Remote unauthenticated attackers can bypass authentication by spoofing in Ivanti Connect Secure versions before 25.1.3.0 and execute arbitrary commands with full system compromise. This vulnerability is confirmed actively exploited (CISA KEV) and publicly available exploit code exists. Ivanti Connect Secure 22.7R2.14 and prior are explicitly not affected, and the vendor-released patch is version 25.1.3.0 or later.
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then execute arbitrary commands, yielding high impact to confidentiality, integrity, and availability. The attack is network-reachable with low complexity but requires victim interaction (CVSS UI:R) - the target must open or interact with attacker-supplied content such as a crafted file, shortcut, or link - which is why SSVC rates it non-automatable while still flagging total technical impact. The flaw affects Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, plus Outlook.com, and is confirmed actively exploited (CISA KEV); given the KEV listing and the assessed high-end impact, this is a genuine top-tier patching priority rather than a high-CVSS-but-low-risk case.
Remote code execution affects Windows desktop applications built on the Microsoft.WindowsDesktop.App.Runtime (WPF) component of .NET, specifically runtimes 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1, as well as Visual Studio 2022 17.14 and Visual Studio 2026 18.10 installations that carry the vulnerable runtime. An unauthenticated attacker can deliver crafted content that, when a victim interacts with an XPS document whose synthetic hyperlinks are exposed through UI Automation, bypasses the application's restrictive navigation checks and reaches attacker-controlled content, leading to code execution in the context of the running application; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) confirms high confidentiality, integrity, and availability impact but explicitly requires user interaction. Vendor patches are available (runtime fixes 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2), and no public exploit code was identified at time of analysis despite the network-reachable attack path.
Remote code execution in Microsoft's Windows Presentation Foundation (WPF) component of .NET allows an unauthenticated remote attacker to run arbitrary code on a Windows host, but only when a WPF-based application loads or renders attacker-supplied XAML or XPS content and the victim opens or processes that malicious document (CVSS PR:N/UI:R). The vulnerable component is Microsoft.WindowsDesktop.App.Runtime, affecting .NET 8.0 (<8.0.32), 9.0 (<9.0.21), 10.0 (<10.0.13), 11.0 (<11.0.0-rc.2), .NET Framework 3.5/4.6.2-4.8.1, Visual Studio 2022 17.14 (<17.14.42) and Visual Studio 2026 18.10 (<18.10.4) on Windows only. Publicly available exploit code exists (a public gist is referenced), though CISA SSVC records Exploitation as none and CISA KEV does not list this CVE; CISA's SSVC decision also rates the issue as not automatable, so mass opportunistic scanning is unlikely and practical risk concentrates on environments whose WPF applications consume untrusted markup. Signals are moderately strong but not uniformly alarming: high technical impact (total via SSVC) is tempered by the required user interaction and the absence of a server-side, zero-click remote path in default configurations.
Command injection in the Wavlink WL-WN530BE1-A wireless router (firmware 251117) allows an authenticated, low-privileged user of the web management interface to execute arbitrary shell commands on the device via the 'Type' parameter of /cgi-bin/uploadVpn.cgi, which is passed unsanitized into a popen() call. Because the flaw requires only a valid session (CVSS PR:L) with no user interaction (UI:N) and generally only LAN-side reachability to the management interface, the practical barrier is low: SOHO devices frequently ship with default or weak admin credentials. Publicly available exploit code exists (a published GitHub gist), but no confirmed active exploitation (CISA KEV) has been reported, and no vendor-released patch version is identified in the available data.
Unauthenticated remote attackers can crash yt-dlp-web-ui 4.0.0 and earlier by sending a single JSON-RPC request to the default Service.Formats method, where a crafted url value such as '--version' is passed to the underlying yt-dlp process and produces unexpected output that fails JSON parsing, leading to a NULL pointer dereference and an unrecovered panic that terminates the server process. No credentials, user interaction, or special configuration are required - the only precondition is network reachability of the JSON-RPC interface - and publicly available exploit code exists, so any instance bound to a routable interface or exposed through a reverse proxy is trivially and repeatedly deniable. The impact is confined to availability: there is no data exposure, integrity loss, or code execution.
Stored cross-site scripting in GitLab CE/EE (affected ranges 19.1 through 19.2.7, 19.3 through 19.3.4, and 19.4 through 19.4.1) lets an authenticated user with repository write access embed a crafted file whose syntax-highlighted output is rendered with unsanitized HTML attributes, executing arbitrary JavaScript in the browser session of any other user who views it. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N reflects that the attacker must be authenticated (PR:L) and that a second user must render the malicious content (UI:R), but that successful execution crosses a trust boundary (S:C) with high confidentiality and integrity impact, including potential theft of session tokens or actions taken as the victim. Exploitation requires publicly available exploit code exists, with a HackerOne report and the upstream work item publicly linked; CISA KEV status was not indicated in the supplied intelligence, so this should be treated as a high-priority authenticated stored XSS rather than a confirmed actively exploited campaign. The affected surface is bounded by the requirement for repository control plus a victim viewing the highlighted file, so unauthenticated or pure drive-by exploitation is not possible.
Denial of service in ASP.NET Core's Kestrel web server allows an unauthenticated remote attacker to deadlock connection handling by sending crafted HTTP/3 reset or abort sequences, causing excessive blocked-thread creation and eventual server resource exhaustion. The flaw affects applications built on Microsoft.AspNetCore.App.Runtime 8.0.x before 8.0.32, 9.0.x before 9.0.21, and 10.0.x before 10.0.13 on Windows, Linux, and macOS, but only when Kestrel is running with HTTP/3 support enabled - servers limited to HTTP/1.1 or HTTP/2 are not exposed. Publicly available exploit code exists (a public gist demonstrates the issue), and the CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), an availability-only impact with no confidentiality or integrity loss; there is no confirmed active exploitation at time of analysis.
Improper verification of a cryptographic firmware signature in the D-Link DCS-930L (firmware B1.08B4) allows a remote attacker to supply a crafted firmware image that the device accepts and flashes, undermining the integrity of the bootloader recovery process. The flaw resides in the mpfd_decode function within bootloader_region.bin, part of the device's Emergency HTTP Recovery Server, which is normally reachable only when the camera is in firmware recovery/bootloader mode rather than in its default running state; exploitation therefore generally requires the device to be in (or forced into) recovery mode and network-reachable, plus the passive user interaction (UI:P) specified by the CVSS 4.0 vector. Publicly available exploit code exists and the input assigns a critical CVSS 4.0 base score of 9.4, but there is no confirmed active exploitation (not listed in CISA KEV) and the E:P metric indicates only Proof-of-Concept maturity.
Stack-based buffer overflow in the TRENDnet TEW-432BRP (firmware 3.10B20) web management interface lets an attacker with a valid low-privilege session crash or execute code on the device by sending an overlong 'Name' parameter to the /goform/formTcpipSetup handler. Publicly available exploit code exists, so risk is elevated wherever the router's management interface is reachable from an untrusted network or is protected only by default or weak credentials; impact is negligible where management access is confined to a trusted LAN. The device reached end-of-life in 2011 and the vendor has confirmed it has no way to test or patch the issue, meaning no vendor fix will be issued and replacement is the only complete remediation. This is not confirmed as actively exploited (CISA KEV), but the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact when the authentication prerequisite is met.
Privilege escalation and security-feature bypass in Microsoft ASP.NET Core's Blazor authorization stack lets an authenticated remote user defeat an application's [Authorize] decision and reach content or operations their role should not permit. The flaw is a race condition in the Microsoft.AspNetCore.Components.Authorization AuthorizeRouteView component, where a stale asynchronous authorization result can be applied after a navigation or an authorization-state change, so the current authorization decision is silently overwritten by an earlier one. Only Blazor applications that use AuthorizeRouteView for route-level authorization are in scope; ASP.NET Core deployments that do not use Blazor component-level authorization are unaffected. Exploitation is non-deterministic (CVSS AC:H) and requires the attacker to already hold a valid authenticated session (PR:L), and publicly available exploit code exists as a published proof-of-concept gist, but CISA SSVC rates exploitation as none and the issue is not automatable. Vendor patches are available across all supported ASP.NET Core release trains.
An authenticated user holding only the Developer role can run CI/CD pipelines on protected branches in GitLab CE/EE without authorization, because the downstream (multi-project/child) pipeline creation service failed to enforce proper permission checks (CWE-863). All versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected, and exploitation is conditional: it requires a valid Developer account plus projects that combine downstream pipelines with protected-branch restrictions, which is why the independent assessment raises attack complexity to High even though the vendor rates the issue 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N). Publicly available exploit code exists in the form of a HackerOne report, but the provided data contains no confirmation of active exploitation and no KEV listing. Integrity impact is the dominant risk: unauthorized pipeline execution on a protected branch can inject or alter build, test, and deployment artifacts that the branch protection model was designed to shield.
Cache poisoning of raw repository file responses in GitLab CE/EE (all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2) lets a low-privileged authenticated user supply crafted repository references so that cached raw-file content is served to other users. When a targeted victim's CI/CD pipeline subsequently fetches that poisoned raw file, the pipeline executes attacker-controlled content, potentially exposing protected environment variables. Publicly available exploit code exists (referenced via a HackerOne report), but the issue is not confirmed as actively exploited (no CISA KEV listing); exploitation is rated high complexity (AC:H), requires authentication (PR:L), and success depends on a victim pipeline actually pulling and running the poisoned content, making this a credible, high-priority issue rather than an emergency.
Improper cleanup of scheduled pipeline execution policy records in GitLab Enterprise Edition lets an authenticated user execute arbitrary CI/CD pipelines in a transferred project using the destination group's privileges. Affected releases are all EE versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Exploitation is conditional - the attacker needs a valid account, a project that has a configured scheduled pipeline execution policy, the project-transfer workflow, and user interaction (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N, 7.7) - but publicly available exploit code exists per the referenced HackerOne report, and no CISA KEV entry has been recorded, so this is a moderate, conditional privilege-escalation risk rather than a mass-exploitation emergency.
Opening a crafted S-102 bathymetric surface HDF5 file in OpenS100 through commit daaa35b can trigger a 32-bit integer overflow that under-allocates a heap buffer and lets attacker-controlled data be written out of bounds, resulting in an application crash or potential arbitrary code execution. The flaw lives in S102_VG_BathymetryCoverage::Read(), where the product of the numPointsLatitudinal and numPointsLongitudinal grid dimensions wraps around before the buffer size is computed. Exploitation is unauthenticated (PR:N) but constrained: no network-reachable path exists (local vector) and the victim must actively open a malicious file, and while publicly available exploit code exists, EPSS is low at roughly 0.20% (10th percentile), the issue is not in CISA KEV, and the overall signal is a real but low-priority issue rather than an urgent threat.
Deserialization of untrusted data in Microsoft Dynamics Business Central (CVE-2026-100214, CVSS 8.8) allows an authenticated attacker with low privileges to execute arbitrary code over the network - the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates no user interaction, low attack complexity, and high confidentiality, integrity, and availability impact within the vulnerable component. Exploitation is gated by a valid Business Central account (PR:L), so this is not unauthenticated remote code execution, but once a foothold account exists and the deserialization endpoint is network-reachable, exploitation is straightforward. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV entry), making this a credible mid-to-high priority issue rather than an emergency; organizations should confirm the specific affected builds and patched versions against the MSRC advisory.
Remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authenticated, low-privileged user of a SharePoint deployment send a malicious serialized payload over the network and obtain code execution with high confidentiality and integrity impact, requiring no user interaction from the victim. The issue is a CWE-502 deserialization-of-untrusted-data flaw rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit has been identified at time of analysis; the decisive exposure factor is the PR:L authentication prerequisite, so practical risk concentrates in deployments where low-privilege, guest, or self-service accounts are broadly provisioned or can be obtained through credential compromise.
Remote code execution in .NET WPF (Microsoft.WindowsDesktop.App.Runtime) allows an unauthenticated attacker to execute code on a victim's Windows system by crafting a malicious XAML/XPS document or serialized payload and convincing the user to open or load it. The vulnerability is a CWE-502 deserialization of untrusted data issue rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); exploitation requires user interaction and is not automatable (SSVC Automatable=no, Exploitation=none). No public exploit code or active exploitation has been identified at time of analysis, though vendor patches are available for all affected .NET and .NET Framework versions.
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted input that is incorporated into a SQL command, giving the attacker arbitrary control over the back-end database and effectively elevating their privileges on the farm. Only SharePoint Server Subscription Edition builds below 16.0.20326.20190 are affected, the attack requires a valid account on the target instance (CVSS PR:L) and no user interaction, so anonymous internet exploitation is not possible; environments already at or above the patched build are not exposed. Microsoft has shipped a fix and no public exploit code has been identified at time of analysis, with CISA SSVC recording Exploitation as none and Automatable as no, making this a credible but not emergency-tier priority that should be fixed on a normal patch cycle - the high CVSS score of 8.8 reflects total loss of confidentiality, integrity and availability once the injection is successfully driven.
Path traversal (CWE-22) in Microsoft Dynamics 365 Business Central lets an authenticated, low-privileged user escape an intended restricted directory through network-reachable functionality, with high confidentiality and integrity impact and a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The required precondition is a valid low-privilege account, so anonymous exploitation is not indicated, and no user interaction or special configuration is needed once that access exists; the exact vulnerable feature or endpoint is not identified in the available description. At time of analysis there is no CISA KEV entry and no public exploit code identified, and no EPSS score was supplied, so this should be treated as a high-severity, patch-now issue driven by its privilege-escalation potential rather than by observed exploitation.
Path traversal in Microsoft Dynamics Business Central (CWE-22) allows an authenticated user holding only low-level privileges to escape an intended directory boundary and elevate privileges over the network, carrying a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity and availability impact and no user interaction required. Because the vector requires PR:L, anonymous remote attackers cannot exploit this alone - the realistic threat is insiders or holders of compromised low-privilege accounts who already possess valid credentials plus network reach to the Business Central application endpoint. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the sole supplied reference is Microsoft's MSRC update guide, which is the authoritative source for fix details.
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-privileged SharePoint account to run code in the server's context and elevate privileges, with low attack complexity and no user interaction required. The flaw is rooted in improper control of code generation (CWE-94) inside SharePoint, and the assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that the authentication prerequisite is the primary barrier - an outside attacker must first obtain or compromise a low-privileged credential, after which confidentiality, integrity, and availability are all fully impacted. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, so this should be treated as a high-priority patch item rather than an actively exploited emergency; the specific vulnerable endpoint is not named in the description and should be confirmed against the Microsoft MSRC advisory.
Code injection in SQL Server Management Studio and Visual Studio Tools for Applications hosts allows remote, unauthenticated attackers to execute arbitrary code in the security context of the user who opens a crafted project, script, or database object. Rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), exploitation is gated by user interaction, so it depends on social-engineering a developer or DBA into opening attacker-supplied content rather than a zero-click or server-side trigger. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; the risk profile makes this a credible patch priority rather than an emergency.
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) allows a low-privileged SharePoint user to run arbitrary code on the server over the network. Per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), the attacker must already hold valid credentials for a SharePoint account - the vulnerable code path is not reachable by unauthenticated users - but no victim interaction is required, and the impact on confidentiality, integrity, and availability is total. The status of this vulnerability at the time of analysis is that no public exploit code has been identified; it is not listed in CISA KEV, so confirmed in-the-wild exploitation has not been established, though the low attack complexity and the common exposure of internet-facing SharePoint portals with broadly provisioned accounts make it a high-priority patch target.
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.20190) allows a low-privileged account holder to send crafted input over the network and corrupt heap memory, potentially gaining full control of the server's confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires only a valid low-privileged SharePoint account plus network reachability to the server - no user interaction - so any farm that issues accounts to untrusted or external users should treat this as high priority. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published a fixed build via its update guide (MSRC advisory CVE-2026-88163), making patching the straightforward path to closure.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.20326.20190, where a heap-based buffer overflow (CWE-122) can be triggered over the network by an attacker holding valid low-privilege credentials, with no user interaction required. A vendor patch is available, and intelligence sources indicate no public exploit identified at time of analysis and SSVC exploitation: none, so this is a credible but not emergency-tier priority primarily constrained by the authentication requirement.
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowing an attacker holding a valid low-privileged account to fully compromise the confidentiality, integrity, and availability of the affected deployment. On-premises installations are affected: SharePoint Server Subscription Edition below build 16.0.20326.20190, plus SharePoint Server 2019 and SharePoint Enterprise Server 2016, all of which are reachable over the network with the attacker needing only PR:L credentials and no victim interaction (AV:N/AC:L/PR:L/UI:N). There is no public exploit identified at time of analysis and CISA's SSVC assessment marks the issue as not automatable, so while impact is rated total, the authentication prerequisite and lack of automation keep this an above-average-priority rather than emergency-level issue; Microsoft has published a vendor fix.
Remote code execution in the Windows Presentation Foundation (WPF) component of Microsoft .NET and .NET Framework allows an unauthorized remote attacker to run arbitrary code after a victim interacts with a crafted XPS document. The flaw is an improperly implemented security check for URI handling (CWE-358): WPF's XPS hyperlink navigation can bypass its URI restrictions and reach an attacker-controlled ObjectDataProvider, resulting in code execution in the context of the hosting application. Affected runtimes include .NET 8 before 8.0.32, .NET 9 before 9.0.21, .NET 10 before 10.0.13, .NET 11 before 11.0.0-rc.2, multiple .NET Framework 3.5/4.6.2/4.7.x/4.8/4.8.1 builds, and Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4; vendor patches are available and there is no public exploit identified at time of analysis, with exploitation gated by mandatory user interaction (UI:R) and SSVC Automatable set to no.
Cross-site scripting (CWE-79) in the ASP.NET Core Blazor WebAssembly Server hosting component allows an unauthenticated, network-based attacker to execute arbitrary script in a victim's browser session by getting attacker-influenced input rendered into a web page without proper HTML neutralization. Affected are applications built on Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.0 through <10.0.13, as well as apps produced by the vulnerable Microsoft Visual Studio 2026 18.10.x (<18.10.4) and Visual Studio 2022 17.14.x (<17.14.42) toolchains. Exploitation is not automatable per CISA SSVC and requires mandatory user interaction (CVSS UI:R) - the victim must load or interact with the crafted content - and no public exploit code or active exploitation has been identified at time of analysis; vendor patches are available, so risk is primarily to unpatched, internet-facing Blazor WebAssembly deployments.
Remote code execution in ASP.NET Core via a code-injection flaw (CWE-94) allows an unauthenticated, network-based attacker to execute arbitrary code when a victim user interacts with crafted content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation requires an ASP.NET Core application that routes attacker-controlled input through a dynamic code-generation or evaluation path; the user interaction requirement (UI:R) is a significant limiting factor, preventing fully autonomous or wormable exploitation. No public exploit code was identified at the time of analysis, and the specific framework API or configuration exposing the injectable path is not described in the available data and should be confirmed against the Microsoft MSRC advisory.
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote low-privilege authenticated attacker to abuse an incorrect authorization check and gain elevated privileges. The flaw is network-reachable with low complexity and no user interaction, and it can result in high confidentiality, integrity, and availability impact (CVSS 8.8, PR:L). No public exploit was identified at time of analysis and CISA SSVC records exploitation as none and automatable as no; the vendor patch is available, and patched builds are not exploitable.
Out-of-bounds write in Microsoft .NET 8.0, 9.0, 10.0, 11.0, and Visual Studio 2022/2026 can allow an unauthenticated remote attacker to execute code when a victim processes crafted input, per CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). This is a genuinely high-priority, patch-worthy flaw but with important caveats that lower its real-world urgency relative to its 8.8 CVSS: exploitation requires user or application interaction to process the malicious input, and no public exploit has been identified at time of analysis. Vendor-released patches are available as .NET 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2, plus Visual Studio 17.14.42 and 18.10.4.
Remote code execution in Microsoft .NET allows an unauthenticated attacker to execute arbitrary code when a legitimate user opens or loads crafted content that triggers an out-of-bounds write in the runtime. The flaw affects a broad range of .NET Framework versions (3.5 through 4.8.1), modern .NET 8.0, 9.0, 10.0, and 11.0 preview, plus Visual Studio 2022 and 2026. No public exploit code or active exploitation has been identified at time of analysis, and CISA SSVC rates the issue as non-automatable, though the mandatory user interaction and wide deployment make patching critical for unpatched systems.
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a low-privileged account escalate to full control over the affected farm, with high impact to confidentiality, integrity, and availability (CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable over the network with low complexity and no user interaction, but it is not pre-authentication - an attacker must first obtain or already possess valid SharePoint credentials. Affected are deployments of SharePoint Server Subscription Edition 16.0.0 prior to build 16.0.20326.20190; patched builds are not exploitable. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none, and Microsoft has released a vendor fix, so this is a high-priority but not emergency patch.
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding only low-privilege credentials to elevate privileges over the network without any user interaction. The flaw is a privilege context switching error (CWE-270) affecting 16.0.0 builds below 16.0.20326.20190, and a vendor patch is available through the Microsoft Security Response Center. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable, so while technical impact is total, the practical risk is elevated rather than emergency-tier.
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-privilege account escalate to higher privileges over the network, because a SharePoint function performs an action without the required authorization check. Affected deployments are Subscription Edition builds below 16.0.20326.20190; patched builds are not exploitable. This is a credible mid-tier priority rather than a drop-everything emergency: exploitation requires an authenticated foothold (CVSS PR:L, so authentication requirements are confirmed as authenticated per vector PR:L), no user interaction is needed (UI:N), and CISA's SSVC assessment records exploitation as none and the flaw as not automatable, so no public exploit was identified at time of analysis and the barrier to mass exploitation is high. A vendor patch is available from Microsoft.
Privilege escalation in Microsoft SharePoint lets an authenticated, low-privileged user send crafted requests over the network and gain high-integrity read and write access across the affected deployment, yielding a CVSS v3.1 base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid credentials on the target farm, so anonymous or fully unauthenticated attackers cannot trigger it; the realistic threat population is existing users, compromised accounts, or attackers who can self-register on internet-exposed farms. No CISA KEV entry and no public exploit code were identified at time of analysis, and no EPSS score was supplied - although external intelligence is sparse, the low attack complexity, network reachability, and lack of user interaction make this a genuine prioritisation item for SharePoint administrators.
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that lacks a proper authorization check, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N) without any user interaction. Only attackers who already hold a valid low-tier SharePoint account - a standard site member, guest, or compromised credential - can exploit this over the network; a fully unauthenticated outsider cannot. No public exploit code and no CISA KEV entry were identified at time of analysis, but the missing-authorization pattern is attractive for lateral escalation once a foothold exists, making multi-tenant, extranet, and internet-facing SharePoint deployments with liberal low-privilege account provisioning the highest-risk environments.
Privilege escalation in Microsoft SharePoint allows an authenticated attacker with low-level privileges to gain elevated access over the network without user interaction. The vulnerability arises from improper access control (CWE-284) and is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), enabling high impact to confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV as actively exploited.
Command injection in Visual Studio Code 1.0.0 through 1.141.0 allows an unauthenticated remote attacker to execute arbitrary code in the context of the editor when a developer opens attacker-controlled content such as a malicious workspace, folder, repository, or project configuration file. Exploitation depends on user interaction (a victim must open the crafted project), but is otherwise low-complexity with high confidentiality, integrity, and availability impact; no public exploit code has been identified at the time of analysis. Microsoft has released a vendor fix in Visual Studio Code 1.141.1.
Use-after-free in Windows Network Load Balancing (NLB) lets an unauthenticated attacker positioned on the same adjacent network segment execute arbitrary code, with high confidentiality, integrity and availability impact (CVSS 8.8, AV:A/AC:L/PR:N/UI:N). Only systems with the optional NLB clustering role installed and configured are exposed; affected platforms include Windows 10 1607/1809 and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; EPSS is 0.65% (50th percentile), and CISA SSVC records exploitation as none with total technical impact and automatable behavior.
SQL injection in Microsoft Configuration Manager (MECM) lets an authenticated attacker with low-privilege network access execute arbitrary SQL against the site database and thereby elevate privileges, with high confidentiality, integrity, and availability impact (CVSS 8.8). The CVSS vector (AV:N/AC:L/PR:L/UI:N) means exploitation requires a pre-existing valid account on the network - fully unauthenticated attackers cannot reach the flaw - but no user interaction or special complexity is needed once such credentials or an authenticated session exist. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no active exploitation, while vendor patches for all affected builds are available.
Remote code execution in Visual Studio Code versions 1.0.0 through 1.141.1 allows an unauthenticated, network-positioned attacker to execute arbitrary code when a victim opens attacker-controlled content (e.g., a crafted workspace, folder, or repository), due to improper output encoding/escaping (CWE-116). Exploitation requires user interaction, and no public exploit code has been identified at time of analysis. The vendor has released a patch in version 1.141.1.
Authentication bypass in Microsoft .NET allows an unauthenticated, remote attacker to forge a cryptographic signature and have it accepted by applications that rely on the framework's signature-verification routines, potentially leading to unauthorized access or token misuse. The JWT Attack tag points to a token-signature validation weakness; exploitation requires the target application or user to process the attacker-supplied signed token (UI:R), which limits reachability for purely passive endpoints. Affected versions include .NET 10.0 before 10.0.402, .NET 11.0 before 11.0.100-rc.2, and the listed Visual Studio 2022 17.14.x/2026 18.10.x builds; vendor patches are available, and no public exploit identified at time of analysis.
Missing authorization in Visual Studio Code allows code execution in the context of the editor's local user when a victim opens attacker-controlled content, such as a malicious workspace, repository, or file; the flaw affects versions from 1.0.0 up to but not including 1.141.1. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) shows no prior authentication is needed on the target, but successful exploitation still hinges on the mandatory user-interaction step, and the resulting impact stays within the user's own session rather than crossing a privilege or scope boundary. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a credible patch-priority for developer endpoints rather than a drop-everything internet-facing emergency; Microsoft rates the fix as available.
Memory corruption in Microsoft .NET's System.Net.Sockets component allows an unauthorized attacker to execute code over a network on Windows hosts, but only against applications that reuse a single SocketAsyncEventArgs instance across both IPv4 and IPv6 UDP datagram sockets. The flaw (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) manifests as an out-of-bounds write in the ReceiveFromAsync path once an undersized cached native address buffer is retained; no authentication or user interaction is required, though the high attack complexity reflects the non-default coding pattern required to reach the vulnerable state. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as none and non-automatable, and no KEV listing applies; Microsoft has shipped fixed runtime builds, making this a meaningful but non-emergency patching priority.
Account takeover is possible in applications built on ASP.NET Core Identity because the framework's password-reset and email-confirmation flows can dispatch mail to the unvalidated address supplied in the incoming request rather than the user's stored canonical address, allowing a remote unauthenticated attacker who can influence that request address to intercept recovery tokens and reset victim credentials. The issue affects Microsoft.AspNetCore.Identity and Microsoft.AspNetCore.Identity.UI deployments running on ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, and 10.0 before 10.0.13, as well as certain Visual Studio 2022 and Visual Studio 2026 builds that bundle the affected runtime; it carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) under CWE-640. No public exploit code was identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this should be treated as a high-priority patching item rather than an active-exploitation emergency.
Unauthorized privilege elevation in Microsoft SharePoint is possible through improper verification of cryptographic signatures, allowing unauthenticated remote attackers to forge authentication tokens and gain elevated access. Rated CVSS 8.1, the flaw requires high attack complexity but no user interaction, and the JWT-attack tag indicates it likely involves defeating JSON Web Token signature checks. No public exploit has been identified at time of analysis.
Authenticated OS command injection in the odt2spip plugin for SPIP before 4.4.0 allows author-level users to execute arbitrary commands as the web-server user by uploading a document with a crafted non-.odt filename through the document import form. The flaw survives sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), then triggers during LibreOffice conversion; exploitation requires a working LibreOffice backend and an author account. No public exploit was identified at time of analysis.
An origin validation error (CWE-346) in Microsoft Power Apps allows an authenticated attacker to achieve remote code execution against affected client deployments by inducing a legitimate user to interact with attacker-controlled content. Only Microsoft Power Apps for Android before 3.26085.7 and Power Apps 1710 (9.2.23071.136) before 2608.5 are affected; patched builds are not vulnerable. Exploitation requires a valid authorized identity in the Power Apps environment (PR:L) plus victim interaction (UI:R), CISA's SSVC assessment records no observed exploitation and rates the attack as not automatable, and no public exploit identified at time of analysis; treat this as an elevated-priority but non-emergency patch item.