A denial-of-service flaw in the HarmonyOS window module can degrade or disrupt availability on affected devices, scored 7.5 by the vendor as network-reachable (AV:N/AC:L/PR:N/UI:N) but availability-only (C:N/I:N/A:H). Huawei published the fix details across three separate October 2026 bulletins covering phones, wearables and laptops, so the exposed population spans multiple device classes running unpatched HarmonyOS builds. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and no EPSS score was supplied; the vuln.today priority label is 'this_week'. The exact protocol and input needed to trigger the crash are not described in the available sources, and the AV:N assignment for a UI/display subsystem component should be verified against the bulletin before treating remote exposure as confirmed.
MediaTek modem firmware contains an out-of-bounds write that can be triggered when a user equipment (UE) attaches to a rogue base station controlled by the attacker, enabling remote privilege escalation without additional execution privileges and without user interaction. The flaw affects numerous MediaTek chipsets running firmware prior to the November 2026 patch (MOLY01338165; MSV-9660). Exploitation requires radio-proximity access and a high-complexity rogue base station setup; no public exploit has been identified at time of analysis.
Privilege escalation in MediaTek modem firmware is possible when a user equipment connects to a rogue base station, where an out-of-bounds write lets an attacker corrupt memory and gain elevated execution on devices built on a broad range of MediaTek chipsets. Exploitation requires the attacker to operate malicious cellular radio infrastructure within range and induce the target to attach; once that precondition is met, no authentication or user interaction is required. No public exploit has been identified at the time of analysis, and CISA SSVC records exploitation as none with automatable set to no, supporting a serious-but-not-emergency priority.
Denial of service in OpenAirInterface CN5G AMF v2.2.1 allows a remote, unauthenticated attacker to crash the AMF process by sending a crafted NAS Registration Request containing a malformed IMEISV in the 5GS Mobile Identity IE. The root cause is an integer truncation (CWE-197) in the NAS decoder: Type6NasIe::Validate() truncates a 32-bit length to 16 bits, bypassing length validation and causing an out-of-bounds heap read in DecodeImeisv(). CVSS 3.1 is 7.5 with availability-only impact; delivery requires NAS/N1 signaling access, normally through a gNB or the N2 reference point, so exposure is not equivalent to an internet-facing service. No CISA KEV listing or confirmed active exploitation is reported; a public gist reference exists but is not verified as working exploit code.
Unauthenticated remote denial of service in Kamailio 6.1.3 and 6.1.4: a crafted SIP REGISTER request carrying an oversized host field in the Via header is copied into a fixed 46-byte stack buffer by w_rx_aar_register() in the ims_qos_npn module, corrupting the stack and terminating the affected instance. Exposure is not universal - the ims_qos_npn module must be loaded and routing must actually invoke w_rx_aar_register() on incoming REGISTERs, which in practice means IMS/VoLTE QoS deployments rather than a default SIP proxy; for those systems the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H only) means any remote sender can trigger the crash with no credentials or user interaction. The issue is not in CISA KEV; a public gist linked from the CVE record is a possible PoC reference that is not verified as working exploit code, and priority per vuln.today is remediation this week rather than emergency response.
A stack-based buffer overflow in the OpenAirInterface CN5G UDM (v2.2.1) lets an unauthenticated network attacker who can reach the Service-Based Interface and supply a valid SUPI crash the UDM process by sending an oversized hex string in resynchronizationInfo.rand or auts to the Nudm_UEAU Generate Authentication Data endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N, A:H) rates this 7.5, but real-world exposure is constrained: the SBI is normally an internal, segmented network between 5G core functions rather than an internet-facing surface, and the demonstrated outcome is stack-canary corruption leading to process termination, not code execution. No CISA KEV entry exists; a public gist reference is linked in the advisory data, but it is not verified as working exploit code, so treat this as a credible DoS bug with a potentially high blast radius for core-network availability rather than a confirmed actively exploited flaw.
Local privilege escalation in the Android kernel arises from a race condition that can corrupt memory in multiple kernel locations, letting an unprivileged local process gain elevated code execution (CWE-362, CVSS 7.4). Only devices running an Android kernel without the upstream fixes are affected; the attacker must already be running code on the device as an ordinary app or process, needs no additional execution privileges, and no user interaction is required. The race window is narrow and timing-dependent (AC:H), EPSS is low at 0.26% (18th percentile), no public exploit has been identified at time of analysis, and this is a genuine but non-emergency priority tracked for the current week rather than an emergency response.
Local privilege escalation in Android's protected KVM (pKVM) hypervisor, where a race condition in __pkvm_pages_to_ppages (mmu.c) can produce an out-of-bounds write and yield high confidentiality, integrity and availability impact at the hypervisor level. Only devices running pKVM - the protected KVM hypervisor present on newer ARM64 Android hardware - are exposed, and the attacker must already execute local code and win a timing-dependent race, which is captured by AC:H and materially limits reliability. No public exploit code has been identified at time of analysis, EPSS is low at 0.16% (5th percentile) and SSVC records no exploitation, making this a genuine but second-tier priority; the vendor fixes are referenced in AOSP kernel commits and the November 2026 Android Security Bulletin.
Local privilege escalation in the Android kernel's ARM LPAE IOMMU page-table code (arm_lpae_split_blk_unmap in io-pgtable-arm-common.c), where a race condition during block-unmap/split operations can corrupt memory. Any app that can execute code locally on an affected device can attempt the attack without elevated privileges or user interaction, though the race window must be won - SSVC rates the flaw non-automatable and EPSS is only 0.15%, so real-world exploitation is unreliable and device-dependent. No public exploit or active exploitation is confirmed (Exploitation: none per SSVC); the issue is addressed in the Android Security Bulletin dated 2026-11-01.
Privilege escalation in Rancher Manager's GlobalRole handling lets a non-administrative user who already holds delegated rights to manage management.cattle.io globalroles and globalrolebindings grant permissions in downstream clusters that exceed their own, because the inheritedNamespacedRules field escaped the escalation validation applied to other permission-carrying GlobalRole fields. Affected deployments are SUSE Rancher 2.15.x where the field exists (reported as 2.15.2, fixed in 2.15.3) and the bundled rancher-webhook 0.11.0 through 0.11.3 and 0.12.0 (fixed in 0.11.4 and 0.12.1); 2.14.x and earlier lack the field and are not affected. The prerequisite is a high-privilege delegated role rather than ordinary cluster access, and administrators gain no escalation, which limits the practical attacker population; no public exploit code is identified in the available data, and no KEV entry is noted.
The StageIt extension for Joomla (published by php-web-design.com) performs state-changing actions without adequate cross-site request forgery protection, so an attacker who can lure a logged-in Joomla user or administrator to a malicious page or crafted link can cause those actions to be executed with the victim's privileges. Versions 1.0 through 5.7.5 and 6.0 through 6.3.5 are affected, and the impact is rated high for both integrity and availability (CVSS 4.0 base 7.2; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), with no confidentiality impact. Exploitation requires an authenticated victim session and user interaction, the attacker needs no credentials, and no public exploit code or confirmed active exploitation is identified in the available sources; priority is triaged as remediation this week.
Persistent denial of service in Absolute Secure Access servers prior to 14.61 is reachable by an authenticated attacker who connects for the first time, where missing length validation can be abused to disrupt availability. The flaw requires valid low-privilege credentials (PR:L) and no victim interaction, and servers at 14.61 or later are fixed. No public exploit was identified at time of analysis, and this is assessed as a moderate-priority availability issue rather than a critical emergency.
Authenticated users of Absolute Secure Access servers running versions prior to 14.61 can supply improperly handled input that results in a persistent denial of service, leaving the service impaired beyond the initial request. The flaw is network-reachable at low complexity and requires no user interaction, but it does require a valid authenticated session (CVSS PR:L), so only accounts able to log in to the server can reach it. Absolute addresses the issue in 14.61; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Incorrect default permissions in Dell Alienware Command Center (AWCC) before version 6.14.54.0 allow a low-privileged local user to tamper with files or resources the component installs with overly permissive access controls, producing a high integrity impact and a lesser availability impact while leaving confidentiality untouched. Exploitation requires the product to be installed and the attacker to already hold a local account on the host; there is no network vector, and no user interaction is needed. The flaw is not confirmed as actively exploited (CISA KEV) and no public exploit was identified at time of analysis, so it warrants prioritized remediation on affected gaming endpoints rather than emergency response, with the vendor fix available as AWCC 6.14.54.0.
SQL injection in psqlODBC before 18.00.0006 can let an authenticated database user who can create a table that an application reads with an updatable cursor manipulate the driver's keyset and positioned SQL, including which rows a positioned UPDATE or DELETE affects. The flaw triggers when the table lacks OIDs, uses an auto-increment int4 column as the row identifier, and that column's server-reported name contains a double quote that the driver fails to escape. No public exploit identified at time of analysis; exploitation is conditional on the application using updatable cursors and performing positioned operations, and requires user interaction per the CVSS vector.
Camaleon CMS releases before 2.9.2 enforce only authentication, not authorization, on the Admin::MediaController endpoints that handle uploads, private file downloads, cropping and media actions, letting any logged-in user whose role lacks the media manager permission reach those functions by direct URL or POST. A low-privileged authenticated attacker can therefore store files via /admin/media/upload, read private media through download_private_file, and use crop with saved_avatar to alter other users' avatars, producing a high confidentiality impact with limited integrity impact. The vendor has released 2.9.2 with a centralized before_action check, so no public exploit code or active exploitation is indicated in the available data; the CVSS 4.0 base score is 7.1 and priority is this_week, reflecting a real but not emergency-grade issue given the authenticated-account prerequisite.
Authorization bypass in Chatify, the Laravel live-chat package (munafio/chatify), before version 1.6.4 lets any authenticated user subscribe to another user's private inbox channel. By POSTing to the package's Pusher authorization endpoint (/chat/auth) with an arbitrary channel name of the form private-chatify.<victim id> and a socket id, an attacker obtains a valid Pusher signature and receives the victim's incoming private messages and attachments in real time. The victim's user id is a sequential integer, so enumeration is trivial; the only prerequisite is a valid account on the target instance (PR:L, network reachable, no user interaction) and the impact is confidentiality-only, with no message injection or tampering. A vendor fix exists in 1.6.4; no public exploit code was identified at time of analysis, although a technical writeup of the bypass is publicly available, and the issue is rated for remediation this week.
This is a moderate-priority issue rather than an emergency: insufficient permission enforcement (CWE-264) in the event notification management module of Huawei HarmonyOS and EMUI allows an attacker who already holds a local foothold, such as an installed application, to reach notification-management functionality or data beyond what that app should be permitted to access, with low confidentiality impact and no integrity or availability impact in the assessed vector. The assessed CVSS score is CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, meaning the attack is local, requires user interaction, needs no privileges, and has high complexity because exploitation conditions are not fully attacker-controlled. No public exploit code has been identified and the CVE is not listed in CISA KEV; the only references are Huawei bulletin index pages that carry no per-CVE technical detail.
An out-of-bounds write in MediaTek modem firmware can be triggered when a user equipment (UE) attaches to a rogue base station and processes a malformed message, potentially giving the attacker privilege escalation on the device; the CVSS 3.1 score is 7.1 (AV:A/AC:H/PR:N/UI:R). Exploitation is constrained by the need to operate cellular radio infrastructure in adjacent range and to induce user interaction, and SSVC records exploitation as none and automatable as no. MediaTek has published a fix under Patch ID MOLY01911177 (issue MSV-10122) in its November 2026 bulletin; no public exploit was identified at time of analysis.
A use-after-free in the Linux kernel's core-dump teardown path lets a local, low-privileged user who can drive a multithreaded process into a core dump corrupt kernel memory by winning a narrow race in coredump_finish(). The function clears the parked thread's ->task entry and then calls wake_up_process() without holding a task reference or being inside an RCU read-side section, so a preemption between the store and the wakeup lets the thread exit and be freed, after which try_to_wake_up() acquires pi_lock in freed memory. Scoring is CVSS 3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.0); no public exploit code was identified at time of analysis, and the high attack complexity and local-only, low-privilege preconditions keep real-world risk below the base score, with a vuln.today priority of this_week.
Local use-after-free in the Linux kernel key-management subsystem: keyctl_describe_key() (KEYCTL_DESCRIBE) passes key->type->name into kasprintf() without holding key->sem, so the retained key reference pins the key but not the module that supplies its type. If a privileged module unload (the description cites af_rxrpc_exit() with AF_RXRPC built as a module, =m) retires the type and free_module() releases the name between the formatter's two allocation-separated passes, the second pass reads freed module storage and faults in string(). Affected are kernels whose key type is provided by a loadable module, where a local user holding at least View permission on such a key races a concurrent module unload; the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H, reflecting local-only, narrow-window exploitation that can crash the kernel and read stale kernel memory, but not a controllable write. No public exploit code or PoC reference and no CISA KEV entry were reported, and exploitation requires a privileged module unload the unprivileged attacker does not control, so this is not an internet-facing emergency - though the published stable-tree fixes should be picked up this week.
Out-of-bounds write in the Cortex-M module ports of Eclipse ThreadX 6.0.1 through 6.5.2.202603 lets a user-mode, memory-protected module thread escape its sandbox: the PendSV handler saves the preempted thread's callee-saved registers and EXC_RETURN value in privileged mode at addresses taken from the thread's process stack pointer without checking it against the thread's stack, so a module that places its stack pointer just above a writable region has up to nine words (25 with floating-point state) written below that region and read back on the next switch-in, and PendSV later branches in Handler mode to the reloaded EXC_RETURN slot. Exploitation is local only (CVSS:4.0 PR:L, assessed CVSS:3.1 PR:L with Scope Changed), requires a system using the Module Manager that loads a user-mode memory-protected module the attacker already controls, and leaves kernel-mode threads and systems without loadable memory-protected modules unaffected; no public exploit code was identified at the time of analysis and the issue is not in CISA KEV, with vendors shipping a fix in ThreadX 6.5.2.202603b.
Stack- and heap-based buffer overflows in libgphoto2 through 2.5.34's jl2005c_init() can corrupt memory and potentially permit code execution when a malicious USB device impersonates a Jeilin JL2005B/C/D camera. Exploitation requires physical attachment of the spoofed device; once enumerated by the jl2005c driver, a device-reported allocation-table entry count of 1022 or more overflows the local stack 'info' buffer and the heap priv->table buffer. The attack needs no authentication or user interaction beyond device enumeration, and the supplied data identifies upstream fixes but no confirmed active exploitation (CISA KEV) or verified working exploit code.
Path traversal in the AWS Serverless MCP Server (awslabs.aws-serverless-mcp-server) before v0.2.1 allows an actor who can influence the MCP agent's serverless project-name input to read the contents of JSON files outside the intended deployment status directory, because the deployment status component does not confine the resolved pathname to that directory. When the server is additionally run with the non-default --enable-write flag, the same input can create or overwrite JSON files outside the directory, clobbering existing files with serverless deployment metadata. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) reflects no privileges required but mandatory interaction, and no public exploit was identified at time of analysis; the vendor states there is no workaround and that upgrading to v0.2.1 is the fix.
Server-side request forgery in newspaper4k through 0.9.6 lets an unauthenticated remote attacker who can influence a page processed by an integrating application cause the Image Extractor to fetch image or meta-refresh URLs pointing at loopback, link-local, private, or internal hosts. The impact is limited to confidentiality - limited internal response content may be exposed - with no integrity or availability effect, and the supplied CVSS 4.0 score is 6.9. The vendor fixed the issue in 0.9.6.1; no public exploit identified at time of analysis.
Repository-internal file disclosure in Otter Wiki 2.20.1 through 2.26.1 lets anyone who can edit a wiki page read files stored inside the application's own repository - most critically .git/config, which frequently holds remote URLs with embedded credentials - by passing an absolute src (for example /.git/config) to the DataTable embedding, which resolves the path and renders the file contents as a table. Under the default configuration anonymous visitors can edit pages, so the CVSS vectors carry PR:N and no account is needed; instances that disable anonymous editing or restrict edit rights require a valid account with edit permission instead. Impact is bounded to reading repository-internal files (confidentiality only, no write or denial-of-service effect), scoring 6.9 under CVSS 4.0 and 5.3 under the assessed CVSS 3.1 vector; there is no CISA KEV listing and no public exploit identified at time of analysis, while a vendor fix is available in 2.26.2.
The Eclipse ThreadX Module Manager fails to enforce thread ownership in its thread-control dispatchers, so a loaded user-mode, memory-protected module can suspend, resume, terminate, reset, re-prioritise and abort the waits of application and other-module threads it does not own. The flaw affects ThreadX 6.0.1 through 6.5.2.202603 deployments that use the Module Manager with memory-protected modules; a malicious or compromised module can cause denial of service and manipulate scheduling, but gains no code execution or memory access. Exploitation requires local (on-device) control of an already-loaded memory-protected module, and the issue is fixed in ThreadX 6.5.2.202603b; no public exploit code has been identified at time of analysis.
Heap out-of-bounds write in L-SMASH through 2.14.5 lets a crafted MP4 or MOV file corrupt heap memory inside applications that use the library to demux media, typically ending in a crash. The flaw lives in the ISO-BMFF box parsers isom_read_hdlr() and isom_read_dref_entry() in core/read.c, which trust a declared hdlr or dref 'url ' box size larger than the bytes actually remaining in the stream, stalling the stream position and driving the write past the allocated buffer. The assessed vector is local (AV:L) with user interaction (UI:R), no authentication, no confidentiality impact, limited integrity impact and high availability impact (CVSS 3.1 6.9 equivalent); an upstream fix commit exists, but no tagged patched release or working exploit code has been independently confirmed, and the issue is not in CISA KEV.
Out-of-bounds write in rapidyaml (ryml) through 0.16.0 lets an attacker who can supply a YAML document containing consecutive or excessive anchors/tags overflow the parser's fixed two-element annotation array in ParseEngine::_add_annotation(), corrupting stack memory and crashing the host process in release builds. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, with VA:H and VI:L) means unauthenticated attackers at the local vector need only get an application to process the crafted document, and the assessed consequence is high availability impact with limited integrity effect rather than confidentiality loss. No CISA KEV entry exists and no public exploit code is confirmed at time of analysis, though a third-party technical writeup describing the parser annotation overflow is referenced; vuln.today priority is this_month, i.e. a moderate, non-emergency issue.
Improper access control in Outline before 1.12.0 leaves previously shared documents readable by unauthenticated users after the owner withdraws them: the public share loader in server/commands/shareLoader.ts retrieves the document through the 'withDrafts' scope and never enforces publishedAt IS NOT NULL, so an existing share link keeps serving the full text. Anyone holding the share URL can pull the withdrawn content through POST /api/shares.info, POST /api/documents.info with shareId, GET /s/<share-id> and GET /s/<share-id>.md without authentication, and while the document stays unpublished the shares.revoke endpoint returns 404 for both the share owner and workspace administrators, so the exposure cannot be closed through the normal UI. The vendor advisory includes a detailed public proof-of-concept walkthrough (not verified working exploit code); the issue was reported by VulnCheck and is fixed in 1.12.0 (commit d015a32459b5f5c5a8ef67aeb81742eeab430c52).
SQL injection in OwnTone Server through 29.3 lets remote attackers read arbitrary media library data through the MPD emulation listener on TCP port 6600. The mpd_sticker_find() handler interpolates the attacker-supplied URI argument directly into a SQLite LIKE filter, so a crafted 'sticker find song' command escapes the intended virtual-path restriction and enumerates every media file along with its filesystem path and metadata. No authentication or user interaction is required, but exploitation depends on the MPD listener being reachable - typically it is bound to a trusted home or LAN network rather than the public internet - and the impact is confined to information disclosure (integrity and availability are unaffected). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has published an upstream fix commit.
Heap memory exhaustion in QuickJS-NG versions before 0.16.0 lets JavaScript executed by an embedding host drain the process one BigInt allocation at a time: each Atomics.store() call on a BigInt64Array or BigUint64Array whose backing buffer is detached (ab.transfer()) or shrunk (ab.resize(0)) during value coercion leaks the converted BigInt instead of freeing it. An attacker able to run scripts inside a QuickJS-NG host - server-side script runners, plugin sandboxes, IoT firmware - can loop that pattern to cause denial of service in long-running processes; there is no confidentiality or integrity impact and no code execution. Vendor CVSS 4.0 is 6.9 with availability impact Low only, the priority label is 'this_month' rather than emergency, and no public exploit code or CISA KEV entry was identified at time of analysis; the fix ships in release 0.16.0.
Out-of-bounds read in Netpbm's tgatoppm converter allows a crafted color-mapped Targa file to crash the tool or leak adjacent memory into the output image. Affected builds are Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08; exploitation is local and requires the victim or an automated workflow to run tgatoppm on the malicious file. No public exploit identified at time of analysis, and a vendor patch is available; this is assessed as a moderate-priority issue, not an emergency.
Insufficient session expiration in the CloudClassroom-PHP-Project Global Session Handler (CWE-613) lets a session that should be terminated keep working after logout, so anyone already holding a live session identifier can continue to reach the associated account's data. Because the project ships on a rolling-release basis, no affected or fixed version numbers exist - the CPE is a wildcard covering all deployments - and the vendor did not respond to the disclosure. Impact is deliberately scoped: low confidentiality only (VC:L, no integrity or availability effect), remote but high complexity (AC:H), and a public proof-of-concept reference exists but is not verified as working exploit code; there is no KEV (CISA) entry and no confirmed active exploitation, and the reporter rates practical exploitability as difficult because a valid session token must be obtained first.
Network-AI's A2AServer fails open on authentication: the `secret` option is optional with no default and `startServer()` performs no fail-closed startup check, so an instance started without a secret accepts unauthenticated JSON-RPC `tasks/send`, `tasks/get` and `tasks/cancel` calls from anyone who can reach the listener. The npm package `network-ai` is affected through version 5.15.4 (vendor fix: 5.15.5); the default 127.0.0.1 bind limits exposure, but the A2A protocol is designed for inter-agent network communication, so operators who bind a reachable interface-or attackers using a co-located/container-network process or DNS rebinding against loopback-can submit attacker-controlled task text to the developer-supplied executor, read task results and cancel tasks. Rated moderate (CVSS 6.9, CWE-306), the issue is not in CISA KEV and no confirmed active exploitation exists, though the GitHub advisory publishes a curl-based proof-of-concept reference; the downstream impact beyond task records and executor output depends entirely on what the configured executor does with the supplied text.
Time-based blind SQL injection in Control Web Panel (CWP) releases prior to webpanel_version 1.30 allows an attacker who can reach an internal, loopback-bound API route - originally /user_panel_dashboard/, later /valid_token/ - to inject the 'user' parameter into a query executed against the oauth_clients table over a MySQL connection opened as root, then read arbitrary database contents by inferring data bit-by-bit. Because the route is bound to loopback rather than exposed publicly, reaching it requires local access to the server or an SSRF/relay primitive in another service; once that reachability exists, no authentication (PR:N) and no user interaction are required. The vendor changelog records a patch, and no public exploit was identified at time of analysis; the slow, inference-based extraction is the main reason this ranks as a this-month priority rather than an emergency despite a high confidentiality impact.
Code execution can be achieved in Dell OpenManage Enterprise versions prior to 4.8.0 by a high-privileged attacker with adjacent-network access who can exploit improper verification of cryptographic signatures. The CVSS 3.1 vector (AV:A/AC:H/PR:H) and CWE-347 indicate that exploitation requires high privileges, adjacent-network positioning, and high-complexity conditions; the 'Jwt Attack' tag suggests a forged or unverified JWT may be involved, but the exact signed object and trigger are not described in the available sources. This is a moderate-severity issue rather than a top-tier emergency, with no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis.
Android's USB service can be induced to enable USB data access while the device is in a strong-authentication-required state (for example a locked or post-boot locked device where USB data should remain restricted), because of a logic error in onStrongAuthRequiredChanged within UsbService.java. The result is a physical privilege escalation: an attacker with the device in hand and a USB connection gains access to data that should have been blocked, with no authentication and no user interaction. It is rated 6.8 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), affecting Android 15, 16, 16-qpr2 and 17 per the November 2026 Android security bulletin; no public exploit is identified in the available data and CISA's SSVC assessment records exploitation as none and automatable as no, so realistic risk is confined to device-theft, evil-maid and forensic-extraction scenarios rather than remote or scalable attack.
A permission bypass in Google Android 14, 15, 16, 16-qpr2 and 17 allows an attacker with physical access to the device to escalate privileges, with no authentication or user interaction required once that physical contact is achieved. Severity is moderate (CVSS 6.8, CWE-693 protection mechanism failure), and the practical exposure is confined to lost, stolen, seized or unattended-device scenarios rather than remote attacks. No public exploit is identified in the available data and EPSS is very low (0.13%, 3rd percentile); the Android security bulletin of 2026-11-01 is the reference, and no fixed version is listed in the supplied evidence.
Format-string handling in psqlODBC before 18.00.0006 can crash applications or disclose client memory when an updatable cursor reads a table without OIDs that has an auto-increment int4 column whose server-reported name contains printf directives. The driver uses that column name as a format string while building the WHERE clause for positioned SELECT, UPDATE, and DELETE statements; exploitation requires a server not trusted under current SSL settings or a database user able to create a table the application reads, plus the non-default cursor/table/column alignment. This is a moderate, not emergency, priority, and no public exploit was identified at time of analysis; the assessed vector is AV:N/AC:H/PR:N/UI:R with high confidentiality and availability impact.
Eclipse ThreadX 6.0.1 through 6.5.2.202603 can be left with its Module Manager permanently deadlocked: when a module preamble declares a data size or a start/stop/callback stack size that overflows the allocation arithmetic, the loaders return TXM_MODULE_MATH_OVERFLOW without releasing the Module Manager mutex, so every later module load, start, stop or unload from any other thread blocks until the system is reset. Affected are systems that actually use the Module Manager and load images through txm_module_manager_in_place_load(), txm_module_manager_memory_load(), txm_module_manager_absolute_load(), txm_module_manager_absolute_load_extended() or txm_module_manager_file_load(); the vector is local with PR:L (CVSS-B 6.8), so the actor must be able to supply a crafted module image. Impact is availability-only - no out-of-bounds read or write occurs and confidentiality and integrity are unaffected - and no public exploit has been identified at time of analysis; the vendor released a fix in 6.5.2.202603b.
Denial of service in the Kvazaar HEVC command-line encoder through 2.3.2 lets an attacker hang the encoder by supplying a crafted .y4m input whose header is truncated and lacks the terminating newline (0x0A); getc() then returns EOF without being checked, so the parse loop in read_header() never makes progress and the process spins indefinitely on a full CPU core. The flaw is local in nature - it requires an operator to run the encoder on attacker-supplied input (UI:P), needs no privileges (PR:N), and produces no confidentiality or integrity impact, only high availability impact. A public PoC reference exists in the form of a published writeup; it is not verified as working exploit code, and there is no KEV confirmation of active exploitation. The only complete fix per the available evidence is updating to code containing the upstream parser rewrite.
Denial of service in The Sleuth Kit through 4.15.0 occurs when a crafted HFS+ image containing an LZVN inline com.apple.decmpfs attribute with a huge uncompressed_size value is parsed, causing an allocation failure and a NULL pointer write in decmpfs_decompress_lzvn_attr(). The flaw affects forensic analysts and automated pipelines that load untrusted HFS+ images; it is a local, user-assisted crash-only issue with no code execution or data compromise. No CISA KEV entry is present and no public exploit identified at time of analysis.
MediaTek's Download Agent (DA), the bootloader/flash-mode download component present on a broad set of MediaTek chipsets, contains an out-of-bounds write that allows an attacker with physical access to the device to escalate privileges, with no credentials, no additional execution privileges and no user interaction required once that physical access exists. The affected scope covers the chipsets enumerated in the EUVD list, including MT6983, MT6985, MT6989, MT6990 and MT6991. Exploitation is not automatable, no public exploit has been identified at time of analysis, and the fix is referenced by Patch ID ALPS11468968 in MediaTek's November 2026 product security bulletin.
Local privilege escalation in Google Android 17 (addressed through the Wear OS security bulletin dated 2026-11-01) is caused by an out-of-bounds write in is_valid_header() in timed_cache_item.c, where a missing bounds check allows memory beyond the intended buffer to be overwritten. Exploitation is local only (CVSS AV:L) and requires the attacker to already hold System execution privileges (PR:H), with no user interaction needed, so the flaw is a post-compromise consolidation primitive rather than an initial-access vector. EPSS is 0.15% (4th percentile), no public exploit has been identified at time of analysis, and the CVE is not in CISA KEV; vuln.today classifies it as this_month priority.
Improper quoting of shell variables in konflux-ci deployment scripts allows unintended command substitution, so crafted arguments can run arbitrary commands with the privileges of the deployment runner. The exposure is local and requires high privileges (CVSS:3.1/AV:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 6.7): an attacker must already be able to supply arguments to the affected scripts inside the deployment context, and impact is bounded by the runner's own permissions. No public exploit code has been identified at time of analysis, and this is not a remotely or unauthenticated exploitable issue.
Elevation of privilege in Dell Alienware Command Center (AWCC) releases prior to 6.14.54.0 lets a local, non-administrative user gain higher-integrity execution on the host, with the vendor advisory also citing arbitrary code execution and denial of service as possible outcomes. Dell scores this at CVSS 6.7 with a local attack vector, high attack complexity, low privileges required and user interaction (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H), so an attacker must already hold a foothold on the machine and must induce the user to do something before the least-privilege weakness (CWE-272) can be exercised. No public exploit code or in-the-wild exploitation has been identified at time of analysis, and the vendor recommends updating to AWCC 6.14.54.0 per DSA-2026-429.
Dell OpenManage Enterprise versions prior to 4.8.0 fail to properly verify cryptographic signatures, which can let an attacker who already holds high-privileged local access on the appliance gain filesystem access. The CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N) means exploitation requires pre-existing administrative privileges on the host and carries high attack complexity; the trigger mechanism and the specific feature or token involved are not described in the available sources, though the issue is tagged as a JWT-related signature attack. There is no public exploit identified at time of analysis and no CISA KEV listing, and effective remediation is available in OpenManage Enterprise 4.8.0 per Dell advisory DSA-2026-467.
Local privilege escalation in the Modem component of a broad range of MediaTek chipsets lets a process that already holds the System privilege bypass permission assignments and gain higher-level capabilities (C:H/I:H/A:H). The CVSS 3.1 score of 6.7 with vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H is honest about the main constraint: exploitation is local and requires the attacker to have already obtained System privilege, so this is a second-stage escalation rather than a remotely reachable entry point, and no user interaction is needed. Affected silicon spans the MT27xx, MT68xx, MT69xx, MT86xx, MT87xx and MT88xx families listed in MediaTek's November 2026 product security bulletin; no public exploit was identified at time of analysis and KEV/EPSS signals were not provided.
Out-of-bounds write in the MediaTek Modem component lets a local attacker who already holds System privilege escalate further on affected MediaTek chipsets. The missing bounds check (CWE-787) can corrupt memory and produce high confidentiality, integrity, and availability impact, but only after a high-privileged local foothold and with no user interaction. No public exploit was identified at time of analysis, and MediaTek tracks the fix as Patch ID MOLY01320076 in its November 2026 product security bulletin.