Improper resolution of path equivalence (CWE-41) in Visual Studio Code allows an unauthenticated local attacker to bypass a security feature, likely Workspace Trust or restricted mode, by convincing a victim to open and interact with a crafted workspace or folder. The vulnerability requires user interaction and high attack complexity, and while it has a CVSS score of 7.7 (High), it is a moderate-priority developer-workstation issue rather than an internet-facing emergency. No public exploit code has been identified at time of analysis, and the exact affected versions should be confirmed via the linked Microsoft advisory.
Unauthenticated file disclosure in Omnispace Agora Project before version 26.10.0 allows any remote attacker who can reach the MobileFileDownload route to retrieve files they are not authorized to access. The route treats md5(filename) as a capability token rather than performing a real access-control check, and because MD5 is deterministic and unsalted, an attacker who guesses or otherwise learns a stored filename can compute a valid token and download the file. No credentials or user interaction are required (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), CISA's SSVC assessment records exploitation as none observed while noting the attack is automatable with partial technical impact, and no public exploit code has been identified at time of analysis; the practical constraint is how guessable the target filenames are. A vendor patch is available in release 26.10.0.
Unauthenticated remote attackers can exhaust resources and disrupt availability across Commvault Cloud deployments by sending specially crafted, highly compressed messages to the platform's network messaging layer. Affected components include the CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale nodes, meaning any deployment exposing the messaging service on the network is reachable under default configurations (PR:N, UI:N). Impact is confined to availability (service disruption/denial of service) with no confidentiality or integrity loss, and no public exploit code or confirmed active exploitation was identified at time of analysis; EPSS data was not provided. Commvault has resolved the issue in a maintenance release and directs all customers to upgrade.
Authenticated, low-privilege users of Siemens RUGGEDCOM CROSSBOW running any version earlier than V6.0 can bypass access controls on sensitive configuration records and retrieve administrative credentials for various internal systems, yielding unauthorized information disclosure and follow-on privilege escalation. The defect is an authorization bypass through a user-controlled key (CWE-639) that is network-reachable with low attack complexity but requires a valid session, consistent with the CVSS 4.0 vector's PR:L and high confidentiality, integrity and availability impact confined to the CROSSBOW system itself. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Siemens has released V6.0 to correct the condition.
Arbitrary file read as root in Wazuh Manager 4.1.0 through 4.14.7 allows an enrolled agent to inject an upgrade_custom message over the agent-to-manager channel with an attacker-controlled file_path that the wm_agent_upgrade module processes without an origin check, disclosing sensitive files such as /etc/shadow and client.keys. Exploitation requires a valid enrolled agent identity (compromised or rogue agent, or stolen client.keys), so despite the vendor's CVSS 4.0 rating of 8.7 with PR:N, this is realistically not an anonymous internet-wide attack - our independent assessment scores it CVSS 3.1 8.7-to-moderate AV:N/AC:L/PR:L/UI:N with high confidentiality impact only. No public exploit code and no CISA KEV active-exploitation entry were identified at time of analysis, and a vendor patch is available in Wazuh 4.14.8.
Unauthenticated remote attackers can exploit XML external entity (XXE) handling in Commvault's CVFS component to read files from the underlying host, resulting in high-confidentiality information disclosure (CVSS 4.0 8.7 HIGH; vendor vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N). Affected deployments are Commvault Cloud and Grid (HSX) CVFS instances, per the vendor's CPE data, that remain on a pre-fix maintenance release and expose an XML-accepting CVFS interface to the network. Integrity and availability are unaffected, and no public exploit has been identified at time of analysis; the primary practical barrier is whether the storage/backup management plane is network-reachable rather than confined to an internal segment.
Remote code execution in Wazuh agents 4.3.0 through 4.14.7 (not including 4.14.8) allows an attacker who already holds manager-level control over a Wazuh deployment to run arbitrary SCA policy command checks as root on every enrolled agent. The root cause is that the SCA subsystem decides whether a policy is trusted by its file path rather than by its configuration source or signature, so an unsigned policy file planted in var/incoming through the agent upgrade channel is honored and its checks execute with root privileges. The vendor CVSS 4.0 base score is 8.6 (High) - network vector, low complexity, no user interaction (PR:H), with high confidentiality, integrity and availability impact on the agent - and represents a fleet-wide escalation that only applies after a manager has already been compromised. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor released a fix in Wazuh v4.14.8.
A heap-based buffer overflow in Commvault MediaAgent (and the associated HyperScale deployment) can be triggered over the network by an unauthenticated attacker, causing the service to crash and denying backup/data-protection availability. The affected component is the MediaAgent service within Commvault Cloud; per the provided CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required, though exploitation depends on the attacker being able to reach the MediaAgent/HyperScale service port, so firewall-segmented backup networks are materially less exposed. Impact is confined to availability (VA:H, with VC:N/VI:N), and there is no public exploit identified at time of analysis; CISA KEV does not list this issue. The input assigns CVSS 4.0 base 8.7 (HIGH); the independent assessment scores it 7.5 (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and both agree the effect is denial of service only.
Use-after-free in FreeRDP's smartcard redirection allows a malicious RDP server to corrupt memory on a connecting client, potentially leading to crashes or code execution. Affected versions are 3.0.0-beta1 through 3.31.x; exploitation requires the victim to connect to an attacker-controlled server with the smartcard channel active, and no public exploit identified at time of analysis.
SQL injection in Payload CMS allows an authenticated attacker holding read plus create-or-update access on a collection to inject arbitrary SQL through the "in" and "not_in" query parameters when the application uses the SQLite, D1-SQLite, Postgres, or Vercel-Postgres database adapters. The flaw is only reachable when a readable collection exposes a "json" field or a "blocks" field configured with blocksAsJSON: true, and can lead to high confidentiality and integrity impact on the backing database. Affected users should upgrade to Payload 3.90.0 (SQLite/D1 adapters and core) or 3.73.0 (Postgres/Vercel-Postgres adapters), or 4.0.0-canary.34; no public exploit identified at time of analysis.
Network storm traffic directed at Rockwell Automation 1732E ArmorBlock I/O modules can exhaust device resources and interrupt communications, causing the module to fault and stop responding on its open TCP and UDP ports; recovery requires a manual power cycle. The CPE data covers the 1732E ArmorBlock I/O product line broadly, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor score 8.7 under CVSS 4.0) confirms this is an unauthenticated, remote, availability-only condition with no confidentiality or integrity impact. There is no public exploit identified at time of analysis and no confirmed CISA KEV listing, so the realistic risk is concentrated in OT/ICS environments where these field devices are reachable from flat or untrusted networks, especially where a power cycle requires physical site access.
Cryptographic signature verification bypass in IBM WebSphere Application Server 8.5 and 9.0 and WebSphere Liberty 17.0.0.3 through 26.0.0.10 lets a remote, unauthenticated attacker forge or tamper with signed content that the server should reject, undermining trust in signed tokens and messages (CVSS 8.7, scope-changed integrity and confidentiality impact). Exploitation requires High attack complexity - the attacker must satisfy conditions outside their control when crafting input to reach the flawed verification path - so only deployments that process and validate signed input are realistically exposed. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Server-side request forgery in Adobe ColdFusion 2023 (≤2023.0.25) and ColdFusion 2025 (≤2025.0.13) lets unauthenticated, network-reachable attackers coerce the server into issuing arbitrary outbound requests, with the changed scope (S:C) allowing those requests to pivot into back-end or cloud services that can confer elevated privileges. Rated CVSS 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, CWE-918), the flaw requires no authentication and no user interaction per the vector, but real-world data exposure depends on the ColdFusion instance having reachable internal targets such as cloud metadata endpoints or internal APIs. No CISA KEV listing and no public exploit code were identified at time of analysis, yet the default-configuration exposure of affected versions makes prompt patching advisable.
Denial of service in Microsoft .NET lets an unauthenticated remote attacker force the runtime into disproportionately expensive computation, driving CPU or memory consumption high enough to degrade or halt a service. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms remote, low-complexity, unauthenticated exploitation with no user interaction and a high availability-only impact, requiring only that the vulnerable .NET code path be reachable by attacker-supplied network input - no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. Exposure is limited to reachable, .NET-based services; internal-only or non-.NET-facing deployments are not affected, and the exact affected runtime versions must be confirmed against the MSRC advisory.
Denial of service in Microsoft .NET and .NET Framework stems from uncontrolled recursion (CWE-674) in the System.Security.Cryptography.Xml and System.Private.Xml libraries, which an unauthenticated remote attacker can trigger by supplying crafted signed or encrypted XML that the target application parses. Affected runtimes include .NET 8.0 before 8.0.32, .NET 9.0 before 9.0.21, .NET 10.0 before 10.0.13, .NET 11.0 before 11.0.0-rc.2, and multiple .NET Framework builds (3.5 through 4.8.1) shipped on Windows, Linux and macOS, plus Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4. Impact is limited to availability (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 7.5) - process crash or hang, with no data exposure or code execution; CISA's SSVC assessment rates exploitation as 'none' meaning no public exploit identified at time of analysis, and exploitation is only practical against services that actually invoke XML signature or encryption validation on untrusted input.
Unauthenticated remote denial of service against Microsoft .NET Framework and the System.Security.Cryptography.Xml library, caused by asymmetric resource consumption (CWE-405) during processing of attacker-supplied XML. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): any service that exposes XML signature parsing/verification to untrusted input, on affected builds of .NET Framework 3.5, 4.6.2/4.7/4.7.1/4.7.2, 4.8 below 4.8.4811.0 and 4.8.1 below 4.8.9363.0, or System.Security.Cryptography.Xml below 10.0.13, can be driven into resource exhaustion that degrades or halts the service. No public exploit code has been identified at time of analysis and it is not listed in CISA KEV; SSVC records Exploitation: none with Automatable: yes, indicating a technically reproducible, wormable-class DoS pattern rather than a currently observed campaign. Impact is limited to availability - no confidentiality or integrity loss and no code execution path.
Denial of service in Microsoft .NET Framework (versions 3.5 through 4.8.1) and the System.Security.Cryptography.Xml package allows a remote, unauthenticated attacker to exhaust server resources by submitting crafted input to an application that processes it through the vulnerable code path; the assessed vector is AV:N/AC:L/PR:N/UI:N with availability-only impact (C:N/I:N/A:H, CVSS 7.5), meaning no data disclosure and no code execution. The affected-component list points at XML and cryptographic-XML handling - for example XML signature verification or SAML-style document parsing - so internet-facing endpoints that accept such documents are the primary exposure. Microsoft has published a vendor advisory with fixed builds, and no public exploit has been identified at time of analysis (SSVC exploitation: none); CISA KEV does not list this CVE.
Unauthenticated remote denial of service in ASP.NET Core (8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2) lets a network-reachable attacker exhaust resources because request processing is not adequately bounded or throttled, degrading or halting availability of hosted applications. Per the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, exploitation requires no credentials, no user interaction, and no special configuration, but impact is confined to availability - no data disclosure or code execution results. No public exploit identified at time of analysis and SSVC records exploitation as none, though the flaw is rated automatable, meaning exploit tooling could be developed; patched framework builds and updated Visual Studio tooling are available from Microsoft.
Denial of service in ASP.NET Core 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaust server memory by sending crafted multipart requests that trigger unbounded buffer allocation in Microsoft.AspNetCore.WebUtilities.FileBufferingReadStream, ultimately degrading or halting the application (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). Affected deployments are those running unpatched runtimes (8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13) and the bundled Visual Studio toolchains, specifically applications that expose endpoints consuming buffered or multipart/form-data request bodies; no authentication or special non-default configuration is required beyond such a route existing. Microsoft has published patched runtime packages, and no public exploit code has been identified at time of analysis - CISA SSVC records exploitation as 'none' and the issue is not listed in KEV, though the attack is rated automatable, making rapid patching advisable for internet-facing upload endpoints.
Denial of service in ASP.NET Core SignalR affects applications that have stateful reconnect enabled and that reference vulnerable versions of Microsoft.AspNetCore.SignalR.Common (8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.5 through 11.0.0-rc.1) or Microsoft.AspNetCore.SignalR.Core (1.0.0 through 1.2.13). An unauthenticated remote attacker can repeatedly trigger stateful reconnect handling so that MessageBuffer.ResendAsync backpressure blocks broadcasts indefinitely while retaining associated server resources, degrading or halting hub messaging for all connected clients; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms a pure availability impact with no confidentiality or integrity loss. CISA's SSVC evaluation rates exploitation as 'none' with automatable attack steps and partial technical impact, and no public exploit code has been identified at time of analysis - patch status is vendor-released, with fixed package versions published by Microsoft, so remediation is straightforward but the exposure is limited to non-default stateful-reconnect configurations.
Arbitrary file system read in Adobe ColdFusion (2023 releases up to and including 2023.0.25 and 2025 releases up to and including 2025.0.13) is achievable through an XML External Entity (XXE) flaw that lets a remote attacker cause the server to resolve attacker-controlled external entities during XML processing. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C (8.6), meaning the attack is unauthenticated, requires no user interaction, and crosses a security boundary so that disclosed data lies outside the vulnerable component's own scope; impact is confidentiality-only (high) with no integrity or availability effect. No public exploit code and no CISA KEV entry were identified at time of analysis, so risk derives from how many unpatched, network-reachable XML-processing endpoints exist rather than from confirmed active exploitation.
Authenticated SQL injection in Frappe Framework before 16.23.0 lets a user with report access alter the raw SQL statement executed by the reportview get_count() method, potentially reading or modifying data the account should not reach. The flaw is reachable through the report/list view API by supplying crafted report input (fields/filters) that was interpolated into a 'select count(*) from ( ... )' query via frappe.db.sql(); the fix rewrites the count using the query builder's Count function with parameterized execution. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), but exploitation requires only a valid account with report access (CVSS PR:L, AV:N), and default deployments older than 16.23.0 are exposed.
Stored cross-site scripting in Froxlor 2.0.0 before 2.3.14 allows an authenticated customer to inject HTML/JavaScript through a theme value set in customer_index.php; the payload only executes when an administrator later views the customer overview with the Theme column enabled. Successful exploitation can abuse the administrator's CSRF token to create administrator accounts or change server settings. No public exploit code or CISA KEV listing is identified in the available data, so this is a credible but conditional priority requiring valid customer credentials and an administrator to browse the affected view.
Server-side request forgery in Adobe Content Credentials (CAI Content Credentials SDK) allows unauthenticated remote attackers to induce the server to make arbitrary outbound requests, potentially reaching internal services and escalating privileges. The CVSS 3.1 base score is 8.6 (HIGH) with a changed scope, high confidentiality impact, and no integrity or availability impact. Exploitation requires no user interaction; no public exploit code has been identified at time of analysis, and the vendor advisory APSB26-163 should be consulted for fixes.
Server-side request forgery in Adobe ColdFusion lets remote unauthenticated attackers force the server to issue requests to internal or otherwise protected endpoints, which Adobe flags as potentially escalating privileges across a security boundary. The affected builds are ColdFusion 2023 up to and including 2023.0.25 and ColdFusion 2025 up to and including 2025.0.13; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) confirms no user interaction and no authentication prerequisite, with confidentiality being the only impact dimension assessed. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, so risk derives from high internet/network exposure of affected builds rather than confirmed active exploitation. Real-world severity hinges on what the ColdFusion host can reach internally, since a scope-changed SSRF that touches cloud metadata services or internal admin APIs can yield credential material even without an integrity or availability impact.
Command injection in the backup function of Teltonika Networks RUTOS and TSWOS allows an attacker who already holds high-privilege administrative access on an adjacent network segment to execute arbitrary OS commands on the device. Affected builds are RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 on RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD and EBG devices, RUTOS 7.22 before 7.25.2 on TAP devices, and TSWOS 1.9 before 1.10.4 on TSW and SWM devices. No public exploit has been identified at time of analysis, and the assessed prerequisites (PR:H for administrator credentials plus AV:A for management-plane adjacency) mean exploitation is not reachable by an arbitrary internet attacker; patched firmware is available.
TOTP-based second-factor authentication in Ikaros 1.2.0 through 1.2.5 can be bypassed, letting an attacker who already knows a valid account password obtain a fully authenticated session - including the master administrator account - without ever supplying a TOTP code. The temporary login token issued by the jwt/apply endpoint can be replayed as a bearer JWT, refreshed into a session token, or exchanged through HTTP Basic login, collapsing a two-factor login into single-factor authentication. This is not a pre-authentication bypass: valid first-factor credentials and an account that relies on TOTP are both required, and the resulting impact is bounded by the privileges of the compromised account (rated 8.6 under CVSS v4.0; assessor's v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N); no public exploit identified at time of analysis, although a public technical writeup documents the temp-token reuse technique.
Wazuh Manager 4.0.0 through 4.14.7 fails to consult its token revocation blacklist inside the check_token routine, so a previously issued administrator JWT remains usable after the administrator grant behind it has been revoked. The bypass specifically affects run_as users that have zero static roles: such an account can keep authenticating with the stale token and self-link the administrator role, permanently re-acquiring privileged access it was supposed to have lost. Exploitation requires an already authenticated actor who previously held high privileges (CVSS vector PR:H), meaning the realistic threat is insider or post-offboarding privilege retention rather than external compromise; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor-released patch is available as 4.14.8.
Session fixation in Omnispace Agora Project before 26.10.0 lets remote, unauthenticated attackers hijack a victim's authenticated session by planting a known session identifier in the victim's browser and waiting for them to log in, because the application does not regenerate the session ID after successful authentication. Exploitation hinges on victim interaction - the target must follow attacker-supplied content that sets a chosen identifier and then actively authenticate to that same session (CVSS UI:A), which is the primary factor limiting real-world abuse. No public exploit code has been identified and the flaw is not confirmed as actively exploited (CISA KEV), and the vendor has shipped 26.10.0 as the fixed release.
Unauthenticated information disclosure in Microsoft Dynamics 365 Business Central allows any attacker who can reach an affected instance over the network to read sensitive data without credentials, user interaction, or any special client-side condition (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The flaw is root-caused to CWE-306 (Missing Authentication for Critical Function) and is strictly a confidentiality issue: no data modification or service disruption results from the bug itself, and no public exploit identified at time of analysis. Practical risk is governed almost entirely by network reachability and patch level, making this a credible, above-average-priority information-disclosure flaw rather than an emergency.
Wazuh Manager 4.14.3 through 4.14.7 and 4.10.4 allow an authenticated API user holding manager:update_config to escalate to root command execution on the manager host by uploading an ossec.conf containing an uppercase <LOG_FORMAT> element. The Python configuration validator matches the log_format tag name case-sensitively and therefore never classifies the block as a command, while wazuh-logcollector matches the same element with strcasecmp and executes its <command> as root on the next reload. The bypass works even with the hardened upload_configuration.remote_commands.localfile.allow: no setting, and the built-in non-system-admin cluster_admin role ('Manager administrator', policy cluster_all) grants both manager:update_config and manager:restart, so a single non-administrator role can complete the upload-and-reload chain over REST on a single, non-clustered manager. Proof-of-concept scripts using a safe /tmp marker are attached to the upstream advisory; EPSS is low (0.37%, 29th percentile) and there is no public exploit identified at time of analysis beyond those PoC references.
Authenticated SQL injection in the calendar module of Omnispace Agora Project before 26.10.0 lets a low-privileged user read arbitrary data from the backend database by tampering with the sortEvents parameter, which is concatenated unsanitized into an ORDER BY clause in app/ModCalendar/CtrlCalendar.php. Exploitation requires a valid session with access to the calendar feature (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so anonymous internet-wide attacks are not possible; the impact is confidentiality-only, with error-based payloads such as extractvalue() used to leak database version information. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available in release 26.10.0.
Second-order SQL injection in Omnispace Agora Project before 26.10.0 lets an authenticated user store a malicious _idCategoryFilter value in their own server-side session, which is later concatenated without parameterization into SQL in app/Common/MdlCategory.php, granting high-impact read and write access to the underlying database. Exploitation requires a valid authenticated session (CVSS 4.0 base 8.6; assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), so unauthenticated outsiders cannot reach the sink and risk concentrates in deployments that issue accounts to numerous or low-trust users; no public exploit identified at time of analysis. The vendor has released 26.10.0, which removes the vulnerable condition.
Authenticated low-privilege FastBee users can read and seize control of IoT devices belonging to other tenants: the DeviceController endpoints accept a caller-supplied device ID or serial number and never verify that the requesting account actually owns that device (CWE-639). Because identifiers are sequential and easy to guess, anyone who can self-register on a FastBee 2.1.0-or-earlier instance can enumerate devices, harvest owner, IP and location metadata, and then overwrite the stored user_id and tenant_id fields to permanently take over the target device. Confirmed exploitation has not been reported (no CISA KEV entry), and no public exploit code was identified at time of analysis, but a detailed third-party technical writeup of the flaw exists, and the independent assessment rates it a genuine, prioritizable authorization defect rather than a drop-everything emergency, since a valid tenant account is a prerequisite (PR:L in the vector) and cross-tenant impact only materializes on multi-tenant deployments.
Missing authorization in MateCloud through 5.0.8 lets any authenticated remote user call /api/v1/admin/storage endpoints in StorageController without an administrative role and supply arbitrary bucket and objectName values, enabling low-privilege or self-registered accounts to list files, obtain pre-signed download URLs for other users' objects, delete objects, and upload at chosen keys. The CVSS 4.0 vector confirms network reachability with low privileges (PR:L) and no user interaction, while the independent assessment limits practical risk to the configured object-storage backend and notes that open self-registration lowers the barrier to entry. No public exploit code or confirmed active exploitation is identified in the supplied intelligence, and the independent assessment treats this as a genuine prioritization concern rather than an inflated high-CVSS artifact.
Authenticated users of Omnispace Agora Project instances running versions before 26.10.0 can insert access-right records (affectations) for arbitrary spaces by invoking setAffectations() with a caller-supplied target space identifier, breaking tenant isolation and extending access to spaces the caller has no rights over. Exploitation is network-reachable, low-complexity, requires only a valid account on the target instance (CVSS PR:L), and needs no user interaction or non-default configuration, yielding high confidentiality and integrity impact while availability is unaffected. No public exploit code has been identified at time of analysis, but because the flaw is a straightforward authorization-check omission reachable by any logged-in user, multi-tenant or shared-hosting deployments carry the highest realistic risk; the vendor-released fix is Agora Project 26.10.0.
Unauthenticated remote attackers can exhaust memory or other pooled runtime resources and cause denial of service against network-reachable services built on affected versions of Microsoft .NET Framework (3.5, 4.6.2/4.7/4.7.1/4.7.2, 4.8, 4.8.1) and the System.Security.Cryptography.Xml package before 10.0.13, because the runtime allocates resources without limits or throttling (CWE-770). The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms the attack requires no authentication, no user interaction and no special configuration against default installations, with impact limited to availability and no confidentiality or integrity loss. No public exploit code or confirmed active exploitation is present in the source data (CISA SSVC exploitation: none; EPSS not reported), although the flaw is assessed as automatable, meaning exploitation can be scripted once a triggering input path is identified.
An out-of-bounds write (CWE-787) in ASP.NET Core and the associated .NET runtimes lets a remote, unauthenticated attacker trigger memory corruption that crashes or destabilizes a network-reachable service, yielding a full loss of availability (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation requires no credentials, no user interaction, and no special configuration - only that the target endpoint be reachable and running an unpatched build (for example .NET 8.0 below 8.0.32, .NET 9.0 below 9.0.21, or .NET 10.0 below 10.0.13). There is no public exploit identified at time of analysis and CISA's SSVC rates exploitation as "none" while marking the flaw fully automatable, so scripted denial-of-service attempts remain a plausible near-term risk; vendor patches are available.
Unauthenticated remote attackers can drive CPU exhaustion in .NET applications that validate untrusted signed CMS/PKCS#7 data, because SignedCms.CheckSignature in the System.Security.Cryptography.Pkcs package repeatedly reparses attacker-controlled X.509 content at quadratic cost (CWE-407, CVSS 7.5, AV:N/AC:L/PR:N/UI:N with availability-only impact, C:N/I:N/A:H). Affected build ranges are System.Security.Cryptography.Pkcs 8.0.0 through 8.0.1, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1, along with the listed .NET Framework 3.5 / 4.6.2 / 4.7 / 4.7.1 / 4.7.2 / 4.8 / 4.8.1 servicing baselines and Visual Studio 2022 17.14 and Visual Studio 2026 18.10. Exploitation is bounded to services that actually accept and cryptographically verify externally supplied signed CMS messages through this API; no public exploit identified at time of analysis, and CISA SSVC records exploitation as none.
Broken access control in Omnispace Agora Project releases before 26.10.0 lets an authenticated space administrator assign users into spaces that lie outside their own authority, breaking tenant isolation in multi-tenant deployments. The flaw sits in the user import flow's join INSERT, where the spaceAffectList affectation is written without the readRight() authorization check on the target space, so a caller holding space-admin rights on one space can manipulate user-space assignments in spaces they should not control (CWE-862, CVSS 8.6 v4.0; assessed as CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Exploitation requires a pre-existing space-administrator account and is only meaningful where separate tenants/spaces are relied upon for isolation; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Unauthenticated abuse of client-trusted logic in the Biletiva Ticketing Platform lets remote attackers bypass security and authorization checks that exist only in the browser client, then directly manipulate server-side state such as ticket, order, or pricing data. The flaw (CWE-602) carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L), meaning no credentials, no user interaction, and only ordinary request tampering are needed to reach the integrity-critical impact, while confidentiality and availability effects remain limited. Exploitation is constrained chiefly by the product's narrow deployment footprint rather than by any technical barrier, and no public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported to national authorities by TR-CERT.
Arbitrary code execution in Adobe Photoshop Desktop is possible when a user opens an attacker-supplied file, because an incorrect authorization check (CWE-863) combined with a scope change lets crafted file content escape the application's intended security boundary and run code as the current user. Photoshop builds 27.10 and earlier and 26.11.7 and earlier are affected, and exploitation hinges on convincing a victim to download and open the malicious file (AV:L, PR:N, UI:R), which makes phishing or poisoned shared assets the realistic delivery path rather than any remote or network-facing vector. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuinely serious but not emergency-tier issue; a vendor advisory (APSB26-158) is available.
Arbitrary code execution in Adobe Dimension 4.1.8 and earlier occurs through a CWE-426 untrusted search path flaw where a local attacker can pre-stage a malicious DLL or shared library in a directory the application searches ahead of the trusted location, which is then loaded when a victim launches Dimension. Exploitation requires local file-write access and user interaction, and no public exploit or CISA KEV listing has been identified at time of analysis. The vendor CVSS base score is 8.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), indicating high impact despite the local and interaction prerequisites.
Arbitrary code execution in Adobe Dimension 4.1.8 and earlier is possible when a user opens a crafted project or asset file containing improperly neutralized input that is then processed during the application's page/content generation (CWE-79). The attack surface is local only: an attacker must first place malicious content on the victim's machine and persuade them to launch Dimension, but success yields full confidentiality, integrity, and availability impact with a changed scope, meaning the resulting code execution can affect resources beyond Dimension's own boundary. The issue is scored CVSS 3.1 base 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Arbitrary code execution in Adobe Dimension (all versions from 0 through 4.1.8 inclusive) is possible because the application loads libraries/DLLs from an uncontrolled search path, allowing a local attacker to plant a malicious file that Dimension resolves and loads. Exploitation yields code execution in the context of the current user and requires the victim to launch the application (UI:R) after a local attacker with user-level write access has staged the malicious element in an attacker-influenceable directory; the scope-changed CVSS vector (AV:L/PR:N/UI:R/S:C) means no prior privileges are needed but local access and user interaction are. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Adobe PSIRT published advisory apsb26-171 for tracking.
An out-of-bounds read in the .NET runtime and toolchain (CVE-2026-96232) allows an unauthenticated, remote attacker to read memory beyond intended buffer boundaries and disclose its contents over the network, rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Affected builds are .NET 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13 and 11.0 before 11.0.0-rc.2, plus applications developed with Microsoft Visual Studio 2022 before 17.14.42 and Visual Studio 2026 before 18.10.4. Only confidentiality is impacted - there is no code execution, privilege escalation or data modification - and no public exploit identified at time of analysis; CISA's SSVC assessment records exploitation as none while noting the attack is automatable, and intelligence sources indicate a vendor patch is available. The practical risk depends entirely on whether a vulnerable .NET application exposes the affected code path to untrusted network input, so internet-facing services built on the unpatched runtimes are the priority targets.
Huawei openUBMC and its related iBMC builds ship a hardcoded SNMPv3 USM key - 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581 in the iBMC product build and 7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b in the community seed - that is used for both authentication and privacy, so an unauthenticated attacker with network reachability to the SNMPv3 service can log in and decrypt SNMPv3 traffic once they pull the constant from the open-source build. Because SNMP is mapped to full device administration on these units, including system reset and firmware upgrade, the practical result is device-level configuration and integrity control; the key is a build constant that is not rotated by the Administrator password reset, so it survives account provisioning and the dangerous state is effectively the default. Reported severity is 8.6, but our reassessment scores it 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) given full confidentiality, integrity and availability exposure; no public exploit code was identified at time of analysis, although the key material itself is publicly recoverable from the open-source build, and the only reliable limiting factor is whether an operator has manually replaced the shipped USM keys.
Thunderbird's Exchange Web Services (EWS) integration can be hung by a hostile Exchange server: a single well-formed SOAP response containing an element with an excessive number of attributes keeps the client's main thread CPU-bound for seconds to hours, freezing the application. Only users who have configured an Exchange/EWS account against an attacker-controlled, compromised, or man-in-the-middle-positioned Exchange server are exposed, and the user must actively use that account so the crafted response is fetched and parsed; the result is availability-only (no code execution, no data disclosure). Mozilla fixed the issue in Thunderbird 158 and Thunderbird 153.5, EPSS is low at 0.17% (6th percentile), and no public exploit code or CISA KEV entry was identified at time of analysis.
An authenticated attacker with administrative access can upload modified firmware to Schneider Electric SAGE RTU 1410, 1430, 1450, 2400, 3030 Magnum, and 4400 devices because the firmware update procedure does not verify image authenticity, allowing full control over the RTU. The vendor CVSS 4.0 vector rates this High severity at 8.6 with high confidentiality, integrity, and availability impact, but the PR:H prerequisite limits realistic exploitation to insiders, stolen admin credentials, or a compromised engineering workstation with device access. No public exploit identified at time of analysis, and no KEV entry or POC data is present.
OS command injection in rovr (a Python-based terminal file manager) through 0.10.3 on Windows allows a file name containing Windows shell metacharacters such as '&' to be passed unquoted to cmd.exe, executing arbitrary commands with the privileges of the user who opens that file via the open_file routine. Only Windows installations of rovr at or below 0.10.3 are affected; the vector is local and successful exploitation requires the victim to actively select and open an attacker-planted file, with the injected command running at the invoking user's existing privilege level (no elevation, no scope change). There is no CISA KEV listing and no public exploit identified at time of analysis; the CVSS 4.0 base score of 8.4 (High) reflects high confidentiality, integrity and availability impact, tempered by the local attack vector and mandatory user interaction.