Improper input validation in the MediaTek modem allows a crafted radio-layer input to crash the baseband, causing denial of cellular service on affected chipsets (including MT8792, MT6897, MT8755, MT6878, MT2716, MT8883, MT8676, MT8793, MT6899, MT8775, MT6835, MT8873 and MT8863) when the device is attached to an attacker-controlled rogue base station. No device authentication (PR:N) and no user interaction (UI:N) are required, but the adjacent attack vector and high attack complexity reflect the rogue-base-station precondition, so this is a targeted proximity attack rather than an internet-remote one. Impact is availability-only - a modem crash - with no code execution, data read or data modification claimed; no public exploit code and no CISA KEV entry were identified in the available data, and MediaTek has published a fix under Patch ID MOLY01870543 in its November 2026 product security bulletin.
A missing bounds check in MediaTek modem firmware causes an out-of-bounds read that can crash the modem and drop cellular service on affected chipsets (including MT6881, MT6991, MT6993, MT6897, MT8678 and others enumerated by the vendor), yielding a remote denial of service. The attacker must operate a rogue base station in radio range and get the victim UE to attach to it; once attached, no authentication or user interaction is required, but the adjacent-network vector and high attack complexity keep realistic exposure narrow, and impact is limited to availability (no confidentiality or integrity loss). MediaTek reports patch ID MOLY01876664 / issue MSV-9834 in its November 2026 product security bulletin; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Header passthrough in samanhappy MCPHub through 1.0.45 and 1.1.7 allows a non-admin server owner to configure an upstream server that forwards the invoking user's credentials - Authorization, Cookie, x-api-key, x-auth-token, proxy-authorization, or the deployment's configured bearer header - to an attacker-controlled endpoint. Exploitation requires a low-privileged account able to create or modify a server entry plus a victim actually invoking a tool on that server, after which a single credential header per invocation is disclosed (confidentiality-only, no integrity or availability impact; assessed CVSS 5.3). A public proof-of-concept writeup reference exists; it is not verified as working exploit code, there is no CISA KEV listing, and the vendor fix is released in v1.1.8 (commit 040f7b9ae004070bdfe5084cde6bc2c609f78e76).
Heap memory corruption in libgphoto2 (through 2.5.34) lets a malicious USB camera driven by the jl2005c camlib overrun a heap buffer by roughly 30 KB during thumbnail decompression, leaking heap contents into generated preview images and allowing memory writes past the allocation. Only hosts that physically connect the crafted device and have the application process the thumbnail/preview are exposed, and the jl2005c code path must actually be reached, which keeps this a medium/low-urgency issue rather than a high-priority emergency. No public exploit code and no CISA KEV listing are confirmed in the available data, and authentication is not required (CVSS 4.0 PR:N) although the attack vector is physical (AV:P).
Stored cross-site scripting in Wing FTP Server versions prior to 8.2.6 allows an authenticated low-privileged web-client user to inject script through a crafted 'nowpath' parameter sent to webclient/makethumb.html, with the payload breaking out of the CDATA section of the admin_get_lastconn.html XML response to forge a connection id. The forged entry is rendered and executed in an administrator's browser when the admin_connection_list.html activity page auto-refreshes, which the reporter states can be leveraged to abuse the Lua console. Rated medium severity (CVSS 4.0 base 5.1; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), exploitation requires valid web-client credentials and an administrator viewing the legacy activity page, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in LaraDashboard 1.4.8 and earlier lets any authenticated account holding the post.create or post.edit permission persist script or event-handler markup inside LaraBuilder design_json blocks (text-editor, HTML, text or heading), which the application then renders unescaped in the builder preview, the admin post view, email-template previews and published pages. Because the payload executes in the browser of a higher-privileged viewer - an administrator or Superadmin opening the content - a low-privilege author can chain the execution with the account's own CSRF-exposed actions toward privilege escalation; exploitation requires a valid low-privilege account and a privileged user action (PR:L/UI:P per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), so it is not an unauthenticated or fully automatable attack and is rated moderate priority rather than an emergency. A public proof-of-concept reproduction script is included in the vendor GHSA advisory; it has not been independently verified as working exploit code, and no active exploitation (CISA KEV) has been confirmed. Vendor-released patch: 1.4.9.
The Regular Labs Users Anywhere extension for Joomla (free and Pro) before version 3.0.1 lets a content author override the administrator's personal-data output setting by embedding an attribute inside a {user}, [email] or [username] tag - for example [email allow_output_email="1"] renders an email address even when 'Allow output of email' is set to No. This is a limited information-disclosure issue (CVSS 5.1, CWE-200) that requires authenticated content-authoring access and a site where Users Anywhere tags are permitted in the content source; it does not defeat a separate policy that blocks those tags entirely. No public exploit or PoC reference exists in the available sources and there is no CISA KEV listing or EPSS score, so it is handled on a monthly patch cadence rather than as an emergency.
SQL identifier injection in the Apache Iceberg write path of AWS SDK for pandas (awswrangler) 3.5.2 through 3.17.0 allows an authenticated principal that can modify AWS Glue Data Catalog metadata to read any table a separate, more privileged principal can access - and to write to the very table that principal is updating - by planting a crafted column name that is spliced unescaped into generated Athena SQL. The flaw is conditional rather than broadly exploitable: the attacker must already hold glue:UpdateTable (or equivalent catalog-modify) rights on a shared database, a more-privileged principal must then invoke to_iceberg() against the poisoned table (required user interaction), and the deployment must pair a shared catalog with an over-privileged Iceberg writer. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor rates it as a privilege-escalation/data-exposure issue fixed in 3.17.1 and prioritizes it for patching this week.
Path traversal in the WordEmbedding_LM.load function of deepset-ai FARM through version 0.8.0 lets a local attacker control the embeddings_filename argument - typically by supplying a crafted model package - and read files outside the intended model directory. The flaw is assessed as low severity (CVSS 3.1: AV:L/AC:L/PR:L/UI:R, limited confidentiality impact only), requires local access and a victim to actually load the attacker-influenced input, and affects an end-of-life product the maintainer no longer supports and did not respond about. A public PoC reference has been published, but it is not verified as working exploit code, and no confirmed active exploitation has been reported.
A heap out-of-bounds read in The Sleuth Kit through 4.15.0 allows a crafted HFS+ disk image to crash forensic analysis utilities such as istat and icat. The flaw is triggered when an analyst opens an attacker-supplied image containing a com.apple.decmpfs extended attribute whose attr_size is 1 to 15 bytes, causing a header read past the heap allocation. Exploitation is local and requires user interaction (the analyst must choose to process the image), the impact is limited to availability (tool crash), and no public exploit was identified at time of analysis; this is a medium-severity denial-of-service issue rather than a code-execution or data-disclosure risk.
A one-byte stack buffer under-read exists in ini_parse_stream() in inih before release r63, reachable when a host application parses attacker-supplied INI content containing a line of at least INI_MAX_LINE-1 bytes immediately followed by an embedded NUL byte. The scored impact is limited to availability: a single out-of-bounds read of abyss[-1] that triggers undefined behavior and can crash the parsing process, with no confidentiality or integrity effect in the assessed vector (the CWE-127 classification reflects the out-of-bounds read class, not a confirmed disclosure primitive). The vector is local (AV:L) and requires the user or application to load the crafted INI data (UI:R/UI:P) with no privileges needed (PR:N); exploitation conditions depend entirely on the host application accepting untrusted INI input. Vendor-released patch: r63, via upstream PR #206 and commit 8e06f6b; a public technical write-up describing the trigger is referenced, but no working exploit code and no active exploitation (CISA KEV) were identified at time of analysis, and the priority label is this_month.
Stored cross-site scripting in the WSO2 API Manager Publisher portal allows users holding the Publisher role to upload SVG files whose content is never validated, so embedded script is persisted and later executed in the browser of any user who views the rendered asset. The flaw is scored CVSS 4.8 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), and its practical reach is narrow because it requires a privileged Publisher account plus victim interaction, while httpOnly-protected session cookies block session hijacking and limit the outcome to browser-context effects such as forced redirects, UI tampering, or reading browser-accessible information. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-prioritised decision label places it in the this-month remediation window rather than an emergency response.
CVE-2026-20566 is an out-of-bounds write (CWE-787) in MediaTek modem firmware affecting a broad list of MediaTek chipsets including the MT6xxx, MT8xxx and MT2xxx families. Exploitation is not a default-configuration remote attack: the victim UE must be connected to an attacker-controlled rogue base station, the attacker must already hold System privilege on the device, and user interaction is required - a layered set of prerequisites that sharply limits realistic risk and is reflected in a low CVSS 4.8 score. Impact is availability-only (denial of service) with no confidentiality or integrity effect; no public exploit code, no CISA KEV listing and no evidence of active exploitation were identified at time of analysis, and CISA SSVC records Exploitation as none with Automatable: no.
Remote file preview in Huawei HarmonyOS can trigger a buffer overflow that affects availability, with a CVSS 4.7 severity. The assessed vector requires user interaction - the victim must open or preview an attacker-supplied file - but no authentication against the target, and the only stated impact is denial of availability; confidentiality and integrity impacts are not supported by the independent assessment. No public exploit has been identified at time of analysis, and Huawei's October 2026 consumer bulletins are the available vendor references.
Stored cross-site scripting in the aidlc-traceability CLI (versions from 0.1.0 up to, but not including, commit 96cf0ea) lets an actor who can modify a project's AI-DLC artifact files place a closing script-tag sequence plus script content in an artifact title or description, which then executes in the browser of a user who generates the HTML traceability report and opens it. The injected script can rewrite the displayed coverage and gap-analysis results and read the report's contents, including the victim's local file paths, but cannot reach other local files or credentials. The flaw is fixed at commit 96cf0ea (2026-07-03); a public proof-of-concept reference exists in the GitHub advisory and is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV entry).
Misconfigured Event Publisher output adapters in affected WSO2 Carbon products can cause irrelevant configuration properties - including credentials or other secrets - to be written into the 'wso2carbon' log files, exposing them to anyone who can read those logs. Exploitation requires a non-default misconfiguration where an adapter is given properties it does not use and those properties carry sensitive values, plus an attacker who already holds high privileges sufficient to read the local wso2carbon log files (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/C:H/I:N/A:N, 4.4 Medium). There is no confidentiality-only impact and no remote or unauthenticated path; no public exploit code or PoC has been identified at time of analysis, and the issue is not listed in CISA KEV.
A logic error in the display subsystem of MediaTek chipsets can crash the system, producing a local denial of service on affected devices. Exploitation requires the attacker to already hold System privilege (CVSS PR:H) and local access (AV:L), with no user interaction needed; only availability is impacted, with no confidentiality or integrity effect. Approximately 30 chipset models are listed as affected, no public exploit code is identified, and the CISA SSVC assessment rates exploitation as none and automatable as no, placing this at a low-to-moderate priority.
A use-after-free in the USB component of MediaTek chipsets allows a local attacker who already holds System privilege to crash the affected device, yielding a denial-of-service condition (CVSS 4.4, AV:L/AC:L/PR:H/UI:N, with only availability impact). The flaw touches a very broad set of MediaTek SoCs, including MT6761, MT6765, MT6768, MT6833, MT6853, MT6877, MT6885, MT6893, MT6989, MT8188, MT8768, MT8786 and MT8196, and is fixed by MediaTek patch ALPS11411916 documented in the November 2026 product security bulletin. No public exploit has been identified at time of analysis, and because the attacker must already be System-privileged, this is a post-exploitation availability issue rather than a route to initial access or privilege escalation.
Local denial of service in the MediaTek USB driver affects a broad set of MediaTek chipsets, where a use-after-free condition can crash the system. The flaw is only reachable by an attacker who already holds System privilege and executes locally, and it requires no user interaction; confidentiality and integrity are unaffected. No public exploit has been identified at time of analysis, CISA SSVC exploitation is none, and the issue is treated as a this-month priority rather than an emergency.
Local denial of service in the MediaTek modem affects devices built on 25 MediaTek chipsets, including MT8873, MT6858, MT8755, and related models, when an attacker already holds System privilege. The flaw is a permission bypass (CWE-280) that requires high local privileges and no user interaction, making it a post-compromise issue rather than an entry point; CVSS 3.1 score is 4.4 with only availability impact. MediaTek has published patch MOLY01880753 in its November-2026 security bulletin, and no public exploit has been identified at time of analysis.
Uncontrolled recursion in HDF5 (through 2.2.0) lets a crafted HDF5 file crash an application that inspects group metadata: a version 1 B-tree whose child pointer refers back to an already-cached node - such as a node pointing to itself - drives H5B__iterate_helper() into unbounded recursion and exhausts the stack. The victim must open the malicious file and the application must reach the vulnerable path through H5Gget_info() or H5Gget_num_objs() on a group, which routes via H5G__obj_info() and H5G__stab_count() into H5B_iterate(); no privileges are required, but user interaction to open the file is. Impact is availability-only (process crash), with no code execution or data disclosure reported, and no public exploit was identified at time of analysis; the disclosed reference is the upstream issue report rather than working exploit code.
A denial-of-service flaw in the HarmonyOS file parsing module allows an attacker to crash the parsing component by supplying a crafted malformed file that the victim opens (CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). The root cause is uncontrolled recursion (CWE-674), which leads to resource exhaustion and a temporary availability impact only - confidentiality and integrity are unaffected. Exploitation is gated by user interaction, which is the primary limiting factor; no public exploit code or active exploitation was identified in the available sources at time of analysis.
A crafted web page loaded into Huawei's ArkWeb rendering module on HarmonyOS can trigger a null pointer dereference that crashes the web component, giving a limited availability-only impact (CVSS 4.3, A:L) with no confidentiality or integrity effect and no code execution. The assessed vector (AV:N/AC:L/PR:N/UI:R) shows the flaw is remotely reachable without authentication, but the attacker depends on the victim opening or navigating to attacker-controlled web content rather than a silent remote attack. No public exploit code or CISA KEV entry is identified at time of analysis, and this is a low-to-moderate priority issue despite being internet-reachable.
Dell Alienware Command Center versions prior to 6.14.54.0 are affected by an improper input validation flaw that a low-privileged local attacker could use to cause a denial of service, with limited integrity impact and no confidentiality loss. Exploitation requires existing local access and is assessed as high complexity, and no public exploit was identified at time of analysis. Dell has published security update DSA-2026-429 for the affected 6.x releases.
Signature verification bypass in @fastify/secure-session 7.5.0 through 8.4.1 allows a holder of an already-issued encrypted session cookie to keep using that session after the cookie signature has been invalidated. When cookie.signed is enabled the plugin calls the cookie unsign routine but, if the signature check reports invalid, it still hands the original cookie value to the session decoder, so the session is decrypted anyway; the practical effect appears only when an application supplies the @fastify/cookie signing secret independently of the session encryption key and retires sessions by rotating just the signing secret. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects that the attacker must already possess an unexpired encrypted session cookie, needs neither secret, and cannot forge session data, extend expiry, or survive rotation of the encryption key; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-supplied fix is 8.4.2.
Local information disclosure in MediaTek Modem affects a broad set of MediaTek chipsets, including MT6897, MT6988, MT6991, and MT8755, and can expose sensitive data through a side channel to an attacker who already holds System privilege. Exploitation is local, highly complex, and requires high privileges, with no user interaction and no integrity or availability impact, so overall urgency is low despite the widespread product line. No public exploit identified at time of analysis, and SSVC records exploitation as none.
Local information disclosure in Google Android 15, 16, 16-qpr2, and 17 stems from a confused-deputy permission bypass that allows an attacker-controlled local component to leverage a more-privileged Android component to access data. The issue is rated CVSS 4.0 with limited confidentiality impact and is not remotely reachable; no public exploit identified at time of analysis, and EPSS is 0.12% at the 2nd percentile.
A permission bypass in Android's Wi-Fi P2P service (WifiP2pServiceImpl.checkNearbyDevicesPermission) lets a locally installed app read nearby-device and Wi-Fi P2P information without holding the required nearby-devices/location permission, a confused-deputy flaw affecting Android 14, 15, 16, 16-qpr2 and 17. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (score 4.0), so no user interaction or elevated privileges are needed, but the attacker must already have local code running on the device and the exposure is confined to confidentiality with no integrity or availability impact. EPSS is 0.12% (2nd percentile), there is no CISA KEV listing and no public exploit identified at time of analysis; the vendor bulletin reference points to the Android Security Bulletin dated 2026-11-01.
Local information disclosure in Android's LocaleManagerService (getXmlFileNameForUser) allows a malicious or compromised app already running on the device to use a confusable path traversal to bypass permission and user-isolation checks and read locale XML files. Affected builds span Android 14, 15, 16, 16-QPR2 and 17; CVSS is 4.0 (AV:L/AC:L/PR:N/UI:N, confidentiality-only impact), EPSS is 0.12% (2nd percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis. The local-access prerequisite and the low-sensitivity data exposed keep real-world risk modest.
Android 14 through Android 16 QPR2 and Android 17 contain a tapjacking/overlay flaw in getTouchOcclusionMode within WindowState.java that can leak limited information to a locally installed malicious app. Only a local app already running on the device can exploit it, and the victim must interact with the obscured UI; confidentiality impact is low with no integrity or availability effect, and EPSS is negligible at 0.11% (1st percentile). No CISA KEV listing or confirmed public exploit code is present in the available data, and the vendor bulletin (November 2026) is the patch reference.
A local information disclosure in Android's SubscriptionManagerService (CVE-2026-59003) allows a locally installed app - or an actor with local or ADB access - to read subscription property data via getSubscriptionProperty without holding the permission the API normally requires, because the permission check is missing (CWE-862). No user interaction and no additional execution privileges are needed, but the attack vector is strictly local (AV:L) and impact is limited to confidentiality (C:L, CVSS 4.0), with no integrity or availability effect. Affected builds span Android 14, 15, 16, 16-qpr2 and 17; EPSS is 0.11% (1st percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and the issue is rated moderate with low urgency, scheduled for this month.
An out-of-bounds read in Android's ShimConverter component (isValid in ShimConverter.cpp) lets an app that is already running locally on the device read a limited amount of adjacent memory, with no authentication and no user interaction required. Only local disclosure is exposed (C:L), with no integrity or availability impact and no remote path. The Android Security Bulletin dated 2026-11-01 lists the fix; devices carrying that patch level are not affected. EPSS is 0.11% (1st percentile), the CVE is not in CISA KEV, and no public exploit was identified at time of analysis.
Information disclosure in Google Android's DownloadProvider allows an unprivileged, locally installed application to retrieve download information it is not authorized to access by exploiting a confused-deputy flaw in checkWhetherCallingAppHasAccess. Android 14, 15, 16, 16-qpr2, and 17 devices that have not applied the November 2026 security patch level are affected. No public exploit was identified at the time of analysis, EPSS is 0.11% (1st percentile), and impact is limited to confidentiality with no code execution, privilege escalation, or data modification.
Denial-of-service conditions in Huawei HarmonyOS's file parsing module can be triggered when a crafted or malformed file is processed locally, with impact limited to reduced availability (A:L). The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, meaning local access or a means to have the file parsed on the target device is the gating prerequisite; no remote path is described. No public exploit code or CISA KEV entry was identified in the available intelligence, and the issue is assessed as a low-to-moderate priority for this month rather than an emergency.
Authentication bypass by spoofing in Dell Alienware Command Center (AWCC) before 6.14.54.0 allows a low-privileged local attacker to tamper with application data, cause denial of service, and spoof application notifications, but only if a legitimate user interacts with the spoofed notifications. The issue is local-only, requires an existing account on the host, and has low integrity and availability impact with no confidentiality impact (CVSS 3.9). No CISA KEV entry was present and no public exploit identified at time of analysis; the vuln.today decision label is monitor.
CORS preflight handling in @fastify/cors 8.2.0 through 11.3.x can terminate the Node.js process when the plugin is registered with the non-default hook: 'onSend' option. On an OPTIONS request carrying Origin and Access-Control-Request-Method, the plugin calls reply.send from inside the onSend hook and re-enters Fastify's send pipeline, so a second write of the response headers throws ERR_HTTP_HEADERS_SENT; with no process-level handler installed, that uncaught exception kills the process. The trigger is a single unauthenticated request (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, 3.7), but only the non-default onSend configuration with preflight enabled is exposed - the default onRequest hook and deployments with preflight: false are unaffected - so this is a low-priority availability issue rather than an urgent threat, and no public exploit code was identified at time of analysis.
The Optimizer module in Huawei HarmonyOS and EMUI performs an operation without an adequate permission check, letting a local app with limited privileges reach data or functionality that should be restricted to more privileged callers. Huawei's own scoring is modest (CVSS 3.7) and the published vector assumes network reachability with high attack complexity, while the independent assessment places the flaw as local with low privileges and only low confidentiality impact - the two views differ on attack vector and on which impact dimension is affected (availability in the vendor vector, confidentiality in the description), and that discrepancy is unresolved in the supplied data. No public exploit code or CISA KEV entry is associated with this CVE, and the vendor bulletin is the only remediation reference provided.
Huawei HarmonyOS contains a permission-control weakness in its background task management module that, under the assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, base score 3.6), requires local access with user interaction and produces only limited confidentiality impact that crosses a scope boundary. No public exploit code has been identified at time of analysis, and the aggregated priority signal is monitor. Huawei's October 2026 consumer, Vision and laptop security bulletins should be consulted for the fixed builds.
Client-side request forgery in Dell Alienware Command Center (AWCC) before 6.14.54.0 allows a low-privileged, remote attacker to make the application issue crafted requests on the victim's behalf, with impact scored as limited confidentiality exposure only (CVSS 3.5). Exploitation requires AWCC to be installed so its custom URL scheme handler is registered, a low-privileged context (PR:L), and victim interaction with an attacker-crafted link (UI:R), which substantially constrains real-world abuse. Every available signal rates this as low severity and the priority decision is monitor; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Use-after-free in the Android EVS HAL allows a local, already-privileged client on an Android Automotive (AAOS) device to free a buffer_handle_t while the camera producer thread is still referencing it, potentially leaking file descriptors from the EVS HAL process. Affected builds are Android 15, 16, 16-QPR2 and 17 on automotive head units, where the EVS HAL component is exposed; the flaw is local-only (AV:L), requires prior privilege (PR:L) and depends on winning a narrow race window (AC:H), giving an assessed CVSS of 2.5. Exploitation status: no public exploit identified at time of analysis, EPSS is 0.13% (3rd percentile) and the vulnerability is tracked at monitor priority, so real-world risk is low and the race is difficult to hit reliably.
Memory corruption in Qt MQTT's QMqttClient can crash Qt-based client applications when an MQTT 5 connection is established under a particular combination of client and server settings. The flaw is a CWE-787 out-of-bounds write reachable by an unauthenticated remote MQTT peer (CVSS 4.0 PR:N) but gated by a specific attack prerequisite (AT:P) and user interaction (UI:P), with the assessed impact limited to availability (VA:H) rather than data exposure or modification. The issue is rated low severity (CVSS 2.3) with a monitor decision label, affects client-side Qt applications rather than a widely exposed server surface, and has vendor patch code available; no public exploit was identified at time of analysis.
Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 can return stored field values in object update responses to a caller that lacks read access, letting a client with update-but-not-read permissions learn atomic-operation results, Cloud Code trigger-set values, and under narrower conditions an entire stored parent field. Exploitation requires an authenticated caller authorized to update the object and a permission mismatch-class-level update allowed while get is denied, or an object ACL granting write but not read-so default configurations that do not grant update without read are not exposed. No public exploit identified at time of analysis, and the issue is low severity with only confidentiality impact.
Authorization bypass in Sanluan PublicCMS 4.x, 5.x and 6.x allows an authenticated low-privilege user to manipulate the refundId argument handled by TradeRefundService.updateAmound and operate on refund records that belong to other accounts. Only deployments that include and actively use the optional publiccms-trade e-commerce/refund module are exposed; core CMS content-serving instances are not affected by this code path. Severity is medium (CVSS 4.0 base 5.3, assessed CVSS 3.1 5.3) and the disclosure states the exploit has been made public, so a public PoC/exploit reference exists, though it is not independently verified as working exploit code. There is no CISA KEV entry, no fixed version is listed in the available evidence, and the vendor did not respond to the report, so no vendor mitigation is stated.
Out-of-bounds read in hivex when parsing registry values with malformed large data block lists can crash applications that process attacker-supplied Windows registry hive files, resulting in denial of service. The assessed vector is local, requires user interaction, and has availability-only impact; no public exploit or CISA KEV entry was identified at time of analysis. This is a low-priority issue consistent with the 'monitor' decision label.
Integer overflow in the legacy Qt5Compat QXmlSimpleReader XML parser can be triggered when an application that still uses this deprecated component parses a crafted XML document, primarily threatening availability through a local, user-interaction-dependent attack path. No public exploit was identified at time of analysis, and vendor patches are available; the overall priority is monitor because exposure is limited to applications that opt into the Qt5 compatibility parser.
Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.
Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted `imodular:// URI` containing attacker-controlled command and argument parameters.
An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, inject spoofed UI elements into the trusted SystemUI Quick Controls panel, and gain a Background Activity Launch (BAL) grant from SystemUI when the user interacts with the spoofed element.
The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOTIVE_EVS`) can cause a torn `weak_ptr` state, leading to a virtual call through a freed object's vtable at `cameraObj->getCameraInfo(&desc)`. This allows for potential arbitrary code execution within the `hal_evs_default` process.
The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to `setExtendedInfo` and `getExtendedInfo`, potentially enabling code execution within the privileged HAL process.