Monthly
Privilege escalation in Axis OS affects all Axis network devices where unsigned ACAP application installation is permitted, allowing an attacker who tricks an administrator into installing a malicious ACAP app to gain elevated privileges on the device. The vulnerability stems from missing input validation in an ACAP configuration file (CWE-1287), enabling crafted configuration values to bypass intended privilege boundaries. No public exploit code has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog.
Insufficient input validation in Amazon Bedrock AgentCore harness allows authenticated remote users to bypass model invocation and associated security controls by submitting crafted content blocks within conversation messages, directly triggering configured tool execution outside the intended agentic pipeline. The vulnerability carries a CVSS 4.0 score of 8.6 with high confidentiality and integrity impact against the vulnerable system (VC:H/VI:H), reflecting the potential for an attacker to invoke tools with whatever permissions those tools hold - such as S3 read access, database queries, or external API calls - without passing through model-layer guardrails. AWS has fully remediated this issue server-side; no public exploit has been identified at time of analysis, and no customer action is required.
Privilege escalation in MediaTek's geniezone component affects ten specific chipset models (MT8792, MT8883, MT8873, MT8893, MT8768, MT8796, MT8799, MT6991, MT8791T, MT8910) due to a missing permission check classified under CWE-1287. An attacker who has already obtained System-level privileges on an affected device can exploit this flaw to escalate further - potentially reaching kernel or TEE-adjacent privilege boundaries - without requiring any user interaction. No public exploit code exists and no active exploitation has been confirmed (EPSS 0.13%, 3rd percentile), positioning this as a chaining vulnerability relevant to targeted attacks rather than opportunistic mass exploitation.
Authentication bypass in Magarsus Consulting IDM-MFA (versions 2025.11.27 up to but not including 2026.03.10) lets remote unauthenticated attackers circumvent multi-factor authentication by supplying improperly-typed input that the application fails to validate. Because IDM-MFA is itself an identity and MFA gateway, a successful bypass undermines the primary control protecting downstream systems, yielding high confidentiality and integrity impact. Exploitation requires some victim interaction (CVSS UI:R), and there is no public exploit identified at time of analysis.
Remote denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows an unauthenticated network attacker to crash or hang the runtime by sending crafted input that fails proper type validation (CWE-1287). The flaw carries a CVSS 7.5 rating driven entirely by availability impact (A:H) with no confidentiality or integrity loss, and no public exploit has been identified at time of analysis. Microsoft has released a patch; there is no indication of active exploitation.
Information disclosure in Microsoft Office Word and related Microsoft 365/SharePoint products exposes sensitive memory contents when a user opens a specially crafted document. Affecting a broad suite of products spanning Word 2016 through Office LTSC 2024 and SharePoint Server versions, the flaw stems from improper input type validation (CWE-1287) in the document parsing subsystem. No public exploit has been identified at time of analysis; EPSS at 0.39% and CISA SSVC exploitation status of 'none' confirm this remains a theoretical rather than actively targeted risk, though Microsoft has released patches.
Temperature parameter validation in vLLM (pip/vllm ≤ 0.23.0) can be bypassed by supplying NaN or positive Infinity as the temperature value, because Python's IEEE 754 float comparison operators silently return False for these inputs, allowing the values to propagate unchecked into GPU CUDA sampling kernels. The invalid inputs trigger undefined behavior or fatal CUDA errors that crash the inference worker process, dropping all in-flight requests and degrading service for every concurrent user sharing that worker. No public exploit has been identified at time of analysis, though the trigger condition is fully disclosed in the published GHSA-7h4p-rffg-7823 advisory and is trivially reproducible from that description alone.
Denial-of-service in Moxa NPort 6000-G2 Series serial device servers allows a low-privileged authenticated attacker to disrupt service and potentially trigger an unexpected device reboot via specially crafted JSON requests to the WebSocket API. The CVSS 4.0 base score of 7.1 reflects high availability impact with no confidentiality or integrity loss. Per current intelligence, there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privileges to crash the database or read out-of-bounds memory by submitting a malformed binary diff through the $_internalApplyOplogUpdate aggregation pipeline stage. The flaw stems from inadequate validation of the binary diff document structure consumed by an internal oplog replay operator that is unexpectedly reachable from user-facing aggregation queries. No public exploit identified at time of analysis, but the low privilege bar and network attack vector make this a meaningful threat in multi-tenant or shared-credential MongoDB deployments.
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database process by submitting a crafted 'mechanism' value to the 'authenticate' command when OIDC authentication is configured. The flaw carries a CVSS 4.0 base score of 8.2 driven by network reachability, no privileges required, and high availability impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in Axis OS affects all Axis network devices where unsigned ACAP application installation is permitted, allowing an attacker who tricks an administrator into installing a malicious ACAP app to gain elevated privileges on the device. The vulnerability stems from missing input validation in an ACAP configuration file (CWE-1287), enabling crafted configuration values to bypass intended privilege boundaries. No public exploit code has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog.
Insufficient input validation in Amazon Bedrock AgentCore harness allows authenticated remote users to bypass model invocation and associated security controls by submitting crafted content blocks within conversation messages, directly triggering configured tool execution outside the intended agentic pipeline. The vulnerability carries a CVSS 4.0 score of 8.6 with high confidentiality and integrity impact against the vulnerable system (VC:H/VI:H), reflecting the potential for an attacker to invoke tools with whatever permissions those tools hold - such as S3 read access, database queries, or external API calls - without passing through model-layer guardrails. AWS has fully remediated this issue server-side; no public exploit has been identified at time of analysis, and no customer action is required.
Privilege escalation in MediaTek's geniezone component affects ten specific chipset models (MT8792, MT8883, MT8873, MT8893, MT8768, MT8796, MT8799, MT6991, MT8791T, MT8910) due to a missing permission check classified under CWE-1287. An attacker who has already obtained System-level privileges on an affected device can exploit this flaw to escalate further - potentially reaching kernel or TEE-adjacent privilege boundaries - without requiring any user interaction. No public exploit code exists and no active exploitation has been confirmed (EPSS 0.13%, 3rd percentile), positioning this as a chaining vulnerability relevant to targeted attacks rather than opportunistic mass exploitation.
Authentication bypass in Magarsus Consulting IDM-MFA (versions 2025.11.27 up to but not including 2026.03.10) lets remote unauthenticated attackers circumvent multi-factor authentication by supplying improperly-typed input that the application fails to validate. Because IDM-MFA is itself an identity and MFA gateway, a successful bypass undermines the primary control protecting downstream systems, yielding high confidentiality and integrity impact. Exploitation requires some victim interaction (CVSS UI:R), and there is no public exploit identified at time of analysis.
Remote denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows an unauthenticated network attacker to crash or hang the runtime by sending crafted input that fails proper type validation (CWE-1287). The flaw carries a CVSS 7.5 rating driven entirely by availability impact (A:H) with no confidentiality or integrity loss, and no public exploit has been identified at time of analysis. Microsoft has released a patch; there is no indication of active exploitation.
Information disclosure in Microsoft Office Word and related Microsoft 365/SharePoint products exposes sensitive memory contents when a user opens a specially crafted document. Affecting a broad suite of products spanning Word 2016 through Office LTSC 2024 and SharePoint Server versions, the flaw stems from improper input type validation (CWE-1287) in the document parsing subsystem. No public exploit has been identified at time of analysis; EPSS at 0.39% and CISA SSVC exploitation status of 'none' confirm this remains a theoretical rather than actively targeted risk, though Microsoft has released patches.
Temperature parameter validation in vLLM (pip/vllm ≤ 0.23.0) can be bypassed by supplying NaN or positive Infinity as the temperature value, because Python's IEEE 754 float comparison operators silently return False for these inputs, allowing the values to propagate unchecked into GPU CUDA sampling kernels. The invalid inputs trigger undefined behavior or fatal CUDA errors that crash the inference worker process, dropping all in-flight requests and degrading service for every concurrent user sharing that worker. No public exploit has been identified at time of analysis, though the trigger condition is fully disclosed in the published GHSA-7h4p-rffg-7823 advisory and is trivially reproducible from that description alone.
Denial-of-service in Moxa NPort 6000-G2 Series serial device servers allows a low-privileged authenticated attacker to disrupt service and potentially trigger an unexpected device reboot via specially crafted JSON requests to the WebSocket API. The CVSS 4.0 base score of 7.1 reflects high availability impact with no confidentiality or integrity loss. Per current intelligence, there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privileges to crash the database or read out-of-bounds memory by submitting a malformed binary diff through the $_internalApplyOplogUpdate aggregation pipeline stage. The flaw stems from inadequate validation of the binary diff document structure consumed by an internal oplog replay operator that is unexpectedly reachable from user-facing aggregation queries. No public exploit identified at time of analysis, but the low privilege bar and network attack vector make this a meaningful threat in multi-tenant or shared-credential MongoDB deployments.
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database process by submitting a crafted 'mechanism' value to the 'authenticate' command when OIDC authentication is configured. The flaw carries a CVSS 4.0 base score of 8.2 driven by network reachability, no privileges required, and high availability impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.