Monthly
Remote code execution in Android (versions 14 through 17) arises from improper type casting in multiple functions of ftsmooth.c, the anti-aliased smooth rasterizer of the bundled FreeType font-rendering engine. An attacker can trigger memory corruption through a maliciously crafted font with no user interaction and no additional execution privileges, per the September 2026 Android Security Bulletin. There is no public exploit identified at time of analysis; CISA SSVC lists exploitation status as none but rates the flaw automatable with total technical impact.
Remote code execution in Android's MatroskaExtractor component (MatroskaExtractor.cpp) affects Android 14, 15, 16, and 16-qpr2 via an improper type cast during Matroska/MKV media container parsing. A low-privileged remote attacker can exploit this flaw without user interaction to achieve full confidentiality, integrity, and availability compromise on the target device. No public exploit has been identified at time of analysis, and EPSS stands at 0.15%, though the zero-interaction requirement and full-impact CVSS 8.8 rating warrant prompt patching.
Local privilege escalation in Windows Search Component exposes virtually the entire Windows ecosystem - from legacy Server 2012 to Windows 11 26H1 - to full system compromise by any low-privileged local user. The flaw stems from an incorrect type conversion or cast (CWE-704) within the Search Component, allowing an attacker with a standard user session to escalate to SYSTEM-level privileges without user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches covering all affected build lines.
Authentication bypass in the User Profile Builder WordPress plugin (versions through 3.16.4) lets unauthenticated attackers log in as the site's Administrator (user ID 1) by submitting a registration with a 61-70 character username, resulting in full site takeover. The flaw is a PHP type-confusion bug where an error object is silently coerced to the integer 1, binding an autologin nonce to the admin account. Rated CVSS 9.8; no public exploit identified at time of analysis, though the fix commit publicly reveals the exact defective code path.
Credential forgery via type confusion in the TCG TPM 2.0 reference code (versions through v184) allows a local attacker holding high-privilege access to submit a falsified TPM key - such as an Attestation Key, DevID Key, or TLS authentication key - to a TPM-aware Certificate Authority and receive a legitimate credential for it. With that credential, the attacker can forge subsequent TPM 2.0 attestations, silently undermining the platform integrity guarantees that downstream security controls depend on, including measured boot verification, zero-trust device posture checks, and DevID-based network admission. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the EPSS score of 0.22% at the 13th percentile is consistent with a targeted, post-compromise technique rather than a commodity attack.
Local privilege escalation in the Windows Notification component lets an already-authenticated low-privileged user elevate to higher privileges (SYSTEM) across a broad range of Windows 10, Windows 11, and Windows Server releases. The flaw stems from an incorrect type conversion/cast (CWE-704) and carries a CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) with high confidentiality, integrity, and availability impact. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Denial of service in node-tar prior to 7.5.18 allows unauthenticated network-reachable attackers to crash Node.js processes by submitting crafted tar archives containing all-digit PAX header path or linkpath values. The library incorrectly coerces these string values to JavaScript numbers in src/pax.ts, causing downstream path handling (normalizeWindowsPath(entry.path).split('/')) to throw an uncaught TypeError when it attempts to call a string method on a numeric value. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Denial of service in NI grpc-device 2.17.0 and earlier allows an authenticated remote attacker to crash or destabilize the gRPC server by sending a crafted BeginSidebandStream message containing an out-of-range enum value. The unchecked cast triggers undefined behavior in the server process, with no public exploit identified at time of analysis. The flaw is reported by the vendor and tracked under GHSA-prfr-q8h3-mqxv.
Denial of service in the Go golang.org/x/crypto/ssh package (versions prior to 0.52.0) allows remote unauthenticated attackers to crash SSH server processes by sending crafted AES-GCM encrypted packets. An incorrectly placed bytes-to-int cast in the AES-GCM packet decoder triggers a server-side panic when processing well-crafted inputs. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.02%.
Remote denial of service in Coturn TURN/STUN server allows unauthenticated attackers to crash ARM64 deployments with a single malformed UDP packet. The vulnerability triggers a fatal SIGBUS signal via misaligned memory access during STUN attribute parsing, requiring no authentication or special configuration. All ARM64 installations of Coturn prior to 4.10.0 are vulnerable to instant process termination. EPSS exploitation probability is not yet available as this is a newly disclosed CVE, but the attack complexity is low (AC:L) and requires no privileges (PR:N), making exploitation trivial once awareness spreads in attacker communities.
Remote code execution in Android (versions 14 through 17) arises from improper type casting in multiple functions of ftsmooth.c, the anti-aliased smooth rasterizer of the bundled FreeType font-rendering engine. An attacker can trigger memory corruption through a maliciously crafted font with no user interaction and no additional execution privileges, per the September 2026 Android Security Bulletin. There is no public exploit identified at time of analysis; CISA SSVC lists exploitation status as none but rates the flaw automatable with total technical impact.
Remote code execution in Android's MatroskaExtractor component (MatroskaExtractor.cpp) affects Android 14, 15, 16, and 16-qpr2 via an improper type cast during Matroska/MKV media container parsing. A low-privileged remote attacker can exploit this flaw without user interaction to achieve full confidentiality, integrity, and availability compromise on the target device. No public exploit has been identified at time of analysis, and EPSS stands at 0.15%, though the zero-interaction requirement and full-impact CVSS 8.8 rating warrant prompt patching.
Local privilege escalation in Windows Search Component exposes virtually the entire Windows ecosystem - from legacy Server 2012 to Windows 11 26H1 - to full system compromise by any low-privileged local user. The flaw stems from an incorrect type conversion or cast (CWE-704) within the Search Component, allowing an attacker with a standard user session to escalate to SYSTEM-level privileges without user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches covering all affected build lines.
Authentication bypass in the User Profile Builder WordPress plugin (versions through 3.16.4) lets unauthenticated attackers log in as the site's Administrator (user ID 1) by submitting a registration with a 61-70 character username, resulting in full site takeover. The flaw is a PHP type-confusion bug where an error object is silently coerced to the integer 1, binding an autologin nonce to the admin account. Rated CVSS 9.8; no public exploit identified at time of analysis, though the fix commit publicly reveals the exact defective code path.
Credential forgery via type confusion in the TCG TPM 2.0 reference code (versions through v184) allows a local attacker holding high-privilege access to submit a falsified TPM key - such as an Attestation Key, DevID Key, or TLS authentication key - to a TPM-aware Certificate Authority and receive a legitimate credential for it. With that credential, the attacker can forge subsequent TPM 2.0 attestations, silently undermining the platform integrity guarantees that downstream security controls depend on, including measured boot verification, zero-trust device posture checks, and DevID-based network admission. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the EPSS score of 0.22% at the 13th percentile is consistent with a targeted, post-compromise technique rather than a commodity attack.
Local privilege escalation in the Windows Notification component lets an already-authenticated low-privileged user elevate to higher privileges (SYSTEM) across a broad range of Windows 10, Windows 11, and Windows Server releases. The flaw stems from an incorrect type conversion/cast (CWE-704) and carries a CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) with high confidentiality, integrity, and availability impact. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Denial of service in node-tar prior to 7.5.18 allows unauthenticated network-reachable attackers to crash Node.js processes by submitting crafted tar archives containing all-digit PAX header path or linkpath values. The library incorrectly coerces these string values to JavaScript numbers in src/pax.ts, causing downstream path handling (normalizeWindowsPath(entry.path).split('/')) to throw an uncaught TypeError when it attempts to call a string method on a numeric value. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Denial of service in NI grpc-device 2.17.0 and earlier allows an authenticated remote attacker to crash or destabilize the gRPC server by sending a crafted BeginSidebandStream message containing an out-of-range enum value. The unchecked cast triggers undefined behavior in the server process, with no public exploit identified at time of analysis. The flaw is reported by the vendor and tracked under GHSA-prfr-q8h3-mqxv.
Denial of service in the Go golang.org/x/crypto/ssh package (versions prior to 0.52.0) allows remote unauthenticated attackers to crash SSH server processes by sending crafted AES-GCM encrypted packets. An incorrectly placed bytes-to-int cast in the AES-GCM packet decoder triggers a server-side panic when processing well-crafted inputs. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.02%.
Remote denial of service in Coturn TURN/STUN server allows unauthenticated attackers to crash ARM64 deployments with a single malformed UDP packet. The vulnerability triggers a fatal SIGBUS signal via misaligned memory access during STUN attribute parsing, requiring no authentication or special configuration. All ARM64 installations of Coturn prior to 4.10.0 are vulnerable to instant process termination. EPSS exploitation probability is not yet available as this is a newly disclosed CVE, but the attack complexity is low (AC:L) and requires no privileges (PR:N), making exploitation trivial once awareness spreads in attacker communities.