Local privilege escalation in Google Android 17 allows an app already running on the device to abuse a confused-deputy component and execute sensitive USSD codes without additional execution privileges or user interaction, with high confidentiality and integrity impact. The issue is rated CVSS 8.4, no active exploitation is confirmed in the supplied data, and no public exploit identified at time of analysis; the vendor reference is the November 2026 Android Security Bulletin. This is a genuine prioritization candidate but not an emergency, matching the this_week decision label.
Intent redirection in Android 17's ContactsPickerActivity lets a locally installed malicious app relay an attacker-controlled intent into a more privileged handler, gaining the privileges of that handler and thereby escalating from an ordinary app sandbox to a higher-integrity context (CVSS 8.4, AV:L/AC:L/PR:N/UI:N, C:H/I:H/A:H). The confused-deputy flaw sits in forwardToPreferredActionPickHandler within ContactsPickerActivity.kt and requires no user interaction and no permissions granted to the calling component, but the attacker must already be able to run code or deliver an intent on the device - typically through a separately installed application. Affected scope is stated as Android 17 only; no public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none, so this is a genuine but non-emergency local privilege-escalation issue slated for remediation in the current patch cycle.
A confused-deputy flaw in multiple Android onActivityResult handlers allows a locally installed app to read contact data belonging to a protected profile (such as a work or managed profile) without holding any permission for it. Per the assessed vector (AV:L/AC:L/PR:N/UI:N) the attacker needs only an installed app - no granted privileges and no user interaction - but the device must actually be configured with a separate protected profile holding the contacts, since without that boundary there is nothing to cross. Affected builds span Android 14, 15, 16, 16-qpr2 and 17 per EUVD; no public exploit code was identified at time of analysis and there is no CISA KEV entry, so priority follows the vendor bulletin rather than observed exploitation.
Authorization bypass in NLnet Labs Krill lets an authenticated Krill operator assert an arbitrary child identity during parent-child provisioning when the target CA's parent CA is hosted on the same Krill server, bypassing the signed CMS verification normally used in the RFC 6492 exchange. The issue is conditional on a shared or multi-tenant deployment with co-located parent and child CAs; single-tenant setups with remote parents are not reachable through this path. CVSS 3.1 rates it 8.4 with high confidentiality and integrity impact, and no public exploit has been identified at time of analysis.
An authorization bypass in NLnet Labs Krill allows an account whose role is deliberately scoped to a subset of CAs (cas = [...]) to exercise its full permission set on any API request that is not tied to a specific CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. Exploitation requires a valid, provisioned Krill account holding such a restricted role (PR:L in the CVSS vector, so this is an authenticated insider or compromised-credential scenario), but a successful attacker can create a child CA beneath any existing CA, hand it that CA's resources, and mint the ROAs supplied in the request, affecting other tenants sharing the instance (S:C). No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, and the vendor advisory is the authoritative source.
Nonce reuse in Krill's login-session token encryption lets an attacker who captures multiple encrypted tokens across Krill restarts exploit a repeated (key, nonce) pair to recover or forge session-token plaintext. The flaw stems from a nonce counter that resets to zero on every restart, so deployments that restart Krill periodically accumulate ciphertexts encrypted under identical key/nonce combinations. Exploitation is not anonymous: it requires low-privilege authenticated access to the login flow, several restarts the attacker cannot directly trigger, and cryptanalytic effort (AC:H), so realistic risk sits below the raw 8.4 score; no public exploit code or active exploitation was identified at time of analysis, and the vuln.today decision label is this_week.
Missing permission checks in the MediaTek GPU pdma driver, paired with a use-after-free, allow local privilege escalation on MT8910 and MT6993 chipsets: code running without privileges can reach the pdma interface and gain elevated execution with no user interaction and no additional execution privileges. MediaTek assigned patch ALPS11365075 (issue MSV-9546) and published it in the November 2026 product security bulletin. No public exploit code or active exploitation has been identified at time of analysis, and SSVC records exploitation as none and the flaw as not automatable, but the total technical impact and CVSS 8.4 severity support this-week rather than emergency-grade prioritization, since the vector is local-only and confined to the listed chipset models.
Out-of-bounds write in the MediaTek modem component allows code that is already running locally on an affected device to corrupt memory and escalate privileges, with no authentication or user interaction required (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/SU/ C:H/I:H/A:H, base score 8.4). Roughly 77 MediaTek MT-series chipsets are enumerated as affected, ranging from entry-level parts such as MT6739, MT6761 and MT6765 through premium SoCs such as MT6989, MT6991 and MT6993. No public exploit code has been identified at time of analysis and SSVC records exploitation as none with no automatable path, but technical impact is rated total and the only complete fix is MediaTek patch MOLY01778991 (issue MSV-8900), published in the November 2026 product security bulletin.
Local privilege escalation in the GPU pdma path of MediaTek MT8910 and MT6993 chipsets allows an unprivileged local process to gain elevated privileges through a use-after-free condition in memory handling. Per the CVSS vector (AV:L/AC:L/PR:N/UI:N), no prior privileges and no user interaction are required once code is running on the device, but the attacker must already have local execution - the flaw is not remotely reachable. Exploitation activity is not confirmed (CISA SSVC: Exploitation none) and no public exploit code has been identified at time of analysis; MediaTek has issued patch ALPS11365070, so exposure is confined to firmware predating that fix.
Absolute Secure Access server versions 13.0 up to but not including 14.61 mishandle attacker-supplied input, allowing a low-privilege authenticated remote user to cause a persistent denial of service. The flaw affects availability only, with an independent CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and a vendor CVSS 4.0 vector that adds subsequent-system availability impact (SA:H); no public exploit code or CISA KEV entry was identified at the time of analysis.
Heap buffer overflow in QuickJS-NG before 0.16.0 allows JavaScript code executed by the embedding application to drive an integer overflow inside js_typed_array_sort(), corrupting heap memory on 32-bit hosts and crashing the process, with limited potential for code execution (vendor CVSS 4.0 score 8.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H). Only 32-bit builds are affected, and exploitation requires a typed array near 2^30 elements - roughly a 1 GB ArrayBuffer - to be allocated successfully, followed by a .sort() call with a comparator; 64-bit builds do not overflow the size computation. No public exploit code was identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV).
Denial of service in Eclipse ThreadX NetX Duo 6.0 through 6.5.2.202603a: the BSD raw IPv6 send path adds a destination-table entry and then reads that entry without first checking whether the add succeeded, so when the table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, a NULL entry is dereferenced and the sending thread crashes. The defect is only reachable in builds that enable NX_BSD_ENABLE, NX_BSD_RAW_SUPPORT and FEATURE_NX_IPV6 where the application itself sends on an AF_INET6 raw socket with IP_RAW_IPV6_HDRINCL set, and only while the default router is unresolved - preconditions a remote sender does not control. A remote party can fill the destination table only if NX_ENABLE_IPV6_PATH_MTU_DISCOVERY is compiled in (32 crafted ICMPv6 Packet Too Big messages quoting distinct destinations were measured to do it); otherwise the table fills from the device's own outbound traffic to distinct off-link destinations. Unauthenticated (PR:N in both the vendor CVSS 4.0 vector and the assessed 3.1 vector) with high attack complexity and present attack requirements; no public exploit code was identified at time of analysis.
Unauthenticated path traversal in the Fastify plugin @fastify/reply-from (all releases up to and including 12.8.0) lets a crafted request escape a configured upstream prefix and reach other upstream endpoints. The plugin's buildURL() checked proxy paths only for forward-slash dot-segments, but the WHATWG URL parser it then used collapses backslashes and %5c into forward slashes on http, https, ws and wss, so a path containing \..\ or %5c..%5c passes the check and resolves to a different upstream path - an unauthenticated request (PR:N) can therefore slip past prefix scoping or Fastify route guards placed in front of reply.from(). Impact is primarily confidentiality (C:H) with limited integrity effect (I:L); no public exploit identified at time of analysis, and exploitation is conditional on the consuming application concatenating untrusted input into the forwarded path.
http4k's Digest authentication advertises the RFC 7616 auth-int quality-of-protection but never binds the request entity body into the digest, so an on-path attacker on a cleartext channel can rewrite the body of an already-authenticated, state-changing request while leaving the Authorization header valid. Affected is the org.http4k:http4k-security-digest module from 4.9.10.0 through 6.59.0.0, and only when an operator explicitly configures ServerFilters.DigestAuth with qop = listOf(Qop.AuthInt); the default Qop.Auth is not affected. The attack is unauthenticated - no credentials are needed - but requires a non-default QoP setting, no TLS, an active MITM foothold, and a body-omitting peer such as http4k's own DigestAuthReceiver, so a strictly RFC 7616-conformant client that hashes the body would simply fail to authenticate. A public PoC reference exists (a dependency-free digest-equivalence harness published with the advisory); it is not verified as working exploit code, and there is no confirmed active exploitation.
Path traversal in http4k’s ThymeleafTemplates Caching and HotReload wrappers allows remote unauthenticated attackers to read files outside baseTemplateDir when an application lets request-controlled data reach ViewModel.template() or its ::selector suffix. The issue affects http4k before 6.62.0.0-ee and is conditional on request-derived template selection; Pug4j is protected by commit 725f1b9697’s containment check, and the pinned Handlebars 4.5.5, FreeMarker and Pebble 4.1.2 engines are not affected. A verified component-level reproduction is published with the advisory, but there is no CISA KEV entry or confirmed exploitation of deployed applications, and impact is limited to disclosure of files readable by the server process; the assessed priority is this_week.
Improper verification of cryptographic signatures in Dell Alienware Command Center (AWCC) versions prior to 6.14.54.0 allows an unauthenticated attacker with an adjacent-network position to present a forged or tampered signed object that the application accepts as trusted, resulting in arbitrary code execution and elevation of privilege. No user interaction is required, but attack complexity is rated high and reach is limited to hosts on the same adjacent network running the consumer gaming utility. No public exploit has been identified at the time of analysis, and the supplied data contains no KEV listing confirming active exploitation.
Argument injection in Dell OpenManage Enterprise versions prior to 4.8.0 allows a low-privileged authenticated user who can reach the appliance over an adjacent network segment to slip attacker-controlled delimiters into a command the product builds, resulting in command execution on the management appliance. The impact is bounded in the CVSS vector to partial confidentiality and integrity loss with no availability effect (C:L/I:L/A:N), giving a moderate base score of 4.6. Exploitation requires both presence on the management network (AV:A) and a valid low-privilege OME account (PR:L), so practical risk is concentrated among insiders or actors who have already established a foothold on the management segment; no public exploit has been identified at the time of analysis and the priority label is this_month, not act_now.
Command injection in Dell OpenManage Enterprise versions prior to 4.8.0 lets an authenticated low-privileged attacker with adjacent-network access execute arbitrary OS commands on the console host. Exploitation requires presence on the same LAN or management VLAN (AV:A) plus valid low-privileged console credentials (PR:L), with no user interaction and low attack complexity; CVSS 3.1 base score is 8.0. No public exploit was identified at time of analysis, and Dell's advisory identifies upgrading to 4.8.0 or later as the only confirmed complete fix, consistent with the vuln.today this_week priority.
Android Automotive OS 14 through 17 builds that include the privileged ClusterHomeSample component allow a locally installed unprivileged app to persistently place potentially misleading or distracting content on the safety-critical instrument cluster. The app can declare an activity with the android.car.cluster.NAVIGATION category and request navigation app focus, after which ClusterHomeSample acts as a confused deputy and launches it without enforcing android.car.permission.CAR_DISPLAY_IN_CLUSTER. The assessed impact is high integrity and low availability with no confidentiality impact; exploitation requires prior local app installation and a build that ships the vulnerable sample path, EPSS is 0.18% (8th percentile), and no public exploit was identified at time of analysis.
Dell Alienware Command Center (AWCC) releases prior to 6.14.54.0 contain an improper privilege management flaw (CWE-269) that lets an attacker who already holds a low-privileged local account escalate to higher privileges, with high impact to confidentiality, integrity and availability. Exploitation requires local access to a Windows host running the affected AWCC build, and the vendor has published a security advisory (DSA-2026-429) covering multiple vulnerabilities in the 6.x line. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing) despite a high CVSS base score of 7.8.
Improper input validation in Android's MMI/USSD handling code (MmiUtils.java) allows a local attacker to escalate privileges by getting crafted USSD/MMI codes processed on the device. Android 14, 15, 16, 16-QPR2 and 17 are listed as affected, and successful exploitation yields high confidentiality, integrity and availability impact, though it requires local presence and a user action (AV:L/PR:N/UI:R, CVSS 7.8). No public exploit has been identified at time of analysis, SSVC records exploitation as none and non-automatable, and EPSS is only 0.11% (1st percentile), so the practical threat is locally scoped rather than a mass-exploitation risk.
Enhanced Confirmation Mode (ECM) can be bypassed on Android 16, Android 16-qpr2 and Android 17 by an already-installed, sideloaded application that manipulates its own package source during a self-update, because of a logic error in handlePackagePostInstall within InstallPackageHelper.java. The result is local escalation of privilege to a higher-integrity state with high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N), though the attacker must first get a malicious app onto the device and running with ordinary User execution privileges. No public exploit code or exploit reference has been identified at time of analysis, SSVC records exploitation as none and the issue as not automatable, so the practical risk is second-tier and tied to environments where sideloading of untrusted applications is permitted.
Local privilege escalation in the Linux kernel Bluetooth L2CAP subsystem: a race between l2cap_sock_bind() and l2cap_chan_connect() lets an L2CAP channel be linked to an l2cap_conn twice, breaking the one-connection-per-channel invariant that l2cap_chan_del() cleanup relies on and exposing memory-corruption paths with high confidentiality, integrity and availability impact. Only local, authenticated processes (PR:L) with access to AF_BLUETOOTH sockets on a kernel built with Bluetooth/L2CAP support can reach the flaw, and exploitation requires winning a narrow timing window (AC:H); there is no remote or unauthenticated path. No public exploit code has been identified at time of analysis, and the issue is prioritized for remediation this week per the assigned decision label.
A race condition in the Linux kernel's ftrace tracing subsystem lets a local, already-privileged user free-and-reuse a trace_array: trace_module_record() walks the ftrace_trace_arrays list from the module notifier without holding trace_types_lock, while a concurrent rmdir of a persistent/named trace instance removes that same array from the list and frees it under the lock, so a module load or unload can walk into freed memory. Affected are kernels built with tracing enabled that actually use persistent trace instances; exploitation is local-only (AV:L) and requires the ability to load or unload kernel modules and to create/remove instance directories under tracefs, which normally means root or CAP_SYS_MODULE/CAP_SYS_ADMIN. Per the independent assessment the race is timing-sensitive (AC:H rather than AC:L), no public exploit code or CISA KEV entry was identified at time of analysis, and impact is rated high for confidentiality and integrity of the kernel.
Local kernel memory corruption in the Linux tracing subsystem can result from a race in update_last_data_if_empty(): concurrent readers that reset persistent 'last boot' trace data without trace_types_lock can double-free module_delta, and a module notifier can update the object while it is being freed. Affected are Linux kernel builds using the non-default persistent boot-mapped last-boot ring buffer, with exploitation requiring local access to tracefs (CVSS AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H; tracefs is commonly root/CAP_SYS_ADMIN-restricted). No public exploit identified at time of analysis, and the supplied decision signal places remediation in the this_week priority band.
Out-of-bounds read and possible out-of-bounds write in the Linux kernel tracing event-filter parser: a local user able to create a perf tracepoint counting event and issue PERF_EVENT_IOC_SET_FILTER with an expression that ends after a logical operator (optionally followed by unary '!' tokens, e.g. 'common_pid == 1 || common_pid == 2 &&') leaves unresolved operator state, so the second parsing pass reads prog[-1] and, depending on adjacent slab contents, can copy an out-of-bounds word into a branch target that survives the forward-only jump check. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8) matches an unprivileged local attacker gaining high confidentiality, integrity and availability impact through kernel memory access, but exploitation requires local access plus permission to open perf tracepoint events, in practice governed by kernel.perf_event_paranoid and/or CAP_PERFMON/CAP_SYS_ADMIN. No public exploit code and no CISA KEV entry were identified at time of analysis, and reliable memory corruption is contingent on adjacent slab contents; upstream stable fix commits are available.
A use-after-free in the Linux kernel's ftrace histogram-trigger code lets a local user who can write to the tracefs event-trigger interface create a target histogram with a field variable, have it latch onto an unrelated pre-existing histogram that merely shares the same keys, and then remove that other trigger - after which unregister_field_var_hists() dereferences the freed histogram, producing a KASAN slab-use-after-free read in event_hist_trigger_free. The assessed vector is AV:L/AC:L/PR:H with high confidentiality, integrity and availability impact, reflecting that tracefs trigger files are normally writable only by root or CAP_SYS_ADMIN, so the practical attack surface is privileged local access on kernels built with CONFIG_HIST_TRIGGERS. No public exploit has been identified at time of analysis; the flaw is fixed by a series of upstream stable commits on git.kernel.org, and the priority label is this_week.
Local use-after-free in the Linux kernel's tracing/histogram subsystem allows a local user with access to the ftrace event-trigger interface to free a synthetic event while an active histogram action still holds a pointer to it, creating a kernel memory-corruption risk. Affected kernels must be built with CONFIG_HIST_TRIGGERS and permit local access to tracefs; exploitation requires registering a histogram on a non-synthetic trace event whose basename collides with a synthetic event before that synthetic event is created, then removing the histogram afterward so se->ref is decremented without a matching increment. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Use-after-free in the Linux kernel's io_uring waitid handling can allow a local user who can issue io_uring syscalls to corrupt kernel memory and potentially escalate privileges, because a race between request completion and the waitid wake handler can free and reuse the request while a wakeup callback still touches it. The flaw is timing-sensitive and requires local access (AV:L, PR:L, AC:H in the independent assessment); it is not remotely exploitable, and hosts that disable io_uring are not exposed. No public exploit code or active exploitation has been identified at time of analysis.
The io_uring waitid implementation in the Linux kernel can be driven into a 31-bit reference-counter wrap by a local user, allowing a waitid request to be claimed and completed a second time, corrupting kernel state. Kernels built with io_uring and waitid support are affected wherever unprivileged users can submit and cancel io_uring waitid operations; systems that disable io_uring for unprivileged users (io_uring_disabled sysctl or seccomp policy) are not exposed. The assessed vector is local with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because the wrap demands on the order of 2^31 failed cancellation attempts and winning the completion-ownership handoff; no public exploit code or active exploitation has been identified at time of analysis, and priority is this_week rather than emergency.
Missing authorization in eta-register versions 2.0.8 and later but before 2.0.9 lets a locally present, low-privileged authenticated user escalate privileges within the application, with high impact on confidentiality, integrity and availability (CVSS 3.1: 7.8, AV:L/AC:L/PR:L/UI:N). The flaw is a CWE-862 missing authorization check reported by TR-CERT; the specific feature, endpoint or request that skips the check is not described in the available sources. No public exploit code is identified in the supplied data and the issue is not in CISA KEV; updating to 2.0.9 is the stated resolution, and priority is rated for handling this week.
Local privilege escalation in the MediaTek GPU pdma kernel driver allows a process already running with user-level privileges on a device built on an affected MediaTek chipset (EUVD lists MT8910 and MT6993) to corrupt kernel memory via a use-after-free and elevate to higher privileges; the flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction beyond the attacker's existing local code execution. The attacker must already have local code running on the device and the device must use one of the affected chipsets, so there is no remote vector, and no public exploit code or active exploitation has been identified at time of analysis. MediaTek has assigned Patch ID ALPS11365081 (Issue MSV-9545), with fixes delivered to device makers through the November 2026 product security bulletin.
A stack-based buffer overflow in PyMuPDF's JM_set_annot_callout_line() lets code that controls the 'callout' argument of Page.add_freetext_annot() pass four or more points into a fixed three-element stack array, corrupting the stack frame and potentially crashing the interpreter or achieving code execution in the process that imports the library. The flaw is present in PyMuPDF 1.25.3 up to but not including 2.0, and is fixed in the 2.0 release by an added count>3 bounds check that raises a 'bad seq of points' RuntimeError. The supplied CVSS 4.0 vector scores it 7.7, while the independent assessment rates it CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting that low privileges and a specific precondition (the hosting application must route untrusted data into the callout parameter) are required; there is no CISA KEV entry and no public exploit identified at time of analysis, though the upstream fix commit ships a regression test that reproduces the overflow with a 100-point callout.
Authenticated tenants who can write their Alertmanager configuration in Grafana Mimir or Grafana Enterprise Metrics (GEM) can read arbitrary files from the Alertmanager host and exfiltrate them to a server they control. The receiver validation that rejects local file references missed two HTTP client settings, http_headers.<name>.files and basic_auth.username_file, so a tenant can point them at any file the Alertmanager process can read; the contents are then placed in an outgoing request header when a notification fires. The issue is rated 7.7 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) with confidentiality-only impact, is fixed in Mimir 3.1.7 and 3.2.2 and in GEM 2.17.20, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Server-side request forgery in SUSE Rancher Manager's `/meta/proxy` endpoint allows an authenticated Rancher user without administrative privileges on the local cluster to make the Rancher server issue requests to hosts the destination allowlist is supposed to block, including internal services and, where IMDSv1 is enabled, the AWS instance metadata endpoint. The allowlist decision is evaluated in a place where it cannot prevent forwarding, so a rejected destination is logged but the request is still handed to the proxy transport; the attacker controls method, headers, body and query string and receives the response. Affected releases are 2.15.0 through 2.15.3, 2.14.0 through 2.14.7, 2.13.0 through 2.13.11, 2.12.0 through 2.12.15 and 2.11.0 through 2.11.19 (and potentially older EOL versions), rated CVSS 7.6 with a vuln.today decision label of this_week; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV).
Remote denial of service in Google Android 14 through 17, including Android 16-qpr2, is caused by a missing bounds check in ipphelper.c that permits a stack buffer overflow when crafted input reaches the IPP-helper parsing code. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction, but the supplied sources do not confirm whether the IPP listener or printing service must be active or exposed for an attacker to reach the flaw; impact is availability-only (A:H) with no code execution or data exposure. This is a moderate, this-week priority rather than an emergency: no public exploit identified at time of analysis, SSVC exploitation is none, and no CISA KEV entry is indicated in the supplied data.
An out-of-bounds write in MediaTek modem (baseband) firmware, tracked as CVE-2026-20549, lets an attacker who operates a rogue base station corrupt memory in the modem of a connected user equipment device, with the potential for remote privilege escalation and code execution in the modem context. The flaw is an improper input validation issue (CWE-787) reachable over the adjacent cellular radio interface (CVSS 7.5, AV:A/AC:H/PR:N/UI:N), affecting devices built on a long list of MediaTek chipsets that have not received patch MOLY01775865. The attacker must first induce the target device to attach to attacker-controlled radio infrastructure, and the CVSS high attack-complexity metric reflects that conditions beyond the attacker's direct control must align for the write to succeed; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation.
Escalation of privilege in MediaTek modem firmware affects a broad set of MediaTek chipsets, including the MT67xx, MT68xx, MT69xx, MT87xx and MT88xx families enumerated in EUVD-2026-115013, when a user equipment connects to a rogue base station controlled by an attacker. A crafted over-the-air message triggers an integer overflow and out-of-bounds write in the modem, allowing privilege escalation with no authentication (PR:N) and no user interaction (UI:N); the assessed vector is AV:A/AC:H, reflecting the need for radio proximity and successful attachment to attacker infrastructure. No KEV listing or EPSS score accompanies the CVE in the provided intelligence, and no public exploit has been identified at the time of analysis; SSVC records Exploitation: none and Automatable: no, and the independent assessment describes the risk signals as moderate and internally consistent.
An out-of-bounds write in MediaTek baseband/modem firmware (patch IDs MOLY01874018 and MOLY01774038) allows radio-adjacent attackers to corrupt modem memory and escalate privileges on Android devices running any of the affected MT-series chipsets. The attacker must operate a rogue base station and the target UE must actually connect or attach to it before a malformed modem message can reach the unchecked code path; once attached, no authentication and no user interaction are required, and the flaw yields high confidentiality, integrity and availability impact (CVSS 3.1 7.5, AV:A/AC:H/PR:N/UI:N). Exploitation is not confirmed in the wild, SSVC marks it non-automatable, and no public exploit or PoC has been identified at time of analysis, though the rogue-base-station priming technique itself is well established.
MediaTek modem firmware contains an out-of-bounds write that can be triggered when a user equipment connects to a rogue base station, allowing the attacker to escalate privileges on the affected device. The issue affects a broad set of MediaTek chipsets covered by the November 2026 vendor bulletin; no authentication or user interaction is required once the device attaches, but the attacker must be within radio proximity and operate rogue cellular infrastructure, so the attack is targeted rather than remotely scalable over the internet. No public exploit is identified at time of analysis, and SSVC records Exploitation: none; the vuln.today decision label is this_week.
An out-of-bounds write in MediaTek modem (baseband) firmware allows an attacker who operates a rogue base station to escalate privileges on a victim handset once the device attaches to that cell, with no authentication or user interaction required after attachment. The flaw is a missing bounds check on data handled across the baseband signaling path and affects a very broad set of MediaTek chipsets, including MT6765, MT6761, MT6768, MT6789, MT6833, MT6853, MT6877, MT6895, MT6983 and MT6991 among many others listed in EUVD-2026-115009. MediaTek has assigned Patch ID MOLY01857954 and published it in the November 2026 product security bulletin; no public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none and the issue as not automatable, and this is a genuine but conditional priority rather than a drop-everything emergency because the attacker must be within cellular radio range with rogue radio infrastructure.
An out-of-bounds write in MediaTek modem baseband firmware lets an attacker who operates a rogue base station escalate privileges on an affected device once the victim UE attaches to that cell, with no authentication and no user interaction required. The flaw affects a broad set of MediaTek MT6xxx/MT8xxx chipsets (including MT6897, MT6988, MT6991, MT6993, MT8678 and MT8755) and carries a 7.5 CVSS score, though the vector's AC:H and CISA SSVC's Automatable:no indicate that successful triggering depends on non-trivial conditions and targeted effort rather than opportunistic mass scanning. No public exploit code was identified at time of analysis and SSVC records Exploitation: none; MediaTek has published patch ID MOLY01877236 in its November 2026 product security bulletin, and the priority signal is 'this_week' rather than an emergency.
Out-of-bounds write in MediaTek modem firmware enables a rogue base station operator to escalate privileges on a connected user equipment (UE) without authentication or user interaction. The flaw (CWE-787, missing bounds check) affects a broad set of MediaTek chipsets and is fixed by patch MOLY01876662 in MediaTek's November 2026 security bulletin. Exploitation is conditional: the attacker must operate a malicious cell and hold the target's radio attachment, so SSVC marks it not automatable, and no public exploit has been identified at time of analysis.
Out-of-bounds reads and writes in psqlODBC before 18.00.0006 arise when a host application forwards untrusted column numbers or row indices into ODBC entry points such as SQLBindCol, SQLColAttribute and SQLSetPos(SQL_ADD), which the driver uses directly as array indices without validation. This is not a default-configuration remote condition: the limiting factor is that the calling application must itself relay attacker-controlled index values to these APIs, which is why the assessed vector carries high attack complexity (AC:H) and a low-privilege requirement (PR:L) alongside high confidentiality, integrity and availability impact. No public exploit identified at time of analysis; the vendor fix is psqlODBC 18.00.0006.
SQL injection in psqlODBC before 18.00.0006 allows an attacker who can influence a table or schema name passed by a host application to SQLSpecialColumns to execute arbitrary SQL with the privileges of the existing database connection. Only SQLSpecialColumns is affected because it fails to escape these identifiers, while the other catalog functions do escape them; applications that pass only trusted or hardcoded identifiers to that function are not exploitable. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, and no public exploit was identified at time of analysis.
A stack-based buffer overflow (CWE-121) in the psqlODBC driver, the official PostgreSQL ODBC driver, lets attacker-influenced SQL text corrupt the memory of any application that forwards it through the driver. Two triggers exist: a {fn ...} ODBC escape with more than 16 argument offsets overflows a fixed 16-entry stack array (and referencing an unsupplied argument copies uninitialized bytes into the query), while copying the body of a {d}, {t}, {ts}, or {escape} escape writes one byte past a 128-byte stack buffer. All versions before 18.00.0006 are affected; no public exploit code was identified at time of analysis, and exposure is confined to applications that pass raw, untrusted SQL text to the driver rather than parameterized queries.
Heap out-of-bounds write in the psqlODBC driver (CWE-787) affects all versions before 18.00.0006 and is reachable only when the UseDeclareFetch option is enabled. The driver sizes its row cache from the column count of a cursor's first result, then accepts a different column count from later FETCH replies; a PostgreSQL server that is not trusted under the current SSL settings can return extra columns and drive writes past the end of the heap allocation, with a keyset reply containing fewer columns than the key fields also causing an unsigned field-count underflow. Unauthenticated remote attackers can exploit this only from a malicious or impersonated backend position, requiring user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.5); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-released fix is 18.00.0006.
A heap buffer overflow in psqlODBC's large-object read path lets a malicious or man-in-the-middle PostgreSQL server overwrite adjacent memory in the client process with server-chosen bytes: the driver trusts the byte count in the loread reply and copies that many bytes into the application-supplied buffer without comparing it to the buffer size. All psqlODBC versions before 18.00.0006 are affected, and any application that fetches a large-object column triggers the vulnerable code path. Exploitation is conditional rather than opportunistic - the client must connect to a server it does not trust under its current SSL settings (for example with certificate verification disabled) or an attacker must hold a man-in-the-middle position, and the assessed vector (AC:H, UI:R, PR:N) reflects that a network position or rogue server plus a large-object fetch is required; no public exploit has been identified at time of analysis and the flaw is not in CISA KEV, so priority is patch-this-cycle rather than emergency response.
Remote unauthenticated denial of service in Nut/OS allows an attacker who can reach any listening TCP port to send a single TCP segment carrying an unknown TCP option with a zero length byte, causing an infinite loop in NutTcpInputOptions and hanging all TCP-based services until the device is rebooted. Releases up to and including Nut/OS 5.1 are affected; the flaw is availability-only, with no confidentiality or integrity impact and no code execution. No public exploit was identified at time of analysis, and CISA SSVC records exploitation as none, though the attack is automatable and the device must expose a reachable TCP service.
Unauthenticated SQL injection in Starnet Computer and Network Systems' Inventory Tracking Application (all builds through 2026-10-16) lets remote attackers reach the backend database and read data they should never see, rated CVSS 3.1 7.5 with confidentiality-only impact (C:H/I:N/A:N). Per the vector AV:N/AC:L/PR:N/UI:N, no credentials and no user interaction are required, so any internet- or network-exposed deployment on a default configuration is directly reachable. No public exploit code was identified at time of analysis and the CVE is not in CISA KEV; practical risk is dominated by deployment scarcity, since the product has a very small installed base and only exposed instances are realistically at risk (vuln.today priority: this_week).