Monthly
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers retrieve previously authorized include-template content from earlier renders. Because TemplateContext.Reset() clears output, globals, cultures, and source files but never clears the CachedTemplates dictionary, applications that pool a TemplateContext across requests and use a request-, tenant-, or user-dependent ITemplateLoader will serve a stale cached template to a later, less-privileged render without re-invoking TemplateLoader.Load(). A vendor patch exists (7.0.0) and a working proof-of-concept is published in the GHSA advisory, but there is no public exploit identified as used in active attacks.
Authentication bypass in silex technology SD-330AC (≤1.42) and AMC Manager (≤5.0.2) allows remote attackers to gain unauthorized access by sending specially crafted packets that exploit residual sensitive data in memory. Attacker can log in without valid credentials due to improper clearance of authentication tokens or session data between requests. EPSS score of 0.03% (7th percentile) indicates low observed exploitation probability. JPCERT/CC reported this vulnerability, and vendor advisory confirms patches are available. Requires user interaction (CVSS 4.0 UI:P), limiting automated exploitation.
Privilege escalation in Eclipse Jetty 9.4.0-12.1.7 allows unauthenticated remote attackers to bypass authentication via ThreadLocal variable pollution in JASPIAuthenticator. Early returns from authentication checks fail to clear ThreadLocal values, causing subsequent requests on the same thread to inherit elevated privileges. CVSS 7.4 with high complexity but no authentication required. EPSS and KEV status not provided; no public exploit identified at time of analysis. Affects all major Jetty versions from 9.x through 12.x.
Residual-data disclosure in the PostgreSQL JDBC Driver (pgjdbc) 42.7.4 through 42.7.13 allows an authenticated attacker who can influence how an application writes a value to recover SQL text and parameter values belonging to earlier statements on the same connection. When an application declares a value length larger than the bytes it actually supplies through PreparedStatement.setObject with a ByteStreamWriter, CopyIn.writeToCopy, PGCopyOutputStream.write, LargeObject.write, or Blob.setBytes, the driver pads the shortfall with whatever bytes remain in its send buffer instead of zeros, exposing up to 8192 bytes of recent traffic per value (16320 bytes when GSS encryption is in use); on a pooled connection those bytes may belong to other tenants or requests. Exploitation is conditional rather than trivial: the affected application must both store and read back such a padded value, its declared lengths must not always match its data, and any cross-request leakage depends on connection pooling, which is why the vendor rates this 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code was identified at time of analysis, and there is no confirmed active exploitation (not in CISA KEV).
Information disclosure in SixLabors ImageSharp 4.0.0 through 4.1.1 allows an attacker who supplies a crafted OpenEXR image to leak process-local memory contents into decoded pixel output, making this a genuine but moderate-priority confidentiality flaw rather than an urgent patch-now emergency. The bug lives in EXR ZIP/ZIPS decompression, where the inflate result can be shorter than the block size the decoder expects; the decoder then reads the full expected block from a pooled buffer obtained through Configuration.Default, so bytes left over from an earlier completed ImageSharp operation can surface in the decoded image. Exploitation requires the host application to decode an attacker-supplied EXR and expose the resulting pixels or output back to that attacker, is unauthenticated (PR:N) with no user interaction (UI:N), but is rated hard to exploit (AC:H) because the attacker cannot control or predict the residual buffer contents; no public exploit code was identified at time of analysis and fixed in 4.1.2.
Uninitialized kernel memory disclosure through the ASUS Armoury Crate Windows driver allows a local low-privileged user to read sensitive data from previously used kernel buffers. The attacker crafts a malicious IOCTL request that bypasses the driver's built-in security verification mechanism, triggering a read of uncleared memory content (CWE-226). No active exploitation has been identified and no public exploit code is known at time of analysis; risk is bounded by the local access prerequisite and the AC:H complexity of defeating the security check.
Cross-tenant information disclosure in OpenStack Ironic before 38.0.1 exposes residual disk contents from prior bare metal node occupants when the autodetect deploy interface is used. The bug causes the mandatory cleaning step to be skipped immediately after a node is enrolled with, or transitioned to, the autodetect deploy interface, meaning a newly allocated tenant may receive a node whose storage has not been wiped. The CVSS scope-change metric (S:C, C:H) reflects the multi-tenant nature of the impact: one authenticated user's data persists onto a node now accessible to a different principal. No public exploit has been identified at time of analysis.
Information disclosure vulnerability in Semtech LR11xx LoRa transceivers (LR1110, LR1120, LR1121) allows attackers with physical SPI interface access to retrieve decrypted firmware contents by exploiting improper memory cleanup after firmware validation. The device fails to clear the last decrypted firmware block from memory after integrity checks complete, enabling an attacker to bypass firmware encryption protection via subsequent SPI memory read commands. This affects early firmware versions and requires direct physical access to the SPI interface.
AnyBurn 4.3 x86 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string to the image conversion function. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WinAVI iPod/3GP/MP4/PSP Converter 4.4.2 contains a denial of service vulnerability that allows local attackers to crash the application by processing malformed AVI files. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers retrieve previously authorized include-template content from earlier renders. Because TemplateContext.Reset() clears output, globals, cultures, and source files but never clears the CachedTemplates dictionary, applications that pool a TemplateContext across requests and use a request-, tenant-, or user-dependent ITemplateLoader will serve a stale cached template to a later, less-privileged render without re-invoking TemplateLoader.Load(). A vendor patch exists (7.0.0) and a working proof-of-concept is published in the GHSA advisory, but there is no public exploit identified as used in active attacks.
Authentication bypass in silex technology SD-330AC (≤1.42) and AMC Manager (≤5.0.2) allows remote attackers to gain unauthorized access by sending specially crafted packets that exploit residual sensitive data in memory. Attacker can log in without valid credentials due to improper clearance of authentication tokens or session data between requests. EPSS score of 0.03% (7th percentile) indicates low observed exploitation probability. JPCERT/CC reported this vulnerability, and vendor advisory confirms patches are available. Requires user interaction (CVSS 4.0 UI:P), limiting automated exploitation.
Privilege escalation in Eclipse Jetty 9.4.0-12.1.7 allows unauthenticated remote attackers to bypass authentication via ThreadLocal variable pollution in JASPIAuthenticator. Early returns from authentication checks fail to clear ThreadLocal values, causing subsequent requests on the same thread to inherit elevated privileges. CVSS 7.4 with high complexity but no authentication required. EPSS and KEV status not provided; no public exploit identified at time of analysis. Affects all major Jetty versions from 9.x through 12.x.
Residual-data disclosure in the PostgreSQL JDBC Driver (pgjdbc) 42.7.4 through 42.7.13 allows an authenticated attacker who can influence how an application writes a value to recover SQL text and parameter values belonging to earlier statements on the same connection. When an application declares a value length larger than the bytes it actually supplies through PreparedStatement.setObject with a ByteStreamWriter, CopyIn.writeToCopy, PGCopyOutputStream.write, LargeObject.write, or Blob.setBytes, the driver pads the shortfall with whatever bytes remain in its send buffer instead of zeros, exposing up to 8192 bytes of recent traffic per value (16320 bytes when GSS encryption is in use); on a pooled connection those bytes may belong to other tenants or requests. Exploitation is conditional rather than trivial: the affected application must both store and read back such a padded value, its declared lengths must not always match its data, and any cross-request leakage depends on connection pooling, which is why the vendor rates this 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code was identified at time of analysis, and there is no confirmed active exploitation (not in CISA KEV).
Information disclosure in SixLabors ImageSharp 4.0.0 through 4.1.1 allows an attacker who supplies a crafted OpenEXR image to leak process-local memory contents into decoded pixel output, making this a genuine but moderate-priority confidentiality flaw rather than an urgent patch-now emergency. The bug lives in EXR ZIP/ZIPS decompression, where the inflate result can be shorter than the block size the decoder expects; the decoder then reads the full expected block from a pooled buffer obtained through Configuration.Default, so bytes left over from an earlier completed ImageSharp operation can surface in the decoded image. Exploitation requires the host application to decode an attacker-supplied EXR and expose the resulting pixels or output back to that attacker, is unauthenticated (PR:N) with no user interaction (UI:N), but is rated hard to exploit (AC:H) because the attacker cannot control or predict the residual buffer contents; no public exploit code was identified at time of analysis and fixed in 4.1.2.
Uninitialized kernel memory disclosure through the ASUS Armoury Crate Windows driver allows a local low-privileged user to read sensitive data from previously used kernel buffers. The attacker crafts a malicious IOCTL request that bypasses the driver's built-in security verification mechanism, triggering a read of uncleared memory content (CWE-226). No active exploitation has been identified and no public exploit code is known at time of analysis; risk is bounded by the local access prerequisite and the AC:H complexity of defeating the security check.
Cross-tenant information disclosure in OpenStack Ironic before 38.0.1 exposes residual disk contents from prior bare metal node occupants when the autodetect deploy interface is used. The bug causes the mandatory cleaning step to be skipped immediately after a node is enrolled with, or transitioned to, the autodetect deploy interface, meaning a newly allocated tenant may receive a node whose storage has not been wiped. The CVSS scope-change metric (S:C, C:H) reflects the multi-tenant nature of the impact: one authenticated user's data persists onto a node now accessible to a different principal. No public exploit has been identified at time of analysis.
Information disclosure vulnerability in Semtech LR11xx LoRa transceivers (LR1110, LR1120, LR1121) allows attackers with physical SPI interface access to retrieve decrypted firmware contents by exploiting improper memory cleanup after firmware validation. The device fails to clear the last decrypted firmware block from memory after integrity checks complete, enabling an attacker to bypass firmware encryption protection via subsequent SPI memory read commands. This affects early firmware versions and requires direct physical access to the SPI interface.
AnyBurn 4.3 x86 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string to the image conversion function. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WinAVI iPod/3GP/MP4/PSP Converter 4.4.2 contains a denial of service vulnerability that allows local attackers to crash the application by processing malformed AVI files. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.