Monthly
Spring Cloud Stream's partition interceptor logic improperly inserts a partition interceptor during message sends under specific conditions, potentially routing messages to unintended partitions. Affected versions span three active release lines: 5.0.0-5.0.2, 4.3.0-4.3.3, and 4.2.0-4.2.6. An authenticated operator with high privileges who triggers a message send under the required conditions could cause limited information disclosure or message integrity degradation by routing data to an unintended partition consumer. No public exploit identified at time of analysis; CVSS score of 3.1 reflects the high access bar and narrow impact.
Full system compromise of Phoenix Contact CHARX SEC EV charging controllers (SEC-3000/3050/3100/3150, versions 1.0.0 through 1.9.0) is possible because an incorrect script execution order tears down the firewall too early during system shutdown, briefly exposing internal-only services to the network. During this transient window a remote unauthenticated attacker can reach services that are normally firewalled off and gain complete control of the device. No public exploit identified at time of analysis, but the flaw is vendor-confirmed (CERT@VDE / advisory VDE-2026-008) and carries a CVSS 4.0 base score of 9.3.
Non-atomic JSON Patch application in cJSON through 1.7.19 allows an attacker who controls the patch document to silently corrupt the target JSON structure even when the API returns a failure status. The apply_patch() function in cJSON_Utils.c deletes existing target members before completing operation validation, meaning a malformed replace (missing value) or move (unresolvable destination) permanently destroys data from the in-memory document tree - defeating the RFC 6902 all-or-nothing contract that callers rely on to reject bad patches safely. No public exploit has been identified at time of analysis, but a detailed researcher disclosure and direct source code reference are publicly available, which may lower the barrier to exploitation; KEV status is not confirmed.
HTTP/2 HPACK dynamic table desynchronization in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) exposes a premature-state-update flaw in header compression logic. An unauthenticated remote attacker can trigger an HPACK encode failure, leaving the server's encoder table out of sync with the peer decoder's table and corrupting all subsequent header blocks transmitted on that HTTP/2 connection. No public exploit has been identified at time of analysis; the AC:H rating indicates reliable triggering requires specific conditions, and CISA KEV does not list this vulnerability.
Password overwrite and administrative unavailability on an unspecified
Information disclosure in GNU Savane's file-serving layer (frontend/php/file.php) allows network-accessible, unauthenticated remote attackers to bypass file authorization controls by supplying untrusted user-controlled data that the application incorrectly treats as authoritative in its access decision logic. Affected installations span Savane 3.14 through 3.17, confirmed by EUVD-2026-38135 and acknowledged via an FSF public statement. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the AC:H CVSS rating suggests non-trivial exploitation rather than a trivially automated mass-scan scenario.
PIN screen authentication bypass in the 2025 Indian Motorcycle Scout Bobber + Tech Infotainment / Digital Round display allows a physically proximate attacker to reach the fully unlocked user interface without entering a PIN. The system's boot-sequence logic (CWE-696) uses the mere presence of Wireless Control Module (WCM) CAN bus traffic as a proxy for immobilizer-fitment, and silently drops the PIN gate when no WCM messages appear - a condition an attacker can manufacture by suppressing the WCM via a CAN bus-off technique during the boot window. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
PIN entry bypass in the Indian Motorcycle Scout Bobber + Tech 2025 infotainment system allows an attacker with physical proximity to the vehicle to access the fully unlocked infotainment interface without entering the correct PIN. The root cause (CWE-696, Incorrect Behavior Order) is that the system treats the presence of Wireless Control Module (WCM) CAN bus traffic during its startup boot window as a proxy for immobilizer detection, and skips PIN enforcement entirely when no WCM messages are observed - a condition an attacker can manufacture by silencing the WCM. Reported by ASRG with no public exploit code and no CISA KEV listing; specific timing and protocol details have been withheld pending vendor remediation.
Infinite loop denial-of-service in OpenStack Ironic's image handling allows low-privileged authenticated attackers to exhaust conductor resources by supplying file:///dev/zero as an image URL, triggering unbounded checksum calculations that never terminate. All Ironic versions from 0 through 35.x prior to commit a3f6d73 are affected. No public exploit independently confirmed but SSVC data indicates proof-of-concept exists; EPSS sits at 0.01% (2nd percentile), consistent with low widespread exploitation likelihood despite the poc signal.
Remote code execution in GitHub Copilot CLI versions prior to 1.0.43 allows attackers to execute arbitrary commands via malicious bare git repositories embedded in project directories. When the CLI agent performs routine git operations, git's automatic bare repository discovery triggers execution of commands specified in config keys like core.fsmonitor. Attackers can deliver the malicious repository through pull requests, compromised dependencies, or pre-existing cloned repositories. No public exploit identified at time of analysis, though the attack technique leverages well-documented git behavior. The vendor-released patch (version 1.0.43) sets safe.bareRepository=explicit to block automatic bare repository discovery.
Spring Cloud Stream's partition interceptor logic improperly inserts a partition interceptor during message sends under specific conditions, potentially routing messages to unintended partitions. Affected versions span three active release lines: 5.0.0-5.0.2, 4.3.0-4.3.3, and 4.2.0-4.2.6. An authenticated operator with high privileges who triggers a message send under the required conditions could cause limited information disclosure or message integrity degradation by routing data to an unintended partition consumer. No public exploit identified at time of analysis; CVSS score of 3.1 reflects the high access bar and narrow impact.
Full system compromise of Phoenix Contact CHARX SEC EV charging controllers (SEC-3000/3050/3100/3150, versions 1.0.0 through 1.9.0) is possible because an incorrect script execution order tears down the firewall too early during system shutdown, briefly exposing internal-only services to the network. During this transient window a remote unauthenticated attacker can reach services that are normally firewalled off and gain complete control of the device. No public exploit identified at time of analysis, but the flaw is vendor-confirmed (CERT@VDE / advisory VDE-2026-008) and carries a CVSS 4.0 base score of 9.3.
Non-atomic JSON Patch application in cJSON through 1.7.19 allows an attacker who controls the patch document to silently corrupt the target JSON structure even when the API returns a failure status. The apply_patch() function in cJSON_Utils.c deletes existing target members before completing operation validation, meaning a malformed replace (missing value) or move (unresolvable destination) permanently destroys data from the in-memory document tree - defeating the RFC 6902 all-or-nothing contract that callers rely on to reject bad patches safely. No public exploit has been identified at time of analysis, but a detailed researcher disclosure and direct source code reference are publicly available, which may lower the barrier to exploitation; KEV status is not confirmed.
HTTP/2 HPACK dynamic table desynchronization in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) exposes a premature-state-update flaw in header compression logic. An unauthenticated remote attacker can trigger an HPACK encode failure, leaving the server's encoder table out of sync with the peer decoder's table and corrupting all subsequent header blocks transmitted on that HTTP/2 connection. No public exploit has been identified at time of analysis; the AC:H rating indicates reliable triggering requires specific conditions, and CISA KEV does not list this vulnerability.
Password overwrite and administrative unavailability on an unspecified
Information disclosure in GNU Savane's file-serving layer (frontend/php/file.php) allows network-accessible, unauthenticated remote attackers to bypass file authorization controls by supplying untrusted user-controlled data that the application incorrectly treats as authoritative in its access decision logic. Affected installations span Savane 3.14 through 3.17, confirmed by EUVD-2026-38135 and acknowledged via an FSF public statement. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the AC:H CVSS rating suggests non-trivial exploitation rather than a trivially automated mass-scan scenario.
PIN screen authentication bypass in the 2025 Indian Motorcycle Scout Bobber + Tech Infotainment / Digital Round display allows a physically proximate attacker to reach the fully unlocked user interface without entering a PIN. The system's boot-sequence logic (CWE-696) uses the mere presence of Wireless Control Module (WCM) CAN bus traffic as a proxy for immobilizer-fitment, and silently drops the PIN gate when no WCM messages appear - a condition an attacker can manufacture by suppressing the WCM via a CAN bus-off technique during the boot window. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
PIN entry bypass in the Indian Motorcycle Scout Bobber + Tech 2025 infotainment system allows an attacker with physical proximity to the vehicle to access the fully unlocked infotainment interface without entering the correct PIN. The root cause (CWE-696, Incorrect Behavior Order) is that the system treats the presence of Wireless Control Module (WCM) CAN bus traffic during its startup boot window as a proxy for immobilizer detection, and skips PIN enforcement entirely when no WCM messages are observed - a condition an attacker can manufacture by silencing the WCM. Reported by ASRG with no public exploit code and no CISA KEV listing; specific timing and protocol details have been withheld pending vendor remediation.
Infinite loop denial-of-service in OpenStack Ironic's image handling allows low-privileged authenticated attackers to exhaust conductor resources by supplying file:///dev/zero as an image URL, triggering unbounded checksum calculations that never terminate. All Ironic versions from 0 through 35.x prior to commit a3f6d73 are affected. No public exploit independently confirmed but SSVC data indicates proof-of-concept exists; EPSS sits at 0.01% (2nd percentile), consistent with low widespread exploitation likelihood despite the poc signal.
Remote code execution in GitHub Copilot CLI versions prior to 1.0.43 allows attackers to execute arbitrary commands via malicious bare git repositories embedded in project directories. When the CLI agent performs routine git operations, git's automatic bare repository discovery triggers execution of commands specified in config keys like core.fsmonitor. Attackers can deliver the malicious repository through pull requests, compromised dependencies, or pre-existing cloned repositories. No public exploit identified at time of analysis, though the attack technique leverages well-documented git behavior. The vendor-released patch (version 1.0.43) sets safe.bareRepository=explicit to block automatic bare repository discovery.