Incorrect permission assignment in QNAP Download Station (all builds prior to 5.10.1.312 or 5.11.2.321) lets a local attacker who already holds an administrator account on the NAS escalate that foothold into full compromise of the device's confidentiality, integrity and availability. The issue is access-gated rather than remotely reachable: the CVSS:4.0 vector marks local attack vector (AV:L) and high privileges (PR:H), so a remote or unauthenticated attacker cannot trigger it and no user interaction is required once admin access exists. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), but vendor-released fixes are available, so the practical risk sits with deployments that share, weakly protect, or already have compromised QNAP admin credentials.
Memory corruption in the snap7 S7 communication library (through version 1.4.3) allows a rogue or impersonated PLC to overflow client-side buffers while handling ReadVar responses, crashing SCADA, HMI, gateway, and custom S7 client processes and corrupting their memory. The flaw is unauthenticated from the protocol perspective (PR:N) and needs no user interaction, but per the authoritative assessment it is only reachable when the attacker already occupies a trusted position in the S7 path of the victim client - an attacker-controlled, spoofed, or MITM'd PLC endpoint (the condition encoded by CVSS 4.0 AT:P); clients that communicate only with legitimate PLCs cannot be triggered. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; CVSS 4.0 base 8.3 (High), with the independent assessment scoring CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H.
Improper authentication in Unitronics UniStream Pro B10/C10 controllers running UniLogic firmware prior to 1.41.329 allows a network-positioned attacker with low-level privileges to bypass authentication, yielding high confidentiality and integrity impact with low availability impact (CVSS 8.3). The flaw requires a valid low-privilege authenticated foothold (PR:L per the CVSS vector) and network reachability to the controller, with no user interaction; OT segmentation limits exposure. No public exploit code or active exploitation (CISA KEV) is identified at time of analysis, though the 'Authentication Bypass' tag suggests the exact authentication precondition should be confirmed in the INCD advisory.
Authenticated low-privilege attackers can exploit a format string vulnerability in Unitronics UniStream Pro B10/C10 controllers running UniLogic firmware prior to 1.41.329, potentially leading to memory corruption, sensitive information disclosure, and code execution. The flaw (CWE-134) is network-reachable and requires valid credentials but no user interaction, with high impact on confidentiality and integrity. No public exploit has been identified at time of analysis.
Improper memory-buffer bounds handling in Unitronics UniStream Pro PLCs (B10 and C10 hardware variants) running UniLogic firmware prior to 1.41.329 allows an attacker with network reachability and low-privilege authentication (CVSS PR:L) to corrupt memory and potentially achieve high confidentiality and integrity impact with limited availability impact (CVSS 8.3). Because these are OT/ICS controllers, successful exploitation could let an authenticated actor disrupt or manipulate the logic and data handled by the device rather than just crash it. The flaw was reported by Israel's INCD; no public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV, so exploitation is currently assessed as requiring deliberate, targeted access rather than opportunistic scanning. Devices already running UniLogic 1.41.329 or later are not affected.
The EnergizeLab Eilik NestJS authentication service grants device tokens for arbitrary robot serial numbers without requiring any credential, so an unauthenticated remote attacker can mint a valid token for any Eilik robot and impersonate that device against the vendor's cloud services. Rated 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N), the flaw is trivially reachable over the network with no authentication or user interaction, and the dominant impact is to integrity of device identity rather than to confidentiality or availability. There is no CISA KEV entry and no public exploit code identified at time of analysis, and no EPSS percentile was supplied with this record, so the practical risk is a genuinely easy-to-exploit flaw with bounded, identity-spoofing impact and no confirmation of real-world use; assessment signals point the same way.
Paid fulfillment bypass in Lychee (Supporter/Pro editions) before 7.7.0: the checkout validators accept any OmnipayProviderType enum value, including the Dummy test gateway that is deliberately hidden from production checkout, so a remote unauthenticated buyer - where webshop_allow_guest_checkout is enabled - can start and finalize a session against the Dummy gateway and, with webshop_auto_fulfill_enabled on, have OrderCompletedListener::fullfillOrder() release the purchasable item without any real payment. The integrity impact is genuine but conditional (CVSS 4.0 base 8.3 with Attack Requirements: Present; assessed CVSS 3.1 8.3, C:L/I:H/A:N), since exploitation requires a paid Supporter/Pro instance running the webshop with at least one enabled purchasable item and the relevant opt-in flags. No public exploit identified at time of analysis, and the vendor has released a fixed version, 7.7.0.
Unauthenticated buyers on Lychee instances running the Supporter/Pro webshop can tamper with the parameters handed to the payment gateway, overriding the server-computed amount, currency, returnUrl, cancelUrl, or transactionId so that a gateway approves a payment for an attacker-chosen price while the merchant is underpaid and auto-fulfilled goods are still delivered. The flaw lives in CheckoutService::preparePurchaseParameters(), which merges the client-supplied additional_data array after the server's own purchase parameters, allowing later string keys to overwrite earlier ones before processPayment() reaches a non-PayPal Omnipay gateway. Exploitation is not a network-wide exposure: it requires an enabled webshop, at least one purchasable item, and an affected Omnipay gateway (PayPal is explicitly not affected), which sharply narrows the population at risk; no public exploit code was identified at time of analysis, though the upstream fix ships a regression test that demonstrates the parameter override, and no CISA KEV entry exists. This is best treated as a credible, prioritizable business-logic flaw rather than an inflated high-severity issue, since the integrity impact on the merchant's billing is real but the prerequisites are opt-in and non-default.
Memory corruption in the HPE NonStop HTTP WEBSERVER can be triggered by network-delivered HTTP input, causing the web server process to fail and potentially halting the NonStop system itself (CVSS 8.2, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Any HPE NonStop deployment that exposes the WEBSERVER component to an untrusted network is in scope, since the assessed vector requires no authentication, privileges, or user interaction against a listening server. The practical risk is bounded by the relatively small installed base of the NonStop platform and by the fact that the worst realistic outcome is availability loss rather than code execution or data disclosure; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Cleartext LDAP credential recovery in go-ldap-admin through 0.6.2 is possible because the application ships with a hard-coded RSA private key, committed to the public repository at config/config.go, that is used to encrypt login passwords. An attacker who obtains the encrypted password blobs - by capturing login traffic or reading a stored encrypted value - can decrypt them offline, or simply replay them to the unauthenticated /base/decryptpwd endpoint, to recover usable LDAP account credentials; no authentication, user interaction, or non-default configuration is required once ciphertext is in hand, which is the only real precondition (reflected in the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N versus the vendor-provided CVSS 4.0 score of 8.2). Deployments that replaced the embedded key with their own keypair are not affected. No vendor patch is identified in the available data, and no public exploit code has been flagged at time of analysis, although a detailed public technical writeup of the decrypt oracle exists.
Response validation in kin-openapi (openapi3filter.ValidateResponse) panics with a nil pointer dereference when an OpenAPI 3.x document declares a response header using a 'content' media-type object instead of a 'schema' field - the document itself validates successfully, but every response validation for the affected operation dereferences the nil schema and crashes, even when the response omits the declared header entirely. All versions prior to 0.146.0 are affected, and the flaw is unauthenticated and network-reachable (CVSS 4.0 AV:N/PR:N), though the decisive qualifier is AT:P: remote availability impact realistically applies only to applications that ingest untrusted or third-party specifications, while applications using only trusted local specs suffer a self-inflicted crash when the affected operation is exercised. No public exploit code and no confirmed active exploitation were identified at time of analysis; the upstream commit adds a regression test and a nil-schema guard in the decoder. EPSS data was not provided for this CVE.
Eclipse Jetty's HttpClient can disclose proxy authentication credentials to a malicious server when the server returns a 407 Proxy Authentication Required status. This information disclosure (CWE-200) affects applications using Jetty's HttpClient with an authenticated forward proxy and connecting to attacker-controlled destinations. Exploitation requires the attacker to control the destination server and the client to be configured with proxy credentials; no public exploit code has been identified at time of analysis, and the CVSS 4.0 score is 8.2 (High).
Unbounded direct-memory allocation in Eclipse Vert.x's MySQL client (io.vertx:vertx-mysql-client) versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 allows a malicious, compromised, or man-in-the-middle MySQL server to crash the client with an out-of-memory condition before authentication completes. The attacker sends a continuous stream of maximum-length (0xFFFFFF) MySQL protocol packets, preventing the decoder from reaching the end-of-message boundary. This is a denial-of-service issue; no public exploit code has been identified at time of analysis (not in CISA KEV).
An unbounded-memory denial of service in the Eclipse Vert.x PostgreSQL client (io.vertx:vertx-pg-client) allows a malicious, compromised, or man-in-the-middle PostgreSQL server to crash a client application by sending a wire-protocol message header whose 4-byte length field is set to an extremely large value (up to Integer.MAX_VALUE). The client-side decoder performs no maximum-size validation, so it keeps accumulating TCP data into a composite buffer until the JVM exhausts heap and terminates; the abuse happens during connection startup, before authentication completes, so no valid database credentials are required - the attacker only needs to control the server side of the connection or sit on the client-to-PostgreSQL TCP path. Per the independent assessment this is a genuine but conditional availability risk (CVSS 8.2, AV:N/AC:H, availability-only impact) rather than a mass-exploitation priority: no public exploit code or confirmed active exploitation was identified at time of analysis, and clients that connect exclusively to trusted, authenticated, TLS-verified PostgreSQL servers are not realistically exposed.
Unbounded direct-memory allocation in Eclipse Vert.x's MSSQL client (io.vertx:vertx-mssql-client) lets a malicious, compromised, or man-in-the-middle SQL Server endpoint crash a connecting client application by streaming TDS packets that never set the END_OF_MESSAGE status flag. Affected versions are [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9] and 5.2.0: the TDS message decoder aggregates inbound packets into a composite direct-memory buffer with no cumulative size cap, so the buffer grows until memory is exhausted and the process dies (availability impact only, with no confidentiality or integrity loss, per the assessed CVSS:3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). The flaw is reachable before authentication completes, meaning no valid server credentials are required, but exploitation is not available to an arbitrary remote attacker - it demands control of, or a man-in-the-middle position on, the server side of the connection, which is why access complexity is rated High. No public exploit code or confirmed active exploitation was identified at time of analysis.
Slican's WebCTI subscriber service for IPx telephone exchanges stores the temporary subscriber password in plaintext, so anyone able to read the backend database can recover the credential and authenticate as that subscriber. Only IPx deployments running WebCTI on versions prior to 6.62.0100 are affected, and the practical gate is prior read access to the database (an insider, stolen or default DB credentials, an exposed datastore, or a chained flaw), so this is best characterized as a credential-recovery weakness triggered after some other access is obtained rather than a directly reachable entry point; the assessed vector (CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) reflects that high-privilege prerequisite, while the CVSS 4.0 data rates it 8.2 with AT:P. Exposure is confidentiality-only (CWE-256) with no integrity or availability impact, there is no evidence of exploitation, and no public exploit code exists; no KEV listing and no EPSS signal were provided. Because the stored secret is described as a temporary password, the exploitation window and account scope may be limited by provisioning lifetime.
Unbounded inbound memory retention in the Eclipse Vert.x MQTT client (io.vertx:vertx-mqtt) allows a malicious or compromised MQTT broker to drive the Vert.x process into memory exhaustion and eventual out-of-memory termination. Client-side applications embedded in Vert.x 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 that subscribe to QoS 2 (exactly-once) topics are affected; the attacker supplies QoS 2 PUBLISH packets with distinct packet identifiers and never sends the matching PUBREL, so each message is retained indefinitely in the client's internal qos2inbound map. The assessed vectors rate this AV:N/AC:H/PR:N with high availability impact only (no confidentiality or integrity impact), reflecting that exploitation requires the attacker to occupy the broker role rather than being an arbitrary remote peer; no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and EPSS data was not provided. Note that the maxInflightQueue option does not mitigate this issue because it constrains only the outbound publish path.
Denial of service in Eclipse Vert.x's vertx-pg-client component allows an attacker controlling the PostgreSQL server or positioned as a man-in-the-middle on an unencrypted connection to crash the client application. The flaw resides in the binary array decoder (DataTypeCodec.binaryDecodeArray), which allocates a Java array based on a server-supplied 32-bit dimension count without upper bound checking, leading to a multi-gigabyte heap allocation and OutOfMemoryError. Affected versions include 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0. Exploitation requires no authentication (PR:N) but does require control of the database server or a MITM position on a non-TLS connection (AC:H), and no public exploit code has been identified at time of analysis.
XML External Entity injection in Sparx Systems Enterprise Architect's XSLT Debugger lets an attacker who convinces a user to open a crafted XML/XSLT file cause the parser to resolve an external DTD and disclose arbitrary files readable by the victim's Enterprise Architect process. The issue was reported by CERT-PL and has been confirmed only in version 17.1, with all other releases unverified because vendor contact attempts were unsuccessful; the CPE entry covers the product across all versions. It is unauthenticated in the network sense but requires the victim to actively load attacker-controlled content into the debugger (UI:A in the CVSS v4.0 vector, UI:R in our CVSS v3.1 assessment), confidentiality-only impact with no write or code execution demonstrated from this flaw alone, and no public exploit identified at time of analysis.
Path-normalization weakness in Eclipse Jetty's HttpClient causes credential disclosure: when HttpClient receives a redirect whose target contains a non-normalized traversal segment such as /secure/../evil, Jetty matches the stored Authorization credential against the literal /secure prefix rather than resolving the path to /evil, and then follows the redirect - sending the /secure-scoped Authorization header to an endpoint that should never receive it. Per the provided CVSS vector (PR:N) the attacker is unauthenticated, but exploitation carries high attack complexity (AC:H): the attacker must be able to control or influence the redirect response returned to HttpClient, and must already have a malicious application deployed on the SAME domain as the target so the leaked header lands on an endpoint they control. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Denial of service in the Vert.x MySQL client (io.vertx:vertx-mysql-client) lets an attacker who controls or intercepts the client-to-database path crash a Vert.x application: a crafted MySQL result-set packet declaring an extremely large column count causes the client to attempt an unbounded heap allocation, and the resulting OutOfMemoryError kills the Netty event loop thread, taking down all connections and verticles in the process. Affected builds are 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, across all platforms where vertx-mysql-client is used. No authentication or user interaction is required once the hostile source or man-in-the-middle position exists (CVSS 4.0 PR:N), but the vendor rates the attack complexity as high (AC:H) because the database endpoint is normally trusted and operator-controlled; there is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Memory corruption in HPE NonStop SOAP 4.0 can be triggered remotely by a crafted SOAP request, resulting in a crash that takes down the affected NonStop system or SOAP service. The vulnerability is network-reachable and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), scoring 8.2 with the impact concentrated on availability (A:H) alongside a limited integrity effect (I:L) and no confidentiality exposure. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the realistic risk depends heavily on whether the SOAP listener is exposed beyond a restricted internal back-office network, making this a moderate-priority availability issue rather than a top-tier emergency.
Weak password hashing in JuggleIM im-server and its imserver-console through 1.8.16 stores admin-console credentials as unsalted SHA-1 digests in the accounts table, allowing an attacker who first obtains the database or its backups to crack those passwords offline with precomputed rainbow tables or GPU brute force. The issue is conditional rather than directly network-reachable, because it requires prior read access to the database or backup files, and no public exploit identified at time of analysis. The independent assessment rates it a moderate, conditional risk with high attack complexity and confidentiality-only impact.
Denial of service in the Eclipse Vert.x Redis client (io.vertx:vertx-redis-client) affects versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0: the RESP parser trusts a server-declared array, push, or attribute length and pre-allocates that many elements without an upper bound, so a crafted response triggers a massive heap allocation that terminates the Vert.x event-loop thread with OutOfMemoryError and denies service to every connection and verticle sharing that loop. Exploitation is conditional rather than opportunistic - a remote, unauthenticated attacker qualifies only if they control or have compromised the Redis server the client talks to, or if they can occupy a man-in-the-middle position on the client-to-Redis path; neither user interaction nor prior client authentication is required, which is why the assessed vector is AV:N/PR:N but AC:H, and impact is availability-only (no confidentiality or integrity loss). No public exploit code or confirmed active exploitation was identified at time of analysis, and this is a genuine but conditional DoS issue rather than a top-tier emergency.
Heap out-of-bounds write in the FreeBSD RACK TCP stack (CVE-2026-101307) lets a remote, unauthenticated attacker who completes a TCP handshake and sends a sufficient number of ACKs cause a 16-bit PCM sample-array growth counter to wrap to zero, producing a near-zero-length kernel heap allocation that is then overwritten with roughly 512 KB of existing sample data. The result is a kernel panic - availability impact only, with no confidentiality or integrity loss - and only FreeBSD 15.1-RELEASE before p5 hosts that have explicitly enabled the non-default RACK stack are exposed; stock FreeBSD hosts using the default stack are unaffected. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none', and EPSS is 0.17% (6th percentile), so the practical near-term risk is moderate and conditional on RACK being enabled.
Slican telephone exchanges encrypt their TCP/IP signalling and management traffic with a symmetric key that is hardcoded in multiple firmware binaries, so anyone who obtains a single firmware image or device copy can decrypt that traffic on any installation using the same key. The issue is fixed in IPx series version 6.62.0100; CVSS 4.0 rates it 8.2 with attack prerequisites (AT:P) because exploitation also requires a position to capture the encrypted traffic (passive sniffing or MITM on the exchange's network). Three discontinued models - CCT-1668 (CCT1CPU), MAC-6400 and CXS-0424, discontinued in 2011 and 2012 - remain permanently affected because they cannot receive a software fix and require a hardware upgrade. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the impact is confidentiality-only (high), with no integrity or availability effect.
Unauthenticated attackers who know the shared identifier of a public, password-protected Lychee album can pull down a ZIP archive of the album's photos via GET /api/v2/Zip without ever supplying the album password, because the download authorization path never re-checks album access. All versions prior to 7.6.3 are affected, and the exposure escalates to full-resolution originals plus associated metadata when the album's grants_full_photo_access flag is also enabled. The flaw only triggers on a non-default sharing configuration (public + password-protected + grants_download on), and no public exploit identified at time of analysis; the vendor fix is 7.6.3.
An authorization bypass in the Checkout Field Manager (Checkout Manager) for WooCommerce plugin, affecting all versions up to and including 7.9.6, lets any logged-in user at subscriber level or above delete arbitrary attachments from the WordPress Media Library. The action handler fails to verify that the caller is permitted to remove the targeted attachment, so a low-privilege account - which many WooCommerce storefronts allow anyone to self-register for - is sufficient to destroy site media content. The vendor addressed the flaw in version 7.9.7; there is no public exploit code and no confirmed active exploitation (CISA KEV) at time of analysis, though the assessed EPSS-style risk is driven by how commonly subscriber registration is left open on commerce sites.
Unauthenticated log injection in the OPNsense WebGUI login handler lets a network-adjacent attacker forge authentication events that manipulate the firewall's sshlockout protection state. Because the usernamefld parameter prior to version 26.1.11 passes carriage-return and line-feed characters through LOG_AUTH into the syslog-ng lockout pipeline, an attacker who can reach the login page can plant a fabricated failure event naming a victim IP, causing that address to be added to the sshlockout PF table and its active states killed, or plant a forged accepted event to reset their own brute-force counter and defeat password-guessing lockout. The flaw requires no authentication and no user interaction, but the assessed AV:A vector means exploitation presumes adjacency or management-network reachability to the GUI; impact is integrity of lockout state and availability of blocked systems (administrative, DNS, gateway, or monitoring addresses), with no confidentiality impact, and no public exploit or confirmed in-the-wild activity was identified at time of analysis.
Passkey assertion forgery in the AliasVault browser extension prior to 0.29.4 allows a malicious website to supply forged origin and relying-party identifier values and, if the victim approves the AliasVault passkey prompt, obtain a valid WebAuthn assertion generated for a different website (CWE-346, origin validation error; CVSS 3.1 base 8.1). The assessed vector is remotely reachable and unauthenticated (AV:N/PR:N) with high confidentiality and integrity impact, but it mandates user interaction (UI:R) and a tight prerequisite chain: the extension must be installed, unlocked, and explicitly configured as the active passkey provider, and the victim must already have a stored passkey for the exact site being impersonated, so the flow is not silent and cannot be triggered by an attacker alone. Only the browser extension passkey provider is implicated - the server, web application, and mobile applications are explicitly unaffected - and the vendor ships a fix in 0.29.4. No public exploit identified at time of analysis.
Arbitrary file overwrite in HPE NonStop Python 3.x lets an attacker who supplies a crafted TAR archive escape the intended extraction directory via .. (dot-dot) sequences in member filenames and clobber files on the NonStop host, with the overwritten data potentially leading to code execution or system compromise depending on the privileges of the extracting process. The vendor rates this 8.0 (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while our independent assessment scores it lower at CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, treating it as local rather than adjacent-vector and integrity/availability-only; unauthenticated access is implied by PR:N in both vectors, but successful exploitation is not automatic - it requires the victim to extract an attacker-controlled archive (UI:R), and the write primitive is bounded by the privileges of the extracting account. No public exploit code was identified at time of analysis, there is no CISA KEV entry, and no EPSS score was supplied, so real-world risk is moderated by the mandatory user interaction rather than by the headline score.
Stored cross-site scripting in the OPNsense OpenVPN connection-status dashboard widget and status view lets an authenticated VPN client execute arbitrary JavaScript inside a firewall administrator's browser session, which the advisory demonstrates can read config.xml, invoke privileged APIs, reset the root password and ultimately obtain root command execution on the appliance. Exploitation is heavily gated: the OpenVPN server must be configured with username-as-common-name and a RADIUS or LDAP authentication backend, the attacker must be able to provision or self-register a backend username containing a double quote, a separate trust boundary must exist between the identity backend and the firewall (the local user database is unaffected because its username validator rejects quotes), and an administrator must open the affected dashboard or status page and trigger the injected handler - the demonstrated payload required pointer movement over the client row rather than unconditional page-load execution. Consistent with the CVSS vector (AV:N/AC:H/PR:L/UI:R) this is a low-privilege, high-complexity, admin-interaction-dependent issue; no public exploit code was identified at time of analysis, and the fix shipped in OPNsense 26.1.11.
Security-feature bypass in Microsoft Office Word - including the wider Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 families on Windows and macOS - lets an attacker defeat a protection mechanism such as Protected View, mark-of-the-web enforcement, or a trust/macro prompt by getting a victim to open or preview a crafted document. No attacker credentials or prior access are required (CVSS PR:N), but exploitation is local (AV:L) and depends on the target user interacting with the file (UI:R); a successful bypass yields high confidentiality, integrity, and availability impact for a 7.8 High severity rating. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has released a patched update through its Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108433).
Heap-based out-of-bounds reads and writes in bincookie prior to 0.1.9 occur when an application calls bincookie_init_file() on an attacker-supplied .binarycookies file, allowing the crafted input to drive byte-swap and iteration loops past a heap buffer sized only to the real file length. The vulnerable parser trusts file-controlled num_pages, page_sizes, and cookie_offsets as loop bounds, so malformed files can crash the host application or corrupt heap metadata in ways that could potentially lead to code execution. Exploitation requires local delivery of the crafted file and user interaction to make the target application parse it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8); no authentication to the parsing application is needed, and there is no public exploit identified at time of analysis. Version 0.1.9 fixes the issue by rejecting malformed files.
Local privilege escalation in TotalAV versions up to 7.1.17 allows an authenticated but unprivileged local user to impersonate the SYSTEM service by forging a gRPC IPC authentication token, leading to arbitrary code execution as NT AUTHORITY\SYSTEM. Publicly available exploit code exists (a proof-of-concept C file is linked in the disclosure), though CISA KEV does not list the vulnerability as actively exploited, and the SSVC assessment rates exploitation as 'poc' with total technical impact. Exploitation requires a local foothold and the vulnerable TotalAV service to be running; it cannot be triggered remotely or against hosts without TotalAV.
Firmware forgery is possible in the EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the public CDN bin.zip) because every installation ships with the same hard-coded AES key, so an attacker who recovers that key can decrypt and craft firmware packages accepted by any device that trusts the updater. Key recovery needs no credentials since the binary is publicly downloadable (PR:N), but the forged image must actually reach a device and be installed by an operator (UI:R), yielding a locally-vectored CVSS 3.1 score of 7.8 with high confidentiality, integrity and availability impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the result is a systemic, fleet-wide trust failure rather than a remotely triggerable network flaw.
Code execution in JetBrains Junie CLI before 26.8.3 allows an attacker to run arbitrary code via a malicious MCP server configuration embedded in an untrusted project. The victim must open and interact with the project (user interaction required), and local access is necessary, but no privileges are required. No public exploit code has been identified at time of analysis.
Path traversal (CWE-22) in QNAP Video Station 5.8.x before 5.8.5 lets an authenticated remote user escape the application's intended media directory and read unexpected files or system data on the underlying NAS. The attacker must first hold a valid account on the target QNAP device (CVSS 3.1 PR:L), so exposure is limited to holders of legitimate low-privilege credentials or anyone able to register or compromise such an account; the vendor's CVSS 4.0 vector additionally carries the AT:P flag, indicating an attack requirement outside the attacker's direct control. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and QNAP has already released a fixed version, so this is a moderate-priority issue that nevertheless warrants prompt patching on internet-exposed NAS devices with open registration or weak accounts.
Authenticated path traversal in QNAP Video Station 5.8.x (fixed in 5.8.5) allows a low-privilege NAS user to read files and system data outside the intended application directory. The flaw requires a valid Video Station login (CVSS PR:L) plus the vendor's stated attack precondition (AT:P), and its impact is limited to information disclosure rather than code execution. No public exploit has been identified at time of analysis, and the practical risk is moderate: a real but constrained, authenticated file-read issue rather than a critical remotely weaponizable bug.
Out-of-bounds write in HPE NonStop QIOMON (T8671L02^ABH and earlier) allows a low-privilege authenticated actor to corrupt adjacent buffer memory when QIOMON processes attacker-influenced input, with the integrity and availability impact rated High and confidentiality impact Low. Exploitation is constrained on two fronts: the attacker must already hold authenticated low-privilege access to the NonStop environment (CVSS PR:L) and a legitimate user must perform an action that feeds malicious input into QIOMON (CVSS UI:R), so the issue is not exploitable as an end-to-end unauthenticated remote attack. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; EPSS data was not provided, so it should be treated as a moderate-priority, non-emergency hardening item.
Unbounded resource allocation in ASP.NET Core - reachable through the System.Formats.Cbor component shipped with Microsoft Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.10 - lets unauthenticated remote attackers exhaust server resources and cause a denial of service. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact), meaning any network-exposed service that actually parses attacker-supplied CBOR input through the vulnerable path can be driven into resource exhaustion without credentials or user interaction. Exploitation is bounded by reachability: deployments that never process untrusted external CBOR/network data, or that sit behind request-size limits, rate limiting, timeouts, or a WAF, have materially reduced exposure. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; a vendor patch is available via the Microsoft Security Response Center advisory.
Unauthenticated remote denial of service in @libp2p/webrtc (the js-libp2p WebRTC transport) before 6.0.28 lets a single crafted UDP STUN Binding Request abort a Node.js webRTCDirect() listener process with SIGABRT, because the attacker-controlled ufrag field is forwarded into DirectRTCPeerConnection.setLocalDescription and reused as the ICE password without any length or character-set validation. The vulnerable code path runs before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, and connection-manager admission, so no credentials, prior connection, or user interaction are required - matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). The confirmed impact is process termination only; no memory corruption, code execution, confidentiallity or integrity impact, browser-side impact, or connection-limit bypass has been demonstrated, and no public exploit code or CISA KEV entry was identified at time of analysis. Affected deployments are limited to Node.js peers that actively expose a webRTCDirect UDP listener; browser peers and nodes without such a listener are unaffected.
Stack buffer overflow in the HPE NonStop SQL/MX Executor allows an authenticated remote user to trigger memory corruption, yielding partial information disclosure and a high-availability impact in the form of a process crash. The flaw is reachable over the network with low attack complexity and no user interaction, but requires valid credentials with at least low-level privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, base 7.6), meaning an attacker must already be able to submit SQL to the Executor. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis; the exposure is further limited because HPE NonStop is a specialized fault-tolerant platform rather than a commodity database, so this is a moderate-priority issue rather than an urgent one.
An out-of-bounds memory read in the SICK Safetyscanners Base C++ driver (CVE-2026-101290) lets a remote attacker crash the affected application by sending a specially crafted packet whose declared length is not properly validated during parsing. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning it is reachable over the network without authentication or user interaction, but the impact is strictly availability - the driver reads past the end of a buffer and the process terminates, producing a denial-of-service condition with no confidentiality or integrity effect and no code execution. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; real-world exposure is bounded by network reachability, since an attacker must be able to deliver malformed scanner-protocol traffic to the interface or port the driver parses, which in typical OT deployments requires presence on or routing into the industrial/scanner network segment. SICK AG published advisory SCA-2026-0015 covering the affected driver.
Unbounded response-header buffering in ReactPHP's HTTP client (react/http) versions 1.0.0 through 1.11.0 allows a malicious or compromised remote server to exhaust the PHP memory_limit of an application that uses React\Http\Browser to fetch attacker-influenced URLs. Because CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H rates this 7.5, the impact is availability-only (event-loop or worker process crash), with no confidentiality or integrity effect; there is no public exploit identified at time of analysis and the issue is not in CISA KEV. The vendor-released patch is version 1.11.1, which enforces a 65536-byte response-header cap and raises an OverflowException when exceeded.
Unauthenticated remote requests can crash Go services that embed kin-openapi before 0.148.0: posting a YAML body containing .nan, .inf, or -.inf to an OpenAPI 3.1 operation carrying a numeric constraint drives the bundled santhosh-tekuri/jsonschema v6.0.2 into a nil big.Rat dereference, panicking inside ValidateRequest. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), reflecting availability-only impact: a standard net/http server recovers the panic per connection so the effect is usually a single dropped request, while non-net/http hosts or panics raised in application goroutines can terminate the process. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation; the need to reach an OAS 3.1 spec, accept application/yaml (or application/x-yaml), and hit an operation with a numeric constraint keeps this a genuine but bounded denial-of-service issue.
A nil-pointer panic in kin-openapi's openapi3filter validation path can crash any Go service that embeds versions 0.136.0 through 0.142.x and serves an OpenAPI 3.1 document with an array schema that omits the items keyword. Unauthenticated remote clients (CVSS vector PR:N/UI:N) only need to send a single nonempty application/x-www-form-urlencoded or multipart/form-data request to an affected operation - or trigger a matching response on a surface such as a response header - to deterministically panic ValidateRequest or ValidateResponse, producing denial of service with no confidentiality or integrity impact (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 7.5). The risk is real but bounded: only OpenAPI 3.1 specs containing the specific malformed-but-spec-legal array shape are exposed, JSON request bodies use a different decoder, and OpenAPI 3.0 documents are rejected at validation time. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation.
Denial of service in lottie-android 6.7.1 and earlier allows remote attackers to crash or hang applications by supplying a crafted Lottie animation JSON that contains a cyclic precomposition reference graph, which triggers uncontrolled recursion during layer model construction in BaseLayer.forModel and CompositionLayer. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms unauthenticated, network-reachable availability impact with no confidentiality or integrity effect. No CISA KEV entry or public exploit code has been identified at time of analysis, but exploitation requires the host application to parse untrusted or remote Lottie files; applications rendering only bundled, trusted animations are not exposed.
Denial of service in Junrar before 7.6.1 allows unauthenticated remote attackers to exhaust CPU and archive-processing worker capacity by supplying a crafted RAR4 archive. The archive drives the built-in RAR virtual machine into an infinite loop via a VM_JMP instruction targeting an address at or beyond the prepared program's codeSize; because the VM cannot execute native code, the supported impact is availability loss rather than code execution. No public exploit code or confirmed active exploitation has been identified, and the flaw is fixed in version 7.6.1.
Unauthenticated time-based blind SQL injection in the WordPress Link Library plugin (all versions up to and including 7.9.2) lets remote attackers append arbitrary SQL to the plugin's existing query via the 'link_url' parameter and use timing side-channels to extract sensitive information from the site's database. The injection is reached through the plugin's front-end link user-submission functionality - the code path the vendor patch modifies in usersubmission.php - so a site only becomes directly attackable if that submission form is enabled and publicly reachable, and no authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) with impact limited to confidentiality (C:H/I:N/A:N, base 7.5). Because the technique is blind and time-based, extraction is slow and requires many timed requests, and no public exploit code has been identified at time of analysis; this is a moderate-priority issue rather than a top-tier emergency.