exploitation=none and Automatable=no, with Technical Impact=partial.
Out-of-bounds read in Microsoft Excel allows a remote, unauthenticated attacker to disclose sensitive information by convincing a victim to open a specially crafted workbook; the user-interaction requirement (UI:R) limits automated exploitation. No public exploit code has been identified at time of analysis, and the vendor has released patches. The CVSS score of 6.5 reflects high confidentiality impact with no integrity or availability effect.
Information disclosure in Microsoft Office Excel (Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise) allows an unauthenticated remote attacker to read memory beyond the bounds of an allocated buffer by convincing a victim to open a specially crafted Excel file. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N confirms a confidentiality-only impact with no integrity or availability loss, no code execution from this issue alone, and a mandatory user-interaction prerequisite - the victim must open the file, and in practice dismiss Protected View or Mark-of-the-Web warnings. There is no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as none with automatable set to no, so this is a moderate rather than top-priority risk; Microsoft has released patched builds.
Spoofing in Windows Shell allows unauthenticated remote attackers to impersonate trusted content by exploiting an incorrectly implemented authentication algorithm (CWE-303), requiring the victim to interact with attacker-supplied content (UI:R). Affects Windows 11 versions 23H2, 24H2, 25H2, 26H1, 26H2 and Windows Server 2025 (including Server Core installation) on builds prior to the patched versions, with high confidentiality impact but no integrity or availability loss. No public exploit identified at time of analysis (CISA SSVC: Exploitation none).
An out-of-bounds read in Microsoft Excel lets remote attackers disclose information when a victim opens a specially crafted spreadsheet, with no authentication or prior privileges required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Exploitation is not zero-click: the attacker must deliver a malicious .xls/.xlsx file (email or web download) and convince the user to open it in a vulnerable build, and there is no public exploit code and no confirmed active exploitation (SSVC Exploitation: none, Automatable: no; no CISA KEV listing) at time of analysis. Affected builds are Microsoft Office LTSC 2021 before 16.0.14334.20974, Microsoft Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise, all of which have vendor patches available; impact is limited to confidentiality, with no integrity or availability effect.
Information disclosure in the Azure DevOps CLI Extension (1.0.6) and Azure CLI lets an attacker who controls or can influence the origin a CLI command is directed at expose high-confidentiality data from the developer or CI environment where the command runs. The attack is not silent or server-side: it requires the victim to actively invoke the affected CLI tooling against the attacker-influenced origin (CVSS UI:R), and no attacker authentication is needed (PR:N). The vulnerable surface is client-side developer/CI tooling rather than the hosted Azure DevOps service, and version 1.0.7 is fixed. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and automatable as no with partial technical impact.
Malformed SSH subsystem requests crash the entire SFTPGo server process in versions prior to 2.7.5, disconnecting every concurrently connected user until an administrator manually restarts the service. Any authenticated SSH account (CVSS PR:L, network-reachable, no user interaction) can trigger it by opening a session channel and sending a short or otherwise invalid subsystem payload, so exposure is greatest on multi-tenant instances that provision accounts to untrusted or low-trust users, while single-tenant or trusted-operator deployments carry materially lower risk. Only availability is affected (C:N/I:N/A:H, 6.5), no public exploit code or CISA KEV entry was identified at time of analysis, and the issue is fixed in 2.7.5.
A denial-of-service condition in the Firefox Printing: Output component lets attacker-controlled content crash or hang the browser when a victim prints or renders it, and Mozilla has fixed the issue in Firefox 158 and Firefox ESR 153.5. Exploitation requires the victim to trigger the printing code path with attacker-supplied content, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H vector: network-delivered and unauthenticated, but gated by mandatory user interaction and limited to availability-only impact with no code execution, data exposure, or persistence. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none with automatable set to no, so this is a moderate-severity availability bug rather than a top-tier priority.
A denial-of-service vulnerability in Mozilla Firefox's WebRTC component can cause the browser to hang or crash when a user opens a malicious web page that triggers resource exhaustion. Affected versions are Firefox before 158 and Firefox ESR before 153.5, with fixes released in Firefox 158 and Firefox ESR 153.5. No public exploit code or active exploitation has been identified, and the CVSS score is 6.5 (medium).
Denial of service in Mozilla Firefox's Sync component can be triggered by crafted synced data, causing uncontrolled resource consumption and a browser crash or hang (CWE-400). The issue affects Firefox before the vendor fix in Firefox 158, and the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates it is network-reachable without privileges but requires victim user interaction. No public exploit was identified at time of analysis, and CISA SSVC rates it non-automatable with partial technical impact.
Denial of service in Mozilla Firefox allows a remote attacker to crash or hang the browser by getting a victim to load crafted content processed by the Site Reports component; versions prior to Firefox 158 are affected. Exploitation requires user interaction (the victim must navigate to or open the attacker-controlled content, per the UI:R metric) and no authentication is required (PR:N), but the SSVC assessment marks the issue as non-automatable, and no public exploit code or active exploitation has been identified at time of analysis. Impact is limited to client-side availability (A:H with no confidentiality or integrity loss and no scope change), so the realistic worst case is a crashed or unresponsive browser session for the targeted user.
Stored cross-site scripting in the WordPress 'Books Gallery' plugin (wp-books-gallery) affects all releases through 4.8.4, allowing an attacker to persist malicious JavaScript that executes in the browser of whoever later views the affected page. Per our assessment, exploitation requires an authenticated WordPress account with at least low-level posting privileges (CVSS vector PR:L) plus victim interaction (UI:R) - a privileged user or site visitor must load the page where the injected payload is rendered - so this is not remotely exploitable without credentials, and real-world risk is materially constrained by those prerequisites. Rated CVSS 6.5 by Patchstack and mapped to CWE-79, this is a moderate-severity issue with no public exploit identified at time of analysis and no CISA KEV listing; exposure is confined to WordPress sites running the Books Gallery plugin at version 4.8.4 or earlier.
Stored cross-site scripting in the ThemeGrill User Registration WordPress plugin (versions through 5.2.8) lets an authenticated low-privilege user - realistically anyone who can complete the plugin's own self-service sign-up form when open registration is enabled - persist malicious script into plugin-stored data that later renders in a victim's browser. The payload only fires when a higher-privileged user, typically an administrator reviewing registrations or user records, loads the affected page, so exploitation requires that human view-step and is not automatable against an idle target; CVSS is 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and because the flaw is scope-changing it can affect resources beyond the plugin's own security context.
Stored cross-site scripting in the SureCart WordPress plugin (Brainstorm Force / SureCart) through version 4.9.4 allows a low-privilege authenticated user to persist malicious JavaScript into plugin-rendered content, which then executes in the browser of any user who views the affected page. Rated CVSS 6.5 (medium), the flaw is remote and network-reachable (AV:N) but tempered by two prerequisites: an attacker must first hold a valid low-privilege account (PR:L), and a victim - typically a site administrator or another authenticated user - must load the poisoned page for the payload to fire (UI:R). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so this appears to be a coordinated disclosure via Patchstack rather than a defect under active exploitation; exposure is highest on sites that allow untrusted visitors to self-register customer or contributor accounts.
Stored cross-site scripting (XSS) in the Prime Slider - Addons For Elementor WordPress plugin (bdthemes-prime-slider-lite) through version 4.7.1 lets an authenticated low-privileged user persist malicious script through slider/Elementor widget content, which then executes in the browser of any higher-privileged user who views the affected page (CVSS 6.5, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Because the payload is stored server-side and fires on page render, the practical impact is session/token theft, content injection, or privileged actions performed in the victim's context - though exploitation is not remote-unauthenticated and requires the victim to interact with the poisoned page. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV listing); this is a moderate-priority, not a drop-everything, issue.
Stored cross-site scripting in PowerPack Addons for Elementor through version 3.1.0 allows authenticated users who can create or edit PowerPack widget content to inject persistent JavaScript that executes when another user views the affected page. The independent assessment rates this as a moderate-priority issue rather than an urgent one: exploitation requires a lower-privileged authenticated WordPress account, typically contributor/author level, and a second user must load the tampered content (UI:R), with scope change but only low confidentiality and integrity impact and no availability impact. There is no public exploit identified at time of analysis, no CISA KEV entry, and no EPSS score was supplied in the provided data.
Stored cross-site scripting in Premium Addons for Elementor (versions through 4.11.110) allows an authenticated low-privilege WordPress user to persist malicious JavaScript through plugin widget input, which then runs in the browser of any user who views the poisoned page. Exploitation requires a content-editing account such as contributor or author (PR:L) plus a victim loading the affected page (UI:R), so single-author and tightly locked-down sites have little exposure while multi-author sites or those with open registration granting posting roles are the primary targets. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS data was supplied with the available intelligence.
Stored cross-site scripting in the Brainstorm Force SureForms WordPress plugin (all versions through 2.12.7) allows an authenticated low-privileged user to inject script payloads through form fields that execute when a higher-privileged user, typically an administrator, later views the stored submission. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw requires an existing submission-capable account plus victim-driven user interaction, so it is not remotely exploitable without authentication. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Stored cross-site scripting in the Griden 'Responsive Slider' WordPress plugin (versions through 0.1.9) allows an authenticated user with at least low-level privileges to persist malicious JavaScript into slider content, which then executes in the browser of any visitor who renders the affected page. Because the payload is stored server-side and fires on victim page views, exploitation requires a victim to interact with the compromised slider (UI:R), while the attacker only needs rights sufficient to edit slider content (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5). No public exploit code has been identified at time of analysis and the plugin is not reported as actively exploited (no CISA KEV listing); risk is elevated for multi-author or low-trust-administration WordPress sites where untrusted accounts can edit slider content.
Stored cross-site scripting in the FolioVision FV Simpler SEO WordPress plugin (versions through 1.9.7) lets a user who already holds a low-privilege account on the site persist malicious script into a plugin-managed input field, which then executes in the browser of a higher-privileged user - typically a logged-in administrator - who views the affected plugin or content page. Patchstack scores it CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), with the S:C scope change indicating the injected script can affect resources beyond the vulnerable component; exploitation is gated on two prerequisites, a valid account (PR:L) and interaction by an authenticated victim (UI:R), so it is not an anonymous drive-by attack. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the plugin is a niche WordPress SEO extension rather than a widely deployed platform component, which limits practical exposure.
Stored cross-site scripting in the IMPress for IDX Broker WordPress plugin (versions through 3.3.1) allows an authenticated low-privilege user - such as a contributor or author who can submit data through an IMPress input field - to persist malicious JavaScript that executes in the browser of any other user, including an administrator, who later views the affected page. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5) reflects that exploitation is not unauthenticated: it requires a valid low-privilege account on the target site plus victim interaction, and it only applies where the plugin is installed and active. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); Patchstack is credited with the report.
Stored cross-site scripting in the Weaver Xtreme Theme Support WordPress plugin (all versions through 7.0.1) allows an authenticated user with only low-level posting privileges to persist malicious JavaScript that then executes in the browser of any user who loads the affected page, including administrators. Rated CVSS 3.1 6.5 (Medium) with a scope-change vector (S:C) and requiring victim interaction (UI:R), the flaw is a CWE-79 improper-neutralization issue reported by Patchstack. No public exploit code has been identified at time of analysis and no fixed version is confirmed in the available data, so exposure is greatest on multi-author installations that grant untrusted accounts content-creation rights. Note that per the CVSS vector (PR:L) this is not exploitable by unauthenticated remote attackers.
Privilege escalation in Microsoft's Windows HID class driver lets an attacker who already has physical access to a machine elevate to kernel-level privileges by attaching a crafted USB/HID peripheral and winning a race condition in the driver's object lifetime handling. Because the vector is physical (CVSS:3.1/AV:P) and attack complexity is high (AC:H), the flaw is not remotely exploitable and is non-deterministic in practice; it is limited to shared, kiosk, unattended, or otherwise physically reachable endpoints. No authentication (PR:N) and no user interaction (UI:N) are required once physical access is obtained, and no public exploit identified at time of analysis; vendor patches are available. Impact is high for confidentiality, integrity, and availability on the compromised host (CVSS 6.4).
Local privilege escalation in Microsoft SQL Server arises from a heap-based buffer overflow (CWE-122) that an already-authenticated, high-privilege attacker can trigger on the database host to corrupt heap memory and execute code in the context of the SQL Server service. The assessed vector (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, score 6.4) confirms this is a post-compromise escalation primitive: it requires local access to the host plus pre-existing elevated privileges (PR:H) and a precise heap-state condition (AC:H), not a remote or unauthenticated attack path. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none with automatable set to no, and vendor-released patches exist for SQL Server 2017, 2019, 2022, and 2025 across both GDR and CU servicing branches, making this a moderate-priority patch-now item rather than an emergency.
TYPO3 CMS versions 14.0.0 through 14.3.8 contain an information disclosure flaw where forms using FileUpload or ImageUpload elements with a custom non-default saveToFileMount store uploaded files in the public 1:/user_upload/ folder instead of the configured restricted storage. This allows unauthenticated remote attackers to access files that were intended to be protected, as they are served without the access checks normally applied to non-public storages, but exploitation requires a specific form configuration and depends on whether sensitive files are uploaded and enumerable. No public exploit code or active exploitation has been reported; the vendor-assigned CVSS 4.0 score is 6.3 (moderate), while our independent assessment yields a lower CVSS 3.1 score due to high attack complexity (AC:H).
Unauthenticated attackers can read unpublished draft blog posts on Aureus ERP deployments through version 1.6.0 by directly requesting the customer-facing post view page with a known or guessed post slug. The bypass exists because the blogs plugin's PostResource skips its authorization check and the ViewPost page never enforces the is_published flag, exposing the full draft title, content, image, tags, author and publish date. Exploitation requires a publicly reachable customer blog containing at least one draft, and the slug must be known or guessed - the key limiting factor reflected as AT:P in the CVSS 4.0 vector - which keeps this a medium-severity information-disclosure issue rather than an emergency; no public exploit code identified at time of analysis.
Unauthenticated username enumeration in Finsys Dockhand through 1.0.18 exploits an LDAP injection flaw in the tryLdapAuth login path (src/lib/server/auth.ts), where the submitted username is inserted into the LDAP search filter without escaping wildcard characters. Attackers can submit incremental patterns such as 'a*' to /api/auth/login and use response-timing differences to confirm which LDAP accounts exist, sidestepping per-username rate limiting because every probe carries a different filter string; the payoff is limited to username disclosure, not authentication bypass or code execution, and exploitation is slow, noisy and sensitive to network jitter. The vendor has shipped a fix in Dockhand 1.0.19, no public exploit code and no KEV-listed active exploitation were identified at time of analysis, and the issue rates as low-to-moderate priority despite the 6.3 medium CVSS 4.0 score. Only deployments with LDAP authentication enabled are affected; environments using non-LDAP authentication are not exposed to this path.
Information disclosure in the Windows Desktop Runtime (WPF) component of .NET allows a remote, unauthenticated attacker to read data from a victim's machine when the victim opens or navigates a crafted XAML or XPS document - or content that causes WPF to fetch a remote URI or TrueType font - inside a WPF-based desktop application on Windows. Per the independent assessment, exploitation is constrained by mandatory user interaction (UI:R) and high attack complexity (AC:H) tied to specific conditions in the XAML/XPS parsing and hyperlink-navigation path, and no public exploit code or confirmed active exploitation has been identified at time of analysis, keeping real-world priority low-to-moderate despite the CVSS 5.3 moderate rating and high confidentiality impact. Affected builds span .NET 8.0, 9.0, 10.0 and 11.0 previews as well as Visual Studio 2022 17.14 and Visual Studio 2026 18.10, which ship the vulnerable runtime.
Azure Resource Manager API access can be abused by an authenticated Grafana user who has query access to an Azure Monitor data source, allowing that user to call ARM APIs beyond Grafana's intended scope using the data source's Azure identity. The issue is a confused-deputy flaw (CWE-441) in Grafana OSS and Grafana Enterprise with CVSS 6.3 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N); exploitation requires low-privileged Grafana authentication but is complicated by the need for an over-privileged Azure identity, and the advisory bounds impact to the Azure role assigned to that identity. No active exploitation is confirmed by CISA KEV and no public exploit is identified in the provided data.
Authentication bypass in NETGEAR RAX30, RAX29, and RAX28 routers lets an unauthenticated attacker who is already on the same local network reach the device management service and either read device information or change administrative settings, compromising the confidentiality and integrity of management data and the availability of device-management functions. The flaw is an instance of CWE-288 (Authentication Bypass Using an Alternate Path or Channel), scored 6.3 by the vendor on the CVSS 4.0 scale, and it is gated by an adjacency requirement: an attacker must be on the local/Layer-2 network (wired LAN, Wi-Fi, potentially guest Wi-Fi) rather than the WAN side, so under a default configuration it is not exploitable from the internet. There is no public exploit identified at time of analysis and no CISA KEV listing; the vendor has published a fix, available through NETGEAR support pages.
FortiSandbox and FortiSandbox Cloud ship with a hard-coded cryptographic key that is used to validate or sign trusted HTTP requests, allowing an unauthenticated remote attacker who knows that static key to craft requests the appliance treats as legitimate and thereby escalate privileges. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, official score 5.3), no valid credentials or user interaction are required once the embedded key is known, though exploitation is limited to deployments that expose the HTTP/management interface to the attacker's network. Affected versions are FortiSandbox 5.2.0-5.2.1, 5.0.0-5.0.6 and all 4.4 releases, plus the corresponding FortiSandbox Cloud versions; there is no public exploit identified at time of analysis, but the issue is authoritative-moderate severity and should be remediated rather than treated as an emergency.
Unauthenticated command execution affects NETGEAR CAX30, RAX30, RAX5, and RAXE300 routers when the Block Sites website-filtering feature is enabled, allowing a network-adjacent attacker with WiFi credentials or a position on the LAN to run unauthorized commands on the device and compromise its confidentiality, integrity, and availability. No administrative login on the router is required and no user interaction is needed, so anyone who can reach the device's network perimeter can potentially reach the vulnerable code path. Exploitation is conditional: if Block Sites is left disabled, as it typically is by default, the flaw is not reachable, which limits realistic risk to deployments where website blocking is actively configured and the wireless or LAN perimeter is shared or weakly protected. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, though a vendor patch is available.
Memory corruption in Zephyr's Bluetooth Classic A2DP/AVDTP host stack allows an adjacent, paired BR/EDR peer to crash or hang the entire device by forcing a delayable work item to survive a session teardown. The attacker opens the AVDTP signalling channel, lets the local application issue an AVDTP procedure (the standard A2DP flow calls bt_a2dp_discover(), arming the 6-second AVDTP_TIMEOUT), then tears the channel down without responding and re-opens it within the remaining window, so that a2dp_get_connection() memsets the session while its timeout node is still linked into the kernel's global timeout list. Preconditions are narrow - the victim must run the experimental CONFIG_BT_A2DP option with the default CONFIG_TIMEOUT_BACKEND_DLIST backend and accept an encrypted (paired) BR/EDR link, which is why the assessed severity is a bounded denial-of-service rather than a remote pre-auth compromise; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
SSRF protection bypass in the Lancet Go library's netutil.IsInternalIP allows applications that use this helper as their allow/deny filter to fetch internal services and cloud metadata endpoints via IPv6 and transition address forms the function misclassifies as external. Affected releases are Lancet 1.3.1 through 1.4.6 and 2.1.2 through 2.3.9; the function must be consumed by a server-side fetch path that accepts attacker-controlled hostnames, which is why the issue is assessed as moderate priority rather than emergency (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, CVSS 4.0 base 6.3). Publicly available exploit code exists (SSVC Exploitation: poc) and an unauthenticated, remote attacker providing hostnames that resolve to fd00::/8, fe80::/10, 100.64.0.0/10, or NAT64/6to4/Teredo encodings of internal IPv4 can reach otherwise unreachable targets; exploitation is not reliably automatable at scale (SSVC Automatable: no) and no confirmed active exploitation (CISA KEV) has been reported.
Information disclosure in Snowy 3.6.5 allows unauthenticated attackers to forge HMAC-SHA256 download signatures for the /dev/file/download endpoint using the hard-coded FILE_DOWNLOAD_SIGN_SECRET constant published in the product's source tree, enabling retrieval of stored avatars, editor images, and attachments. The flaw is rated CVSS 4.0 base 6.3, and publicly available exploit code exists. Practical exploitation still requires knowing or guessing valid file ids, which caps technical impact to read-only file disclosure with no write, modification, or denial-of-service capability.
Heap buffer underwrite in ImageMagick's PICT decoder (coders/pict.c) on 32-bit builds allows unauthenticated remote attackers to corrupt memory below the allocated buffer by supplying a crafted PICT file with maximized row, column, and bytes-per-line values, potentially causing a crash or code execution. Affected versions are ImageMagick before 7.1.2-33 (7.x) and before 6.9.13-58 (6.x) when compiled as 32-bit; 64-bit builds are not affected. No public exploit code has been identified at the time of analysis, and the CVSS v4.0 score is 6.3 (moderate) with high attack complexity per the assessed CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).
OS command injection in Fortinet FortiManager (8.0.0 and 7.6.0-7.6.6) and FortiManager Cloud (7.6.2-7.6.6) allows a high-privileged authenticated attacker on an adjacent network to execute arbitrary operating system commands, enabling privilege escalation and potential full compromise of the management appliance. The vulnerability requires an existing administrative account (CVSS PR:H) and network adjacency (AV:A), and no public exploit identified at time of analysis. Despite the high-value nature of the target, these prerequisites substantially narrow realistic risk to post-compromise or malicious insider scenarios, consistent with the moderate-risk assessment.
Information disclosure in GitLab Pages (GitLab CE/EE) lets an authenticated user who already holds access to Pages log data recover access tokens and other secrets, because sensitive request data was written into log files and forwarded to error-tracking events. All GitLab CE/EE versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected, per CWE-532 (insertion of sensitive information into a log file). The assessed CVSS is 6.2 and the privilege requirement is high (PR:H) - the attacker must be an authenticated user who can already read the affected Pages logs, so this is not remotely reachable by anonymous users against a default configuration; no public exploit code or active exploitation has been identified at time of analysis. Impact is limited to disclosure of whatever tokens or secrets happened to be captured in logging or error tracking, but because the leaked credentials can span security boundaries the change scope is rated S:C.
Open redirect handling in Windows BitLocker (CWE-601) lets an attacker with physical possession of a BitLocker-protected device redirect to an untrusted destination and bypass the drive-encryption security feature, with high confidentiality and integrity impact assessed at CVSS 6.1 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The vector is unauthenticated and requires no user interaction, but the attack is strictly physical: it cannot be performed remotely or automated (CISA SSVC Automatable: no, Exploitation: none) and realistically applies to lost, stolen, or unattended hardware rather than devices kept under physical control. No public exploit identified at time of analysis, and Microsoft has shipped vendor-released patched builds for every affected Windows 10, Windows 11, and Windows Server version.