AdPlug through 2.4 contains a heap-based buffer overflow in the KSM (Ken Silverman Music) module player, CksmPlayer::update() in src/ksm.cpp, where register writes accumulated for a single time slot overflow the fixed databuf[2048] array and corrupt the heap-resident player object. A crafted .ksm module whose notes share one time slot triggers the out-of-bounds write without authentication (CVSS PR:N), but the attacker-supplied file must reach and be opened or played on the target (AV:L, UI:R/UI:P), so the real-world exposure is local and interaction-dependent, with the dominant impact being availability loss (A:H) and minor integrity effects (I:L) rather than code execution. An upstream fix is available in GitHub PR #295; no public exploit code was identified at time of analysis.
Stack-based out-of-bounds read and write in nifti_clib through 3.0.1 allows an attacker who supplies a crafted 540-byte NIfTI-2 header to crash or corrupt stack memory in any application that parses that file through nifti_image_read(). The flaw is unauthenticated per the published CVSS vectors but is local and file-driven: the target must actively open or process the malicious NIfTI-2 file, so there is no remote network-triggered path, and the dominant impact is denial of service (CVSS 6.9, AV:L/AC:L/UI:P, A:H with only I:L and C:N in the independent assessment). No public exploit identified at time of analysis; exposure is confined to software that links the vulnerable nifti_clib versions and accepts untrusted NIfTI-2 header data.
Processing a malicious DSM module file with libmodplug through 0.8.9.1 triggers a heap-based out-of-bounds write in CSoundFile::ReadDSM(), corrupting heap memory and crashing the consuming process. Exploitation is local in nature: it requires a victim to open or load a crafted DSM file whose header declares more than 240 PATT chunks or whose patt_len value wraps, defeating the missing nPat bound against MAX_PATTERNS. Impact is bounded to availability (process crash) with limited integrity effect and no confidentiality disclosure, and no public exploit code was identified at time of analysis; a public technical write-up of the defect exists, and the risk converges on a medium-severity memory-safety issue rather than a top-tier priority.
Decoding crafted iCalendar text that ends in a trailing backslash drives a heap-based out-of-bounds read in libical 4.0.6 and earlier, allowing the attacker to crash the consuming application or expose a small amount of adjacent heap memory. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, meaning a victim must locally open or process the malicious calendar data (for example a crafted .ics file, meeting invite, or subscribed feed) and the dominant outcome is a crash / denial of service, with only limited confidentiality loss rather than code execution; the PR:N component indicates no attacker credentials are needed on the affected host. No public exploit identified at time of analysis, the flaw is not listed in CISA KEV, and an upstream fix exists via the referenced pull request and commit.
Opening a crafted R2004 or R2010+ DWG file with GNU LibreDWG through 0.14.8612 can crash the parsing application and expose a small amount of process memory, because the AcDs data-section decoder indexes a static schema-property-type handler table using an unchecked 'schdat' index. The issue is local and user-assisted: an attacker must deliver the file, and a victim or an automated pipeline must actually parse it with dwgread, dwg2dxf, or any tool linked against LibreDWG; no authentication is required and default configurations are affected (CVSS 3.1 AV:L/AC:L/PR:N/UI:R, C:L/A:H). No public exploit code was identified at time of analysis, and the practical impact is a medium-severity denial-of-service against DWG-processing workflows plus limited out-of-bounds information disclosure, making this a defense-in-depth file-parsing issue rather than an emergency.
Heap out-of-bounds read in WildMIDI through 0.5.0 allows attackers to crash applications or disclose adjacent heap bytes by supplying a crafted .hmp file with an HMP chunk length of 0-12 that underflows to roughly 4 GB. Exploitation is local and file-driven: the target application or user must load the malicious .hmp file, reaching _WM_ParseNewHmp() with no authentication or special privileges required, and the impact is limited to denial of service or heap information exposure via WildMidi_GetInfo() with no code-execution or write primitive. This is a genuine but modest-priority issue, not a high-urgency flaw; no public exploit identified at time of analysis and CISA KEV does not list active exploitation.
A heap out-of-bounds read (CWE-125) in libyal's libfwsi shell-item parsing library, through the 20260522 snapshot, lets a crafted MTP volume shell item read past allocated buffer bounds inside libfwsi_mtp_volume_values_read_data(), typically crashing the consuming process. The issue is triggered locally and requires the victim to actively open or process an attacker-supplied Windows shell-item artifact - a .lnk file, a jump list, or a shell bag - that embeds a 10 to 53 byte MTP volume shell item declaring an item data size of 44 bytes or more; no attacker privileges are required (CVSS 4.0 base 6.9, PR:N). Practical exposure is limited to environments that actually run libfwsi-based parsers, such as digital-forensics and timeline tooling, and the realistic outcome is process termination (availability impact rated High) with only limited information disclosure possible; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Heap out-of-bounds read in libfwsi (libyal) through version 20260522 allows an attacker to craft an MTP file entry shell item that makes a libfwsi-based parser read past the end of a heap buffer, crashing the consumer and potentially disclosing a small amount of adjacent heap memory. The trigger is a shell item of 10-73 bytes whose declared item data size is 44 or more, embedded in a Windows .lnk file, jump list, or shell bag that the victim's tooling later loads or analyzes; the assessed CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, meaning local delivery, no privileges required, passive user interaction, high availability impact and only limited confidentiality impact. No public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and the practical outcome is a denial-of-service crash in DFIR/shell-item tooling (for example plaso) rather than remote code execution.
Rendering a crafted XPS document drives GNOME libgxps through 0.3.2 (the renderer used by consumers such as Evince) into a heap out-of-bounds read inside path_geometry_start_element(), allowing an attacker to crash the consuming application and leak adjacent heap bytes into rendered output. The trigger is a PolyBezierSegment or PolyQuadraticBezierSegment Points attribute whose point count is not a multiple of three (bezier) or two (quadratic), so exploitation is limited to a local, file-based attack that requires the victim to open or render the malicious document via user interaction (CVSS 4.0 AV:L/UI:P, PR:N) with no authentication or privilege bypass, no code execution, and only low confidentiality impact alongside high availability impact. An independent assessment scores the flaw 6.9 (medium) using CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, and no public exploit identified at time of analysis despite a public technical writeup documenting the arity mismatch; the affected range is captured by the wildcard CPE cpe:2.3:a:gnome:libgxps:*:*:*:*:*:*:*:*.
Processing a crafted MIRAX whole-slide image with OpenSlide through 4.0.1 can trigger a heap out-of-bounds read in the MIRAX tile-position logic, crashing the consuming application and exposing limited adjacent heap data. The issue is local and user-assisted because a malicious .mrxs/Slidedat.ini must be opened or ingested by a victim or automated pipeline, and it does not by itself enable code execution or persistent data modification. No public exploit identified at time of analysis, and no CISA KEV active-exploitation entry is present in the supplied intelligence.
An out-of-bounds read in catdoc's xls2csv converter lets an attacker who supplies a crafted .xls file cause the tool to read past the end of a heap buffer and emit adjacent memory contents into the converted CSV output, or crash the process outright. The flaw lives in copy_unicode_string() in src/xlsparse.c and is triggered when a LABEL, STRING, or SST record declares 0xFFFF two-byte characters, a count that is consumed without adequate validation against the actual buffer size. All catdoc versions through 0.95 are affected, and exploitation requires a victim or an automated document-processing pipeline to open the malicious spreadsheet with xls2csv; the impact is therefore moderate in human-driven workflows but materially higher where untrusted spreadsheets are converted automatically, and no public exploit code was identified at time of analysis.
CFITSIO through 4.7.0 contains a heap out-of-bounds read in its image decompression routines when processing a crafted FITS file that uses SUBTRACTIVE_DITHER_1 compression and sets the ZDITHER0 seed to zero or a negative value. Triggering the bug requires local access and user interaction to open the file and decode pixels, resulting in a crash (denial of service) and a limited, non-targeted leak of heap memory into decoded pixel values. No public exploit code or active exploitation has been identified, and the issue is best characterized as a moderate-priority file-parsing bug rather than a remote code execution threat.
sdbootutil on SUSE Linux Enterprise Server 16.1, SLES for NVIDIA 16.1, openSUSE Leap 16.1, and Tumbleweed creates a world-readable debug log at /var/log/sdbootutil.log, enabling any local user to read potentially sensitive information from it. This local information disclosure (CWE-732) requires that the debug log has been generated and contains secrets. No public exploit has been identified at time of analysis, and the issue is not known to be actively exploited.
Out-of-bounds write in FluidSynth (versions through 2.6.1) allows an attacker to corrupt heap and stack memory by getting a crafted SF2 SoundFont loaded and played - unvalidated PMOD/IMOD modulator destination values of 63 to 255 are used to index the per-voice generator array and updated_gen_bit bitfield without bounds checking. Because the attack vector is local and the victim (or an application acting on their behalf) must open or play the malicious SoundFont, the realistic impact is memory corruption and application crashes (availability) rather than code execution or data theft. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the write-up and source references point to a code-review/crash class of issue rather than an urgent, remotely exploitable defect.
A heap out-of-bounds read in libmikmod's IMF_Load() loader (CWE-125) lets a crafted Imago Orpheus (IMF) module map notes to sample indices far past the allocated sample table, crashing any application that parses the file with libmikmod 3.3.15 or earlier. Exploitation is local and requires the target application to load attacker-supplied IMF content, with no privileges or authentication needed, so the practical impact is denial of service against media players, trackers, and game engines that link the library. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 4.0 base score of 6.8 reflects high availability impact with no demonstrated confidentiality or integrity loss.
Denial of service in WildMIDI through 0.5.0 occurs when an application using the library opens or decodes a crafted HMI file that places a 0xfe 0x10 sub-event near the end of the input buffer. The _WM_ParseNewHmi() routine in src/f_hmi.c performs a heap out-of-bounds read of up to four bytes past the allocation, crashing the decoder; the issue is CWE-125 and cannot be triggered remotely without local file delivery and user interaction, and the over-read does not expose the four bytes to the attacker. Independent assessment rates this CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (low-to-moderate real-world risk, below the headline CVSS 4.0 score of 6.8), and no public exploit identified at time of analysis.
Parsing a crafted Ogre3D asset pair with Assimp through 6.0.5 crashes the host process: the importer resolves a submesh bone index that does not exist in the accompanying skeleton, BoneById() returns null, and the unchecked result is dereferenced in OgreStructs.cpp. The impact is availability-only - no code execution and no data disclosure - and exploitation requires the victim application to import the attacker-supplied .mesh and .skeleton files (local attack vector with user interaction, no authentication needed), so real-world risk is concentrated in workflows that routinely ingest untrusted 3D models. No public exploit code is identified in the available data and the issue is not listed in CISA KEV, although a public technical writeup of the crash path is referenced.
OS command injection in Netgate pfSense CE 2.5.0 through 2.9.0 allows an authenticated OpenVPN client to run arbitrary shell commands as the low-privileged 'unbound' user by embedding shell metacharacters in the certificate common name or username that openvpn.learn-address.sh interpolates unquoted into a 'su -c' string. Exploitation requires three conditions to line up: valid VPN authentication (the CVSS vector is PR:L, so authenticated), the non-default 'DNS Resolver (unbound) client registration' feature enabled, and attacker-controlled CN or username - which is why the assessed severity is low (CVSS 2.3 in the v4 vector supplied; equivalent CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L per independent assessment). Publicly available exploit code exists; there is no confirmation of active exploitation (not in CISA KEV) and impact is confined to the unbound user rather than root, so this is a genuine but low-priority issue.
Heap-based out-of-bounds read in unarr through 1.1.1 lets a crafted ZIP archive crash any host application that links the library and passes it attacker-controlled input. The defect is in zip_parse_extra_fields() in zip/parse-zip.c, where an incorrect length check on the ZIP64 extra-field record allows reads past the end of a heap buffer when an archive supplies 0xFFFFFFFF sentinel values together with a truncated ZIP64 record; the demonstrated impact ceiling is a denial of service (process crash), with no confidentiality or integrity compromise and no code execution indicated. Exploitation requires the malicious archive to reach the victim and be opened or processed by the vulnerable application (local attack vector, passive user interaction, no privileges required), and no public exploit identified at time of analysis - this is a moderate-severity, low-priority issue rather than an urgent one.
Heap-based out-of-bounds read in LibRaw through 0.22.2 allows a crafted Nikon NEF/TIFF file to crash applications that decode it. The flaw lives in LibRaw::parseNikonMakernote(), where a malformed 5-byte ShotInfo makernote tag declaring version 243 causes the parser to read past the end of a short buffer; because the file must be opened or processed by the victim (CVSS vector PR:N but AV:L/UI:P in the v4.0 score, and AV:L/UI:R in our independent v3.1 assessment), an attacker cannot trigger it remotely on their own. Impact is assessed as availability-only - no confirmed memory disclosure, code execution, or privilege gain - and no public exploit code or confirmed active exploitation was identified at time of analysis, though a technical writeup and the affected source lines are publicly linked. This is a moderate-risk availability flaw, not a top-priority emergency.
Crafted AMS (Velvet Studio) module files can crash any application that uses libmodplug 0.8.9.1 or earlier by triggering a heap-based out-of-bounds read in CSoundFile::ReadAMS2(). The attacker must deliver a specially formed AMS file whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer; the victim must then open or process the file, and no authentication is required. The issue is a local, client-side denial-of-service (CVSS 6.8) with no confirmed confidentiality or integrity impact, and no public exploit code or active exploitation has been identified at time of analysis.
Loading a crafted MultiTracker (.mtm) module file with a declared channel count above 32 in applications linked against libmikmod through 3.3.15 triggers an out-of-bounds read in MTM_Load(), crashing the process. The flaw is a medium-severity local denial-of-service issue (CVSS 4.0 base 6.8) requiring user interaction to open or process the malicious file; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in UADE through 3.05 crashes applications that probe or play attacker-supplied Amiga module files, because an unsigned length subtraction in uade_filemagic() wraps around on deliberately short inputs. The malformed module must be small enough to slip past the format-probe bounds checks in amifilemagic.c yet trigger the bufsize underflow, after which the code reads far past the end of the buffer. Impact is limited to a denial of service, typically a segmentation fault that terminates the host player or library consumer; the attack requires the crafted file to be opened locally and the user to trigger the probe/playback path (CVSS:3.1/AV:L/PR:N/UI:R, availability-only), with no code execution, privilege gain, or data disclosure. The affected software is a niche Amiga emulation/audio library with limited deployment, so real-world risk is moderate; no public exploit identified at time of analysis, and the CVE is not in CISA KEV.
Processing a crafted ZIP archive with zziplib through 0.13.80 can cause a denial-of-service (crash) via an out-of-bounds read in the mmapped parsing path (zzip/mmapped.c). This local attack requires the victim to open the malicious file (passive user interaction) and no authentication, but results only in a crash (CVSS 4.0 base 6.8, availability impact only). No public exploit code or active exploitation has been identified at time of analysis.
assimp through 6.0.5 is susceptible to a NULL pointer dereference when parsing a crafted Ogre3D .mesh file with a morph animation track that references a missing submesh or absent shared geometry, crashing the host process. The flaw requires user interaction (passive, such as opening or importing the file) and no privileges are needed on the victim's system; no public exploit code is identified at time of analysis. This is a moderate-severity, availability-only issue with no impact on confidentiality or integrity.
An out-of-bounds write in the Lenovo Energy Management kernel-mode driver lets a local authenticated user crash the affected Windows host with a blue-screen (kernel bugcheck) error, producing a denial-of-service condition on systems where the driver is installed and loaded. The flaw is availability-only: the assessed impact is kernel memory corruption leading to a crash, with no demonstrated path to code execution or data disclosure, and it requires the attacker to already hold a local session on the machine (PR:L) - there is no network-reachable attack surface. No public exploit code and no evidence of active exploitation were identified at time of analysis, so this should be treated as a moderate-severity, patch-and-move-on item rather than an emergency; the vendor advisory is Lenovo LEN-218444.
Directory traversal in Grav CMS versions 2.0.3 through 2.0.6 allows authenticated remote attackers with low privileges to read arbitrary sensitive files on the server. The flaw exists in the mediaDirFunc Twig method within GravExtension.php, where crafted path sequences can escape the intended media directory. No public exploit has been identified at time of analysis, and the CVSS 3.1 vector (6.5) reflects high confidentiality impact with no integrity or availability effects.
Stored cross-site scripting in EspoCRM (all versions prior to 9.3.9) lets an authenticated administrator inject JavaScript that executes in every user's browser session by placing crafted content in the applicationName setting and abusing CSP nonce injection. The payload is persisted in the main application page without escaping, so it executes for all users who load the application and can leak page data including unsaved form input. Publicly available exploit code exists, but exploitation requires the highest application privilege (administrator), and impact is limited to confidentiality (C:L) with no integrity or availability effect, making this a genuinely low-priority issue despite the available POC.
Opening a specially crafted PowerPoint document in an unpatched Microsoft Office build can trigger an out-of-bounds read that leaks the contents of process memory to the attacker. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and the corresponding Office for Mac / LTSC for Mac 2021 and 2024 clients; exploitation is remote and needs no credentials (AV:N/PR:N) but hinges entirely on user interaction (UI:R), since the victim must open or preview the malicious file. The result is read-only memory disclosure (C:H, I:N, A:N) rather than code execution or data tampering, and there is no public exploit identified at time of analysis, though a vendor patch is available per the Microsoft Security Response Center advisory.
An out-of-bounds memory read in Microsoft PowerPoint lets remote attackers leak information from the memory of the affected Office process when a user opens a specially crafted presentation file. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), meaning confidentiality is heavily impacted while integrity and availability are untouched, and it affects Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021/2024 on both Windows and macOS. No public exploit has been identified at time of analysis, but the attack path is straightforward: an unauthenticated attacker only needs to convince a victim to open a malicious .ppt/.pptx file, so email and web-delivered documents remain the primary delivery vector. A vendor patch is available through Microsoft's update guide.
An information disclosure vulnerability in Microsoft PowerPoint allows a remote, unauthenticated attacker to trigger an out-of-bounds memory read by convincing a victim to open a specially crafted presentation file, potentially exposing heap contents that may contain sensitive data. Affected builds span Microsoft 365 Apps for Enterprise, Office 365 for Mac, and the Office LTSC 2021 and 2024 releases on both Windows and macOS. The attacker needs no credentials (PR:N), but the attack hinges entirely on user interaction (UI:R) - the document must be opened, and Protected View or Mark-of-the-Web handling for externally sourced files can interrupt the chain. Microsoft has released a vendor patch and no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in Microsoft Word allows a remote, unauthenticated attacker to read memory contents from an affected Office installation by getting a user to open or preview a maliciously crafted Word document delivered over the network, such as an email attachment or a download. The flaw is a use-after-free (CWE-416) that is present in Microsoft 365 Apps for Enterprise and in Microsoft Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024; per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) the impact is limited to confidentiality, with no code execution, integrity, or availability effect. This is a moderate-priority issue rather than a critical one: exploitation is gated by the mandatory UI:R user-interaction requirement, and no confirmed active exploitation (CISA KEV) or publicly available exploit code was identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center advisory.
An out-of-bounds read in Microsoft Word (CWE-125) lets remote, unauthenticated attackers disclose the contents of process memory when a victim opens a specially crafted document, with affected builds spanning Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021/2024, and Office LTSC for Mac 2021/2024. Exploitation requires the user to open the malicious file (UI:R) and deliver it successfully through social engineering, so it is not a zero-click or wormable flaw, and the impact is limited to information disclosure (C:H, I:N, A:N) without code execution or persistence. No public exploit code has been identified at time of analysis, and Microsoft has published a vendor patch through its update guide.
Information disclosure in Microsoft Word (and the broader Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021/2024 families) allows a remote attacker to read memory contents from the affected application by convincing a victim to open a specially crafted document. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N): the attacker needs no authentication, but exploitation hinges on user interaction - the target must open the malicious file - so delivery depends on phishing or social engineering rather than automatic remote compromise. Impact is limited to confidentiality (no code execution, integrity, or availability effect) and remains confined to the vulnerable process; there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, though the disclosure of high-value memory contents can still expose sensitive document data or session material. Microsoft has published a vendor patch via its MSRC update guide.
An out-of-bounds read in Microsoft Word (CVE-2026-108434, CVSS 6.5) allows a remote, unauthenticated attacker to disclose information from process memory if the victim opens or previews a specially crafted Word document. Affected builds are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC for Mac 2021/2024 plus Office 365 for Mac, per the vendor CPE list. Because the vector requires user interaction (UI:R) and the impact is limited to confidentiality (C:H with I:N/A:N), there is no zero-click or server-side exploitation path; Microsoft has published a fix through its MSRC update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a moderate-priority patching item rather than an emergency.
Arbitrary code execution is possible in HPE NonStop Posix User Threads for an authenticated local user with low-level privileges who supplies crafted input to the pthread functionality, due to a heap-based buffer overflow (CWE-122). The flaw requires pre-existing local access (AV:L), no user interaction (UI:N), and no non-default configuration indicated by the available data; there is no public exploit identified at time of analysis. The vendor advisory is at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US, and the independent assessment rates confidentiality, integrity, and availability impact as High despite the vendor's 6.6 Medium base score with Low/Low/High impact.
A stack-based buffer overflow in the HPE NonStop Kernel Level Thread Model library allows a locally authenticated, low-privileged user to overwrite stack memory and, in the assessed worst case, execute arbitrary code in the context of the affected library. The vulnerability is reachable only with local access and valid low-privilege credentials (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so it cannot be triggered remotely and requires an attacker to already hold a foothold on the NonStop host; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed severity is moderate rather than emergency-grade. Success depends on invoking the vulnerable library from an existing session, which constrains realistic exposure to insiders, compromised local accounts, or post-exploitation privilege-escalation chains on operator-managed NonStop systems.
SQL injection in GYM One's administrative user-search endpoint (admin/users/index.php) allows an authenticated administrator to read arbitrary database tables - including user records and password hashes - and, where the underlying database account holds elevated privileges such as MySQL's FILE privilege, to write files onto the server filesystem. The flaw affects all GYM One releases prior to 1.4.1 and is reachable remotely through the search_name and search_email GET parameters, though it requires a valid administrator session (PR:H), which confines realistic exploitation to insiders or attackers who have already compromised an admin account. There is no public exploit identified at time of analysis, no indication of confirmed active exploitation (CISA KEV), and the vendor has released a fixed version, 1.4.1, so risk is best characterized as moderate and access-gated rather than urgent and broadly exploitable.
Denial of service in the tinytag Python metadata-reading library affects versions 2.0.0 through 2.2.x: parsing a crafted M4A/MP4 file that places a zero-length sub-atom inside a '----' (iTunes freeform custom field) atom leaves the atom traversal loop unable to advance, so metadata extraction hangs indefinitely and the reading process must be killed. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 6.5) - a victim application must be induced to open, scan, or upload the malicious file - and impact is confined to availability, with no data disclosure or modification. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis; the flaw is fixed in tinytag 2.3.0.
Memory exhaustion in OpenNMS Meridian and Horizon lets an authenticated user who holds provisioning privileges crash the monitoring server by supplying XML that declares internal entities designed to expand uncontrollably - either directly through a requisition or foreign-source import, or indirectly via a remote requisition URL that the server fetches and parses itself. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so a successful attack yields full availability loss with no confidentiality or integrity impact, and no public exploit code was identified at time of analysis (the issue is not listed in CISA KEV). This is a moderate-priority availability issue rather than a drop-everything emergency: the attacker must already hold a trusted provisioning account, and the vendor states that Meridian and Horizon are intended for private-network deployment rather than direct internet exposure.
Unauthenticated shortcode injection in the Ocean Extra plugin for WordPress (all versions up to and including 2.6.0) lets remote attackers pass attacker-controlled values into the WordPress do_shortcode() function without proper validation, causing arbitrary registered shortcodes to execute. Per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, score 6.5), no authentication and no user interaction are required, but real-world impact is bounded by which shortcodes are actually registered on the target site; the practical severity is therefore moderate rather than critical, and no public exploit code or confirmed active exploitation was identified at time of analysis. Note that the OceanWP/Ocean Extra vendor advisory and an upstream code changeset are the primary available intelligence, and no vendor-released fixed version number is independently confirmed.
Kernel panic (denial of service) is reachable in FreeBSD's kernel TLS (kTLS) implementation when an established TLS 1.3 peer sends a crafted or invalid record, because an off-by-one error in the code that locates the inner record type can underflow and then unconditionally dereference a NULL pointer. Only hosts running kTLS with TLS 1.3 receive-side offload are affected, specifically FreeBSD 14.4-RELEASE before p10, 14.5-RELEASE before p1, 15.0-RELEASE before p14, and 15.1-RELEASE before p4, and the attacker must already be a negotiated peer on that TLS session (PR:L), so this is not reachable by an arbitrary scanner. Impact is confined to availability, with no code execution or data exposure; no public exploit code is identified at time of analysis, EPSS is 0.19% (8th percentile), CISA SSVC records Exploitation: none / Automatable: no, and there is no KEV entry.
Information disclosure in the Apache Airflow Keycloak provider's multi-team mode lets any authenticated member of one provisioned team read other teams' audit events through the Airflow UI or the event-log API, because audit-log rows not tied to a Dag were authorized against the shared 'View' resource that every team role can read. Only deployments with '[core] multi_team' enabled, the Keycloak auth manager configured, and teams provisioned via 'airflow keycloak-auth-manager create-team' are affected; the default single-team mode, non-Keycloak auth managers, and unauthenticated users are unaffected (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, CWE-732). The exposure is read-only and bounded by the requirement for valid team-member credentials, no public exploit code was identified at time of analysis, and the fix is available in apache-airflow-providers-keycloak 0.11.1 or later.
Cross-site scripting in the Kendo UI for jQuery FileBrowser and ImageBrowser components (v2023.1.117 through pre-v2026.3.1015) lets a file or directory name containing script-related HTML execute JavaScript in the browser of any user who opens the affected browse dialog, compromising the confidentiality and integrity of data reachable in that application origin. Exploitation is conditional: an attacker must be able to influence the name of a file or directory that the component enumerates (typically via an upload or a shared storage path), and the payload only fires when a victim actually views the FileBrowser or ImageBrowser view - the independent assessment therefore scores this AV:N/AC:L/PR:L/UI:R (6.5) rather than the vendor's PR:N/UI:N vector. Impact is confined to the victim's browser context with no server-side code execution; no public exploit code was identified at time of analysis and there is no CISA KEV listing, but a fixed release (v2026.3.1015) is available.
Stored cross-site scripting in the Brainstorm Force Presto Player WordPress plugin, affecting all versions through 4.5.3, allows an authenticated user with low-level content privileges to persist malicious JavaScript that executes in the browser of any other user who views the affected page. Successful exploitation requires a victim to interact with the crafted content (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5), so it is a two-actor, stored attack rather than a direct unauthenticated compromise; the scope change (S:C) reflects that script executes in the context of the victim's session rather than the attacker's. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided, so the near-term risk is moderate and driven primarily by the large installed base of the plugin.
Stored cross-site scripting in the WP Chill Download Monitor WordPress plugin (versions through 5.3.3) lets an authenticated low-privilege user persist malicious script that executes in the browser of whoever later views the affected admin or front-end page. Exploitation requires a valid account on the target site with at least low-privilege posting capability plus a victim (typically an administrator) who views the tainted content, so risk concentrates on sites that allow open registration or run multi-author workflows. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) by the reporter, with scope change reflecting that the injected script runs in the victim's session context; no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the source data.
Stored cross-site scripting in the YITH WooCommerce Compare plugin for WordPress (versions through 3.15.0) lets an authenticated low-privilege user persist malicious script that executes in the browser of any other user, including an administrator, who later views the affected page. The flaw is rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, meaning it is reachable over the network but requires a pre-existing low-privileged account and victim interaction, so it is not exploitable by a fully unauthenticated attacker against a default install. No public exploit code or confirmed active exploitation was identified at time of analysis.
Missing OAuth state validation in the python-social-auth social-core LINE backend (LineOAuth2, versions prior to 5.0.2) lets an unauthenticated remote attacker complete the authorization-code exchange on behalf of a crafted callback URL they control, silently logging a victim into the attacker's LINE identity. When the application's account-linking feature is also enabled, the same missing check persists the attacker's LINE identity onto the victim's existing account, creating a durable unauthorized login path. The issue is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R, integrity-only with no confidentiality or availability impact) and depends on phishing the victim into visiting the crafted callback; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. Only deployments with the LINE backend enabled are affected, and the upstream fix ships in 5.0.2.
Sensitive data exposure in ClikIT's Infinite Uploads WordPress plugin (all versions through 3.4.1) lets an attacker who already holds a low-privileged account on the site cause embedded secrets to be returned in outbound responses. Per the assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the flaw is remotely reachable with low complexity and no user interaction, but the PR:L metric means an authenticated session is a hard prerequisite - anonymous visitors cannot trigger it - so confidentiality is fully impacted while integrity and availability are untouched. Severity is moderate (CVSS 6.5); there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, and the exact endpoint or feature that emits the sensitive data is not disclosed in the available advisory.
Stored cross-site scripting in the MDTF (Meta Data Filter & Taxonomy Filter) WordPress plugin, versions through 1.4.0, lets an authenticated low-privilege user persist a malicious script through a plugin-controlled input field, which then executes in the browser of any privileged user who later views the affected page or admin screen. The vulnerability carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting that exploitation needs a valid low-privileged account plus a victim's page load, but that the resulting script runs with scope change into the surrounding admin context. No public exploit identified at time of analysis, and the flaw is a moderate rather than top-tier priority given the authentication and user-interaction gates.