Improper authentication (CWE-287) in TP-Link Tapo C210 V3.60 firmware lets an attacker positioned on the same adjacent network retrieve shared credential material and cryptographic metadata by sending unauthenticated DS JSON API requests to the camera, without any credentials or user interaction. The recovered shared credential is then accepted by the Streamd Digest authentication mechanism as the administrative password, so the attacker can establish encrypted media sessions and view the camera's protected streams without ever knowing the device account password. Impact is confined to confidentiality - high credential/crypto disclosure and unauthorized media-session access - with no integrity or availability effect cited; exploitation requires local LAN/Wi-Fi adjacency and is not reachable directly from the internet, and no public exploit code or CISA KEV entry was identified at time of analysis.
Heap out-of-bounds read in GIMP's XCF text-layer parasite parsing allows a crafted .xcf file, opened by a victim, to leak adjacent heap memory into layer text and crash the application, causing information disclosure and denial of service. The issue is local and requires user interaction (CVSS 7.1, AV:L/UI:R/PR:N), and the provided intelligence shows no public exploit or CISA KEV entry; it is a moderate-priority issue rather than an urgent remote threat.
Integer overflow in MikroTik RouterOS firewall SAME-target handling can crash or brick affected routers when an authenticated user with firewall/NAT rule privileges installs a manipulated ipt_SAME rule. The flaw affects RouterOS through 6.40.5, 6.44, and 7.20.8, with fixes in 7.21.5 and 7.23.1. No CISA KEV listing was provided and no public exploit was confirmed at time of analysis; the assessed impact is availability-only.
Email manipulation in Krayin CRM before 2.2.7 allows authenticated users with scope-restricted Mail module access to edit, trash, or permanently delete other users' emails by enumerating sequential numeric IDs against EmailController write actions. The update path also discloses email subject, body, and linked lead and person data, and setting is_draft=0 can re-send the victim's email. The vendor fixed this in 2.2.7; no public exploit was identified at time of analysis, and the issue is moderate priority because exploitation requires a valid non-global account.
Insecure direct object reference in Krayin CRM before 2.2.7 allows an authenticated user with a restricted, per-user data scope to read quotes belonging to other users by querying the quotes search and lead-products endpoints, which fail to apply the per-user scope filter in QuoteController. Successful abuse discloses quote addresses, totals, contact details, and product pricing for any user or lead in the instance. The flaw requires a valid low-privileged account (CVSS v4.0 7.1 as published; independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), is read-only with no integrity or availability impact, and has no public exploit identified at time of analysis. Vendor-released patch: 2.2.7.
Denial of service in rdesktop through 1.9.0 lets a malicious or man-in-the-middled RDP server crash the client by sending a crafted revision-2 bitmap cache order to process_bmpcache2() in orders.c. The CVSS vector indicates the server-side attacker is unauthenticated, but the victim must initiate an RDP connection (UI:P); the outcome is a heap out-of-bounds read and client crash with no code execution, privilege gain, or confirmed data disclosure. No CISA KEV entry or public exploit code was identified at time of analysis, and an upstream fix is proposed in PR 437.
Denial of service in rdesktop through 1.9.0 allows a malicious or compromised RDP server to crash the client by sending a malformed 32 bpp compressed bitmap in a bitmap update PDU or bitmap cache order. The server declares a large bitmap geometry while supplying a truncated compressed body, causing process_plane() in bitmap.c to read past the receive buffer; exploitation requires the victim to initiate an RDP connection to the attacker-controlled endpoint, so user interaction is required despite the unauthenticated remote vector. No public exploit code was identified at time of analysis, and CISA KEV does not list this issue.
SGLang 0.5.22 and earlier, when deployed with the Mooncake prefill/decode disaggregation backend, can have its Prefill scheduler memory exhausted by unauthenticated network-adjacent attackers, resulting in the scheduler being OOM-killed and inference service becoming unavailable. The attacker first reads the Prefill rank address from the exposed /route endpoint, then sends STAGING_RSP messages carrying oversized chunk_idx values under fresh room identifiers, so handle_staging_rsp() allocates memory without any bound or validation. Only PD-disaggregated deployments using Mooncake are exposed - default single-node SGLang installations do not exercise the affected path - and there is no public exploit code or CISA KEV entry identified at time of analysis, though the HIGH availability impact (CVSS 7.1, AV:A/PR:N) makes an internal-fabric attacker able to repeatedly restart-cycle the service.
Unauthenticated decode-registration flooding can exhaust memory in SGLang 0.5.22 deployments that use the Mooncake disaggregation backend in prefill/decode mode, ultimately OOM-killing the Prefill scheduler. The attack requires network-adjacent access to the Prefill rank's ZMQ PULL socket and no credentials, but it does not affect default single-node or non-disaggregated SGLang setups. No public exploit was identified at time of analysis, and exploitation is not confirmed in CISA KEV.
Missing authorization in RisingWave before 3.1.0 allows any authenticated low-privilege SQL user with CREATE privilege on a schema to create posix_fs sources or fs sinks that point at arbitrary server filesystem paths, enabling theft of credentials and keys and creation of files with the RisingWave process's privileges. The vendor CVSS 4.0 score is 7.1 (High); the prerequisite is only a valid SQL account with schema CREATE, and no user interaction or special victim-side configuration is needed in affected releases. RisingWave 3.1.0 fixes this by gating local filesystem connectors behind frontend.unsafe_enable_local_fs_connector, which defaults to false in release builds; no public exploit code or active exploitation is identified in the supplied intelligence.
Stack exhaustion in the Qt SVG module (QtSvg) lets a crafted SVG containing deeply nested elements crash applications that parse or render it, producing a denial of service limited to availability. The flaw affects Qt products using QtSvg and is remotely deliverable, but exploitation requires the target application to load the attacker-supplied SVG (CVSS UI:P / assessed UI:R), with no authentication required per PR:N. Source data shows vendor patches but no public exploit code or KEV confirmation, so no public exploit identified at time of analysis.
Reflected cross-site scripting in the Ays Pro Quiz Maker WordPress plugin through version 6.7.1.91 lets unauthenticated remote attackers lure a victim into opening a crafted URL so injected script runs in the victim's browser within the WordPress site origin. The CVSS 3.1 score is 7.1, and exploitation requires user interaction rather than a background attack; the authoritative assessment rates confidentiality and integrity impact as low with no availability impact. No public exploit or CISA KEV entry was identified in the provided data at time of analysis.
Unsafe reflective class loading in openGauss-connector-jdbc's LogFactory lets an attacker who controls the JDBC 'logger' connection parameter (URL or connection properties) force the driver to instantiate an arbitrary class present on the client classpath via its String-argument constructor before any Log subtype check occurs, enabling unintended class-loading and constructor side effects. Affected builds run from JDBC 1.1.0 through the 2.x/3.x/5.x/6.x lines (including 6.0.6) and 7.0.0-RC1/RC2/RC3; the flaw is fixed in 7.0.0-LTS. Exploitation is precondition-heavy - local/config-level influence over connection settings (CVSS 7.0, AV:L/AC:H/PR:L) plus a suitable gadget class on the classpath - and no public exploit has been identified at time of analysis.
Sensitive information disclosure in Dell Application Store versions prior to 26.05.0.7 allows an authenticated low-privileged local attacker to read data that should be protected because a critical resource has incorrect permissions. Exploitation is local, requires a non-trivial condition, and is assessed as low urgency; no public exploit identified at time of analysis. Dell's fixed release is 26.05.0.7, documented in DSA-2026-411.
KMS token exfiltration in Apache Arrow C++ and PyArrow can occur when an application reads an attacker-supplied Parquet file with modular encryption, has a pluggable KmsClient configured, and leaves the KMS URL file-controlled rather than setting it in KmsConnectionConfig. An unauthenticated attacker can exploit this only if the configured KmsClient does not validate the host and actually connects to the file-provided URL, sending a KMS token to an attacker-chosen endpoint; the CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, with high confidentiality impact and no integrity or availability impact. Affected releases are Apache Arrow C++ 4.0.0 before 26.0.0 and PyArrow 8.0.0 before 26.0.0; no public exploit was identified at time of analysis, and 26.0.0 disables file-controlled KMS URLs by default with opt-in via read_kms_url.