Stored cross-site scripting in CloudClassroom-PHP-Project's manageassessment2.php allows remote unauthenticated attackers to supply crafted ExamName or Q1-Q5 values that execute script in a victim's browser when the page is viewed, with the CVSS 4.0 vector requiring user interaction. The issue is low severity (CVSS 2.1) and the supplied priority label is monitor; a public PoC reference exists, but it is not verified as working exploit code, and no KEV confirmation is present in the supplied intelligence.
Cross-site scripting in CloudClassroom-PHP-Project's updatedetailsfromfaculty.php allows remote attackers to manipulate the fname argument and inject script that executes when a victim loads the page where the value is rendered. The referenced advisory describes a stored-XSS condition, and a public PoC reference exists; it is not verified as working exploit code. No CISA KEV confirmation or EPSS score was supplied, and the assessed severity is low, with exploitation requiring user interaction and possible authentication ambiguity at the faculty detail-update endpoint.
Path traversal in deepset-ai FARM through 0.8.0 allows unauthenticated remote attackers to influence the vocab_filename argument of EmbeddingTokenizer.from_pretrained and read files outside the intended vocabulary location, with limited confidentiality impact and no integrity or availability effect; user interaction is required per the assessed vector. Exploitation depends on a host application passing attacker-influenceable input into vocab_filename, and a public PoC reference exists; it is not verified as working exploit code. The vendor did not respond, the project is unmaintained, and no vendor-released patch was identified.
Path traversal in the Knip developer CLI (Webpro-nl, versions up to and including 6.44.0) allows a crafted 'workspaces' value in a project's Knip configuration to escape the intended directory when the autofix writeFile routine in IssueFixer.ts is executed, overwriting or deleting files outside the project tree. The issue is rated 5.3 MEDIUM under CVSS 4.0 (CWE-22); exploitation is not passive, it requires a victim to run the autofix/IssueFixer path against a project whose configuration or repository content is attacker-influenced, making this a developer-workstation and supply-chain exposure rather than a service-facing remote flaw. No confirmed active exploitation (CISA KEV) is recorded, but a public PoC reference exists; it is not verified as working exploit code. The vendor was contacted about the disclosure and did not respond.
Warracker releases up to and including 1.0.3 mishandle authorization in their Paperless-ngx integration, letting any signed-in non-administrative user who owns at least one warranty link another user's private Paperless document to their own warranty and then download it, because the presence of a document ID on a warranty is treated as proof of ownership. Exploitation requires the optional Paperless-ngx integration to be enabled with a shared API token that can read the target document, and affects confidentiality only (private receipts, invoices and similar records) with no integrity or availability impact assessed. The vendor has fixed the flaw in 1.0.4; a public proof-of-concept walkthrough exists in the GHSA advisory, but it was validated against synthetic records and a mocked Paperless-ngx API rather than a live deployment, so it is not verified as working exploit code, and the issue is rated for this-month remediation rather than emergency action.
MoviePilot through 3.1.2 deserializes untrusted Python pickle data when restoring saved workflow execution context, and the workflow fork endpoint copied an attacker-supplied 'context' field from shared workflow payloads straight into that stored context, so a crafted shared workflow can trigger code execution on the instance that forks or later runs it. Exploitation requires an authenticated account with access to the Workflow feature (CVSS 4.0 PR:H in the supplied vector; the independently assessed 3.1 vector scores PR:L) and depends on the legacy Base64 pickle 'content' format being loaded by WorkflowExecutor.restore_context. A public PoC reference exists; it is not verified as working exploit code, no confirmed active exploitation (CISA KEV) has been reported, and the vendor has fixed the issue in 3.1.3.
A local race condition in Android's DevicePolicyManagerService removeUserData routine can cause denial of service; this is a moderate-severity, low-priority local availability issue, not an urgent remote threat. It affects Android 14, 15, 16, 16-qpr2, and 17, and requires an app or process already running at ordinary application privilege level, with no user interaction. No public exploit was identified at time of analysis, and EPSS is 0.11% (percentile 1%).
Information disclosure in EchoHS GeekezBrowser through 1.8.0 lets any local process that can reach the application's localhost Public API read the /api/status response, because that endpoint served data without an authorization check and with a wildcard CORS origin. The exposure is local rather than remote, the leaked data is low sensitivity, and there is no integrity or availability impact, which keeps this at a low-to-moderate severity (CVSS 4.0 base 4.8). A public PoC reference exists in the project's GitHub issue tracker but is not verified as working exploit code; no CISA KEV listing was supplied, and the vendor has released 1.8.1 with a fix.
A stack-based buffer overflow in psqlODBC, the PostgreSQL ODBC driver, affects all releases before 18.00.0006 when updatable cursors are used - and they are enabled by default. The driver copies the server-supplied ctid (and oid, for tables with OIDs) value into a fixed 32-byte stack buffer using the server-declared length without validating it against the buffer size, so a value of 32 bytes or more overwrites adjacent stack memory; builds compiled with _FORTIFY_SOURCE abort instead. Reaching the flaw needs a specific attacker position: either a PostgreSQL server the client does not trust under its current SSL/TLS settings (malicious or man-in-the-middle server) or a database user able to create a view with its own column named ctid that the application then reads through an updatable cursor; the assessed vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this medium severity with availability-only impact, and no public exploit or active exploitation has been reported.
Stack buffer over-write in psqlODBC before 18.00.0006 can corrupt an application process that forwards attacker-influenced SQL text to the driver. A schema or table identifier longer than the 128-byte stack buffer can cause up to two bytes past the buffer (a double quote and NUL) via a parsed statement's table name or the last INSERT target during SELECT @@IDENTITY rewriting, and a malicious or compromised PostgreSQL server can add a one-byte over-write through an overlong column name in that rewrite. CVSS 3.1 scores this 5.9 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H), exploitation requires the application to expose untrusted identifiers, the supplied priority label is this_month for normal-cycle patching, and the supplied data shows no CISA KEV confirmation or public exploit reference; no public exploit identified at time of analysis.
Client-side crash and limited out-of-bounds read affect psqlODBC before 18.00.0006 when the driver connects to a PostgreSQL server that is not trusted under its current SSL settings and the server returns malformed counts or lengths. The flaws are in SQLBulkOperations, SQLStatistics, and bytea octal decoding, and exploitation requires the user or application to initiate the connection to an attacker-controlled or spoofed server. No public exploit was identified at time of analysis, and the vendor has released psqlODBC 18.00.0006 as the fixed version.
Denial of service in Fastify 5.8.0 through 5.12.7 can terminate the Node.js process when a server uses a nonzero handlerTimeout and a streaming route stays open past that timeout. An unauthenticated remote client can trigger the crash with a single request to an affected streaming endpoint, interrupting other in-flight requests; the default handlerTimeout of 0 is not affected, and no public exploit code was identified at time of analysis. This is a moderate, conditional availability issue because the vulnerable configuration is not the default, and it is fixed in Fastify 5.12.8.
Denial of service in @fastify/multipart 5.3.0 through 10.1.6 allows an unauthenticated remote client to hang upload requests when an application handler performs asynchronous work before consuming a file stream. Malformed multipart bodies that end inside a file part without a closing boundary cause the plugin to destroy the in-progress stream without an error, leaving delayed consumers such as pipeline() or toBuffer() waiting indefinitely and keeping connections open; repeated requests can exhaust server resources. This is availability-only and conditional on the delayed-consumer pattern, with no public exploit identified at time of analysis and a vendor fix in 10.1.7.
@fastify/http-proxy 11.6.0 through 11.6.2 lets an unauthenticated remote attacker reach upstream resources outside the intended proxy prefix by sending a path that hides its backslash dot-segments behind percent-encoding (for example /pub/%5C..%5Csecret), which the plugin's destination validator lets through and the upstream, if it decodes %5C and treats backslash as a path separator, resolves to a sibling location. Impact is confidentiality only (C:H, I:N, A:N) and highly conditional, which is why CVSS 3.1 scores it 5.9 with AC:H: the escape only happens against an upstream whose path handling treats a decoded backslash as a separator, the advisory's canonical case being a Windows host serving static files, and the flaw is moot wherever prefix/rewritePrefix is not relied on as a confidentiality boundary. There is no public exploit identified at time of analysis and no KEV listing, and the vendor-released fix is version 11.6.3; the CNA is the OpenJS Foundation and priority is this_month rather than emergency response.
An out-of-bounds read in the peripheral module of Huawei HarmonyOS lets an attacker who can already execute code locally on the device read past the end of an allocated buffer, exposing limited adjacent memory contents. The assessed impact is confidentiality-only (low), with no integrity or availability effect; the vector is local (AV:L) with no privileges (PR:N) and no user interaction (UI:N) required once an application is running on the device, so the local-access precondition is the main barrier. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, which is consistent with the 'this_month' prioritization rather than an emergency response.
Use-after-free in the Huawei HarmonyOS location service module can be triggered by an unauthenticated local attacker able to run code on the device, with no user interaction required. Successful exploitation may corrupt memory and affect availability, with low confidentiality, integrity and availability impact per the assessed CVSS vector. No public exploit code or confirmed active exploitation was identified at time of analysis, and the available signals place it at moderate severity with this-month remediation priority.
A race condition (CWE-362) in the Huawei HarmonyOS location service module lets a local, low-privileged user or app disrupt the service, with the assessed impact limited to availability rather than confidentiality or integrity. The flaw is only reachable with local access to the device (AV:L) and depends on winning a timing window (assessed AC:H), so it is not remotely exploitable and successful triggering requires persistence or repeated attempts. No public exploit code has been identified and the issue is not in CISA KEV; Huawei has published October 2026 consumer, wearable and laptop security bulletins that should be consulted for fixed builds, although specific affected and fixed HarmonyOS versions are not enumerated in the available data.
Improper authorization in the custom URL scheme handler of Dell Alienware Command Center (versions up to and including 6.14.20.0) allows a remote, unauthenticated attacker to abuse the registered handler to reach command execution, launch phishing content, and carry out remote execution - but only if the victim actively opens a crafted link. Dell rates the issue CVSS 5.8 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L): no credentials are needed, yet mandatory user interaction and additional conditions beyond a single request sharply constrain practical exploitation. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the vendor's priority guidance places remediation in the this-month window rather than immediate action.
This is a moderate, not emergency, priority: an out-of-bounds read in libaec through 1.1.7 (m_se_decode() in src/decode.c) lets a crafted CCSDS 121.0 / SZIP stream crash the decoder and potentially leak adjacent memory into decoded samples. The flaw is only reachable when an application built on libaec decodes attacker-supplied data that selects Second Extension coding and whose first fundamental sequence is longer than 2^31 zero bits, which wraps a signed index negative and defeats the bounds check; the vector is local with the victim feeding untrusted input to the decoder (UI:P / AT:P), and no authentication to the library is involved (PR:N). An upstream fix exists in PR #66, but a tagged patched release is not independently confirmed; there is no CISA KEV entry and no public exploit code confirmed at time of analysis, though a public technical writeup of the signedness issue is referenced.
Information disclosure in WSO2 Identity Server's Keystore REST API lets remote attackers learn the server-side file paths of certificate files by sending a request whose content-type header the component fails to validate. The affected code spans the Keystore REST API commons and v1 modules, and the same component ships in WSO2 Identity Server, Identity Server as Key Manager and Open Banking IAM. The exposure is limited to path strings rather than certificate contents, private keys or credentials, and no public exploit has been identified at time of analysis; the vendor rated it 5.8 with Scope:Changed, while the independent assessment treats scope as unchanged and scores confidentiality-only, low impact.
Path traversal (CWE-22) in Dell OpenManage Enterprise versions prior to 4.8.0 allows a low-privileged attacker positioned on an adjacent network to supply a crafted pathname and reach files outside the intended restricted directory, resulting in high-confidentiality information exposure with no integrity or availability impact. The vendor advisory DSA-2026-467 rates the issue CVSS 5.7 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting that exploitation requires both adjacency to the console and a valid low-privilege account rather than open-internet reachability. No public exploit code was identified at time of analysis, and the vulnerability is not confirmed as actively exploited (no CISA KEV listing); priority is assessed as this_month rather than emergency.
Denial of service in Huawei HarmonyOS lets an attacker who shares an adjacent network with a target device and holds low-level privileges exhaust resources in the DSoftBus (distributed soft bus) module, degrading availability of the device. Phones, Vision devices and wearables running affected HarmonyOS builds are addressed by three separate Huawei consumer bulletins dated October 2026 (listed under References). Severity is moderate and availability-only (CVSS 5.7, AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, CWE-400); no public exploit identified at time of analysis and no CISA KEV entry, which places this at a this-month remediation priority rather than an emergency.
Incorrect permission assignment on a critical resource in Dell OpenManage Enterprise versions prior to 4.8.0 allows an attacker who already holds low-privilege local access to bypass an intended protection mechanism and read information they should not be able to reach. The flaw is confidentiality-only (no integrity or availability impact) and is scored 5.5; it cannot be triggered remotely or without credentials, since the assessed vector requires local access (AV:L) and low privileges (PR:L). There is no CISA KEV listing and no public exploit code identified at time of analysis, and Dell addresses the issue with the 4.8.0 release described in advisory DSA-2026-467.
Dell OpenManage Enterprise versions prior to 4.8.0 ship with an incorrect permission assignment on a critical resource (CWE-732), allowing a low-privileged local user to bypass a protection mechanism and read data they should not be able to reach. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (5.5), so exploitation requires local access to the host plus existing low-privileged credentials, and the result is a confidentiality impact only - no integrity or availability effect and no scope change. No public exploit code and no confirmed active exploitation were identified at time of analysis; this is a moderate-severity, local-access issue that should be patched on a normal cycle rather than treated as an emergency.
Improper permission enforcement in the Bluetooth module of Huawei HarmonyOS and EMUI allows a local attacker to cause a high availability impact after user interaction, rated CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). The flaw is confined to Huawei's device operating systems and offers no confidentiality or integrity impact; no public exploit identified at time of analysis and no CISA KEV entry. Huawei's October 2026 consumer security bulletins are the reference advisories.
Local information disclosure in Huawei HarmonyOS allows an attacker with code already running under low privileges to reach the WLAN module and expose sensitive data. Exploitation requires local access to the device and low-level privileges (PR:L), with no user interaction; confidentiality impact is high, while integrity and availability are unaffected. No public exploit was identified at time of analysis, and active exploitation is not confirmed (not listed in CISA KEV); Huawei consumer bulletins cover phones, vision products, wearables, and laptops.
Local denial of service in the GNSS (location) component of MediaTek chipsets MT6990, MT6980D, MT2737, MT6982, MT6988, MT6986 and MT6813 stems from a missing bounds check that permits an out-of-bounds write, carrying an assessed CVSS of 5.5 with availability-only impact. Exploitation requires local access to the device plus user interaction (AV:L/UI:R) and yields no additional execution privileges, no code execution and no data exposure; no public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as none. MediaTek has released patch ALPS11309305 under issue ID MSV-10730 in its November 2026 product security bulletin.
Missing authentication in the VPN Client List Handler of WAVLINK WN536AX6-A firmware V260507_2.0.0 lets remote attackers manipulate the 'opt' argument in /bin/ioos to disclose VPN client information without credentials. The disclosure states the exploit is now public and references a GitHub write-up, but no CISA KEV entry is indicated; the issue is confidentiality-only and moderate priority because the management service is typically LAN-facing unless remote management is enabled.
An out-of-bounds read in Android's Vorbis codebook decoder (decode_packed_entry_number in codebook.c) lets remote, unauthenticated attackers leak limited memory contents by having the device process a crafted audio stream, with no user interaction required per the vendor CVSS vector. Impact is confined to low-confidentiality information disclosure on Android 14 through 17, with no integrity or availability effect and no code execution. No public exploit has been identified at time of analysis; EPSS is low at 0.17% (6th percentile) and there is no CISA KEV listing, so this is a moderate, patch-cycle issue rather than an emergency.
An out-of-bounds read in the Android software APV (Advanced Professional Video) decoder implemented in C2SoftApvDec.cpp lets remote attackers disclose limited device memory by getting a crafted APV stream decoded on the device. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) requires no privileges and no user interaction, although the attacker must still place the malicious media in front of that decoder through a messaging, web, or media-app path. Impact is confined to confidentiality (C:L) with no integrity or availability effect; Android 16, Android 16-QPR2, and Android 17 are listed as affected, EPSS is low at 0.17% (6th percentile), and no public exploit has been identified at time of analysis.
psqlODBC before 18.00.0006 on Unix-like systems can expose query text and data to other local users when logging is enabled, because log files are created in /tmp with predictable names and default permissions. A local authenticated attacker can read a victim's logs or pre-place a symbolic link at the predictable path so the driver appends log data to an attacker-chosen file with the victim's privileges. Exploitation requires logging to be explicitly enabled and a separate local account on the same host; no public exploit identified at time of analysis, and the issue is assessed as moderate rather than urgent.
DJ-Classifieds before 3.11.3 exposes seller contact details and draft ad content to any logged-in user through an insecure direct object reference in the duplicate-my-ad feature. An authenticated user of any role can supply another advert's small sequential numeric ID to the new-ad form and receive that ad's full content, including phone number, address, email, and price, even if the ad was never published, blocked, or still pending. No public exploit was identified at time of analysis, and the assessed impact is confidentiality-only with a moderate CVSS score of 5.3.
Stored cross-site scripting in Otter Wiki before 2.26.2 lets anyone able to edit a page - including anonymous users under the default configuration - persist HTML and script inside a ```math fenced code block that the renderer emits without escaping, so the payload executes in the browser of every viewer who opens the poisoned page. Successful exploitation requires the victim to view the page (passive user interaction) and grants script execution in the wiki's origin in a scope-changed context, with low confidentiality and integrity impact on the viewer's session rather than on the server. This is a genuine but moderate-priority issue, not an emergency: no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, with a vendor fix released in 2.26.2.
Outline workspaces running versions before 1.12.0 let any authenticated workspace member - including read-only members with no membership in the target collection - publish attacker-supplied documents into private collections, enabling content injection such as phishing links or misleading policy text placed inside trusted confidential spaces. The bypass uses documents.unpublish with detach:true to strip a draft's collection while retaining its parentDocumentId, then documents.update with publish:true and the private collection's UUID; the retained parent link satisfies the authorization check instead of the destination collection's createDocument policy, whereas a detached draft without a parent is correctly rejected with 403. Impact is integrity-only - the injected document appears in listings for legitimate collection members, but the attacker gains no read access to the collection. Severity is medium (CVSS 4.0 base 5.3; independent assessment CVSS 3.1 5.3, C:N/I:L/A:N); the upstream advisory contains a documented proof-of-concept reproduction (a public PoC reference) and there is no CISA KEV entry confirming active exploitation.
Improper authorization in LaraDashboard 1.4.0 through 1.4.8 lets an authenticated user holding only the read-only email_template.view permission send arbitrary HTML email through the MCP send-email tool. Authenticated low-privilege users (or holders of an MCP token minted while that permission was present) can mint a token and POST attacker-chosen sender, recipient, subject and raw HTML body to /mcp/send-email, turning the application's mailer into a phishing or spam relay that abuses the site's sending reputation; the assessed impact is a limited integrity violation, with no confidentiality or availability impact. The vendor fixed the permission check in v1.4.9 (the tool now requires email_template.edit), and the GHSA includes a public proof-of-concept script that has not been independently verified as working exploit code; no confirmed active exploitation (CISA KEV) or public exploit tooling is indicated at time of analysis.
Category-management authorization bypass in Camaleon CMS before 2.9.2 lets an authenticated low-privileged user rename or delete categories belonging to a different post type by pairing their own authorized post_type_id with an arbitrary category ID in update or destroy requests. The flaw is an insecure direct object reference (CWE-639) in Admin::CategoriesController with medium severity impact limited to integrity and availability of category objects; it does not disclose data or enable code execution. Vendor-released patch 2.9.2 is available, and no public exploit code was identified at time of analysis.
MrDoc through 1.1.1 allows any authenticated user to read other users' private document templates by submitting sequential doctemp_id values to the get_doctemp view, whose database lookup lacks an owner constraint. The flaw is a CWE-639 object-level authorization bypass affecting confidentiality only (CVSS 4.0 score 5.3, PR:L); template contents can be read but not modified or deleted. No public exploit code was identified at time of analysis, and an upstream vendor fix commit is available.
Reflected cross-site scripting in the StageIt extension for Joomla (php-web-design.com) affects versions 1.0 through 5.7.5 and 6.0 through 6.3.5, allowing an unauthenticated remote attacker to have script execute in a victim's browser when the victim loads a crafted URL; the issue is rated CVSS 5.3 (moderate). Exploitation requires user interaction (UI:P) and impact is limited to the victim's browser session, and no public exploit or CISA KEV entry is identified at time of analysis; the vuln.today decision label is this_month.
An out-of-bounds read in MediaTek's modem ip_stack can crash the modem and cause denial of service on devices built with affected MediaTek chipsets (including MT6897, MT6989, MT6991 and MT6983) when the victim UE connects to an attacker-controlled rogue base station. Exploitation requires radio proximity and successful over-the-air attachment, but no authentication or user interaction once attached; impact is assessed as availability-only (C:N/I:N/A:H). No public exploit code was identified at time of analysis, and the CVSS 5.3 rating reflects the substantial rogue-base-station precondition.
Adjacent-range denial of service in the MediaTek modem affects the listed chipsets when a user equipment (UE) is attached to an attacker-controlled rogue base station. An integer overflow (CWE-190) in modem processing produces an availability-only impact, scored CVSS 3.1 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), with no confidentiality or integrity effect and no user interaction once the rogue-station precondition is met. No CISA KEV entry or public exploit was identified at time of analysis, and the specific triggering input is redacted in the available sources.
Denial of service in the MediaTek modem on a broad set of MediaTek chipsets occurs when a user equipment (UE) is connected to an attacker-controlled rogue base station and receives signaling that triggers a CWE-617 logic error, causing an application crash. The issue is availability-only (CVSS 5.3) and requires adjacent radio proximity plus the operational effort of running a rogue base station and inducing attachment, after which no authentication or user interaction is needed. No public exploit was identified at time of analysis, and the vendor patch is identified as MOLY01416152.
Modem denial of service affects MediaTek MT-series chipsets through an integer overflow that causes an out-of-bounds read and can crash the cellular modem. The attacker must operate a rogue base station within radio range and get the victim UE to attach to it; once that precondition is met, no authentication or user interaction is required. The assessed impact is availability-only (C:N/I:N/A:H) with high attack complexity (AC:H), no public exploit code is identified in the available data, and the issue is rated moderate rather than emergency-grade.
Denial of service in the MediaTek modem affects a broad range of MediaTek chipsets (CPE cpe:2.3:a:mediatek,_inc.:mediatek_chipset) when a UE is connected to a rogue base station, caused by an out-of-bounds read from a missing bounds check. CVSS 3.1 is 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting an adjacent-network, high-complexity attack that requires the victim device to attach to an attacker-controlled base station. No public exploit code or active exploitation is identified at time of analysis, and the vendor patch ID is MOLY01758223.
Remote denial of service affects the modem firmware on a broad range of MediaTek chipsets, including MT6980, MT8768, MT6897 and many others, when a UE connects to an attacker-controlled rogue base station within radio range. An out-of-bounds read caused by improper input validation (CWE-125) can crash the modem; CVSS PR:N and UI:N indicate no authentication or user interaction is needed once the UE attaches, while AC:H reflects the non-trivial effort of standing up a rogue cell and coercing attachment. Impact is availability-only (C:N/I:N/A:H), no public exploit or CISA KEV entry was identified at time of analysis, and MediaTek provides patch ID MOLY01758225.
An out-of-bounds read in the MediaTek modem firmware of a broad range of MediaTek chipsets (MT27xx, MT68xx, MT69xx, MT86xx, MT87xx, MT88xx and MT89xx families) allows an attacker operating a rogue base station to crash or destabilize the modem of any UE that camps on it, producing a denial of service. The flaw is a missing bounds check (CWE-125) reachable over the cellular radio interface with no authentication and no user interaction, although the attacker must first stand up fake radio infrastructure within range and get the target device to attach to it, which is why the vector is scored AV:A/AC:H and severity is moderate at 5.3. Impact is confined to availability - no code execution and no data compromise - and no public exploit code has been identified at time of analysis; MediaTek has issued fix patch IDs MOLY01349680 and MOLY01369097 (issue MSV-9364) through its November 2026 product security bulletin, and the issue is prioritized for remediation this month rather than as an emergency.
Denial of service in MediaTek modem firmware can crash the baseband when a UE attached to an attacker-controlled rogue base station sends malformed input that fails validation and reaches an assertion (CWE-617). The issue affects a broad set of MediaTek MT-series chipsets and is scored CVSS 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), so exploitation requires radio proximity and getting the device to camp on the rogue cell, with no authentication or user interaction. No public exploit was identified at time of analysis, and MediaTek has published Patch ID MOLY01707455.
Denial of service in the MediaTek modem is reported to occur when a user equipment (UE) is camped on an attacker-controlled rogue base station, affecting the MediaTek chipsets listed in the EUVD data. The issue is scored CVSS 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting an adjacent-network, high-complexity attack that requires no privileges or user interaction and causes only availability impact. No public exploit was identified at time of analysis, and the rogue-base-station precondition substantially limits practical exposure.
Remote denial of service in the MediaTek modem component affects a broad range of MediaTek chipsets (CPE cpe:2.3:a:mediatek,_inc.:mediatek_chipset) when a victim UE attaches to an attacker-controlled rogue base station. The modem performs an incorrect bounds check before a memory write, producing an out-of-bounds write (CWE-787) that can crash or destabilize the modem; impact is limited to availability, with no confidentiality or integrity effect and no code execution claimed. CVSS 3.1 is 5.3 (AV:A/AC:H/PR:N/UI:N/A:H), reflecting radio proximity and a non-trivial rogue-station setup; no public exploit was identified at time of analysis and no CISA KEV entry is present.
A missing bounds check in MediaTek modem (baseband) firmware can be driven into an out-of-bounds write, crashing the modem and causing a denial of service on the affected handset. The attack is only reachable from the radio side: the device must first be attached to a rogue base station operated by the attacker, which then delivers a malformed message. No authentication or user interaction is required, but the adjacent-range access path and the difficulty of luring a UE onto an attacker-controlled cell keep this at CVSS 5.3 (AV:A/AC:H/PR:N/UI:N/A:H), with availability impact only. No public exploit code or PoC reference has been identified at time of analysis, and the issue is not in CISA KEV; MediaTek has published a fix under Patch ID MOLY01775984 in its November 2026 product security bulletin.
Remote denial of service in MediaTek modem (baseband) firmware affects a broad range of MediaTek chipsets, where a missing bounds check during processing of messages received from the network permits an out-of-bounds write and a modem crash. The attacker must operate a rogue base station and get the target handset (UE) to attach to it; the attack is radio-adjacent, unauthenticated (PR:N) and requires no user interaction (UI:N), but is rated high complexity (AC:H) because of the rogue-base-station setup and the need to lure the UE into connecting. Impact is limited to availability (modem denial of service) with no code execution, data disclosure or integrity impact, and no public exploit was identified at time of analysis.