Monthly
Image decoding through the sharp npm library before 0.35.0 - or through a system libvips older than 8.18.3 - exposes the GIF, TIFF and VIPS loaders to five inherited libvips decoder flaws (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242), two of which are rated High under CVSSv4. An attacker who can get crafted images into an affected application can trigger those decoder bugs with no victim interaction; the independent assessment (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) treats the path as remotely reachable and unauthenticated, so real exposure depends on whether the application accepts untrusted uploads. No public exploit code or CISA KEV entry was identified at time of analysis, and upgrading to sharp 0.35.0/0.35.3 or blocking the three loaders removes the vulnerable path.
Denial of service in the MediaWiki DataTransfer extension 1.46.0 through 1.46.x allows remote unauthenticated attackers to exhaust PHP process memory by submitting a tiny malformed .xls/OLE spreadsheet that triggers an unbounded sector-chain loop in the bundled PHPSpreadsheet library's OLERead component. The flaw is reachable through automatic spreadsheet type detection (Reader\Xls::canRead) whenever the extension processes attacker-controlled files; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) confirms no authentication or user interaction is required and that only availability is impacted. Publicly available exploit code exists per SSVC (Exploitation: poc) even though no CISA KEV confirmed exploitation has been reported, and EPSS is low at 0.15% (percentile 4); vendor patches are available, with the extension fixed in 1.47.0 and upstream PHPSpreadsheet fixed in 5.8.1, 3.10.7, 2.4.7, and 2.1.18.
Bundled-dependency exposure in the Image::WebP Perl module (versions 0 through 0.2, distributed by CPAN author ZAPAD) ships a statically compiled copy of libwebp 0.3.0 from 2013, which contains multiple known decoder flaws including the critical CVE-2023-4863 heap buffer overflow. Any Perl application that uses this module to decode an attacker-supplied WebP image reaches the outdated internal decoder, potentially enabling memory corruption and remote code execution. There is no public exploit identified for this specific repackaging, EPSS is low at 0.17%, and CISA SSVC records exploitation status as none - but the embedded CVE-2023-4863 was historically a high-impact, widely-abused decoder bug.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker over HTTP, targeting the Centralized Thirdparty Jars component. Oracle rates the flaw 8.8 and describes it as 'easily exploitable,' with successful attacks yielding complete takeover (high confidentiality, integrity, and availability impact). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV.
Arbitrary code execution in Adobe Dreamweaver Desktop 21.7 and earlier stems from a vulnerable third-party component bundled with the application, allowing an attacker to run code in the context of the user who opens a malicious file. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the changed-scope CVSS of 8.6 reflects the potential for the embedded component flaw to break out of Dreamweaver's security boundary.
Denial-of-service in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote unauthenticated attacker crash the application by exercising a bundled vulnerable third-party component, taking the storefront offline. The flaw carries CVSS 7.5 with an availability-only impact and no confidentiality or integrity effect; there is no public exploit identified at time of analysis, and EPSS is low at 0.07%. It was reported by Adobe and addressed in security bulletin APSB26-49.
Perl versions 5.9.4-5.40.3, 5.41.0-5.42.1, and 5.43.0-5.43.8 bundle a vulnerable version of Compress::Raw::Zlib that inherits multiple information-disclosure vulnerabilities from a vendored zlib library, including CVE-2026-27171. Affected users running these Perl versions can experience data exposure through the bundled compression module. Vendor patches are available in Perl 5.40.4, 5.42.2, and 5.43.9 via Compress::Raw::Zlib 2.221.
Dependency regression in a log-processing component of an ICS inventory-management product reintroduced a previously remediated, vulnerable HTTP client library version after a security-focused update was reverted. The reintroduced library is used in exactly one code path - an outbound initialization request to a single fixed, vendor-controlled URL - and never processes attacker-supplied input, severely constraining practical exploitability. Exploitation would require an adversary positioned to subvert the single outbound call to the trusted endpoint and leverage known vulnerabilities in the older HTTP client library, a scenario the CVSS 4.0 AC:H/AT:P metrics reflect. No public exploit and no KEV status are associated with this finding.
SAP NetWeaver AS Java's Adobe Document Services (ADS) component ships outdated open-source cryptographic and data transfer libraries that carry known, unpatched-within-the-product vulnerabilities classified under CWE-1395. Low-privileged authenticated attackers with network access can exploit these library weaknesses to achieve limited impact across confidentiality, integrity, and availability of the affected ADS component. No public exploit code or active exploitation has been identified; this is a supply-chain dependency risk with a CVSS 6.3 Medium score and no indication of weaponization at time of analysis.
HCL iReflection Third party vulnerable and outdated components issue was detected in the web application. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.
Image decoding through the sharp npm library before 0.35.0 - or through a system libvips older than 8.18.3 - exposes the GIF, TIFF and VIPS loaders to five inherited libvips decoder flaws (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242), two of which are rated High under CVSSv4. An attacker who can get crafted images into an affected application can trigger those decoder bugs with no victim interaction; the independent assessment (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) treats the path as remotely reachable and unauthenticated, so real exposure depends on whether the application accepts untrusted uploads. No public exploit code or CISA KEV entry was identified at time of analysis, and upgrading to sharp 0.35.0/0.35.3 or blocking the three loaders removes the vulnerable path.
Denial of service in the MediaWiki DataTransfer extension 1.46.0 through 1.46.x allows remote unauthenticated attackers to exhaust PHP process memory by submitting a tiny malformed .xls/OLE spreadsheet that triggers an unbounded sector-chain loop in the bundled PHPSpreadsheet library's OLERead component. The flaw is reachable through automatic spreadsheet type detection (Reader\Xls::canRead) whenever the extension processes attacker-controlled files; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) confirms no authentication or user interaction is required and that only availability is impacted. Publicly available exploit code exists per SSVC (Exploitation: poc) even though no CISA KEV confirmed exploitation has been reported, and EPSS is low at 0.15% (percentile 4); vendor patches are available, with the extension fixed in 1.47.0 and upstream PHPSpreadsheet fixed in 5.8.1, 3.10.7, 2.4.7, and 2.1.18.
Bundled-dependency exposure in the Image::WebP Perl module (versions 0 through 0.2, distributed by CPAN author ZAPAD) ships a statically compiled copy of libwebp 0.3.0 from 2013, which contains multiple known decoder flaws including the critical CVE-2023-4863 heap buffer overflow. Any Perl application that uses this module to decode an attacker-supplied WebP image reaches the outdated internal decoder, potentially enabling memory corruption and remote code execution. There is no public exploit identified for this specific repackaging, EPSS is low at 0.17%, and CISA SSVC records exploitation status as none - but the embedded CVE-2023-4863 was historically a high-impact, widely-abused decoder bug.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker over HTTP, targeting the Centralized Thirdparty Jars component. Oracle rates the flaw 8.8 and describes it as 'easily exploitable,' with successful attacks yielding complete takeover (high confidentiality, integrity, and availability impact). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV.
Arbitrary code execution in Adobe Dreamweaver Desktop 21.7 and earlier stems from a vulnerable third-party component bundled with the application, allowing an attacker to run code in the context of the user who opens a malicious file. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the changed-scope CVSS of 8.6 reflects the potential for the embedded component flaw to break out of Dreamweaver's security boundary.
Denial-of-service in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote unauthenticated attacker crash the application by exercising a bundled vulnerable third-party component, taking the storefront offline. The flaw carries CVSS 7.5 with an availability-only impact and no confidentiality or integrity effect; there is no public exploit identified at time of analysis, and EPSS is low at 0.07%. It was reported by Adobe and addressed in security bulletin APSB26-49.
Perl versions 5.9.4-5.40.3, 5.41.0-5.42.1, and 5.43.0-5.43.8 bundle a vulnerable version of Compress::Raw::Zlib that inherits multiple information-disclosure vulnerabilities from a vendored zlib library, including CVE-2026-27171. Affected users running these Perl versions can experience data exposure through the bundled compression module. Vendor patches are available in Perl 5.40.4, 5.42.2, and 5.43.9 via Compress::Raw::Zlib 2.221.
Dependency regression in a log-processing component of an ICS inventory-management product reintroduced a previously remediated, vulnerable HTTP client library version after a security-focused update was reverted. The reintroduced library is used in exactly one code path - an outbound initialization request to a single fixed, vendor-controlled URL - and never processes attacker-supplied input, severely constraining practical exploitability. Exploitation would require an adversary positioned to subvert the single outbound call to the trusted endpoint and leverage known vulnerabilities in the older HTTP client library, a scenario the CVSS 4.0 AC:H/AT:P metrics reflect. No public exploit and no KEV status are associated with this finding.
SAP NetWeaver AS Java's Adobe Document Services (ADS) component ships outdated open-source cryptographic and data transfer libraries that carry known, unpatched-within-the-product vulnerabilities classified under CWE-1395. Low-privileged authenticated attackers with network access can exploit these library weaknesses to achieve limited impact across confidentiality, integrity, and availability of the affected ADS component. No public exploit code or active exploitation has been identified; this is a supply-chain dependency risk with a CVSS 6.3 Medium score and no indication of weaponization at time of analysis.
HCL iReflection Third party vulnerable and outdated components issue was detected in the web application. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.