Siemens Software Center (all versions) loads dynamic-link libraries from an uncontrolled search path, allowing an authenticated local attacker with high privileges to stage a crafted DLL where the application will load it and achieve arbitrary code execution in the application's context, with full confidentiality, integrity, and availability impact on the affected host. The vendor scores this CWE-427 DLL-hijacking issue CVSS 4.0 8.4 (AV:L/AC:L/AT:N/PR:H/UI:N), and our independent assessment agrees on the local vector, no user interaction, unchanged scope, and high C/I/A impact. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV; exploitation is constrained to a local, already highly privileged actor able to write to a directory on the loader's search path.
OS command injection in Netgate pfSense CE 2.7.0 through 2.9.0 allows an authenticated web-interface user who holds the QinQ edit privilege to execute arbitrary commands as root. The attacker saves a crafted parent interface ('if') value and then re-edits the QinQ entry, causing that unvalidated value to be interpolated into an ifconfig shell command; publicly available exploit code exists, and no confirmed active exploitation (CISA KEV) has been reported. The principal constraint is the high privilege requirement - only operators already trusted with interface configuration can reach the vulnerable code path - and risk is further reduced where the management UI is not exposed to untrusted networks or lower-privileged users.
OS command injection in Netgate pfSense CE 2.7.0 through 2.9.0 lets an authenticated web GUI user who holds the Traffic Shaper Limiters privilege execute arbitrary commands as root, turning a narrowly delegated configuration permission into full appliance compromise. The flaw is triggered when an operator edits a limiter and injects a crafted hidden 'number' value and then deletes that limiter, causing delete_queue() to pass the unquoted, attacker-controlled value to dnctl via /bin/sh running as root. Publicly available exploit code exists (VulnCheck advisory plus Abraxas Labs research and a PoC repository), and while the issue is not listed in CISA KEV as actively exploited, exploitation is gated on prior authenticated access with the Limiters privilege (PR:H) and on the attacker completing the limiter edit-then-delete workflow.
Command injection in Netgate pfSense CE through 2.9.0 allows an authenticated user with Virtual IP (CARP) edit privileges to execute commands as root by storing a malicious VHID value that is later interpolated into ifconfig calls or CARP status rendering. Publicly available exploit code exists, and the independent assessment rates this as a privilege-gated high-impact issue rather than an unauthenticated remote compromise; CISA KEV does not confirm active exploitation in the supplied data. Affected deployments are those where administrators or delegated operators can create or modify CARP VIPs, narrowing realistic risk to insiders or attackers who already hold privileged firewall UI access.
Command injection in Netgate pfSense CE through 2.9.0 allows remote authenticated users with limited 'Wireless Edit' or 'Interface Assignments' GUI privileges to execute arbitrary commands as root. The flaw is triggered by supplying a crafted wireless parent interface name such as ath0;<cmd> through interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command. Publicly available exploit code exists, and the assessed impact is high for confidentiality, integrity, and availability, though exploitation requires valid credentials with one of those specific privileges and access to the management interface.
Command injection in Netgate pfSense CE 2.4.5 through 2.9.0 lets an authenticated WebGUI user holding the Advanced Admin Access privilege execute arbitrary commands as root by placing newline or $(...) sequences in the Login Protection (sshguard) threshold, block time, or detection time fields, which are written unvalidated to sshguard.conf and sourced as root when the service restarts. The flaw is privilege-gated rather than mass-exploitable: the CVSS vector specifies PR:H, so only already-administrative accounts can trigger it, with no user interaction required beyond the attacker's own session. Publicly available exploit code exists (referenced in the CVE record), and the root cause is CWE-78 OS command injection.
OS command injection in Netgate pfSense CE (through 2.9.0) allows remote attackers holding an authenticated web-GUI account with gateway edit privileges to execute arbitrary commands as root by planting shell metacharacters in the zone index of an IPv6 link-local gateway Monitor IP, which start_dpinger() passes unescaped into the dpinger shell command when gateway monitoring is applied. Exploitation requires high privileges (CVSS 4.0 PR:H) and no victim interaction (UI:N), but yields high confidentiality, integrity and availability impact on the firewall itself; publicly available exploit code exists (abraxas/pfsense-gw-ipv6-zone) with no confirmed active exploitation reported. This is a genuine but access-gated priority: unauthenticated or low-privileged users cannot reach the vulnerable gateway-edit path, so exposure is limited to deployments where such configuration rights are delegated.
Command injection in pfSense CE 2.7.0 through 2.9.0 allows authenticated users who hold only the Captive Portal HA privilege to execute commands as root by manipulating backwardsyncip to point at an attacker-controlled XMLRPC server and returning connected_users entries with shell metacharacters in ip or mac fields. Exploitation is privilege-gated: it requires the specific Captive Portal HA WebGUI permission, use of Captive Portal high-availability sync, and the ability to influence the synced connected_users data. Publicly available exploit code exists, but no CISA KEV confirmed active exploitation is identified; this is a credible privilege-gated priority rather than a mass-exploitation emergency.
Authorization bypass in Netgate pfSense CE through 2.9.0 allows an authenticated WebGUI account that holds page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php to replace config.xml despite lacking the 'User - Config: Deny Config Write' privilege; the account can otherwise be read-only. Successful exploitation can yield root-level code execution after a configuration reload or reboot, and publicly available exploit code exists. The independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.6), reflecting a remote authenticated low-privilege attacker with high confidentiality, integrity, and availability impact.
Unauthenticated denial of service in LightLLM through 1.2.0 lets any remote attacker who can reach the /generate endpoint take down the inference worker with a single crafted request: supplying the internal pd_kv_trans_params field causes a pickle.loads failure in InferSamplingParams that kills the inference thread. Because the /health endpoint keeps responding normally, monitoring will not detect the failure, and every subsequent request hangs until the process is restarted. Publicly available exploit code exists (referenced in the upstream GitHub issue), and no CISA KEV entry or EPSS data was provided; the assessed impact is availability-only with no confidentiality or integrity loss.
Unauthenticated remote denial of service in SODOLA SL902-SWTGW124AS switch firmware before version 200.2.12 lets any attacker who can reach the device's embedded HTTP management server crash it by sending a crafted multipart/form-data POST request containing an oversized boundary value in the Content-Type header. The overflow leaves the switch fully unresponsive, dropping both management access and traffic forwarding until its self-recovery cycle completes, though the assessment confirms no code execution, data disclosure, or configuration tampering occurs. Publicly available exploit code exists (published by the researcher and documented in the VulnCheck advisory), and the CVE carries a CVSS v4.0 base score of 8.7, but there is no indication of confirmed active exploitation in CISA KEV; the practical risk is governed mainly by whether the web management plane is exposed to attacker-reachable networks.
Authenticated VPN users can execute arbitrary commands as root on pfSense CE through 2.9.0 by exploiting an OS command injection in the OpenVPN connect/disconnect script, openvpn.connect_async.sh. The attack requires a valid VPN account authenticated via RADIUS or LDAP and a username containing single quotes and shell metacharacters that break out of an eval'd pfctl anchor name. Publicly available exploit code exists (reported by VulnCheck), though no active exploitation has been confirmed by CISA KEV. This is a credible high-priority issue for any pfSense CE deployment that uses OpenVPN with external authentication.
Command injection in Netgate pfSense CE 2.7.0 through 2.9.0 lets an authenticated administrator who holds IPsec Mobile configuration privileges store a crafted single-line login banner that escapes the unquoted strongswan.conf attr value and injects charon.start-scripts entries, resulting in command execution as root on the firewall. Exploitation is gated by high privilege (PR:H) and by a charon restart precondition - the injected payload only runs when the strongSwan daemon is restarted, not at submission time - but publicly available exploit code exists and the impact on confidentiality, integrity, and availability is high. This is a genuine high-priority issue for organizations running affected pfSense CE firewalls, but its exploitation is gated by privilege rather than exposure, and no unauthenticated or unprivileged path has been identified.
Root command execution on pfSense CE through 2.9.0 is achievable by authenticated attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege, who inject newline characters into the ptpid or PPP periodic-reset hour/minute fields of interfaces_ppps_edit.php. The injected newlines are written unescaped into /etc/crontab by configure_cron(), causing scheduled root command execution. Publicly available exploit code exists; CISA KEV does not list this CVE, and no public exploit activity has been confirmed. CVSS 4.0 score is 8.6 (PR:H), and an independent assessment concurs with high impact but notes this is a credentialed privilege-escalation-to-root flaw rather than a pre-auth mass-exploitation threat.
Local file disclosure in SimplePie through 1.9.0 lets a malicious or compromised feed server read files on the host running the PHP application: by replying to a feed request with an HTTP Location redirect - or by planting an autodiscovery <link> - that points at a file:// path, the library follows the reference and reads the target file into the parsed feed. Exploitation requires no privileges (PR:N) but does require the attacker to control the feed server's responses or inject a feed URL into the application (AC:H, AT:P), and disclosure is bounded to files readable by the web-server process. Vendor fix is available via upstream PR 991, public exploit code exists (a PoC targeting pfSense's RSS widget has been published), and no confirmed active exploitation (CISA KEV) was identified at time of analysis.
Authenticated pfSense CE administrators with General Setup privileges can achieve root-level PHP code execution by injecting an auto_prepend_file directive into php.ini through an unvalidated timezone value. Publicly available exploit code exists, but exploitation is conditional: the injected directive only runs after php.ini is regenerated at boot or on a php-fpm restart, and the attacker already holds administrator-equivalent access, making this a post-authentication privilege escalation rather than an unauthenticated remote compromise or mass-exploitation threat. Netgate pfSense CE through 2.9.0 is affected.
Authenticated pfSense CE WebGUI users holding L2TP Server or PPPoE Server edit privileges can inject mpd5 commands - including an up-script that executes as root - by submitting a RADIUS shared secret that contains a quote and newline. The weakness affects pfSense CE through 2.9.0 and requires a RADIUS-backed VPN configuration that actually starts a session for execution; publicly available exploit code exists, but CISA KEV does not list this CVE and no confirmed active exploitation has been reported. This is a genuine but access-gated code execution issue rather than a mass-exploitation threat.
Command injection in pfSense CE through 2.9.0 allows authenticated users with the PPPoE Server Edit privilege to inject newline characters into the username field, causing mpd5 to run arbitrary commands as root when a PPPoE client authenticates. The flaw resides in services_pppoe_edit.php, which fails to sanitize the username POST field (CWE-93). Public exploit code exists, but exploitation requires an enabled PPPoE server and a subsequent client authentication event, limiting this to a post-authentication privilege-escalation attack.
Boolean-based blind SQL injection in EspoCRM versions 8.1.0 through 9.3.7 allows an authenticated non-administrator to inject crafted expressions through the 'where' parameter of the GET entity streamAttachments endpoint, enabling extraction of arbitrary database contents - including active administrator session tokens - and subsequent full privilege escalation. The flaw requires a valid low-privilege session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, 7.6) and is not exploitable anonymously. Public exploit code exists for this issue, though it has not been confirmed as actively exploited (CISA KEV); EspoCRM 9.3.8 is the fixed release.
Unauthenticated remote attackers can force-publish, rewrite, and create the managed pages of any WordPress site running Tutor LMS below 4.1.1, because the plugin's page-regeneration routine omits a capability check (CWE-862). Impact is confined to integrity - unpublished pages can be pushed live, existing page content overwritten, missing pages created, and the plugin options that reference those pages changed - with no confidentiality or availability effect and no code execution, so realistic damage is content tampering and manipulation of plugin page references rather than site takeover. Publicly available exploit code exists, and the CVSS 3.1 base score is 7.5 (HIGH) with vector AV:N/AC:L/PR:N/UI:N, making it trivially reachable on exposed sites; there is no CISA KEV entry indicating confirmed active exploitation at time of analysis.
Reflected cross-site scripting in the Document Gallery WordPress plugin (versions through 5.1.1) lets an unauthenticated attacker inject script into an HTML attribute returned by one of the plugin's AJAX actions, and the payload executes in the browser of any user who opens the crafted link - including a logged-in administrator. Publicly available exploit code exists and the issue is documented in the WPScan vulnerability database (EUVD-2026-101853), so exploitation only requires luring a victim into clicking or loading a malicious URL; no credentials are needed to deliver the payload (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). At CVSS 7.1 the assessed impact is moderate rather than critical: script execution is confined to the victim's browser session instead of granting direct server control, there is no CISA KEV entry indicating confirmed actively exploited, and the decisive limiting factor is the mandatory victim interaction.
OS command injection in the pfSense-pkg-frr package (2.0.2_1 and source revision 2.1.2_1) lets an authenticated WebGUI user holding only the low-privilege page-status-frr role execute arbitrary commands as root on the firewall. The flaw sits in the FRR status filter on status_frr.php, where a crafted filter value escapes a single-quoted sed expression that concatenates escapeshellarg() output before being evaluated through a popen() pipeline. Exploitation requires the optional FRR package to be installed plus a valid authenticated session with the page-status-frr privilege (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8), so it is a post-authentication privilege escalation rather than a pre-auth compromise; there is no public exploit identified at time of analysis, and no CISA KEV listing. Updated FRR packages resolve the issue for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.
QNAP HybridDesk Station (HD Station) before 4.2.22 contains a missing authentication flaw in a critical function, allowing unauthenticated attackers on an adjacent network to gain access to the system. Exploitation is constrained by a specific attack precondition and passive user interaction, and only QNAP NAS devices with the optional HD Station app installed and enabled are exposed. The vendor has released HybridDesk Station 4.2.22 and later as a fix; no public exploit was identified at time of analysis.
Authenticated path traversal in Lychee photo-management tool prior to 7.6.4 allows any logged-in user to read files accessible to the web process - including the application's .env file with APP_KEY and database credentials, and other users' private images - by sending encoded traversal segments to GET /image/{path}. Exploitation is not unconditional: it requires the supported but non-default configuration with temporary_image_link_enabled on and both temporary_image_link_when_logged_in and secure_image_link_enabled off, so default installations do not expose the vulnerable code path in an exploitable state. The impact is read-only information disclosure (no write or availability effect) and disclosure of APP_KEY or DB credentials can escalate to further compromise; no public exploit was identified at time of analysis, and the vendor fixed the flaw in 7.6.4.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition due to a path traversal flaw (CWE-22) that permits an attacker with low-privilege credentials to escape restricted directories and execute code over the network. The vulnerability carries a CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N) and requires a valid SharePoint session, making it a credible priority for patching but not an immediate emergency according to current evidence. A vendor patch is available, and no public exploit code has been identified at time of analysis.
Arbitrary OS command execution on hosts running MoviePilot through 3.1.5 is achievable when the product's LLM agent ingests attacker-controlled content via browse_webpage, search_web, or torrent metadata parsing and is induced to call the unrestricted ExecuteCommandTool, which runs shell commands through asyncio.create_subprocess_shell under the admin session's is_admin context. The flaw is a prompt-injection-to-RCE chain (CWE-1427) that bypasses the validate_command_safety denylist by setting confirm_dangerous=true; the attacker needs no MoviePilot credentials (CVSS PR:N), but an administrator must interact with the poisoned content (UI:P in CVSS:4.0, UI:R in the assessed CVSS:3.1) and the model must be successfully coerced, so the issue is conditionally gated rather than a mass-exploitation emergency. Severity is 8.7 in CVSS:4.0 and 8.7 in the independently assessed CVSS:3.1; no public exploit code and no CISA KEV entry are associated as of this analysis.
Out-of-bounds read in the Driftregion iso14229 UDS server library before version 0.10.1 lets an unauthenticated sender crash the diagnostic stack or disclose adjacent memory by submitting a short RequestFileTransfer (SID 0x38) request whose filePathAndNameLength field is set to 0xFFFC-0xFFFF, wrapping the length arithmetic and defeating the buffer-length check before file-transfer callbacks read past the receive buffer. The issue carries a CVSS 4.0 base score of 8.8 and is assessed as AV:N/AC:L/PR:N/UI:N with low confidentiality and high availability impact (CWE-190 integer wraparound), so no credentials or user interaction are required once the handler is reachable. No public exploit code has been identified at time of analysis and no EPSS score was supplied; real-world exposure is gated by transport, since AV:N holds only where the server is reachable over an IP transport such as DoIP, whereas the typical CAN/ISO-TP deployment restricts an attacker to the vehicle or device bus.
Remote code execution in ThemeHigh's Email Customizer for WooCommerce (Pro) through version 3.9.5 allows any authenticated user with subscriber-level access or higher to write attacker-controlled PHP into executable files inside the WordPress uploads directory through the plugin's send_test_mail() function, leading to full site compromise. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) makes clear that the low-privilege account requirement is the main gate; exposure is greatest on WooCommerce stores that permit open customer/subscriber self-registration rather than manual account approval. Code execution also depends on the server permitting PHP to run from the uploads path, so sites that already harden that directory are materially less exposed, and no public exploit code has been identified at time of analysis.
Heap-based memory corruption in Microsoft Word - affecting Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 - lets a remote, unauthenticated attacker execute arbitrary code in the context of the victim, but only when that victim opens or previews a specially crafted Word document. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms the trigger is entirely dependent on user interaction, so there is no zero-click or server-side path; no public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available. That combination - high technical severity but a required user action and an available fix - makes this a high-priority vulnerability rather than an emergency.
Heap-based buffer overflow in Microsoft Word allows remote, unauthenticated attackers to execute arbitrary code when a user opens a maliciously crafted document. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and their macOS editions, with a CVSS score of 8.8; no public exploit identified at time of analysis, and CISA KEV does not list active exploitation, though high impact and low attack complexity make this a genuine high-priority issue. The primary limiting factor is the required user interaction to open the weaponized file, and code runs with the victim's privileges rather than SYSTEM.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, and Office 365 for Mac when a user opens or previews a specially crafted document. The flaw is a stack-based buffer overflow (CWE-121) rated 8.8, reachable by unauthenticated remote attackers with PR:N but requiring user interaction with UI:R; successful exploitation yields code execution with the victim user’s privileges. A vendor patch is available, and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Word (CWE-122) allows an unauthorized attacker to execute code in the context of the victim when a specially crafted Word document is opened, earning a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw affects Word as shipped in Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021 and 2024 on both Windows and macOS. Exploitation is unauthenticated from the attacker's side but requires the victim to open an attacker-supplied file, so success depends on social engineering and on getting past Protected View or Mark-of-the-Web warnings for documents downloaded from the internet. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); patch data indicates a vendor fix is available via the Microsoft Security Response Center advisory.
Heap-based buffer overflow in Microsoft Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024) allows a remote, unauthenticated attacker to execute code in the context of the victim when a crafted document is opened, matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8 High). Exploitation is not interaction-free: the vector's UI:R component and the assessed conditions require file delivery plus a user open action, so Protected View and Mark-of-the-Web prompts materially limit real-world success. No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available from Microsoft and this remains a genuine priority for patching.
Heap-based buffer overflow in Microsoft Word allows remote unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted document. Affects Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. No public exploit identified at time of analysis, but this is a genuine high-priority issue given the potential for code execution and widespread product deployment; exploitation requires user interaction (opening or previewing the malicious file).
Code execution in Microsoft Word - across Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 - is achievable when a victim opens an attacker-crafted document containing a malformed numeric field that triggers an integer truncation flaw (CWE-197) inside the Word parsing path. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication or prior access is needed, but successful exploitation is gated by mandatory user interaction: the target must open or preview a malicious file, so delivery depends on phishing, web download, or similar social-engineering vectors. At time of analysis there is no public exploit identified, and Microsoft has published a fix via its MSRC update guide, so fully patched installations are not exposed.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, where a heap-based buffer overflow (CWE-122) is triggered when a victim opens or previews a specially crafted document. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows an unauthenticated remote attacker needs no credentials, but the UI:R metric confirms victim interaction is mandatory, making delivery dependent on phishing or file-sharing social engineering. Successful exploitation yields code execution at the privilege level of the user who opened the file, with high confidentiality, integrity, and availability impact, but no scope change or privilege escalation beyond that user's context; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft. This is a credible patching priority despite the absence of exploitation telemetry.
Remote code execution in Microsoft Office Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS builds) allows an unauthenticated attacker to run arbitrary code in the security context of a victim who opens a specially crafted document. The flaw is a heap-based buffer overflow reachable over the network, and because it requires only low attack complexity and no privileges (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), the sole barrier to exploitation is the user-interaction requirement - the victim must open the malicious Word file, which is the primary limiting factor. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status, but Microsoft has published a vendor patch, so this should be treated as a genuine high-priority, patch-now item rather than an emergency.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, where a crafted document triggers a heap-based buffer overflow and lets an unauthenticated attacker run code in the context of the victim. Exploitation is network-delivered (email or web) but requires the user to open or preview the malicious file (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R); no elevated privileges are needed on the target. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch per its advisory; the severity and default-configuration reachability make this a real patching priority despite the user-interaction dependency.
Remote code execution in Microsoft Excel is possible when a user opens or previews a specially crafted spreadsheet, which triggers a use-after-free during file parsing and lets an unauthenticated attacker run code in the context of the victim. The flaw carries a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, the Mac LTSC and Office 365 for Mac builds, and Office Online Server, with no attacker authentication required but mandatory user interaction (UI:R) - meaning successful exploitation depends on social engineering rather than automatic server-side triggering, and Protected View plus Mark-of-the-Web warnings can interrupt the chain. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, and Microsoft has published a vendor fix via its MSRC update guide; risk is high but manageable through prompt patching and the existing Office security defaults.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office for Mac/LTSC for Mac editions, allowing an unauthenticated attacker to execute arbitrary code by convincing a victim to open a specially crafted document (UI:R). The stack-based buffer overflow (CWE-121) requires no privileges or non-default configuration (PR:N, AC:L), making it a high-priority target for social-engineering campaigns, though no public exploit code has been identified at time of analysis. Patch available per vendor advisory from the Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft Office (Windows and macOS builds: Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365/LTSC for Mac) allows unauthenticated remote attackers to execute arbitrary code when a victim opens a crafted document. Exploitation requires user interaction (UI:R in the CVSS vector) and is not zero-click, executing with the victim user's privileges rather than SYSTEM. No public exploit has been identified at time of analysis, and a vendor patch is available per the Microsoft advisory (CVE-2026-108444).
Remote code execution in Microsoft Word (part of Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021/2024) allows unauthenticated attackers to execute arbitrary code in the context of the victim who opens a crafted document. The vulnerability is an off-by-one error (CWE-193) in the Word parser that can corrupt memory, and no public exploit code or active exploitation has been identified at time of analysis. Microsoft has released a patch via its MSRC update guide.
Use-after-free memory corruption in Microsoft Office Word enables remote attackers to execute arbitrary code with the privileges of the user who opens a maliciously crafted document. The flaw is unauthenticated (PR:N) but requires the victim to open the document (UI:R), and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS editions (Office 365 for Mac, Office LTSC for Mac 2021/2024). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); vendor patches are available, making this a genuine high-priority patching target rather than an emergency.
Heap-based buffer overflow in Microsoft Word (CWE-122) enables remote code execution when a user opens an attacker-crafted document in an affected Office build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or the Mac equivalents - and rates CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R): the malicious file must actually be opened, so delivery depends on phishing or document-sharing lures rather than autonomous network exploitation, and Protected View or Mark-of-the-Web sandboxing on untrusted documents can block the trigger until the user dismisses it. Vendor patches are available via the Microsoft Security Response Center update guide; no public exploit code or confirmed active exploitation was identified at time of analysis, though the high confidentiality, integrity, and availability impact across all supported Office channels warrants prompt patching.
Stack-based buffer overflow in Microsoft Word permits remote code execution in affected Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and Office LTSC 2021/2024 (including Mac editions) when a victim opens a maliciously crafted document. The vulnerability is unauthenticated from the attacker's perspective but requires user interaction (UI:R), so delivery typically depends on phishing or social engineering, and no public exploit identified at time of analysis or CISA KEV confirmation is available in the provided data. Patch available per vendor advisory via Microsoft's MSRC update guide.
Heap-based memory corruption in Microsoft Word lets a remote, unauthenticated attacker execute arbitrary code in the security context of the user who opens a specially crafted Word document. Affected software includes Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 and 2024, and the corresponding Office LTSC/Office 365 for Mac builds referenced in the CPE list; exploitation is not automatic, since the victim must open the malicious file (UI:R), but no credentials or special configuration are required otherwise. Microsoft has published a security update, and no public exploit code was identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word allows unauthenticated remote attackers to execute code on vulnerable systems when a user opens a crafted document, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The attack requires user interaction (opening a malicious file) and executes code in the context of the opening user without privilege escalation, resulting in a CVSS score of 8.8. No public exploit code or active exploitation has been identified, and a vendor patch is available; this is a high-priority vulnerability but not an emergency based on current signals.
A heap-based buffer overflow in Microsoft Word's document-parsing code lets an unauthenticated remote attacker execute arbitrary code when a victim opens a maliciously crafted Word file, affecting Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. The attack is network-deliverable (typically a phishing attachment or downloaded document) but cannot trigger without user interaction, since the victim must open or preview the file; successful exploitation runs code in that user's security context rather than SYSTEM. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a high-priority patching item - rated 8.8 with the vendor patch already available - rather than an emergency zero-day response.
Eclipse Jetty's host whitelist/blacklist enforcement in the jetty-server and jetty-proxy modules performs case-sensitive comparisons, so a remote, unauthenticated attacker can bypass the filter simply by altering the letter case of the Host value (e.g. 'EXAMPLE.com' instead of 'example.com') and reach hosts the operator intended to block or exclude. The flaw only matters where an operator has explicitly configured a host whitelist or blacklist and treats it as a security boundary; deployments without host-based filtering are unaffected. The vendor has published a security advisory (GHSA-7wfj-j486-mxrf), and no public exploit code has been identified at time of analysis, though the low attack complexity (AC:L, PR:N, UI:N) and high confidentiality impact make the bypass straightforward to attempt wherever the non-default filtering configuration is present.
The EnergizeLab AI Station (RK3562) firmware image ships with hard-coded root credentials and an SSH daemon enabled by default, so any attacker who can reach the device's SSH port from the same LAN or adjacent network segment can log in as root and take complete control of the unit. Rated CVSS 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw needs no authentication, no user interaction, and no pre-existing privilege on the device - the only barrier is network reachability, per the adjacent-network attack vector. No vendor patch has been identified at time of analysis, and no public exploit code or confirmed active exploitation (CISA KEV) was identified; because every device running stock firmware is affected by design rather than by misconfiguration, this is a high-priority issue for any organization with these units deployed, not a paper-only finding.