Open redirect in the nextjs-auth0 SDK before version 4.32.0 allows remote unauthenticated attackers to redirect users to an arbitrary external domain after authentication by crafting a malicious returnTo parameter that passes the SDK's same-origin check but is later reconstructed into a scheme-relative or absolute URL. Exploitation requires the victim to click an attacker-supplied authentication link and complete the login flow (CVSS vector includes UI:R), limiting impact to redirection with no direct code execution or data read on the host. No public exploit code or active exploitation (CISA KEV) has been identified, and a vendor patch is available in version 4.32.0.
Stored cross-site scripting in the Unstructured-IO unstructured Python library before 0.24.1 allows unauthenticated remote attackers to embed active content in parsed documents, which executes in a victim reviewer's browser origin when generated HTML output is rendered. The flaw affects partition_html(html_parser_version="v2") and the VLM partitioner, whose unescaped to_html() path preserves attacker-controlled tags, attributes, and javascript: links into metadata.text_as_html; exploitation is second-order and requires user interaction (CVSS 3.1 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit identified at time of analysis; the vendor released a fix in unstructured 0.24.1 that adds the nh3 sanitization dependency.
Spoofing in Mozilla Firefox's DOM Web Serial component affects Firefox versions before 158 and Firefox ESR versions before 153.5, allowing a crafted webpage to mislead the user through spoofed browser or Web Serial-related UI. Exploitation requires the victim to visit or interact with an attacker-controlled page (UI:R) and does not require authentication (PR:N); impact is limited to low confidentiality and integrity with a scope change. EPSS is low at 0.19% (8th percentile), and no public exploit or CISA KEV entry was identified at time of analysis.
Reflected cross-site scripting in SAP NetWeaver Enterprise Portal allows unauthenticated remote attackers to inject a malicious script into a URL parameter that is reflected back in the server response, where it executes in the browser of any portal user who opens the crafted link. Exploitation depends on user interaction (CVSS 3.1 base 6.1, MEDIUM, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and can result in theft of session information, manipulation of portal content, or redirection of the victim. No public exploit identified at time of analysis.
DOM-based cross-site scripting in the SAPUI5 Support Assistant Overlay lets an unauthenticated attacker craft a publicly hosted link that, when opened by a logged-in SAP user, causes attacker-controlled input to be read by client-side code and written into the DOM without sanitization, executing script in that user's browser context. Exploitation is not automatic: it requires the Overlay component to be present and reachable plus user interaction (UI:R), so the attacker must socially engineer a specific authenticated victim into clicking the link. There is no public exploit identified at time of analysis and no confirmed active exploitation; the assessed severity is moderate (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) with limited confidentiality and integrity impact on the victim's browser scope and no availability impact.
Open redirect in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context, enabling user-information tracking and page defacement. The vulnerability requires user interaction (UI:R) and results in low confidentiality and integrity impact with no availability impact, yielding a CVSS score of 6.1. No public exploit code has been identified at time of analysis.
Phase Console through 2.77.3 fails to enforce the Secrets read permission on the secretHistory GraphQL query, so an authenticated organisation member who lacks that permission but possesses a wrapped environment key can retrieve encrypted secret-history events and decrypt the returned secret values with that key. Exploitation requires valid organisation membership, prior environment-key access, and a known secret identifier, making this a moderate-severity authorization-escalation/confidentiality issue (CVSS 4.0 base 6.0; CWE-862) rather than unauthenticated remote compromise. No KEV or EPSS data was provided; no public exploit identified at time of analysis.
Authenticated JumpServer users who hold permission to create or execute Ansible-based automation tasks can inject attacker-controlled template expressions that the automation rendering engine evaluates, invoking sensitive Ansible lookups (file, pipe, env, password) that disclose files or environment values and may permit limited command execution under the privileges of the automation process. All JumpServer deployments prior to 4.10.17-lts are affected, but exploitation requires operator-level privilege (CVSS vector PR:H) and remains confined to the automation process - it grants neither unauthenticated access nor reach into unrelated JumpServer assets. No public exploit identified at time of analysis, and the issue is fixed in version 4.10.17-lts.
Information disclosure in Microsoft SharePoint Server Subscription Edition lets an already highly privileged, authenticated attacker read confidential data over the network from an affected farm. Exploitation requires PR:H per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), so the practical exposure is limited to privileged insiders or adversaries who have already taken over a high-privilege account; there is no integrity or availability impact. The flaw carries a CVSS base score of 4.9 and, per CISA SSVC, exploitation has not been observed and the issue is not automatable; no public exploit code was identified at time of analysis. Microsoft has published a vendor fix, making this a medium-priority patching item rather than an emergency.
Uncontrolled resource consumption in the Windows RPC Endpoint Mapper service (listening on TCP 135) allows an unauthenticated, remote attacker to deny service over a network by exhausting service resources. Rated CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), the impact is availability-only and the High attack complexity means an outage is not achievable with a single trigger against default configurations, but requires sustained or precisely timed request volume. The affected surface spans Windows Server 2012 through Server 2025 (including Server Core) plus Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and Microsoft has published a vendor update guide.
Windows Failover Cluster on Windows Server 2019, 2022, and 2025 can be crashed by an unauthenticated network attacker, leading to a denial of service. The flaw stems from an uncaught exception (CWE-248) in the clustering service; exploitation requires the Failover Clustering feature to be enabled and the target's cluster network interface to be reachable, and the HIGH attack complexity (AC:H) means a specific race or state condition must be met, limiting reliable exploitation. No public exploit code has been identified at time of analysis, and the SSVC framework rates exploitation as none, making this a moderate-priority availability issue rather than a critical emergency.
A pre-authentication denial-of-service condition in the .NET cryptographic library System.Security.Cryptography.Pkcs causes CPU exhaustion on Windows when `EnvelopedCms.Decode` processes specially crafted CMS/PKCS#7 attribute sets, because the decoding routine performs quadratic work proportional to the number of attacker-supplied attributes rather than linear work. Affected applications are Windows-hosted .NET apps that reference a vulnerable package version (8.0.0-8.0.1, 9.0.0-9.0.20, 10.0.0-10.0.12, or 11.0.0-preview.1 through 11.0.0-rc.1) and pass untrusted PKCS#7/CMS enveloped data into the decode path - a pattern common in S/MIME mail gateways, signed-message web endpoints, and certificate/token processing services; there is no impact to confidentiality or integrity (CVSS 5.9, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-405). Exploitation requires no authentication or user interaction but is constrained by the Windows-only scope, the requirement that the vulnerable CMS decode path actually be reachable from untrusted input, and high attack complexity (AC:H) needed to tune payloads for meaningful amplification; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit identified at time of analysis, though vendor-released patches are available. Visual Studio 2022 (17.14.0-17.14.41) and Visual Studio 2026 (18.10.0-18.10.3) installations that bundle the affected SDK/runtime are also in scope.
FreeRDP client versions 3.0.0 through 3.31.x fail to validate a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against the client's enabled protocol set in nego_process_negotiation_response(), enabling a security protocol downgrade. A malicious RDP server or man-in-the-middle can override /sec:nla pinning by selecting RDSTLS, complete authentication with an all-zero cookie, and capture the user's cleartext password from the Client Info PDU. No public exploit has been identified at time of analysis; updating to FreeRDP 3.32.0 resolves the issue. The flaw is rated moderate risk, with only credential confidentiality impacted (no code execution, integrity, or availability impact).
Heap-based out-of-bounds write in FreeRDP 3.18.0 through 3.31.x allows a malicious or compromised ARM routing service to crash the RDP client by returning a long redirectedUsername that overflows the CLI credential prompt buffer once the user types input. The vulnerability requires attacker control of the ARM/gateway redirection service in the connection path (AT:P) and passive user interaction (UI:P), and is unauthenticated (PR:N) per the CVSS 4.0 vector; successful exploitation results in a client-side denial of service with no confidentiality or integrity impact. No public exploit code or confirmed active exploitation has been identified at time of analysis.
FreeRDP clients (versions 3.0.0-beta4 through 3.31.x) can be crashed by a malicious or compromised ARM gateway that returns a zero-length HTTP 200 response, triggering a NULL pointer dereference in arm_handle_request_ok. This client-side denial-of-service requires the victim to connect through the attacker-controlled ARM gateway; it is not exploitable in default standalone RDP configurations. The attack is unauthenticated but requires a man-in-the-middle or gateway compromise, and no public exploit code has been identified at time of analysis.
Heap use-after-free in FreeRDP smartcard emulation affects versions 3.0.0 before 3.32.0 and allows a malicious RDP server to crash the connecting client process by racing SCARD_IOCTL_DISCONNECT against SCARD_IOCTL_TRANSMIT on a single smartcard handle. Exploitation is remote and unauthenticated but requires the victim to initiate a session to an attacker-controlled or compromised server, smartcard redirection/emulation to be enabled, and the attacker to win a non-deterministic timing window; the independently assessed impact is availability-only heap corruption and termination, not code execution. No public exploit code or CISA KEV active exploitation was identified at time of analysis.
Use-after-free in the MongoDB Server aggregation engine lets an authenticated user holding read privileges trigger disclosure of unrelated process memory - or, depending on heap state, an unexpected mongod termination - by issuing an aggregate command that combines an internal aggregation stage with a cursor batch size of 0. The vendor-assigned CVSS 4.0 score is 6.0 (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N), while our independent CVSS 3.1 assessment rates it 6.x as AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L, reflecting that exploitation demands valid credentials, the exact option combination, and a favourable memory-reuse window. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is a moderate-priority hardening item rather than an emergency.
Credential disclosure in FreeRDP 3.0.0 through 3.31.x allows a malicious or man-in-the-middle RDP server to recover reusable administrative domain, username, and password values when a user connects with the /restricted-admin option, which fails to suppress CredSSP delegation and sends the cleartext password in TSPasswordCreds and the Client Info PDU. The flaw is CWE-522 (insufficiently protected credentials), confirmed by the FreeRDP project in advisory GHSA-jhxw-3hj9-9hqh and reported by VulnCheck, with a CVSS 4.0 score of 6.0 and an independent CVSS 3.1 assessment of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. Exploitation requires the victim to start a restricted-admin session and the attacker to control the destination or hold a MITM position on the RDP/CredSSP channel; no public exploit identified at time of analysis.
Use-after-free in the Microsoft QUIC (MsQuic) Schannel native library allows an unauthenticated, remote attacker who can reach a QUIC/HTTP-3 endpoint to disclose memory contents over the network, with impact limited to confidentiality (no integrity or availability effect). Affected software includes .NET applications referencing the Microsoft.Native.Quic.MsQuic.Schannel package in versions 1.9.0 through 2.6.1, plus a broad set of Windows 11 and Windows Server 2022/2025 builds and Visual Studio 2022/2026 that ship the vulnerable QUIC binaries. Exploitation is non-deterministic because the CVSS vector (AC:H) reflects a race condition the attacker must win, and no public exploit code has been identified at time of analysis; the CISA SSVC assessment records exploitation as none and the issue as not automatable, making this a genuine-but-moderate risk rather than a fire-drill.
Improper input validation in the Okta Credential Provider for Windows (versions before 1.4.6.0) allows a locally authenticated, high-privilege attacker to feed a malformed serialized credential buffer that the provider parses as a Kerberos logon structure without validating buffer size or packed string offsets, resulting in out-of-bounds memory reads and writes, provider process termination, and potential disclosure of adjacent process memory into local system logs. Because the CVSS vector is AV:L/PR:H/UI:N, exploitation requires pre-existing high-privilege local access on the host rather than remote or unauthenticated reach, and the primary demonstrated outcome is memory disclosure into logs plus a possible crash, not code execution. There is currently no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); a vendor-released patch (1.4.6.0) is available, which together with the local-only, high-privilege prerequisites makes this a moderate-severity hygiene and hardening issue rather than a mass-exploitation priority.
Improper input validation in Adobe's CAI Content Credentials (C2PA) tooling lets a remote, unauthenticated attacker bypass a security check and obtain unauthorized write access to content-credential data, which can be triggered without any user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, base 5.9). The affected components are the JavaScript SDK @contentauth/c2pa-web through 0.13.4, the Rust c2pa crate through 0.90.15, and c2patool through 0.27.15. Reliability is deliberately constrained: Adobe states exploitation depends on conditions beyond the attacker's control, reflected as high attack complexity, so this is a moderate-priority integrity/tampering issue rather than a top-tier emergency; no public exploit or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS signal was supplied. Impact is limited to integrity (C:N/A:N) - tampering with provenance/credential data rather than data theft or denial of service.
Active Directory Federation Services (AD FS) on Windows Server 2019, 2022, and 2025 lets an unauthenticated network attacker bypass an authentication security feature, yielding a high integrity impact (CVSS 5.9, CWE-1390) with no credentials and no user interaction required. Exploitation depends on network reachability to the AD FS federation endpoint - which in many deployments is internet-facing - but the HIGH attack complexity (AC:H) means the attacker must also satisfy conditions outside their control, so reliable exploitation is difficult. There is no public exploit identified at time of analysis, and vendor-released patches are available for every affected build (Windows Server 2019 10.0.17763.9376, 2022 10.0.20348.5761, 2025 10.0.26100.33650 and later, including Server Core installations).
Authentication bypass in Microsoft Active Directory Federation Services (AD FS) allows a remote attacker with network reachability to the federation/SSO endpoint to satisfy an authentication check under specific conditions and obtain a trust outcome that should have been denied. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N (base 5.9) confirms no credentials and no user interaction are required, while the High attack complexity signals the bypass succeeds only in particular attacker-uncontrolled token or request states rather than against every request; impact is integrity-only (C:N/I:H), meaning a modified or improperly validated authentication decision rather than data disclosure. Microsoft has released vendor fixes for the affected AD FS-enabled Windows Server builds, and no public exploit code or confirmed active exploitation was identified at time of analysis, so risk concentrates on default-configured, internet-exposed, unpatched AD FS deployments.
Denial of service in NVIDIA NVSentinel for Linux: the platform-connectors component exposes its gRPC health-event interface over a world-writable Unix domain socket that performs no authentication (CWE-306), letting a local user drive health-event traffic into the service. NVIDIA rates it 6.0 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H), but the world-writable, unauthenticated socket contradicts the high-privilege prerequisite, so the practical barrier is lower and the effective vector is closer to PR:L - any local account on the host can reach the interface. Exploitation requires local (non-network) presence on a host running NVSentinel with platform-connectors active, and impact is confined to availability with no data disclosure or modification; no public exploit code was identified at time of analysis.
A stack-based out-of-bounds write in GNOME Remote Desktop's VNC TLS read path, as shipped in Red Hat Enterprise Linux 8, 9, and 10, can crash the service and cause denial of service. An unauthenticated remote attacker (per the CVSS vector PR:N) who can reach an enabled VNC TLS listener and drive the connection into a peek/read size mismatch can corrupt memory on the stack; the vector rates this CVSS 5.9 with availability-only impact (C:N/I:N/A:H) and high attack complexity (AC:H), reflecting that the mismatch is non-trivial to trigger reliably. The vulnerable configuration is not default: remote desktop sharing must be explicitly enabled with the VNC backend and a reachable TLS listener, which is uncommon on headless or server RHEL installs; no public exploit code and no confirmed active exploitation were identified at time of analysis, and this should be handled as a routine patch rather than an emergency.
Information disclosure in the Azure Key Vault client SDK packages occurs because the SDK fails to properly validate the origin of responses it consumes (CWE-346), allowing an unauthorized attacker positioned to supply or impersonate a network origin to expose sensitive data handled by applications built on the affected libraries. Exploitation is unauthenticated (PR:N) and requires no user interaction (UI:N), but carries high attack complexity (AC:H, CVSS 5.9) because the attacker must control or influence the network response or origin, typically via an in-path/MITM or origin-spoofing position; confidentiality impact is high while integrity and availability are unaffected. No public exploit has been identified at time of analysis and CISA SSVC records exploitation as none with automatable exploitation rated no, so urgency is driven primarily by whether deployments rely on the vulnerable SDK versions rather than by active threat activity.
Persistent denial of management access in Fortinet FortiSandbox stems from an uncaught exception (CWE-248) triggered by crafted HTTP requests sent to the appliance's GUI/CLI management interface; FortiSandbox 5.2.0 through 5.2.1, 5.0.0 through 5.0.6, and all 4.4 versions are affected. Exploitation is not unauthenticated - the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) shows a privileged account on the management interface is required, so realistic abuse is confined to insiders or misuse of already-compromised administrative credentials, and the resulting impact is limited to availability (persistent loss of GUI and CLI access) with no data exposure or modification. There is no confirmed active exploitation and no public exploit identified at time of analysis; the issue is a modest-priority availability concern rather than an emergency, with remediation guidance published in Fortinet PSIRT advisory FG-IR-26-176.
Improper certificate validation in Adobe's CAI Content Credentials (C2PA) tooling lets an attacker slip forged or untrusted provenance data past the certificate/credential validation path, producing a security-feature bypass with integrity impact (CVSS 5.9, CWE-295). Affected implementations are the Content Credentials Rust SDK at or below c2pa-v0.90.15, the JS SDK at or below @contentauth/c2pa-web@0.13.4, and C2PA Tool at or below c2patool-v0.27.15 - any deployment that invokes the affected validation code on attacker-supplied content. Exploitation is unauthenticated (PR:N) and requires no user interaction (UI:N), but is rated AC:H because success depends on conditions beyond the attacker's control, meaning the bypass is not reliably reproducible on demand; no public exploit code has been identified and the issue is not confirmed as actively exploited (CISA KEV).
Improper certificate validation in Adobe's CAI Content Credentials / C2PA tooling lets an attacker bypass trust verification and obtain unauthorized write access to content credentials, an integrity-only impact. Affected components are the JavaScript SDK (@contentauth/c2pa-web 0.13.4 and earlier), the Rust SDK (c2pa 0.90.15 and earlier) and the C2PA command-line tool (c2patool 0.27.15 and earlier); the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N indicates remote exploitation with no authentication and no user interaction, but a high attack-complexity caveat because success depends on a pre-existing certificate-chain or environmental state the attacker cannot force. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and EPSS data was not provided; our independent assessment rates this as a moderate-severity, low-urgency issue confined to integrity.
Command injection in SAP Yeoman UI (app-studio-toolkit) enables an attacker to execute arbitrary OS commands with the developer's privileges by crafting a malicious workspace settings.json that sets ApplicationWizard.installationLocation to a shell payload. The command fires when the developer triggers a generator installation or uninstallation, which invokes child_process.execSync with the unsanitized value. The assessed CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates local exploitation requiring user interaction, with high impact to confidentiality, integrity, and availability on the developer workstation; no confirmed active exploitation or public exploit code is identified in the provided data.
Local information disclosure in AMI Aptio V BIOS/UEFI firmware allows low-privileged local attackers to access sensitive data, with potential follow-on privilege escalation and limited integrity/availability impact. The issue is medium-severity, requires pre-existing local access and high attack complexity, is not remotely reachable, and has no public exploit identified at time of analysis; AMI advisory AMI-SA-2026002 should be reviewed for affected versions and fixes.
An out-of-bounds read (CWE-125) in Citrix Workspace app for Windows can be triggered by a local, low-privileged user on an affected endpoint, leading to limited confidentiality and integrity impact together with a high availability impact (crash/DoS) as reflected in both the CVSS 4.0 base score of 5.8 and the independent CVSS 3.1 assessment (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H). Only Windows builds prior to 2603.20 CR, prior to LTSR 2607, and prior to LTSR 2507 CU3 are affected. The attack is not remotely reachable, requires an existing foothold on the host and specific high-complexity preconditions or timing flagged by AT:P and AC:H, and no public exploit code has been identified at time of analysis; this is routine patch-cycle work rather than an emergency.
Out-of-bounds read in the Windows Wi-Fi Driver (CWE-125) allows an attacker who already sits on the same wireless network or local Layer-2/broadcast segment as the target - and who already holds low-level privileges on that adjacent segment - to read beyond the bounds of a kernel buffer and disclose information from the affected Windows system. The issue affects a broad range of supported builds, from Windows 10 1607 through Windows 11 26H2 and the corresponding Windows Server 2016/2019/2022/2025 releases, all of which are fixed by the current cumulative updates. Impact is limited to confidentiality (CVSS:3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.7); there is no integrity or availability impact, no code execution or privilege escalation, no public exploit code identified at time of analysis, and CISA's SSVC rates exploitation as none and automatable as no, making this a moderate, patch-routinely item rather than an emergency.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition (16.0.0 prior to build 16.0.20326.20190) lets an attacker holding a valid, low-privileged SharePoint account inject content that is rendered in another user's browser, enabling spoofing and manipulation of page content. Exploitation requires the victim to view or interact with the attacker-controlled content, and impact is limited to low confidentiality and integrity with no availability effect, consistent with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, score 4.6). There is no public exploit identified at time of analysis and CISA's SSVC assessment records no exploitation and no automatable attack path, making this a low-severity, low-priority issue; a vendor patch is available.
Cross-site scripting (spoofing) in Microsoft SharePoint Server Subscription Edition lets an authenticated, authorized user submit crafted content that SharePoint renders without proper neutralization, causing attacker-controlled script to execute in a victim's browser session when that victim views the content. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) shows the two gating factors are valid authentication to the SharePoint instance and required victim interaction, with impact confined to low confidentiality and low integrity and no availability effect. The issue carries a CVSS base score of 4.6 and affects Subscription Edition builds before 16.0.20326.20190; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition, affecting builds before 16.0.20326.20190, allows an authenticated attacker with permission to insert content into a page rendered to other users to spoof page content or run script in a victim's browser once the victim views or interacts with the affected page. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, reflecting low confidentiality and integrity impact and a requirement for prior authentication plus victim interaction. No public exploit was identified at time of analysis, and the vendor has released a patch.
Information disclosure in the Windows Secure Kernel Mode component lets a locally authenticated attacker with low privileges read sensitive system information that should remain isolated inside the hypervisor-protected secure kernel, affecting Windows 10, Windows 11 and Windows Server 2016 through 2025 builds that predate Microsoft's fixed versions. Exploitation is constrained by high attack complexity and state-dependent conditions (CVSS AC:H, PR:L, AV:L), and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none, the attack as non-automatable, and technical impact as partial. Microsoft has released patches, so this is a moderate-priority hardening item rather than an emergency response.
Stored cross-site scripting in Microsoft SharePoint Server Subscription Edition (16.0.0 builds prior to 16.0.20326.20190) allows an authenticated user who can author or edit content to inject script that later executes in the browser of a different user who views the affected page, resulting in spoofed page content. Exploitation requires a valid SharePoint account with content-editing rights and victim interaction, so it is neither unauthenticated nor zero-click; the assessed impact is limited to spoofing with low confidentiality and integrity consequences and no availability impact. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation, making this a low-priority, patch-on-normal-cycle issue rather than an emergency.
Spoofing of integrity-protected state inside Windows Virtualization-Based Security (VBS) enclaves is possible on affected Windows 11 and Windows Server builds because of improper synchronization of a shared resource (CWE-362) within the enclave code path. An attacker must already hold authenticated low-privileged code execution on the local host (AV:L, PR:L) and then win a competitive timing race (AC:H) to tamper with enclave-managed data; the changed scope (S:C) reflects that the impact crosses from the attacker's user-mode context into the enclave security boundary, producing high integrity impact with no confidentiality or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC assessment classifies the issue as non-automatable with only partial technical impact.
Archive extraction in muCommander through 1.6.2 can write files outside the chosen destination because UnpackJob does not correctly normalize remote paths before validating them against a ZipSlip check. The impact is integrity-only: an attacker who supplies a crafted TAR or ZIP archive can create or overwrite files that the victim's FTP or SFTP account can write, such as ../../.ssh/authorized_keys, but only if the victim actively extracts that archive into a remote FTP/SFTP folder. The CVSS vectors indicate no privileges required (PR:N) but mandatory user interaction (UI:R/UI:A) and a conditional remote-extraction workflow; no public exploit identified at time of analysis, and the independent assessment rates this as a moderate, conditional risk rather than an urgent priority.
Spoofing of data protected by the Windows Virtualization-Based Security (VBS) Enclave is possible for a local attacker who already holds a low-privileged foothold on the machine, because the enclave relies on encryption of insufficient strength. Exploitation requires the VBS Enclave feature to be in use and is constrained by high attack complexity (AC:H) and non-automatable conditions per SSVC, and it yields integrity/spoofing impact only (I:H) with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; severity is moderate (CVSS 5.6) and a vendor patch is available.
Improper authentication in SourceCodester Human Resource Management System 1.0 lets remote, unauthenticated attackers forge an authenticated administrator session by supplying manipulated role, pfimg, and EmpId arguments to the session_start call in controller/employee.php, effectively achieving pre-authentication admin takeover. The exploit has been made public, so publicly available exploit code exists and can be reused against any reachable instance of this widely distributed PHP/MySQL demo application. Risk signals are mixed: the CNA assigned a moderate CVSS 4.0 base of 5.5 with exploit maturity E:P, while independent assessment rates the impact as High for both confidentiality and integrity on an unauthenticated network vector, meaning the practical severity is likely well above the published base score.
Local integrity tampering in the Windows Update Stack allows an authenticated low-privilege attacker who already holds a session on an affected Windows host to modify update-related configuration or state that should be protected, producing a high integrity impact with no confidentiality or availability effect. The flaw (CWE-15, external control of a system or configuration setting) touches a broad set of Windows 10, Windows 11, and Windows Server branches from 1809/21H2 through 26H1/26H2 and Server 2019/2022/2025. Vendor patches are available, no public exploit code or active exploitation has been identified, and CISA's SSVC assessment records exploitation as none with the issue rated non-automatable, so real-world risk is largely confined to insiders or post-compromise tampering rather than scalable remote attacks.
An out-of-bounds read in the Windows Fast FAT driver (fastfat.sys) lets a local attacker disclose kernel memory contents by persuading a user to mount or open an attacker-crafted FAT/exFAT volume, disk image, or VHD. Windows 10 and Windows 11 (23H2 through 26H2) plus Windows Server 2012 through 2025 are affected, and exploitation requires local access with user interaction while yielding information disclosure only - no code execution or system modification, which keeps severity moderate rather than critical. No public exploit code has been identified at time of analysis, no confirmed active exploitation is known, and a vendor patch is available from Microsoft's update guide.
An out-of-bounds read (CWE-125) in Microsoft's Windows Media Foundation allows a local attacker to disclose information by convincing a victim to open or process a specially crafted media file. Affected are unpatched Windows 10, Windows 11, and Windows Server editions up to the fixed build for each release - for example Windows 11 24H2 below 10.0.26100.9711, Windows 10 22H2 below 10.0.19044.7807, Windows Server 2022 below 10.0.20348.5761, and Windows Server 2012 R2 below 6.3.9600.23470. Exploitation requires no attacker privileges (PR:N) but is entirely contingent on victim user interaction (UI:R) with the malicious file, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, and the impact is read-only information disclosure with no code execution or data tampering.
Uncontrolled memory allocation in the js-beautify library (versions up to and including 1.15.1 on the 1.x line and 2.0.3 on the 2.x line) lets remote, unauthenticated attackers drive excessive memory consumption by feeding crafted JavaScript, CSS, or HTML source into the beautifier's formatting routines, degrading or crashing the host process. The weakness is a library-level availability flaw: js-beautify is not network-facing on its own, so real exposure only materializes when an embedding application - a web-based formatter, code-review service, IDE backend, or API - passes attacker-supplied input into it. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, with VA:L and no confidentiality or integrity impact), the effect is limited to denial of service, and the E:P exploit-maturity metric indicates publicly available proof-of-concept exploit code exists; there is no indication of confirmed active exploitation, and the vendor did not respond to the disclosure, so no vendor patch has been identified.
Opening a specially crafted PowerPoint document can cause Microsoft PowerPoint to read beyond the bounds of an allocated memory buffer and disclose process memory contents to an attacker (CVSS 5.5, C:H/I:N/A:N). The flaw affects Microsoft Office LTSC 2024 and 2021, Microsoft 365 Apps for Enterprise, and the Mac editions of Office/Office LTSC, and exploitation requires the victim to open the malicious file locally (AV:L, UI:R, PR:N) - it cannot be triggered remotely or automatically. There is no evidence of active exploitation or public exploit code, CISA SSVC rates exploitation as none and automatable as no, and Microsoft has released vendor patches for the affected builds.
Out-of-bounds memory read in Microsoft Excel allows an attacker to disclose information by convincing a victim to open a specially crafted Excel file with a vulnerable Office build. Affected releases are Microsoft Office LTSC 2021 before 16.0.14334.20974, Microsoft Office LTSC 2024 before 16.0.17932.21056, and affected Microsoft 365 Apps for Enterprise builds delivered through the Office security release channel. CISA's SSVC decision framework rates exploitation as none and no public exploit code has been identified at time of analysis; the flaw yields only information disclosure of adjacent memory (C:H, I:N, A:N) with no code execution or availability impact on its own, and exploitation is gated by a local vector (AV:L) plus mandatory user interaction (UI:R).
Out-of-bounds read in Microsoft Excel allows local attackers to disclose sensitive information from memory when a user opens a crafted spreadsheet. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2024 (below 16.0.17932.21056), and Office LTSC 2021 (below 16.0.14334.20974). Exploitation requires the victim to open a malicious file locally (UI:R, AV:L, PR:N), no public exploit was identified at time of analysis (SSVC Exploitation=none, Automatable=no), and vendor patches are available; the risk is assessed as moderate with impact limited to confidentiality (C:H, I:N, A:N) and no code execution or data modification.
Local information disclosure in Microsoft Windows Hello allows an attacker who already holds low-privileged authenticated access on a Windows 10 or Windows 11 host to read sensitive system data that should be outside their control sphere. Exploitation requires local interactive access (AV:L, PR:L), involves no victim user interaction (UI:N), and yields only confidentiality impact - no code execution, tampering, or denial of service - which is why our assessment rates this a genuine but comparatively low-priority issue rather than an urgent one. There is no evidence of active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, SSVC rates it not automatable, and Microsoft has released fixed build floors for every affected branch.