Monthly
Local privilege escalation in Android's Settings app (SettingsFragment.java) affects Android 14 through 17, including 16-qpr2, allowing a low-privileged local attacker to gain full device control via misleading or insufficient UI in the getItemList method. No victim interaction is required - the attacker's own low-privileged app or session is sufficient to trigger the UI bypass. EPSS is 0.12% (2nd percentile) and SSVC records no active exploitation, but SSVC simultaneously rates technical impact as total, reflecting the severity of a successful attack despite limited observed real-world activity.
Xmind fails to display adequate security warnings when users open file attachments, enabling remote code execution with the privileges of the current user. An attacker can exploit this by tricking users into opening malicious files or visiting crafted pages, with the unsafe action proceeding without proper user notification. No patch is currently available.
Zed Editor versions prior to 0.219.4 fail to display tool invocation parameters during permission prompts or after execution, allowing attackers with high privileges to execute tools with malicious or unintended parameters without user awareness. Public exploit code exists for this vulnerability. The issue is resolved in version 0.219.4, which adds expandable tool call details for transparency.
A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. [CVSS 8.0 HIGH]
Code execution in pdfforge PDF Architect 9.1.74.23030 occurs when the application processes a crafted XLS file and runs dangerous embedded script without presenting the user a warning prompt (CWE-356). An attacker must convince a target to open a malicious XLS file - or visit a page that serves one - after which code executes in the context of the current user; the LOCAL attack vector, mandatory user interaction (UI:R), and HIGH attack complexity (AC:H) confine this to targeted file-delivery scenarios rather than broad remote exploitation. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the 7.0 score reflects high confidentiality, integrity, and availability impact gated behind user action and attacker-uncontrolled preconditions.
PDF Architect version 9.1.74.23030 executes embedded PDF Launch actions without first warning the user, so a crafted document can run arbitrary script in the victim's security context when opened. The flaw is local and requires user interaction, and no public exploit code has been identified at time of analysis; successful exploitation gives the attacker the same privileges as the current user.
Code execution in pdfforge PDF Architect 9.1.74.23030 occurs when a user opens a crafted DOC file, because the application executes dangerous embedded script without presenting a security warning (CWE-356). This is a moderate-risk client-side flaw requiring user interaction and high-complexity conditions, with code running only at the current user's privilege level; no public exploit identified at time of analysis and no CISA KEV entry is available.
Soda PDF Desktop 14.0.509.23030 executes content reached through a PDF Launch action without surfacing the security warning users would normally have to approve, letting a crafted document run code in the victim's own security context. Exploitation is gated by mandatory user interaction: the target must open the malicious PDF (or a page that serves it), and because the CVSS vector carries PR:N with no scope change, no prior privileges are needed but the resulting code runs only with the victim's existing rights. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a targeted, file-delivery-dependent client-side risk rather than a drive-by network threat.
Code execution in Soda PDF Desktop 14.0.509.23030 is possible when a user opens an attacker-crafted Word file, because the application runs dangerous embedded script without the expected UI warning. The attack is client-side and requires user interaction (UI:R), and any code runs only with the current user's privileges rather than elevated or system-level rights. No public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in Soda PDF Desktop 14.0.509.23030 is triggered when a user opens a crafted XLS file that causes embedded dangerous script to run without the application's normal security warning. The attack is local and user-interaction-dependent (AV:L/UI:R), executes only at the current user's privilege level, and does not provide an unauthenticated network path. No public exploit code or CISA KEV active-exploitation confirmation was identified in the supplied intelligence at time of analysis.
Local privilege escalation in Android's Settings app (SettingsFragment.java) affects Android 14 through 17, including 16-qpr2, allowing a low-privileged local attacker to gain full device control via misleading or insufficient UI in the getItemList method. No victim interaction is required - the attacker's own low-privileged app or session is sufficient to trigger the UI bypass. EPSS is 0.12% (2nd percentile) and SSVC records no active exploitation, but SSVC simultaneously rates technical impact as total, reflecting the severity of a successful attack despite limited observed real-world activity.
Xmind fails to display adequate security warnings when users open file attachments, enabling remote code execution with the privileges of the current user. An attacker can exploit this by tricking users into opening malicious files or visiting crafted pages, with the unsafe action proceeding without proper user notification. No patch is currently available.
Zed Editor versions prior to 0.219.4 fail to display tool invocation parameters during permission prompts or after execution, allowing attackers with high privileges to execute tools with malicious or unintended parameters without user awareness. Public exploit code exists for this vulnerability. The issue is resolved in version 0.219.4, which adds expandable tool call details for transparency.
A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. [CVSS 8.0 HIGH]
Code execution in pdfforge PDF Architect 9.1.74.23030 occurs when the application processes a crafted XLS file and runs dangerous embedded script without presenting the user a warning prompt (CWE-356). An attacker must convince a target to open a malicious XLS file - or visit a page that serves one - after which code executes in the context of the current user; the LOCAL attack vector, mandatory user interaction (UI:R), and HIGH attack complexity (AC:H) confine this to targeted file-delivery scenarios rather than broad remote exploitation. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the 7.0 score reflects high confidentiality, integrity, and availability impact gated behind user action and attacker-uncontrolled preconditions.
PDF Architect version 9.1.74.23030 executes embedded PDF Launch actions without first warning the user, so a crafted document can run arbitrary script in the victim's security context when opened. The flaw is local and requires user interaction, and no public exploit code has been identified at time of analysis; successful exploitation gives the attacker the same privileges as the current user.
Code execution in pdfforge PDF Architect 9.1.74.23030 occurs when a user opens a crafted DOC file, because the application executes dangerous embedded script without presenting a security warning (CWE-356). This is a moderate-risk client-side flaw requiring user interaction and high-complexity conditions, with code running only at the current user's privilege level; no public exploit identified at time of analysis and no CISA KEV entry is available.
Soda PDF Desktop 14.0.509.23030 executes content reached through a PDF Launch action without surfacing the security warning users would normally have to approve, letting a crafted document run code in the victim's own security context. Exploitation is gated by mandatory user interaction: the target must open the malicious PDF (or a page that serves it), and because the CVSS vector carries PR:N with no scope change, no prior privileges are needed but the resulting code runs only with the victim's existing rights. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a targeted, file-delivery-dependent client-side risk rather than a drive-by network threat.
Code execution in Soda PDF Desktop 14.0.509.23030 is possible when a user opens an attacker-crafted Word file, because the application runs dangerous embedded script without the expected UI warning. The attack is client-side and requires user interaction (UI:R), and any code runs only with the current user's privileges rather than elevated or system-level rights. No public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in Soda PDF Desktop 14.0.509.23030 is triggered when a user opens a crafted XLS file that causes embedded dangerous script to run without the application's normal security warning. The attack is local and user-interaction-dependent (AV:L/UI:R), executes only at the current user's privilege level, and does not provide an unauthenticated network path. No public exploit code or CISA KEV active-exploitation confirmation was identified in the supplied intelligence at time of analysis.