Authentication bypass in python-jose through 3.5.0 allows a remote unauthenticated attacker (CVSS vector PR:N) to forge HS256/HS384/HS512 JSON Web Tokens with arbitrary claims that jwt.decode will accept, because the library's HMACKey and CryptographyHMACKey classes accept zero-length HMAC secrets. The flaw is only reachable in deployments where the application's HS-family verification key actually resolves to an empty value, such as an oct JWK whose 'k' member is empty - the AT:P attack-requirement in the CVSS 4.0 vector and the AC:H rating in the independently assessed CVSS 3.1 vector. Correctly configured applications that supply a non-empty, properly sourced HMAC secret are not exploitable; no public exploit code was identified at time of analysis, and the vendor issue tracker (mpdavis/python-jose#398) is the coordination point.
Stored cross-site scripting in GoFound through 1.4.1 lets unauthenticated attackers plant HTML/script by submitting document text to the /api/index endpoint, with no credentials required (CVSS:4.0 PR:N). The payload stays inert in the index until an administrator runs a dashboard search that matches the poisoned document, at which point searcher/engine.go returns the stored content unescaped and dashboard.vue renders it via v-html, executing in the admin's browser session. Exploitation is therefore interaction-gated and scoped to the administrator's browser rather than the server; a public PoC reference exists but is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation. The issue is rated 5.1 and prioritised as "this_month" rather than an emergency.
PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting flaw in the unauthenticated /share/v1/common/file/upload endpoint, where an attacker can upload HTML content under an image extension. The stored payload executes when an administrator is lured to /static-file/<key>?a=.pdf, because the query string defeats nginx attachment handling and causes the HTML to render inline, enabling theft of the panda_wiki_token JWT and session takeover. Exploitation requires administrator interaction and a valid admin session; a public PoC reference exists but is not verified as working exploit code, and the provided data do not confirm active exploitation.
Path-restriction bypass in @fastify/http-proxy 9.0.0 through 11.6.5 lets unauthenticated remote attackers escape an intended upstream prefix by supplying a route parameter that decodes into path separators and fragment or query delimiters, potentially enabling SSRF or authorization bypass in the upstream service. Exploitation requires the application to use both parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path; deployments without that configuration are not affected. The vendor-priority decision is act_now, the fix is version 11.6.6, there is no workaround other than upgrading, and no public exploit was identified at time of analysis.
Authenticated cPanel/WHM users can cause a privileged panel operation to write an arbitrary root-owned file, escalating a low-privilege hosting or reseller account to root on unpatched builds (below 11.138.0.19, 11.136.0.51, 11.134.0.67, or 11.110.0.154 on their respective branches). Exploitation requires valid panel credentials reached over the network (CVSS PR:L) with no user interaction, so anonymous internet attackers are not in scope. The vendor has released fixes, CISA SSVC records exploitation as none and automatable as no, and no public exploit has been identified at time of analysis; this is a genuine but not emergency-level priority to schedule within the current patch window.
Code injection in Regular Labs Sourcerer before 17.0.1, when used with Articles Anywhere before 20.1.1, allows an authenticated article author to have PHP-bearing Sourcerer content from a low-trust article evaluated under the identity of a more-trusted enclosing article. The vulnerable path requires Articles Anywhere to include that article, inclusion to be processed before Sourcerer, and Force Content Triggers to be off; ordinary Articles Anywhere output is not affected. No confirmed active exploitation or public exploit was identified in the provided intelligence, and updates to Sourcerer 17.0.1 and Articles Anywhere 20.1.1 address the flaw.
Madong Admin SaaS through 5.1.4 exposes its platform tenant-management API without authentication because the shipped middleware configuration registers the platform access-token middleware under the key 'platformapi' instead of the webman application key 'platform', so calls to /platformapi/tenant/account, /platformapi/tenant/bind-plan and /platformapi/tenant/sync-data reach controller actions with no identity check. Remote unauthenticated attackers who can reach the platform API can therefore list, create, modify, disable or delete tenants and bind subscription plans. The vendor has published an upstream fix, the issue is high severity (CVSS 8.8), and no public exploit was identified at time of analysis.
Authenticated remote code execution in ManageEngine Password Manager Pro builds before 13236 and ManageEngine PAM360 builds before 8601 allows a low-privileged user who can reach the web interface to execute operating-system commands, with high confidentiality, integrity, and availability impact. The flaw is CWE-78 command injection and requires a valid authenticated session (CVSS PR:L); the specific vulnerable feature, endpoint, and trigger are not described in the available sources. No public exploit identified at time of analysis, and the priority is this_week rather than an emergency.
Authenticated command injection in Temporal Server 1.31.0 through 1.31.2 allows a caller holding only a read role in a single namespace to execute commands of their choosing on the Worker Service host under the account the server process runs as. The bundled auto-scaled-workers module's k8s compute provider builds its Kubernetes client from client configuration supplied in the caller's request, and the reachable route (ValidateWorkerDeploymentVersionComputeConfig, registered as a read-only namespace operation) exercises that code during configuration validation, so no worker deployment, scaling decision, or unusual request sequence is required. Vendor fixes are available in v1.31.5 and v1.32.2; no public exploit identified at time of analysis, and the priority comes from stock 1.31.0-1.31.2 deployments permitting every registered compute provider by default when workercontroller.compute_providers.enabled is unset, not from observed exploitation.
Denial of service in the Eclipse ThreadX NetX Duo NetX Secure DTLS server (versions 6.0 through 6.5.2.202603a) lets remote, unauthenticated attackers exhaust the application-configured session pool by sending one spoofed datagram per forged source address or port, locking legitimate DTLS clients out of service. Sessions are allocated before the HelloVerifyRequest cookie exchange and are never reclaimed by the library when a handshake stalls or times out, so the denial persists until the application resets the affected sessions and can last indefinitely if it never does. Confidentiality and integrity are unaffected; no public exploit code was identified at time of analysis, though the low session counts typical of embedded targets mean only a handful of forged datagrams are needed.
Unauthenticated access to calendar and contact data in cPanel/WHM lets remote attackers read the calendar and contact data of any mail account by supplying a crafted NUL byte that bypasses input neutralization. Affected deployments are cPanel/WHM servers exposing the calendar and contact (CalDAV/CardDAV) functionality, and exploitation requires only network reachability to the service, with high confidentiality impact but no modification or disruption. No public exploit code or confirmed active exploitation appears in the supplied sources, all of which are vendor and NVD references; the referenced vendor advisory is dated October 20th, 2026, and the vulnerability is tagged as an information disclosure issue.
Authentication bypass in Johnson Controls EasyIO Neo EC (firmware EC 3.3b62 through EC 3.3b63) and CW Edge Controller (CW 3.3b24 through CW 3.3b25) can let an attacker reach functionality through a channel that does not enforce the same authentication checks as the normal path, with high confidentiality, integrity and availability impact on the controller. The vendor rates it 8.7 under CVSS 4.0 but also scores high attack complexity, a required attack precondition, high privileges and active user interaction, prerequisites that sit awkwardly with the 'authentication bypass' label; the independent assessment instead models it as network-reachable with no privileges and no user interaction, so the true privilege and precondition requirements should be confirmed with Johnson Controls. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; priority is this_week.
A NULL pointer dereference in the Eclipse ThreadX NetX Duo IPv6 stack lets an unauthenticated sender on the network crash the IP helper thread and stop all packet processing. The ICMPv6 Packet Too Big handler stores the entry returned by _nx_icmpv6_dest_table_add without checking the status, so once a sender fills the destination table with messages quoting distinct destinations, the next message dereferences NULL; measured on the ThreadX Linux port this is the 9th such message with the default table of 8 (the 33rd with a table of 32). Only builds that enable both FEATURE_NX_IPV6 and NX_ENABLE_IPV6_PATH_MTU_DISCOVERY contain the vulnerable code, and path MTU discovery is off by default; no public exploit code was identified at time of analysis, and the vendor shipped a fix in 6.5.2.202603b, making this a conditional availability risk that should be patched this week rather than an emergency.
Remote code execution in Control Web Panel (CWP) installations running a webpanel_version earlier than 1.16 allows an authenticated user-panel account with access to the phpini_editor module to execute arbitrary OS commands and write files to attacker-chosen paths. Both abused actions are standard module functionality: acc=update feeds an attacker-supplied path into file_put_contents without confinement, and acc=addlabelphpiniadv passes unsanitized input into shell_exec without escaping. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity and availability impact with PR:L, meaning a valid low-privileged panel credential is the gating prerequisite; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, but a vendor patch exists and the finding is triaged as a this-week priority.
An authenticated low-privileged Control Web Panel (CWP) user can abuse path traversal in the module parameter handled by services/users/index.php to include arbitrary local .php files on installations running webpanel_version before 1.16. The module name is concatenated directly into a PHP include path with no allowlist, basename() call, or traversal filtering, so whether the flaw escalates to code execution depends on a local .php file whose contents the attacker can influence; no public exploit was identified at time of analysis. Exploitation requires a valid CWP session (PR:L) rather than being fully unauthenticated, and the vendor has released version 1.16 to close the issue, making this a genuine priority for the week rather than an emergency.
Cross-workspace authorization bypass in Jpom through 2.11.12 allows an authenticated user holding SSH command execute permission in one workspace to run commands on SSH hosts in other workspaces by submitting foreign command-template and SSH-node IDs to POST /node/ssh_command/batch. The endpoint resolves both IDs without workspace ownership filtering, so the request executes using the target hosts' stored SSH credentials; practical impact depends on a multi-workspace deployment that has command templates and SSH nodes configured elsewhere. CVSS 8.7; no public exploit identified at time of analysis; a vendor fix is available.
Cross-workspace authorization bypass in Jpom through 2.11.12 allows an authenticated user who holds Docker permission in any one workspace to manage Docker hosts registered in other workspaces by supplying a foreign Docker asset id. Successful abuse gives control of containers, images, volumes and networks on the targeted host, including the ability to create privileged containers with host bind mounts. Exploitation requires a multi-workspace (multi-tenant) deployment with at least one Docker host registered in another workspace; no public exploit code was identified at time of analysis, and the issue is rated this_week priority rather than an emergency.
Incorrect authorization in madong-admin-saas through 5.1.4 lets a tenant user replay their login JWT against /platformapi controllers in multi-tenant deployments, where the middleware's platform-admin type check was skipped, allowing creation of platform administrator accounts, reading of tenant database settings, and control over every tenant. Only instances running with multi-tenant mode enabled (config('tenant.enable') true) are exposed; single-tenant deployments reject non-platform tokens correctly. Exploitation requires a valid low-privilege tenant account (PR:L per the assessed vector), and no public exploit code has been identified at time of analysis; the vendor patch is available as an upstream commit.
OpenCSG CSGHub through v2.6.0-ce allows unauthenticated remote attackers to read files from private model, code, and space repositories by abusing the public file resolve route. The flaw is an authorization bypass (CWE-639) in which a percent-encoded current_user parameter injected into the file path is forwarded by the portal to the backend with the portal's server API key, causing the backend authorization check to trust the attacker-controlled identity. Published severity is CVSS 8.7 (CVSS 4.0), with assessed impact limited to high confidentiality loss; no CISA KEV entry is provided, a public technical write-up exists but working exploit code is not confirmed, and no fixed version is identified in the supplied sources.
Authenticated remote code execution affects Zoho ManageEngine EventLog Analyzer and ManageEngine Log360 in all builds before 13062, where a user holding high privileges can inject operating system commands through the Log Forward configuration option. Because the flaw is network-reachable and requires no user interaction, an attacker who already holds admin-level credentials or a privileged session can turn log-forwarding configuration into arbitrary command execution on the host, with high confidentiality and integrity impact across a scope change. Priority is assessed as this_week rather than an emergency: no public exploit code has been identified at time of analysis, and exploitation depends on first obtaining privileged access to the product's management interface. The precise injectable input within Log Forward is not described in the available sources.
Blind SQL injection in the WSO2 API Manager Admin REST API allows an authenticated administrator to inject insufficiently sanitized input into the structure of executed SQL statements, letting the attacker infer database contents and potentially degrade or take down the database service. Tracked as CVSS 3.1 8.7 High (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H, CWE-89), the flaw affects WSO2 API Manager together with the related WSO2 API management components listed in the CPE data - Traffic Manager, API Control Plane, Universal Gateway and the Carbon API Management Implementation. The high-privilege prerequisite (PR:H) is the dominant limiting factor: exposure is confined to holders of administrator credentials on the Admin REST API, so realistic risk centers on compromised or abused admin accounts and malicious insiders rather than broad remote attack; no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV.
Path traversal in LobeHub Chat (npm @lobehub/chat, versions 1.84.26 through 2.1.48) lets any authenticated user write arbitrary files with attacker-controlled content: the file.createFile tRPC procedure stores an unsanitized name containing '../' sequences in the files.name database column, and a later document-parse call feeds that value into path.join() inside writeTempFile(). Because the write primitive is unrestricted within the application user's permissions, an attacker can overwrite an executed file such as startServer.js and gain code execution after a container restart, or corrupt critical application files to cause persistent crash loops and denial of service; multi-tenant deployments are the highest risk since any tenant user reaches this path, and self-registration turns it into an effectively unauthenticated attack. A detailed public proof-of-concept, including a demonstration video, is published in the project's GitHub security advisory; the issue is not listed in CISA KEV and no confirmed active exploitation has been reported, and the vendor shipped a fix in 2.1.49.
Path traversal in Network-AI through 5.15.4 lets an attacker who controls the path passed to InputSanitizer.sanitizePath() escape the intended sandbox by supplying a sibling directory whose name shares the base directory's string prefix, enabling file read or directory listing outside the base; the advisory argues write outside the base is also possible, but that primitive is not demonstrated. The flaw requires a consuming application to use this helper as its terminal path validation with attacker-influenced inputPath and a basePath set to the sandbox root, and it is limited to prefix-sharing sibling layouts because classic ../../../ traversal is still rejected. The advisory includes a public proof-of-concept reproduction script, not verified as working exploit code; no CISA KEV active-exploitation status is indicated in the supplied data, and the independent assessment scores confidentiality impact as high with no integrity or availability impact.
Path traversal in Network-AI's AgentVCR component lets a caller who controls the cassette name passed to load() or save() read arbitrary .json files or overwrite them anywhere the Node.js process has filesystem permissions. Versions 5.13.4 through 5.15.4 of the npm package network-ai are affected; 5.15.5 is the first release containing the fix. The impact is a confidentiality and integrity breach confined to paths ending in .json: an attacker can disclose secrets held in JSON configuration and, per the upstream advisory, overwrite AuthGuardian trust-level configuration to obtain a grant an operator's policy had denied, or corrupt the active-grant store to invalidate legitimate agents' tokens - no code execution path was demonstrated. Exploitation depends on the consuming application deriving cassette names from an untrusted source, requires some privilege within the orchestration (CVSS PR:L), and the upstream advisory itself publishes a reproducible proof-of-concept script demonstrating the file-read primitive; no confirmed active exploitation is reported.
Path traversal in Network-AI's FileJobStore lets a low-privilege authenticated attacker who controls a job id read or delete arbitrary .json files under the process's filesystem permissions in network-ai 5.13.4 through 5.15.4. The advisory shows how traversal sequences such as ../../some-config reach readFile or unlink through FileJobStore.get(), FileJobStore.delete(), JobQueue.getJob(), or JobQueue.cancel(), exposing credentials, grant tokens, and configuration that can weaken AuthGuardian authorization; no remote code execution was demonstrated. This is a credible this-week priority when job management is exposed to untrusted requests, but active exploitation is not confirmed (not in CISA KEV) and the advisory includes a proof-of-concept script.
OS command injection in Control Web Panel (CWP) versions before 1.30 lets attackers who can reach the loopback-bound /valid_token/ API route run arbitrary commands as root by placing shell metacharacters in the unvalidated 'user' parameter, which is passed unescaped to shell_exec(). Reachability is the gating factor: the route is bound to the loopback interface, so exploitation requires local host access or an intermediary such as an SSRF primitive, a misconfigured reverse proxy, or a co-tenant process that can reach 127.0.0.1 - no authentication or user interaction is enforced once the endpoint is reachable. No public exploit code or CISA KEV entry is present in the available data; the vendor has published a fix in the 1.30 changelog and the vulnerability is tagged for remediation this week.
OS command injection in Control Web Panel (CWP) versions before webpanel_version 1.30 lets an attacker who can reach the loopback-bound database restore API route /v1/restoredatabase/ run arbitrary operating system commands as root. The restoreDBBackup() handler takes an attacker-supplied file path from the POST body and passes it into a shell command without escaping, so shell metacharacters in that path are executed with the panel's root privileges. Exploitation is unauthenticated and requires no user interaction, but per the assessed vector (AV:L) the route is reachable only from the CWP host itself - a local account or process, or a chained path such as SSRF to 127.0.0.1 - rather than directly from the internet; no public exploit code was identified at time of analysis, and a vendor fix is available in version 1.30.
LaraDashboard through 1.4.2 lets any administrator holding the ordinary settings.edit permission - which the default Admin role carries - reach Superadmin-only core-upgrade functionality, so a low-privileged admin can create and download full backups that include the application source and database/backup.sql with password hashes, and can trigger restore, delete-backup or core-upgrade operations against the site. The root cause is an incorrect authorization check in SettingPolicy, not an unauthenticated weakness: exploitation requires a pre-existing non-Superadmin Admin account, needs no user interaction, and has low attack complexity against default deployments. The vendor fixed the issue in v1.4.5, and the GitHub advisory includes a public proof-of-concept reproduction script that has not been independently verified as working exploit code; the supplied intelligence contains no CISA KEV listing or other confirmed active-exploitation signal.
Missing authorization in the Codestar backup AJAX handlers (csf-export, csf-import, csf-reset) of the Product Gallery Slider & Additional Variation Images for WooCommerce plugin, versions 2.3.23 up to but not including 2.3.26, lets a user holding the Shop Manager role read, overwrite or delete arbitrary WordPress options by supplying an attacker-chosen option name through the 'unique' parameter. Because wp_user_roles is itself an option, a Shop Manager can rewrite role capabilities and elevate to full administrator. Exploitation requires an authenticated Shop Manager (or higher) account that can view the plugin settings page to harvest the csf_backup_nonce, so anonymous visitors, subscribers and customers cannot reach it; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, placing practical risk on stores that delegate Shop Manager to semi-trusted staff. A vendor patch is available in 2.3.26.
Stored cross-site scripting in the Helix Ultimate template framework for Joomla (all versions below 2.2.11) lets an authenticated, low-privileged backend user persist script through the Media Picker that then executes in the browser of another user who views the affected page. The reporter (Joomla) rates it CVSS 4.0 8.6 High, while our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) scores it lower because exploitation needs a backend foothold plus victim interaction, and the practical impact scales with the privilege of whoever renders the payload - an administrator viewing the poisoned page is the worst case, equal- or lower-privileged users are far less damaging. It is prioritized for remediation this week; no public exploit code and no CISA KEV entry were identified at time of analysis.
Code injection (CWE-94) in the StageIt extension for Joomla, published by php-web-design.com, allows an attacker who already holds high-privilege access to the Joomla administrator back end to have attacker-controlled configuration 'setting string' values interpreted as code, yielding high impact to confidentiality, integrity and availability (CVSS 8.6; CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Affected builds are StageIt 1.0 through 5.7.5 and 6.0 through 6.3.5; sites on other versions are out of scope. The flaw is not reachable by an unauthenticated remote user and requires no victim interaction once administrative access exists - the dominant limiting factor is the PR:H privilege prerequisite, and no public exploit code or CISA KEV entry is associated with this CVE at time of analysis (priority label: this_week).
Stored cross-site scripting in the Mega Menu Badge Text field of the Helix Ultimate template/framework for Joomla before version 2.2.11 lets an authenticated Joomla user with menu or template management privileges plant script that executes when another user - typically an administrator or editor - views a page or admin screen rendering the affected badge. The flaw is CWE-79 and applies only where the Mega Menu feature is actually in use with a badge configured on a menu item; our assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, meaning privileged authoring access plus victim interaction rather than unauthenticated remote exploitation. No public exploit code or confirmed active exploitation was identified in the available sources; the vendor has released version 2.2.11 as the fixed release.
Authenticated OS command injection in the timezone configuration field of Barracuda Email Security Gateway, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center allows an administrator-level user to run arbitrary commands as root once the crafted timezone value is processed. The flaw is scored 8.6 under CVSS 4.0 (AV:N/AC:L/PR:H/UI:N with high confidentiality, integrity and availability impact) and was reported by Mandiant, with priority guidance placing remediation in the current week. No public exploit code has been identified at time of analysis, but the companion Barracuda advisory also documents a pre-authentication authorization bypass, so the administrator prerequisite may be removable by chaining and should not be treated as a reliable mitigation.
Unauthenticated SQL injection in Control Web Panel (CWP) before webpanel_version 1.16 allows attackers who can reach the loopback API authentication gate access_token() to read arbitrary MySQL database contents and forge authentication results, bypassing the API's authentication check. The flaw is rated CVSS 8.5 (CVSS 4.0 AV:L/AC:L/PR:N/UI:N) and requires reaching the loopback/localhost interface, so local access or a pivot such as SSRF is needed; no public exploit identified at time of analysis.
Heap buffer overflow in QuickJS-NG releases before 0.16.0 gives JavaScript code a path to memory corruption on 32-bit hosts: a Proxy whose ownKeys trap reports an array-like result with a length near 2^32 wraps a 32-bit property count in js_proxy_get_own_property_names(), so the buffer allocated for enumerated keys is far smaller than the number of entries later copied into it. Only 32-bit deployments are affected - the GHSA states explicitly that on 64-bit platforms the allocation size is correct and the overflow does not occur - and the attacker must already be able to execute JavaScript inside the embedding host (CVSS 4.0 AV:L/PR:L), with no user interaction required once script runs. Successful exploitation corrupts heap metadata and can crash the host or potentially lead to code execution; there is no CISA KEV listing and no public exploit identified at time of analysis, though the upstream fix commit includes regression tests that demonstrate the trigger. Vendor-released patch: 0.16.0.
Heap buffer overflow in Netpbm's jbigtopnm converter allows a crafted multi-plane JBIG file with large header dimensions to trigger an integer overflow while calculating the output buffer size, after which jbg_dec_merge_planes() overruns the undersized heap allocation, causing crashes or potentially code execution. Affected releases are Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08. The issue is local with user interaction required to process the file, CVSS 4.0 rates it 8.5, no public exploit was identified at time of analysis, and vendor patches are available.
Heap buffer overflow in Netpbm's xpmtoppm converter allows an attacker who supplies a crafted XPM file with a characters-per-pixel value greater than 3 to overwrite fixed 3-byte colorName hash entries, causing crashes or potentially code execution. Affected versions are Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08; the assessed vector is local with no privileges and requires the victim or an automated workflow to run xpmtoppm on the hostile file. No public exploit was identified at time of analysis, and vendor patches are available for all three branches.
Stack-based buffer overflow in Netpbm's picttoppm converter allows a crafted PICT file to overflow the fixed-size coord stack array in scanPoly() once polygon edges produce more than 5000 coordinate points, crashing the converter or potentially allowing code execution in the context of the process that parses the image. The flaw affects Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08, is rated 8.5 under CVSS 4.0 (CWE-121), and is a local-vector issue with passive user interaction because the victim must deliberately run picttoppm on the attacker-supplied file; no public exploit has been identified at time of analysis. The vendor has shipped fixes and the priority decision places remediation in this week, but the exposure is a locally exploitable file-parsing memory-corruption bug rather than a remotely reachable one, since picttoppm is a specific conversion utility rather than a listening service.
Stack-based buffer overflow in Netpbm's picttoppm PICT-to-PPM converter lets an attacker who supplies a crafted PICT file containing a polygon with more than 100 points overwrite the fixed-size pts array in paintPoly(), crashing the converter and potentially achieving code execution in the context of the converting process. Only Netpbm builds before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 are affected, and exploitation requires picttoppm to actually be run on the malicious file (CVSS AV:L with UI:P), so exposure is limited to users and automated image-conversion pipelines that process untrusted PICT input. Vendor fixes are published for all three branches; no public exploit code was identified at time of analysis, and the case is triaged as this_week rather than an emergency.
Heap memory corruption in Netpbm's winicontopam converter affects releases before 10.86.51, 11.02.30, and 11.15.08, where a crafted ICO/CUR file declaring a width or height above 32767 wraps the signed int16_t row/column loop counters negative and drives writes through negative row buffer indices. The assessed vector is local (AV:L) with passive user interaction (UI:P) and no privileges required, so exploitation only occurs when a user, or a server-side or batch pipeline, runs winicontopam on attacker-supplied icon input; the confirmed outcome is a crash, with arbitrary code execution described only as a potential, non-demonstrated consequence. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available in all three maintained branches.
Heap-based buffer overflow in Netpbm's sgitopnm converter affects releases before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07. A local, unauthenticated attacker can trigger it only when a user or automated job runs sgitopnm on a crafted RLE-compressed SGI image with an oversized offset table length, causing a heap write past the buffer that can crash the process and may permit code execution. No public exploit was identified at time of analysis, and the risk is context-dependent rather than an internet-facing emergency.
A use-after-free race condition in multiple functions of base.c in the Android kernel lets an attacker who already runs code locally as an unprivileged app escalate privileges to kernel level, with no user interaction required. Local access is mandatory and the flaw is timing-dependent, so reliably winning the race is a practical limiting factor; exploitation is assessed as not automatable. No public exploit or confirmed active exploitation was identified at time of analysis, and the vendor has published upstream kernel fixes alongside the Android Security Bulletin.
Local privilege escalation in the Android kernel lets code that is already running on the device - a malicious installed app or a local shell - trigger a use-after-free in ksys_unshare() and corrupt kernel memory, potentially gaining elevated privileges. The flaw is reachable through the unshare() system call, which is callable without special privileges (CVSS PR:N) and needs no user interaction (UI:N), but it is strictly local (AV:L): the attacker must first obtain unprivileged code execution on the target by some other route, and the precise object-lifetime condition that fires the bug is not described in the available sources. No public exploit has been identified at time of analysis (SSVC exploitation: none) and no CISA KEV listing applies; the assigned priority is this_week, and the impact is rated total by SSVC (C:H/I:H/A:H, base 8.4).
Google Android 16, 16-qpr2, and 17 contain a use-after-free in multiple unspecified locations that can be triggered by code running locally on the device, such as a malicious or compromised app, without user interaction or additional execution privileges. Successful exploitation could elevate privileges and provide high confidentiality, integrity, and availability impact. No CISA KEV entry or public exploit reference is present in the supplied intelligence, so no public exploit is identified at time of analysis; remediation is tied to the November 2026 Android Security Bulletin (2026-11-01).
Local privilege escalation in Google Android 16, 16-qpr2, and 17 is caused by a use-after-free race condition in multiple platform code paths. An attacker who can already execute code on the device at low privilege can attempt to win the race and gain elevated privileges without user interaction; the assessed vector is local with high attack complexity, and reliable success is non-deterministic. No public exploit code or confirmed active exploitation is identified in the supplied data, and the November 2026 Android security bulletin is the vendor reference.
Android XR 14 contains a local privilege-escalation flaw in WindowManagerService, where the addDragDropListener path performs no permission check (CWE-862), so a locally installed, unprivileged app can register a drag-and-drop listener it should never be allowed to hold. Per the assessed vector (AV:L/AC:L/PR:N/UI:N, C:H/I:H/A:H, 8.4) the attacker must already have code running on the headset, but needs no privileges and no user interaction once that app is executing, and can then gain high-impact read and write capability over other applications' window/drag data. Exploitation is not confirmed (CISA SSVC exploitation: none, automatable: no), and no public exploit has been identified at time of analysis; the practical exposure is bounded by the narrow deployment base of the Android XR 14 headset platform.
Local privilege escalation in Google Android 14, 15, 16, 16-qpr2 and 17 allows an app already running on the device to bypass a permission check by inducing an uncaught exception, yielding high confidentiality, integrity and availability impact within the local security boundary. The CVSS vector (AV:L/AC:L/PR:N/UI:N) means no pre-existing privileges and no user interaction are needed once attacker-controlled code executes locally; the flaw is not remotely reachable. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.12% (2nd percentile), so signals point to moderate, patch-cycle urgency rather than an emergency - fixed builds are published in the Android Security Bulletin dated 2026-11-01.
A permission bypass in Android's NfcService.java allows any installed application, without special privileges or user interaction, to invoke NFC service functions that are missing their permission check and thereby escalate privileges locally to a higher-integrity context (CVSS 8.4, CWE-862). Affected branches are Android 14, 15, 16, 16-qpr2 and 17, with fixes published in the November 2026 Android Security Bulletin. Exploitation requires the attacker to already run code on the device; a public PoC reference exists but is not verified as working exploit code, EPSS is 0.12% (2nd percentile), and there is no CISA KEV listing, so signals point to a genuine but non-emergency local privilege-escalation issue.
Android 15, Android 16 and Android 16-qpr2 devices can have Factory Reset Protection bypassed through a missing authorization check in OemLockService.java, where setOemUnlockAllowedByUser fails to verify the caller holds the required permission (CWE-862). The flaw lets a local attacker set the OEM-unlock-allowed flag and clear FRP without user interaction, yielding high confidentiality, integrity and availability impact at a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U). Exploitation requires local access to the device - a locally installed or malicious app, or physical possession - and no public exploit code was identified at time of analysis; EPSS is 0.12% (2nd percentile) and the issue is not in CISA KEV.
Local privilege escalation in Google Android 14, 15, 16, 16-QPR2 and 17: a heap buffer overflow (CWE-122) in getEntryFileName in ZipFileRO.cpp, the native ZIP central-directory entry-name read path, can be driven by an attacker who already has local code execution on the device - typically an installed unprivileged app - to corrupt heap memory and gain code execution in the context of the privileged component that parses the archive, with no additional execution privileges and no user interaction required (CVSS 8.4, AV:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and its exploitation prerequisite is prior local execution; the exact malformed ZIP input that triggers the overflow is not detailed in the available sources. EPSS is low at 0.12% (2nd percentile) and no public exploit has been identified at time of analysis, but the vendor has published a fix in the 2026-11-01 Android Security Bulletin, and the priority assessment places remediation in the current week.