Adjacent-range denial of service in the MediaTek modem affects the listed chipsets when a user equipment (UE) is attached to an attacker-controlled rogue base station. An integer overflow (CWE-190) in modem processing produces an availability-only impact, scored CVSS 3.1 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), with no confidentiality or integrity effect and no user interaction once the rogue-station precondition is met. No CISA KEV entry or public exploit was identified at time of analysis, and the specific triggering input is redacted in the available sources.
Denial of service in the MediaTek modem on a broad set of MediaTek chipsets occurs when a user equipment (UE) is connected to an attacker-controlled rogue base station and receives signaling that triggers a CWE-617 logic error, causing an application crash. The issue is availability-only (CVSS 5.3) and requires adjacent radio proximity plus the operational effort of running a rogue base station and inducing attachment, after which no authentication or user interaction is needed. No public exploit was identified at time of analysis, and the vendor patch is identified as MOLY01416152.
Modem denial of service affects MediaTek MT-series chipsets through an integer overflow that causes an out-of-bounds read and can crash the cellular modem. The attacker must operate a rogue base station within radio range and get the victim UE to attach to it; once that precondition is met, no authentication or user interaction is required. The assessed impact is availability-only (C:N/I:N/A:H) with high attack complexity (AC:H), no public exploit code is identified in the available data, and the issue is rated moderate rather than emergency-grade.
Denial of service in the MediaTek modem affects a broad range of MediaTek chipsets (CPE cpe:2.3:a:mediatek,_inc.:mediatek_chipset) when a UE is connected to a rogue base station, caused by an out-of-bounds read from a missing bounds check. CVSS 3.1 is 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting an adjacent-network, high-complexity attack that requires the victim device to attach to an attacker-controlled base station. No public exploit code or active exploitation is identified at time of analysis, and the vendor patch ID is MOLY01758223.
Remote denial of service affects the modem firmware on a broad range of MediaTek chipsets, including MT6980, MT8768, MT6897 and many others, when a UE connects to an attacker-controlled rogue base station within radio range. An out-of-bounds read caused by improper input validation (CWE-125) can crash the modem; CVSS PR:N and UI:N indicate no authentication or user interaction is needed once the UE attaches, while AC:H reflects the non-trivial effort of standing up a rogue cell and coercing attachment. Impact is availability-only (C:N/I:N/A:H), no public exploit or CISA KEV entry was identified at time of analysis, and MediaTek provides patch ID MOLY01758225.
An out-of-bounds read in the MediaTek modem firmware of a broad range of MediaTek chipsets (MT27xx, MT68xx, MT69xx, MT86xx, MT87xx, MT88xx and MT89xx families) allows an attacker operating a rogue base station to crash or destabilize the modem of any UE that camps on it, producing a denial of service. The flaw is a missing bounds check (CWE-125) reachable over the cellular radio interface with no authentication and no user interaction, although the attacker must first stand up fake radio infrastructure within range and get the target device to attach to it, which is why the vector is scored AV:A/AC:H and severity is moderate at 5.3. Impact is confined to availability - no code execution and no data compromise - and no public exploit code has been identified at time of analysis; MediaTek has issued fix patch IDs MOLY01349680 and MOLY01369097 (issue MSV-9364) through its November 2026 product security bulletin, and the issue is prioritized for remediation this month rather than as an emergency.
Denial of service in MediaTek modem firmware can crash the baseband when a UE attached to an attacker-controlled rogue base station sends malformed input that fails validation and reaches an assertion (CWE-617). The issue affects a broad set of MediaTek MT-series chipsets and is scored CVSS 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), so exploitation requires radio proximity and getting the device to camp on the rogue cell, with no authentication or user interaction. No public exploit was identified at time of analysis, and MediaTek has published Patch ID MOLY01707455.
Denial of service in the MediaTek modem is reported to occur when a user equipment (UE) is camped on an attacker-controlled rogue base station, affecting the MediaTek chipsets listed in the EUVD data. The issue is scored CVSS 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting an adjacent-network, high-complexity attack that requires no privileges or user interaction and causes only availability impact. No public exploit was identified at time of analysis, and the rogue-base-station precondition substantially limits practical exposure.
Remote denial of service in the MediaTek modem component affects a broad range of MediaTek chipsets (CPE cpe:2.3:a:mediatek,_inc.:mediatek_chipset) when a victim UE attaches to an attacker-controlled rogue base station. The modem performs an incorrect bounds check before a memory write, producing an out-of-bounds write (CWE-787) that can crash or destabilize the modem; impact is limited to availability, with no confidentiality or integrity effect and no code execution claimed. CVSS 3.1 is 5.3 (AV:A/AC:H/PR:N/UI:N/A:H), reflecting radio proximity and a non-trivial rogue-station setup; no public exploit was identified at time of analysis and no CISA KEV entry is present.
A missing bounds check in MediaTek modem (baseband) firmware can be driven into an out-of-bounds write, crashing the modem and causing a denial of service on the affected handset. The attack is only reachable from the radio side: the device must first be attached to a rogue base station operated by the attacker, which then delivers a malformed message. No authentication or user interaction is required, but the adjacent-range access path and the difficulty of luring a UE onto an attacker-controlled cell keep this at CVSS 5.3 (AV:A/AC:H/PR:N/UI:N/A:H), with availability impact only. No public exploit code or PoC reference has been identified at time of analysis, and the issue is not in CISA KEV; MediaTek has published a fix under Patch ID MOLY01775984 in its November 2026 product security bulletin.
Remote denial of service in MediaTek modem (baseband) firmware affects a broad range of MediaTek chipsets, where a missing bounds check during processing of messages received from the network permits an out-of-bounds write and a modem crash. The attacker must operate a rogue base station and get the target handset (UE) to attach to it; the attack is radio-adjacent, unauthenticated (PR:N) and requires no user interaction (UI:N), but is rated high complexity (AC:H) because of the rogue-base-station setup and the need to lure the UE into connecting. Impact is limited to availability (modem denial of service) with no code execution, data disclosure or integrity impact, and no public exploit was identified at time of analysis.
Improper input validation in the MediaTek modem allows a crafted radio-layer input to crash the baseband, causing denial of cellular service on affected chipsets (including MT8792, MT6897, MT8755, MT6878, MT2716, MT8883, MT8676, MT8793, MT6899, MT8775, MT6835, MT8873 and MT8863) when the device is attached to an attacker-controlled rogue base station. No device authentication (PR:N) and no user interaction (UI:N) are required, but the adjacent attack vector and high attack complexity reflect the rogue-base-station precondition, so this is a targeted proximity attack rather than an internet-remote one. Impact is availability-only - a modem crash - with no code execution, data read or data modification claimed; no public exploit code and no CISA KEV entry were identified in the available data, and MediaTek has published a fix under Patch ID MOLY01870543 in its November 2026 product security bulletin.
A missing bounds check in MediaTek modem firmware causes an out-of-bounds read that can crash the modem and drop cellular service on affected chipsets (including MT6881, MT6991, MT6993, MT6897, MT8678 and others enumerated by the vendor), yielding a remote denial of service. The attacker must operate a rogue base station in radio range and get the victim UE to attach to it; once attached, no authentication or user interaction is required, but the adjacent-network vector and high attack complexity keep realistic exposure narrow, and impact is limited to availability (no confidentiality or integrity loss). MediaTek reports patch ID MOLY01876664 / issue MSV-9834 in its November 2026 product security bulletin; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Header passthrough in samanhappy MCPHub through 1.0.45 and 1.1.7 allows a non-admin server owner to configure an upstream server that forwards the invoking user's credentials - Authorization, Cookie, x-api-key, x-auth-token, proxy-authorization, or the deployment's configured bearer header - to an attacker-controlled endpoint. Exploitation requires a low-privileged account able to create or modify a server entry plus a victim actually invoking a tool on that server, after which a single credential header per invocation is disclosed (confidentiality-only, no integrity or availability impact; assessed CVSS 5.3). A public proof-of-concept writeup reference exists; it is not verified as working exploit code, there is no CISA KEV listing, and the vendor fix is released in v1.1.8 (commit 040f7b9ae004070bdfe5084cde6bc2c609f78e76).
Heap memory corruption in libgphoto2 (through 2.5.34) lets a malicious USB camera driven by the jl2005c camlib overrun a heap buffer by roughly 30 KB during thumbnail decompression, leaking heap contents into generated preview images and allowing memory writes past the allocation. Only hosts that physically connect the crafted device and have the application process the thumbnail/preview are exposed, and the jl2005c code path must actually be reached, which keeps this a medium/low-urgency issue rather than a high-priority emergency. No public exploit code and no CISA KEV listing are confirmed in the available data, and authentication is not required (CVSS 4.0 PR:N) although the attack vector is physical (AV:P).
Stored cross-site scripting in Wing FTP Server versions prior to 8.2.6 allows an authenticated low-privileged web-client user to inject script through a crafted 'nowpath' parameter sent to webclient/makethumb.html, with the payload breaking out of the CDATA section of the admin_get_lastconn.html XML response to forge a connection id. The forged entry is rendered and executed in an administrator's browser when the admin_connection_list.html activity page auto-refreshes, which the reporter states can be leveraged to abuse the Lua console. Rated medium severity (CVSS 4.0 base 5.1; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), exploitation requires valid web-client credentials and an administrator viewing the legacy activity page, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in LaraDashboard 1.4.8 and earlier lets any authenticated account holding the post.create or post.edit permission persist script or event-handler markup inside LaraBuilder design_json blocks (text-editor, HTML, text or heading), which the application then renders unescaped in the builder preview, the admin post view, email-template previews and published pages. Because the payload executes in the browser of a higher-privileged viewer - an administrator or Superadmin opening the content - a low-privilege author can chain the execution with the account's own CSRF-exposed actions toward privilege escalation; exploitation requires a valid low-privilege account and a privileged user action (PR:L/UI:P per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), so it is not an unauthenticated or fully automatable attack and is rated moderate priority rather than an emergency. A public proof-of-concept reproduction script is included in the vendor GHSA advisory; it has not been independently verified as working exploit code, and no active exploitation (CISA KEV) has been confirmed. Vendor-released patch: 1.4.9.
The Regular Labs Users Anywhere extension for Joomla (free and Pro) before version 3.0.1 lets a content author override the administrator's personal-data output setting by embedding an attribute inside a {user}, [email] or [username] tag - for example [email allow_output_email="1"] renders an email address even when 'Allow output of email' is set to No. This is a limited information-disclosure issue (CVSS 5.1, CWE-200) that requires authenticated content-authoring access and a site where Users Anywhere tags are permitted in the content source; it does not defeat a separate policy that blocks those tags entirely. No public exploit or PoC reference exists in the available sources and there is no CISA KEV listing or EPSS score, so it is handled on a monthly patch cadence rather than as an emergency.
SQL identifier injection in the Apache Iceberg write path of AWS SDK for pandas (awswrangler) 3.5.2 through 3.17.0 allows an authenticated principal that can modify AWS Glue Data Catalog metadata to read any table a separate, more privileged principal can access - and to write to the very table that principal is updating - by planting a crafted column name that is spliced unescaped into generated Athena SQL. The flaw is conditional rather than broadly exploitable: the attacker must already hold glue:UpdateTable (or equivalent catalog-modify) rights on a shared database, a more-privileged principal must then invoke to_iceberg() against the poisoned table (required user interaction), and the deployment must pair a shared catalog with an over-privileged Iceberg writer. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor rates it as a privilege-escalation/data-exposure issue fixed in 3.17.1 and prioritizes it for patching this week.
A heap out-of-bounds read in The Sleuth Kit through 4.15.0 allows a crafted HFS+ disk image to crash forensic analysis utilities such as istat and icat. The flaw is triggered when an analyst opens an attacker-supplied image containing a com.apple.decmpfs extended attribute whose attr_size is 1 to 15 bytes, causing a header read past the heap allocation. Exploitation is local and requires user interaction (the analyst must choose to process the image), the impact is limited to availability (tool crash), and no public exploit was identified at time of analysis; this is a medium-severity denial-of-service issue rather than a code-execution or data-disclosure risk.
A one-byte stack buffer under-read exists in ini_parse_stream() in inih before release r63, reachable when a host application parses attacker-supplied INI content containing a line of at least INI_MAX_LINE-1 bytes immediately followed by an embedded NUL byte. The scored impact is limited to availability: a single out-of-bounds read of abyss[-1] that triggers undefined behavior and can crash the parsing process, with no confidentiality or integrity effect in the assessed vector (the CWE-127 classification reflects the out-of-bounds read class, not a confirmed disclosure primitive). The vector is local (AV:L) and requires the user or application to load the crafted INI data (UI:R/UI:P) with no privileges needed (PR:N); exploitation conditions depend entirely on the host application accepting untrusted INI input. Vendor-released patch: r63, via upstream PR #206 and commit 8e06f6b; a public technical write-up describing the trigger is referenced, but no working exploit code and no active exploitation (CISA KEV) were identified at time of analysis, and the priority label is this_month.
Stored cross-site scripting in the WSO2 API Manager Publisher portal allows users holding the Publisher role to upload SVG files whose content is never validated, so embedded script is persisted and later executed in the browser of any user who views the rendered asset. The flaw is scored CVSS 4.8 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), and its practical reach is narrow because it requires a privileged Publisher account plus victim interaction, while httpOnly-protected session cookies block session hijacking and limit the outcome to browser-context effects such as forced redirects, UI tampering, or reading browser-accessible information. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-prioritised decision label places it in the this-month remediation window rather than an emergency response.
CVE-2026-20566 is an out-of-bounds write (CWE-787) in MediaTek modem firmware affecting a broad list of MediaTek chipsets including the MT6xxx, MT8xxx and MT2xxx families. Exploitation is not a default-configuration remote attack: the victim UE must be connected to an attacker-controlled rogue base station, the attacker must already hold System privilege on the device, and user interaction is required - a layered set of prerequisites that sharply limits realistic risk and is reflected in a low CVSS 4.8 score. Impact is availability-only (denial of service) with no confidentiality or integrity effect; no public exploit code, no CISA KEV listing and no evidence of active exploitation were identified at time of analysis, and CISA SSVC records Exploitation as none with Automatable: no.
Remote file preview in Huawei HarmonyOS can trigger a buffer overflow that affects availability, with a CVSS 4.7 severity. The assessed vector requires user interaction - the victim must open or preview an attacker-supplied file - but no authentication against the target, and the only stated impact is denial of availability; confidentiality and integrity impacts are not supported by the independent assessment. No public exploit has been identified at time of analysis, and Huawei's October 2026 consumer bulletins are the available vendor references.
Stored cross-site scripting in the aidlc-traceability CLI (versions from 0.1.0 up to, but not including, commit 96cf0ea) lets an actor who can modify a project's AI-DLC artifact files place a closing script-tag sequence plus script content in an artifact title or description, which then executes in the browser of a user who generates the HTML traceability report and opens it. The injected script can rewrite the displayed coverage and gap-analysis results and read the report's contents, including the victim's local file paths, but cannot reach other local files or credentials. The flaw is fixed at commit 96cf0ea (2026-07-03); a public proof-of-concept reference exists in the GitHub advisory and is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV entry).
Misconfigured Event Publisher output adapters in affected WSO2 Carbon products can cause irrelevant configuration properties - including credentials or other secrets - to be written into the 'wso2carbon' log files, exposing them to anyone who can read those logs. Exploitation requires a non-default misconfiguration where an adapter is given properties it does not use and those properties carry sensitive values, plus an attacker who already holds high privileges sufficient to read the local wso2carbon log files (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/C:H/I:N/A:N, 4.4 Medium). There is no confidentiality-only impact and no remote or unauthenticated path; no public exploit code or PoC has been identified at time of analysis, and the issue is not listed in CISA KEV.
A logic error in the display subsystem of MediaTek chipsets can crash the system, producing a local denial of service on affected devices. Exploitation requires the attacker to already hold System privilege (CVSS PR:H) and local access (AV:L), with no user interaction needed; only availability is impacted, with no confidentiality or integrity effect. Approximately 30 chipset models are listed as affected, no public exploit code is identified, and the CISA SSVC assessment rates exploitation as none and automatable as no, placing this at a low-to-moderate priority.
A use-after-free in the USB component of MediaTek chipsets allows a local attacker who already holds System privilege to crash the affected device, yielding a denial-of-service condition (CVSS 4.4, AV:L/AC:L/PR:H/UI:N, with only availability impact). The flaw touches a very broad set of MediaTek SoCs, including MT6761, MT6765, MT6768, MT6833, MT6853, MT6877, MT6885, MT6893, MT6989, MT8188, MT8768, MT8786 and MT8196, and is fixed by MediaTek patch ALPS11411916 documented in the November 2026 product security bulletin. No public exploit has been identified at time of analysis, and because the attacker must already be System-privileged, this is a post-exploitation availability issue rather than a route to initial access or privilege escalation.
Local denial of service in the MediaTek USB driver affects a broad set of MediaTek chipsets, where a use-after-free condition can crash the system. The flaw is only reachable by an attacker who already holds System privilege and executes locally, and it requires no user interaction; confidentiality and integrity are unaffected. No public exploit has been identified at time of analysis, CISA SSVC exploitation is none, and the issue is treated as a this-month priority rather than an emergency.
Local denial of service in the MediaTek modem affects devices built on 25 MediaTek chipsets, including MT8873, MT6858, MT8755, and related models, when an attacker already holds System privilege. The flaw is a permission bypass (CWE-280) that requires high local privileges and no user interaction, making it a post-compromise issue rather than an entry point; CVSS 3.1 score is 4.4 with only availability impact. MediaTek has published patch MOLY01880753 in its November-2026 security bulletin, and no public exploit has been identified at time of analysis.
Uncontrolled recursion in HDF5 (through 2.2.0) lets a crafted HDF5 file crash an application that inspects group metadata: a version 1 B-tree whose child pointer refers back to an already-cached node - such as a node pointing to itself - drives H5B__iterate_helper() into unbounded recursion and exhausts the stack. The victim must open the malicious file and the application must reach the vulnerable path through H5Gget_info() or H5Gget_num_objs() on a group, which routes via H5G__obj_info() and H5G__stab_count() into H5B_iterate(); no privileges are required, but user interaction to open the file is. Impact is availability-only (process crash), with no code execution or data disclosure reported, and no public exploit was identified at time of analysis; the disclosed reference is the upstream issue report rather than working exploit code.
A denial-of-service flaw in the HarmonyOS file parsing module allows an attacker to crash the parsing component by supplying a crafted malformed file that the victim opens (CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). The root cause is uncontrolled recursion (CWE-674), which leads to resource exhaustion and a temporary availability impact only - confidentiality and integrity are unaffected. Exploitation is gated by user interaction, which is the primary limiting factor; no public exploit code or active exploitation was identified in the available sources at time of analysis.
A crafted web page loaded into Huawei's ArkWeb rendering module on HarmonyOS can trigger a null pointer dereference that crashes the web component, giving a limited availability-only impact (CVSS 4.3, A:L) with no confidentiality or integrity effect and no code execution. The assessed vector (AV:N/AC:L/PR:N/UI:R) shows the flaw is remotely reachable without authentication, but the attacker depends on the victim opening or navigating to attacker-controlled web content rather than a silent remote attack. No public exploit code or CISA KEV entry is identified at time of analysis, and this is a low-to-moderate priority issue despite being internet-reachable.
Dell Alienware Command Center versions prior to 6.14.54.0 are affected by an improper input validation flaw that a low-privileged local attacker could use to cause a denial of service, with limited integrity impact and no confidentiality loss. Exploitation requires existing local access and is assessed as high complexity, and no public exploit was identified at time of analysis. Dell has published security update DSA-2026-429 for the affected 6.x releases.
Signature verification bypass in @fastify/secure-session 7.5.0 through 8.4.1 allows a holder of an already-issued encrypted session cookie to keep using that session after the cookie signature has been invalidated. When cookie.signed is enabled the plugin calls the cookie unsign routine but, if the signature check reports invalid, it still hands the original cookie value to the session decoder, so the session is decrypted anyway; the practical effect appears only when an application supplies the @fastify/cookie signing secret independently of the session encryption key and retires sessions by rotating just the signing secret. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects that the attacker must already possess an unexpired encrypted session cookie, needs neither secret, and cannot forge session data, extend expiry, or survive rotation of the encryption key; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-supplied fix is 8.4.2.
Local information disclosure in MediaTek Modem affects a broad set of MediaTek chipsets, including MT6897, MT6988, MT6991, and MT8755, and can expose sensitive data through a side channel to an attacker who already holds System privilege. Exploitation is local, highly complex, and requires high privileges, with no user interaction and no integrity or availability impact, so overall urgency is low despite the widespread product line. No public exploit identified at time of analysis, and SSVC records exploitation as none.
Denial-of-service conditions in Huawei HarmonyOS's file parsing module can be triggered when a crafted or malformed file is processed locally, with impact limited to reduced availability (A:L). The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, meaning local access or a means to have the file parsed on the target device is the gating prerequisite; no remote path is described. No public exploit code or CISA KEV entry was identified in the available intelligence, and the issue is assessed as a low-to-moderate priority for this month rather than an emergency.
Authenticated Apache Oozie users can abuse the workflow rerun/reconfigure capability to bypass a job's per-job ACL and take ownership of a workflow belonging to another tenant, changing its configuration and, per the assessed vector, its integrity. The CVE states that all Oozie versions are affected and, because the project was retired in February 2025 and moved to the Apache Attic in April 2025, the maintainers do not plan to release a fixed version. No public exploit was identified at time of analysis; exploitation requires an existing authenticated account on a multi-tenant Oozie instance that hosts jobs owned by other users.
Out-of-bounds read in Apache Arrow Rust (`arrow` crate) versions 33.0.0 through 57.3.1, 58.4.0, 59.3.1, and 60.0.0 can expose memory contents beyond a RunEndEncoded child values array when malformed run-end values are accepted through the ArrayData interface. The independent assessment assigns CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, making this remote and unauthenticated, but practical exposure is limited to applications that pass untrusted or malformed RunEndEncoded data into that interface; applications processing only trusted, internally generated Arrow data are not realistically exposed. No public exploit has been identified at time of analysis, and the vendor recommends upgrading to 60.1.0, 59.3.2, 58.4.1, or 57.3.2.
An authenticated Apache Syncope administrator who holds entitlements to manage workflow definitions can import a BPMN process containing a JUEL expression attribute through the REST API and then start that process, causing the expression to be evaluated server-side with no sandbox and resulting in arbitrary code execution in the Syncope server context (assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The flaw is an improper isolation or compartmentalization weakness (CWE-653) affecting Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0 through 4.1.3; because the vector requires high privileges (PR:H), exposure concentrates in deployments where workflow-management entitlements are broadly delegated. No public exploit code and no confirmed active exploitation were identified at time of analysis, and fixes are available in 4.0.9 and 4.1.4.