Client-side DOM cross-site scripting in Misskey's RSS widgets lets an attacker who controls or can inject into a feed that a victim has subscribed to execute arbitrary script in the victim's browser when the victim clicks a crafted feed-item link. All Misskey versions from 12.0.0 up to 2026.7.0 are affected, specifically the WidgetRss, WidgetRssTicker, and statusbar-rss components, which rendered feed-item links without restricting the URL scheme; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) indicates unauthenticated remote exploitation that still requires a user to actively click the malicious link. No public exploit code has been identified at time of analysis, and the issue is fixed in version 2026.7.0.
Incorrect authorization in Chrome's Mojo IPC layer on Windows prior to 155.0.8059.79 allows a local attacker - a low-privileged user or code already running inside a Chrome child process - to escape the sandbox and execute arbitrary code with the browser's privileges; the flaw is a privilege boundary failure in the browser process, not a remote code-execution bug reachable by a web page alone. Exploitation requires a foothold on the Windows host: either a malicious local program or, in the more typical Chrome scenario, a compromised sandboxed renderer that chains this bug to break out. There is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor patch is available; NVD's 9.6 score (AV:N/UI:R) overstates reachability compared with the independently assessed vector (AV:L/PR:L/UI:N), so the practical risk profile is a post-compromise sandbox escape rather than an unauthenticated network attack.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition (on-premises builds 16.0.0 below 16.0.20326.20190) lets an authenticated, low-privilege user coerce the SharePoint server into issuing HTTP requests to internal or otherwise unreachable endpoints, producing high confidentiality, integrity and availability impact and enabling privilege elevation over the network. The issue is rated CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), so an existing authenticated account is required and additional server-side conditions must be satisfied for the forgery to succeed, which materially limits reliability. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none', and Microsoft has published a vendor-released fix, making this a genuine but moderate-priority issue rather than a drop-everything emergency.
Authentication bypass by spoofing in the Microsoft.AspNetCore.Authentication.Negotiate package for ASP.NET Core lets an authenticated remote attacker (PR:L) have their Kerberos-authenticated identity associated with an unintended LDAP principal, yielding high confidentiality, integrity, and availability impact (CVSS 7.5) after the attacker reaches the application over the network. Exposure is conditional: the application must use an affected package version - 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, or 10.0.0 through 10.0.12 - and must have LDAP claim resolution enabled, an opt-in and non-default configuration, on Windows, Linux, or macOS. CISA's SSVC assessment records no exploitation, and no public exploit code was identified at time of analysis; the AC:H metric reflects that a specific spoofing/timing condition outside the attacker's full control must be satisfied, making this a genuine but conditional privilege-escalation issue rather than a mass-exploitation emergency.
Code execution in .NET and Visual Studio can be triggered when a developer or user processes attacker-supplied content - such as a crafted project, build input, or dependency - that pulls functionality in from an untrusted control sphere and executes it. Affected builds are .NET 8.0 before 8.0.132, .NET 9.0 before 9.0.319, .NET 10.0 before 10.0.113, Visual Studio 2022 17.14 before 17.14.42, and Visual Studio 2026 18.10 before 18.10.4; the issue is network-reachable and unauthenticated (PR:N) but requires user interaction (UI:R) and non-trivial preconditions (AC:H), so an attacker cannot silently trigger it remotely. There is no public exploit identified at time of analysis and no confirmed active exploitation - the CISA SSVC exploitation value is 'none' - which keeps this a moderate-priority issue rather than a drop-everything emergency despite the 7.5 High CVSS score, especially since the SSVC technical impact is assessed as 'total' once exploitation conditions are met.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privileged user on the target farm coerce the server into issuing requests to attacker-influenced destinations, which Microsoft rates as a network-vector privilege elevation (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not trivial: the assessed conditions require a valid low-privileged account (PR:L) plus environmental factors captured by AC:H - a reachable internal target, specific server configuration, and/or timing and state dependencies that the attacker does not fully control. Only SharePoint Server Subscription Edition builds 16.0.0 below 16.0.20326.20190 are affected, no user interaction is needed (UI:N), no public exploit was identified at time of analysis, and CISA's SSVC evaluation records Exploitation: none and Automatable: no, so this is a real but non-urgent patching priority rather than an emergency.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker with low privileges force the SharePoint application server to issue crafted requests on their behalf, which can expose sensitive internal resources and, per Microsoft's rating, enable privilege elevation over a network. The affected builds are SharePoint Server Subscription Edition versions earlier than 16.0.20326.20190, and exploitation requires network access plus a valid low-privileged account while also requiring attack-specific conditions that Microsoft captures as high complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5). CISA's SSVC decision data records Exploitation: none, Automatable: no, and Technical Impact: total, so no public exploit code or in-the-wild activity is identified; the impact is nonetheless potentially total against confidentiality, integrity, and availability once the request-forgery primitive is chained successfully, and a vendor patch is available. This is a moderate-priority vulnerability that does not currently rise to emergency status.
Privilege escalation in upKeeper Instant Privilege Access through version 1.7.1 lets a local, authenticated low-privileged user gain elevated privileges by triggering improper handling of undefined values during input processing, with user interaction required for the escalation to succeed. The flaw carries a CVSS 4.0 base score of 8.6 (High) driven by total confidentiality, integrity and availability impact across both the vulnerable component and subsequent systems, although local access (AV:L), a valid low-privileged account (PR:L) and mandatory user interaction (UI:A) materially constrain real-world exploitability. There is no public exploit identified at time of analysis, and CISA SSVC assessment records Exploitation: none with Automatable: no, meaning scripted or fully autonomous attacks are not expected.
An authentication bypass in the Wazuh Manager API (versions 4.6.0 through 4.14.7) lets an account that already holds delegated user-administration rights take full control of the reserved wazuh superuser account by submitting an empty password to the user-update endpoint, after which the attacker can authenticate as that superuser with a blank credential. The flaw is a logic error in the security.update_user handling: the reserved-user guard and the password-policy check sit inside a truthiness test, so an empty string evaluates as falsy and both protections are skipped entirely, yielding a complete confidentiality, integrity, and availability impact on the manager (CVSS 8.6 under CVSS 4.0; our independent assessment scores CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is not unauthenticated and cannot be triggered by a low-privilege user - it requires a pre-existing privileged (PR:H) role capable of calling the user-update RBAC endpoint - so risk is concentrated in multi-tenant, MSSP, or role-delegated deployments and in post-compromise privilege escalation; confirmed actively exploited status is not present (no CISA KEV listing) and no public exploit code was identified at time of analysis. A vendor patch is available in Wazuh v4.14.8.
Missing authorization in the NVIDIA AIStore ETL management API lets remote, unauthenticated attackers read ETL job information and issue start or stop operations against existing extract-transform-load pipelines by sending crafted GET or POST requests to an AIStore proxy (CVE-2026-65172, CVSS 8.6, CWE-862). Per the assessed vector (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:L), no credentials or user interaction are required; the practical constraint is network reachability to a proxy that exposes the ETL management API in Linux or Kubernetes deployments. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the immediate risk is driven by exposure of the proxy API rather than by observed attack activity.
Unauthenticated remote attackers can abuse NVIDIA AIStore's experimental HT backend to perform server-side request forgery by supplying a crafted 'original URL' value, causing the AIStore server to issue requests to attacker-chosen destinations and disclose information reachable from the server's network position. The flaw carries a CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), reflecting no authentication or user interaction requirement and a scope change, with impact confined to confidentiality - integrity and availability are unaffected. There is no public exploit identified at time of analysis, and the practical risk is gated almost entirely on whether the experimental HT backend has been enabled on a network-exposed deployment, since that component is not part of the default AIStore configuration and is only reachable in non-standard setups.
Server-side request forgery in NVIDIA AIStore for Linux's distributed sort (dsort) component allows remote unauthenticated attackers to make an AIStore node issue outbound HTTP requests to an arbitrary URL by supplying a crafted external key map URL, resulting in disclosure of information from internal or otherwise unreachable services. The CVSS 3.1 base score is 8.6 (High) via AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, meaning the attack is network reachable, low complexity, requires no privileges and no user interaction, with the impact limited to confidentiality (integrity and availability are unaffected). At time of analysis no public exploit code has been identified, there is no CISA KEV listing for this CVE, and no EPSS score was supplied in the available data.
Heap-based buffer overflow in Microsoft SQL Server lets an attacker who already holds a valid low-privilege database login execute arbitrary code on the database engine over the network, with impact crossing a security scope boundary (CVSS 8.5; AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Affected builds span SQL Server 2017, 2019, 2022, and 2025 across both the GDR (security-only) and cumulative-update branches, so most unpatched enterprise estates that still run older builds are in scope. Exploitation is not trivial - the high attack complexity implies reliable heap layout/grooming or a timing-sensitive corruption window must be achieved - and there is no public exploit identified at time of analysis, but a vendor patch is available and the flaw should be prioritized on internet-exposed or broadly accessible database listeners.
Privilege elevation in Microsoft SQL Server (2017, 2019, 2022 and 2025 builds below their patched levels) allows an authenticated, low-privileged database principal to trigger a heap-based buffer overflow in the database engine over a network connection and gain higher privileges, with impact crossing a security boundary (CVSS 8.5, S:C). Exploitation is not anonymous: the attacker must already hold a valid SQL Server login (PR:L) and satisfy a hard-to-control heap-state or race condition (AC:H), so the flaw is not automatable or scalable (SSVC Automatable: no, Exploitation: none), and no public exploit code has been identified at time of analysis. Microsoft has published fixed builds via its update guide, so this is a legitimate but not top-tier emergency priority - patch promptly, with urgency driven by the total technical impact and the broad installed base.
Authenticated code execution in Microsoft SQL Server 2017 through 2025 arises from a heap-based buffer overflow (CWE-122) that allows a low-privileged database login to execute code on the database server over the network. Exploitation is not available to unauthenticated attackers: valid credentials for a SQL Server login are mandatory (CVSS PR:L) and the high attack complexity (AC:H) reflects the heap-layout grooming normally required for a reliable overflow, so the practical bar is considerably higher than the 8.5 base score alone suggests. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds across every affected servicing branch.
Authenticated remote code execution in Microsoft SharePoint allows a low-privileged user with network access to trigger deserialization of untrusted input, potentially running code on the server. The vulnerability requires a valid SharePoint account (PR:L), needs no user interaction (UI:N), and has low attack complexity (AC:L), but assessed impacts are limited to low confidentiality, integrity, and availability (CVSS 7.4, S:C). No public exploit or active exploitation is indicated in the provided intelligence, and this is a credible but moderate-priority vulnerability, with risk concentrated in environments where SharePoint accounts are broadly provisioned or the service is internet-exposed to authenticated users.
Improper link resolution in Citrix UniconOS before 2607 CR and before 2603 LTSR CU2 lets local attackers with low privileges escalate to high-impact file read and write operations by planting symbolic links that privileged processes follow. Successful exploitation yields high confidentiality, integrity, and availability impact on the affected device, though the attack requires an existing local foothold and cannot be performed remotely. No public exploit code or confirmed active exploitation has been identified at time of analysis.
An unauthenticated, network-positioned attacker can bypass a security feature in Visual Studio Code versions 1.0.0 up to but not including 1.141.1 by getting a victim to open or interact with attacker-controlled content, resulting in high confidentiality impact (CVSS 7.4, S:C/C:H/I:N/A:N). The user-interaction requirement (UI:R) is the primary limiting factor - the flaw cannot be triggered fully passively and no privileges or local access are needed once the victim interacts. Neither KEV confirmation nor public exploit code has been identified at time of analysis, so this is a moderate-priority patching item rather than an emergency, though the scope-changed, high-confidentiality rating keeps it above routine maintenance.
Local privilege escalation in Hammock AssetView allows an authenticated low-privileged user with interactive logon to a Windows host running the Management Console or Client Terminal to gain SYSTEM privileges. The flaw stems from incorrect permission assignment on a critical resource (CWE-732) and is rated CVSS 8.5 (High) in CVSS 4.0, reflecting high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and exploitation requires the attacker to already have local interactive access to the specific component host, not arbitrary managed endpoints.
Stored cross-site scripting in the Plane (makeplane) project management tool prior to version 1.4.0 allows an authenticated project member to plant a crafted link using an unsafe URL scheme, such as javascript:, inside a comment, which then executes in the browser context of any other user who selects that link. Exploitation is conditional rather than drive-by: the attacker must already hold legitimate project membership (PR:L) and a second user must actively click the injected link (UI:P/UI:R), which is why this is a genuine but conditional threat rather than a critical remote compromise. Vendor-released patch: 1.4.0; no public exploit code and no confirmation of active exploitation were identified at time of analysis, and EPSS risk data was not provided, so risk derives from the CVSS 4.0 base score of 8.5 and the high confidentiality and integrity impact within the affected web application scope.
Path traversal in the Wazuh Manager cluster upload handlers (upload_list_file, upload_rule_file, upload_decoder_file) lets an attacker who holds the cluster authentication key write files to arbitrary paths on the manager as the wazuh user, with '../' sequences in the filename parameter slipping past REST controller validation. Affected versions are Wazuh 4.1.1 through 4.14.7 (fixed in 4.14.8); exploitation requires the manager to be running in cluster mode and the actor to already possess the shared cluster key, so this is a post-compromise/lateral-movement primitive against clustered deployments rather than an internet-facing unauthenticated bug. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), but the integrity and availability impact is high once the key prerequisite is met, and the vendor has shipped a patch.
Arbitrary code execution in Adobe ColdFusion 2023 and 2025 is achievable through an incorrect authorization flaw (CWE-863) in a component that is, by default, reachable only from the administrative network zone. Exploitation requires two prerequisites confirmed by the assessed vector CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (8.4): the attacker must already be positioned on the adjacent administrative network segment, and must hold a high-privilege ColdFusion account; no user interaction is required and complexity is low once those conditions are met. There is no public exploit identified at time of analysis, so this is a serious but constrained flaw rather than a drop-everything internet-facing emergency - exposure is concentrated in organizations that expose the ColdFusion administrative zone broadly or allow high-privilege accounts to proliferate.
Improper input validation in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows a high-privileged, already-authenticated attacker with network adjacency to the administrative component to execute arbitrary code in the context of the current user, with full confidentiality, integrity and availability impact and a changed scope (CVSS 8.4). Exploitation is access-gated rather than remotely reachable: the attacker must hold high privileges on the system (PR:H) and be positioned within the administrative network zone where Adobe confines the vulnerable component by default (AV:A), with no user interaction required (UI:N). No public exploit code and no CISA KEV entry have been identified at time of analysis, so this is a high-severity but access-gated issue rather than a drop-everything emergency; because the scope is changed, successful exploitation can affect resources beyond the vulnerable component itself.
Improper privilege management in Windows' WinINet component (wininet.dll) lets an authenticated, low-privileged local attacker spoof a trusted identity and bypass authentication, with the impact spilling beyond WinINet's own security boundary into other components on the host. The flaw is rated CVSS 3.1 8.4 (High) under the vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, so an attacker must already hold a local foothold on an unpatched machine, but then needs no user interaction and faces low complexity; CISA's SSVC assessment records exploitation as none, automatability as no, and technical impact as total. Affected platforms are Windows 10 21H2/22H2, Windows 11 23H2 through 26H2 plus 26H1, and Windows Server 2022/2025 builds below the patch thresholds in EUVD-2026-100013; no public exploit code was identified at time of analysis, and Microsoft has released vendor fixes.
Path traversal in Wazuh Manager 4.1.1 through 4.14.7 lets an attacker who has already compromised a cluster worker node read or delete arbitrary files on the cluster master - including rbac.db - by sending traversal or absolute-path filenames through the internal cluster RPC channel. The flaw is a post-compromise, lateral-escalation primitive: it requires a multi-node deployment, adjacent network position inside the cluster, and high worker-level privileges (PR:H), and it bypasses the REST API's filename validation and RBAC enforcement because the equivalent REST endpoints do validate paths. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a patch in Wazuh 4.14.8.
Improper link resolution in Serena before 2.0.0 allows a symlink committed inside a repository to redirect the tool's file operations outside the project root, letting an attacker read or overwrite files such as ~/.ssh/id_rsa or cloud credential stores. The flaw affects Project.is_path_in_project(), which validated containment only on the lexically normalized path, plus the line-based and symbol-level editing tools that skipped the path-confinement check entirely, so read_file, create_text_file, delete_lines and replace_lines can be steered to arbitrary locations. Exploitation requires the user to open and work within an attacker-influenced repository (local attack vector, no attacker authentication required, UI:R per the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N vector); no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is version 2.0.0.
Newline injection in the Ftps.add API of Froxlor 0.10.0 through versions prior to 2.3.14 lets an authenticated customer account insert arbitrary entries into the root-owned NSS group database, ultimately enabling local privilege escalation on affected hosts. The unvalidated additional_members parameter accepts embedded newline characters, and the REBUILD_NSSUSERS cron job later writes those values without sanitization into /var/lib/extrausers/group, so an attacker with a valid customer login can seed privileged group memberships that are cashed in only once they obtain local access to the machine. Exploitation is gated by customer-level authentication (CVSS vector PR:L) and by the host being deployed with the libnss-extrausers backend with the rebuild cron active; no public exploit code identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status.
SQL injection in RUGGEDCOM CROSSBOW versions below V6.0 lets an attacker who already holds administrative credentials inject arbitrary SQL commands through the Name and Value fields of custom file labels, compromising the underlying database. The vendor-assessed vector (CVSS 4.0 8.4, PR:H, AV:L) and our independent assessment converge on a high-severity but access-gated issue: exploitation requires an authenticated administrative session and local access, with no user interaction, and no public exploit code identified at time of analysis. Siemens has released a fix in V6.0, so the practical priority is moderate and centered on insider or compromised-admin scenarios rather than external mass exploitation.
Heap memory corruption in Mozilla Thunderbird versions prior to 158 allows a sufficiently large, malformed MIME message processed through libmime to overflow 32-bit buffer-growth arithmetic, potentially causing an undersized reallocation and an out-of-bounds memcpy into adjacent heap memory. The vendor rates this high severity (CVSS 8.4; AV:L/AC:L/PR:N/UI:N), but EPSS is only 0.17% and there is no CISA KEV entry or public exploit identified at time of analysis. Exploitation requires an unpatched client to parse the crafted message and may be constrained by heap allocator and ASLR mitigations, so the practical outcome may range from a crash to code execution only if the memory corruption is successfully shaped.
Siemens SIMATIC IPC devices (BX-21A, RW-543A, IPC227G/277G/277G PRO/327G/377G) contain a BIOS vendor test key in the UEFI Secure Boot key database, enabling an attacker with local physical or administrative access to boot an OS or UEFI application signed with that key and completely bypass Secure Boot protections. Exploitation is access-gated - requiring hands-on device access or existing administrative privilege - and no public exploit code or confirmed active exploitation has been identified at time of analysis, but successful compromise results in full loss of confidentiality, integrity, and availability of the device.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition (builds prior to 16.0.20326.20190) allows an authenticated user with a valid SharePoint account to plant script content that executes in the browser of another user who views the affected page, enabling spoofing and theft or manipulation of data within that victim's session context. The defect carries a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N), which reflects a meaningful prerequisite chain: the attacker must already hold an authenticated account (PR:L) and the payload only fires when a victim interacts with the crafted content (UI:R). There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so this is a moderate-priority vulnerability that merits scheduled patching rather than emergency response.
Incorrect authorization checks in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allow a low-privileged authenticated user - such as a registered customer or a limited back-office/B2B account - to bypass security controls and gain unauthorized read and write access, with a limited impact on availability (CVSS 8.3, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L). No administrative role and no victim user interaction are required, so any internet-facing storefront or admin surface exposing the vulnerable authorization check is in scope; the practical gating factor is possession of some valid credential, and stores permitting open customer or B2B self-registration lower that bar considerably. At time of analysis there is no CISA KEV listing and no public exploit identified, and no EPSS score was supplied; the root cause is classified as CWE-863 (Incorrect Authorization) and Adobe has published advisory APSB26-153, which should be treated as the authoritative source for affected and fixed versions.
Finsys Dockhand before 1.0.43 turns authenticated stack-template submission into a server-side data-theft primitive: an attacker-supplied repository URL or stackfile value is fetched by the server and the fetched body is echoed back in the compose response field, so internal services and cloud instance-metadata endpoints can be read directly rather than probed blindly. Any holder of a valid Dockhand account with the ability to create or submit stack templates to the API compose endpoint can exploit this, and the impact grows sharply where the instance has reachable IMDS or sensitive internal services on its network. No public exploit code was identified at time of analysis, and the vendor has released version 1.0.43 as the fix; the 8.4 score reflects high confidentiality impact tempered by the requirement for an authenticated account.
Improper link resolution before file access in Microsoft .NET (CWE-59, 'link following') allows an authorized local attacker to elevate privileges, rated CVSS 7.3 with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. Affected components include .NET 9.0 before 9.0.319/9.0.122, .NET 10.0 before 10.0.113, .NET 11.0 before 11.0.100-rc.2, Visual Studio 2022 version 17.14 before 17.14.42, and Visual Studio 2026 version 18.10 before 18.10.4. Exploitation requires a pre-existing low-privileged local account, the ability to plant symbolic links or junctions, and required user/process interaction to trigger a privileged file operation, so the SSVC decision is Exploitation: none, Automatable: no, Technical Impact: total; no public exploit identified at time of analysis, and the EPSS/KEV signals in the provided data give no indication of active exploitation.
Path traversal in .NET (CWE-22) allows an authenticated local attacker to escape an intended restricted directory and elevate privileges on the host, with the same flaw reaching users through the Visual Studio 2022 17.14 and Visual Studio 2026 18.10 toolchains. Successful exploitation requires a local, already-authenticated foothold (PR:L) plus user interaction (UI:R), meaning a higher-privileged user or process must be induced to act on an attacker-influenced pathname; it is therefore not remotely triggerable, and CISA's SSVC assessment records Exploitation: none, Automatable: no, with total technical impact if it does succeed. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this rates as a moderate-priority local privilege-escalation issue rather than an urgent, widely exploitable threat. Vendor patches are available.
Authenticated code execution in Microsoft SharePoint Server Subscription Edition affects all builds from 16.0.0 up to (but not including) 16.0.20326.20190, allowing an attacker who already holds high (farm-administrative) privileges to run arbitrary code over the network with no user interaction. Because the CVSS vector is PR:H (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2), the flaw is not reachable by anonymous or low-privileged users, but for a privileged actor it yields complete loss of confidentiality, integrity, and availability. There is no CISA KEV listing and no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', although technical impact is assessed as total, and a vendor patch is available.
Path traversal in NLTK's WekaClassifier integration (all versions through 3.10.3) lets attackers who control the model_filename or model argument escape nltk.pathsec containment and drive the Weka JVM to write files outside permitted data roots via the -d option, or probe for file existence via -l. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), but exploitation requires an application that wires attacker-controllable values into WekaClassifier and has a working Weka Java/JVM toolchain installed - a non-default, niche integration that most NLTK deployments never invoke. Under those preconditions, the CVSS 4.0 base score of 8.3 is driven by a network vector with high integrity impact (VI:H), while the AT:P metric reflects the required application-wiring precondition.
Sandbox escape through a use-after-free in Google Chrome's Passwords component allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in versions prior to 155.0.8059.79. The flaw carries a high attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) because the heap-timing condition must be reliably won, and it is not a standalone attack: it functions as the second stage of a chain, so no public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none'. Vendor-released patch 155.0.8059.79 is available, which keeps opportunistic mass exploitation unlikely and points to targeted use only.
Use-after-free in Google Chrome's Passwords component (desktop stable builds prior to 155.0.8059.79) allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox by convincing a victim to load a crafted HTML page. The 8.3 CVSS score reflects high confidentiality, integrity, and availability impact with a changed scope, but it is unauthenticated on paper (PR:N) only in the sense that no credentials are checked - the real gate is the prerequisite renderer compromise plus a hard-to-win use-after-free race (AC:H) and required user interaction (UI:R). No public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis, and Google has already released a fixed build, so the signals point to lower real-world urgency than the raw score suggests.
Use-after-free in Google Chrome's ShapeDetection implementation, affecting all versions prior to 155.0.8059.79, allows an attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox, turning a renderer foothold into full browser-process compromise. Exploitation is not standalone: the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and the assessed conditions require both a prior renderer compromise achieved through a separate bug and user interaction, since the victim must load attacker-controlled crafted HTML that exercises the ShapeDetection API to trigger the free-then-reuse condition. Exploitation status is limited: no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.21% (11th percentile), though the SSVC technical impact is rated total because success means code execution beyond the Chrome sandbox.
Sandbox escape in Google Chrome on macOS lets an attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox by delivering a crafted extension that abuses incorrect reference resolution in the Extensions subsystem, affecting all Mac builds prior to 155.0.8059.79. Google rates the issue High (Chromium severity: High) and has shipped a vendor fix, and there is no public exploit identified at time of analysis, with the CISA SSVC assessment recording exploitation as none. The impact is total once the chain fires (Scope:Changed, C:H/I:H/A:H), but high attack complexity (AC:H), required user interaction (UI:R) and the hard prerequisite of a prior renderer compromise make this a targeted second-stage escalation rather than a standalone remote exploit.
Firefox ESR builds prior to 153.5 contain a mitigation bypass in the browser's File Handling component, allowing attacker-controlled content to defeat a protection mechanism and, once triggered, to affect resources beyond the vulnerable component (scope change) with high confidentiality and integrity impact. Exploitation requires the attacker to persuade a user to open or handle crafted content (UI:R) and no authentication is required (PR:N), while the high attack complexity (AC:H) indicates an additional condition outside the attacker's direct control must also be satisfied - the exact trigger is not described in the available sources. No public exploit code has been identified at time of analysis and EPSS sits at 0.20% (9th percentile), which is consistent with a browser flaw gated by user interaction and a complexity precondition rather than mass scanning activity.
Mozilla Firefox installations that have not yet been updated to ESR 153.5 can be made to bypass an existing security mitigation through the browser's File Handling component, allowing an unauthenticated remote attacker who persuades a user to open attacker-supplied content to cross a security boundary with high confidentiality and integrity impact. The CVSS vector (AC:H, UI:R, S:C) shows the attack is not consistently reliable and depends on the victim interacting with the crafted content, so there is no fully passive or zero-click path; the specific file type or feature state that triggers the bypass is not described in the available sources. No public exploit has been identified at time of analysis and EPSS is low at 0.20% (9th percentile), but the vendor has published a fixed ESR build and the priority label is this_week.
Sandbox escape in Mozilla Firefox allows attacker-controlled web content to break out of the browser's content sandbox by winning a timing-dependent race condition in the Networking component (CWE-362), rated CVSS 8.3 with scope change (S:C), meaning compromise extends beyond the sandboxed process. Exploitation is unauthenticated (PR:N) and remote (AV:N) but requires the victim to load attacker-controlled web content (UI:R) and is unreliable per attempt due to high attack complexity (AC:H). No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.16% (5th percentile); the vulnerability is fixed in Firefox 158 and Firefox ESR 153.5.
Local attackers with low-level privileges can cause buffer overflows and memory corruption in AMI AptioV UEFI firmware by supplying malformed length values to a firmware interface, potentially leading to arbitrary code execution within the BIOS/SMM environment. The vulnerability (CWE-805) affects AptioV-based firmware across OEM platforms and requires local access plus existing OS-level privileges; no public exploit identified at time of analysis. Due to the local attack vector and dependency on OEM firmware updates, this is assessed as a credible but second-tier priority.
Remote unauthenticated attackers can interfere with other clients' database writes in Parse Server versions 5.4.0 through 8.6.95 and 9.0.0 through 9.10.2-alpha.4 by exploiting a race condition in transactional batch request handling that shares state across concurrent requests. Successful exploitation requires a transaction-capable backend (PostgreSQL or MongoDB replica set/sharded cluster) and concurrent requests from multiple clients; it can lead to rollback of acknowledged writes and, on PostgreSQL, indefinitely open transactions that cause subsequent writes to fail. No public exploit code has been identified at the time of analysis, and the flaw is not confirmed as actively exploited.
Privilege escalation through the Azure Key Vault SDK client libraries (azure-keyvault-secrets, azure-keyvault-keys, azure-keyvault-certificates and azure-keyvault-administration) allows an authorized attacker who already holds a valid low-privilege Key Vault identity to steer the SDK's communication channel toward an unintended endpoint, exposing secrets, keys and certificates and thereby gaining the vault's data-plane privileges. Exploitation is not trivial: the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) requires an authenticated low-privilege identity plus specialized preconditions such as attacker-influenced network positioning or precise timing, with no user interaction and no availability impact, while scope is changed because compromise of the client library reaches the Key Vault resource itself. No confirmed active exploitation (not listed in CISA KEV) and no public exploit code were identified at time of analysis, and CISA's SSVC decision framework rates Exploitation as 'none' and Automatable as 'no', although Technical Impact is rated total; Microsoft has released a vendor patch. This is a genuine but second-tier priority rather than an emergency.
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows a high-privileged backend user to persist malicious JavaScript into vulnerable admin form fields, which then executes in the browser of any other user who views the affected page, potentially hijacking that victim's account or session. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N, 8.1 High) requires the attacker to already hold a high-privileged backend account (PR:H) and requires a second victim to browse the poisoned page (UI:R); no unauthenticated or low-privilege entry path exists, so this is primarily an insider-abuse or post-compromise escalation vector. There is no public exploit code identified at time of analysis, and despite the High base score our assessment puts real-world priority at medium-to-moderate rather than emergency, with vendor fixes described in Adobe bulletin APSB26-153.
Unauthenticated remote attackers can corrupt the persisted status of batch job instances on IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 via a deserialization flaw (CWE-502), rated CVSS 3.1 base 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L). Real-world exposure is limited because exploitation requires the optional, non-default Java Batch / JSR-352 batch management and persistence capability to be enabled on a network-reachable Liberty server, and the resulting impact is confined to the integrity of persisted batch state rather than full server compromise. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis.
Unsalted MD5 password storage in Xxyopen novel through 3.5.0 allows offline recovery of user plaintext passwords from the user_info.password column, because UserServiceImpl.register() calls DigestUtils.md5DigestAsHex without any per-user salt or key stretching. The flaw is a confidentiality amplifier rather than a directly reachable bug: an attacker must first obtain the password column via a database leak, SQL injection, exposed backup, or insider access, after which precomputed rainbow tables and GPU brute force make short or common passwords recoverable in seconds to hours, enabling credential reuse against the application and elsewhere. No public exploit code was identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV), though the root cause and the upstream BCrypt fix are both publicly documented; instances migrated to the patched code, and accounts that have re-logged-in to trigger the BCrypt upgrade, are no longer affected.