Information Disclosure
Monthly
Improper access controls in Ningyuanda TC155 firmware 57.0.2.0 ONVIF Device Management Service allows unauthenticated local network attackers to trigger a factory reset by manipulating the FactoryDefault argument with 'Hard' input, resulting in information disclosure and configuration loss. Publicly available exploit code exists; vendor has not responded to disclosure attempts.
Template injection in CTCMS up to version 2.1.2 allows authenticated remote attackers to bypass template engine protections via improper neutralization of special elements in the Frontend/Template Management Module. The vulnerability affects the CT_Parser.php library and enables information disclosure with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, though EPSS exploitation probability remains low at 0.09% (26th percentile), suggesting limited real-world weaponization despite POC availability.
Heap-based buffer overflow in Autodesk Shared Components - the shared file-parsing libraries used by multiple Autodesk applications to read CATIA V5 CATPRODUCT product/assembly files - allows an attacker who convinces a user to open a crafted file to crash the application, read sensitive memory contents, or execute arbitrary code in the context of the current process. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a local, user-interaction-driven attack: no authentication to the host is required, but the attacker must first deliver the file to the victim and the victim must explicitly open it, and impact stays within the privileges of the user running the Autodesk product. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Sensitive information disclosure in Hitron HI3120 firmware 7.2.4.5.2b1 exposes credentials or session data to a local low-privileged attacker through the device's web management interface Logout function in index.html. The root cause, indicated by the 'Insufficient Session Expiration' tag, is that the logout action fails to fully invalidate or clear sensitive session artifacts, leaving them recoverable post-logout. No active exploitation is confirmed (EPSS 0.11%, 1st percentile), and the attack surface is constrained to local access with low privileges, significantly limiting real-world impact despite the High confidentiality rating.
Sixun Shanghui Group Business Management System 4.10.24.3 allows unauthenticated remote attackers to access files and directories through the /ExportFiles/ endpoint due to improper access controls, resulting in information disclosure of sensitive data. The vulnerability requires high attack complexity and has publicly available exploit code, but remains difficult to exploit in practice with an EPSS score of 0.06% indicating minimal real-world exploitation probability.
Remote code execution via dynamic code resource manipulation in SamuNatsu HaloBot's Inter-plugin API allows authenticated remote attackers to execute arbitrary code by manipulating the action argument in the html_renderer plugin. The vulnerability affects unsupported legacy versions of the product (commit hash 026b01d4a896d93eaaf9d5163a287dc9f267515b and earlier), with publicly available exploit code disclosed but no vendor-released patch, as the maintainer has abandoned the project and did not respond to early disclosure.
Symlink following in the USB Handler of Ugreen DH2100+ firmware up to 5.3.0 enables a physically present attacker with high privileges to achieve full system compromise. Exploit code is publicly available but the attack cannot be executed remotely and requires administrative access. The low EPSS score (0.01%) reflects the limited exploitation conditions.
Improper access controls in DecoCMS Mesh up to 1.0.0-alpha.31 allow remote attackers to manipulate the domain argument in the createTool function of the Workspace Domain Handler, resulting in unauthorized information disclosure. The vulnerability requires high attack complexity and has published exploit code available, though real-world exploitation appears difficult. CVSS score of 2.9 reflects low severity with limited confidentiality impact, while EPSS scoring at 25th percentile suggests minimal real-world exploitation probability.
MartialBE one-hub up to version 0.14.27 uses a hard-coded cryptographic key in the SESSION_SECRET environment variable of its default docker-compose.yml configuration, allowing remote attackers to potentially decrypt or forge session tokens with high attack complexity. The vulnerability requires non-standard deployment configurations and affects confidentiality rather than integrity or availability. Exploit code has been disclosed publicly, though active exploitation remains unconfirmed by CISA, and the vendor explicitly recommends against using the default Docker Compose example in production environments.
Weak cryptographic hashing in the image_check function of Tenda AX9 firmware 22.03.01.46 allows remote attackers to compromise firmware integrity validation without authentication. The vulnerability has a CVSS score of 2.9 (very low severity) and publicly available exploit code exists, but the high attack complexity and difficult exploitability rating indicate practical barriers to successful exploitation. Real-world risk is minimal: while the vulnerability permits information disclosure related to hash values, it does not enable remote code execution or device takeover.
PHP object injection in Doubly Cross Domain Copy Paste plugin (≤1.0.46) allows authenticated attackers with Subscriber-level privileges to execute arbitrary code via deserialized untrusted input from uploaded ZIP archives. Exploitation requires administrators to explicitly enable Subscriber access. Available POP chains enable code execution, file deletion, and sensitive data retrieval. Attack vector requires low privilege (PR:L) authentication with network accessibility and no user interaction. No public exploit identified at time of analysis.
A buffer information disclosure vulnerability exists in the Aircompressor Java compression library affecting Snappy and LZ4 decompressor implementations. Versions 3.3 and below of Airlift Aircompressor allow remote attackers to read previous buffer contents through crafted compressed input, potentially leaking sensitive data from applications that reuse output buffers across multiple decompression operations. With an EPSS score of 0.19% (41st percentile), active exploitation appears low probability despite the network-accessible attack vector, and no public proof-of-concept is currently documented.
Improper file handling in macOS allows local applications to access protected user data through a logic flaw in the operating system's file access controls. The vulnerability affects macOS Sequoia, Sonoma, and Tahoe, requiring user interaction to trigger exploitation and resulting in unauthorized disclosure of sensitive information without the ability to modify or disable system access. Apple has released patched versions (macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2), with no public exploit code identified at time of analysis.
Local apps can access sensitive user data through improved privacy controls in Apple operating systems across iOS, iPadOS, macOS, visionOS, and watchOS. The vulnerability requires local network access and an authenticated user session (PR:L), limiting exposure to installed applications with explicit permissions. Confirmed patches are available across all affected platforms, and exploitation probability is very low (EPSS 0.02%), indicating this is a privacy-boundary issue rather than a critical security flaw.
Password field disclosure in Apple operating systems allows remote observation of credentials during FaceTime screen sharing sessions. Affects iOS/iPadOS 18.x through 18.7.2, iOS/iPadOS 26.0-26.1, macOS Sequoia through 15.7.2, macOS Tahoe through 26.1, and visionOS through 26.1. Attackers with network access to FaceTime sessions can view password fields that should be masked, creating credential exposure risk during remote support or collaboration scenarios. EPSS score of 0.03% (10th percentile) indicates low automated exploitation probability, and no public exploit identified at time of analysis.
Local apps can access sensitive user data through inadequate log redaction in Apple's operating systems, affecting iOS 18.7.2 and earlier, iPadOS 18.7.2 and earlier, iOS 26.1 and earlier, iPadOS 26.1 and earlier, macOS Sonoma 14.8.2 and earlier, macOS Tahoe 26.1 and earlier, visionOS 26.1 and earlier, and watchOS 26.1 and earlier. The vulnerability requires local app execution with limited user privileges but no interaction, resulting in unauthorized read access to sensitive data stored in application logs. While EPSS probability is minimal (0.01%), the local attack vector and high confidentiality impact warrant patching in environments where untrusted apps may be installed.
Local apps on Apple macOS and iPadOS can access sensitive user data through inadequate information disclosure controls, requiring local execution and low-level user privileges. Affected versions include iOS 18.7.2 and earlier, iPadOS 18.7.2 and earlier, macOS Sequoia 15.7.2 and earlier, macOS Sonoma 14.8.2 and earlier, and macOS Tahoe 26.1 and earlier. Apple has released patched versions (iOS 18.7.3, iPadOS 18.7.3, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2) with improved access controls to restrict unauthorized data exposure. With an EPSS score of 0.02% (4th percentile) and no public exploit code identified at time of analysis, this represents a low real-world exploitation probability despite the moderate CVSS score.
Local privilege escalation in macOS allows unprivileged applications to access sensitive user data through a permissions bypass. Affects macOS Sequoia versions prior to 15.7.3 and macOS Tahoe prior to 26.2. Attack requires local system access and user interaction (UI:R). EPSS exploitation probability is very low at 0.02%, and no public exploit code or active exploitation has been reported.
Intel-based Mac computers running macOS Sequoia prior to 15.7.3 or macOS Tahoe prior to 26.2 are vulnerable to a cryptographic downgrade attack that allows unprivileged local applications to bypass code-signing restrictions and access sensitive user data. The vulnerability exploits inadequate validation of signed components, enabling information disclosure through JWT or similar signed-data attacks. Active exploitation has not been confirmed, and the extremely low EPSS score (0.01%) indicates minimal real-world exploitation risk despite the local attack vector.
Local privilege escalation on Intel-based macOS systems allows unsigned or weakly-signed applications to access sensitive user data by downgrading code-signing protections through cryptographic validation bypass. The vulnerability affects macOS Sequoia prior to 15.7.3 and macOS Tahoe prior to 26.2, requires user interaction to execute a malicious app, and has an extremely low exploitation probability (EPSS 0.01%) despite moderate CVSS severity. No active exploitation or public exploit code has been identified.
Local privilege escalation in macOS allows authenticated applications to access sensitive user data through insufficient permission restrictions on Sequoia, Sonoma, and Tahoe versions. The vulnerability requires local access and low-privilege user context but enables high-impact confidentiality compromise without requiring user interaction or elevated privileges to trigger. A vendor-released patch is available across all affected macOS versions.
Local privilege escalation in Apple's spellcheck API allows authenticated users to inappropriately access files on macOS, iOS, and related platforms through a logic flaw in access controls. Affected versions include macOS Sonoma 14.x and earlier, macOS Sequoia 15.7.2 and earlier, iOS 18.x and earlier, iPadOS 18.x and earlier, and watchOS 11.x and earlier. This vulnerability requires local access and user-level privileges but carries a low EPSS score (0.01%, percentile 3%) indicating minimal real-world exploitation likelihood at present. No public exploit code or active exploitation has been identified.
macOS logging system fails to redact protected user data from log entries, allowing local authenticated applications to access sensitive information through log files across Sequoia, Sonoma, and Tahoe versions. Apple addressed this privacy issue by improving data redaction mechanisms in patched versions (macOS Sequoia 15.7.3, Sonoma 14.8.3, Tahoe 26.2). No public exploit identified at time of analysis, with EPSS exploitation probability at 0.01% (3rd percentile), indicating minimal real-world risk despite local attack vector.
Session fixation in macOS Voice Control allows authenticated local users to transcribe another user's activity on the same system, disclosing sensitive information without user interaction. The vulnerability affects macOS Sequoia, Sonoma, and Tahoe and is fixed in versions 15.7.3, 14.8.3, and 26.2 respectively. Real-world risk is minimal due to low EPSS (0.01%), requirement for local access and prior authentication, and the need for Voice Control to be explicitly enabled.
Local arbitrary applications on macOS can read sensitive location information due to a permissions validation flaw (CWE-284), affecting macOS Sequoia, Sonoma, and Tahoe. The vulnerability requires user interaction to trigger but grants unauthorized access to location data without proper authorization checks. Apple has released patches in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, and macOS Tahoe 26.2 to remediate the issue by removing the vulnerable code. No public exploit or active exploitation has been confirmed.
Improper data access control in macOS allows local applications to read sensitive user data without explicit user consent, exploitable through user interaction. The vulnerability affects macOS Sequoia (before 15.7.3), macOS Sonoma (before 14.8.3), and macOS Tahoe (before 26.2). No public exploit code or active exploitation has been identified; EPSS probability is extremely low at 0.01%, indicating minimal real-world attack likelihood despite the moderate CVSS score.
Sensitive user data exposure in Apple macOS allows a locally-installed application to bypass access controls and read data outside its authorized scope, exploiting improper state management. Affected systems include macOS Sequoia prior to 15.7.4, macOS Sonoma prior to 14.8.4, and macOS Tahoe prior to 26.1. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact (CVSS C:H) warrants prompt patching on systems where untrusted applications may execute.
Path traversal vulnerability in macOS directory path handling allows local apps with user privileges to read sensitive user data through improper path validation. Affects macOS Sequoia (before 15.7.3), Sonoma (before 14.8.3), and Tahoe (before 26.1). EPSS score of 0.01% indicates minimal real-world exploitation likelihood despite moderate CVSS severity.
Local authenticated applications can access protected user data on macOS due to improper access control restrictions (CWE-284). This affects macOS Sequoia, Sonoma, and Tahoe across multiple versions and is fixed in Sequoia 15.7.3, Sonoma 14.8.3, and Tahoe 26.2. The vulnerability requires local access and authenticated user privileges to exploit, limiting real-world risk despite the confidentiality impact; no public exploit code or confirmed active exploitation has been identified.
Improper cache handling in macOS allows attackers with physical access to recover deleted notes from memory. The vulnerability affects macOS Sequoia (before 15.7.2), macOS Sonoma (before 14.8.2), and macOS Tahoe (before 26.2), exposing sensitive user data through inadequate data sanitization. No public exploit code has been identified, and the extremely low EPSS score (0.02%) reflects the requirement for physical device access, making real-world exploitation unlikely outside of targeted scenarios involving stolen or temporarily compromised hardware.
Yalantis uCrop 2.2.11 contains an improperly exported Android application component (UCropActivity) in AndroidManifest.xml that allows local attackers with application-level privileges to access the component via intent manipulation, potentially disclosing sensitive information. The vulnerability requires local access and user application permissions but affects confidentiality with low impact. Public exploit code is available, though the EPSS score of 0.06% suggests limited real-world exploitation despite public disclosure.
FreePBX Endpoint Manager versions before 16.0.96 and 17.0.1 through 17.0.9 ship with a weak default app_password of only six numeric digits, which unauthenticated remote attackers can brute force to recover the credential; depending on local mapping that same password may grant access to extension, voicemail, User Manager, DPMA, or EPM phone admin functions. Severity is moderate and the impact is bounded to low confidentiality and integrity effects (CVSS v4.0 base 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N; the independent assessment confirms remote unauthenticated reach with low C/I impact and no availability impact). EPSS is 0.27% (17th percentile) and no public exploit or CISA KEV listing was identified at time of analysis. Vendor fixes are available in 16.0.96 and 17.0.10.
Okta Java SDK versions 11.0.0 through 20.0.0 allow concurrent ApiClient requests to cross-contaminate response status codes and headers, which can undermine access-control decisions in multithreaded applications. This is a timing-dependent race condition (CWE-362) that is not remotely exploitable against default deployments; exploitation requires an application that invokes ApiClient concurrently and bases authorization on its response status or headers. No public exploit or active exploitation has been identified, and EPSS is low at 0.21%, but a vendor patch is available in version 20.0.1 (GHSA text says 21.0.0+).
Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) firmware automatically collect and transmit sensitive information over the network in cleartext, with no user disclosure or opt-in, in the devices' default operating mode. Because the data is not encrypted, anyone positioned to observe the hubs' traffic - a device on the same LAN/Wi-Fi segment or an on-path upstream device - can read the collected information; no authentication or user interaction is required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N per this assessment; NVD rates it AV:N for 7.5). This is a privacy/data-protection weakness rather than a high-severity remote compromise: EPSS is 0.19% (8th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating active exploitation.
Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) accept firmware images without properly validating their signatures and rely on outdated cryptographic primitives that can be abused to forge a signature that passes verification, allowing a remote attacker to install arbitrary malicious firmware on the hub. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates no authentication or user interaction is needed, but high attack complexity because the attacker must be positioned to deliver the image to the device - typically by intercepting the OTA/update channel. Publicly available exploit code exists per the referenced report, but there is no evidence of confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile), so risk is serious in impact yet low in observed urgency for most defenders.
Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 fail to validate TLS server certificates in discovery services and CoAP gateway communications, enabling man-in-the-middle attacks that can control or monitor connected devices. An unauthenticated on-path attacker (e.g., with a compromised router or rogue access point) can exploit this without user interaction, though the high attack complexity (AC:H) reflects the need for a MITM position. Publicly available exploit code exists, but EPSS is low (0.18%), and no active exploitation is confirmed.
Aqara Hub devices - Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027) and Hub M3 (4.3.6_0025) - skip TLS server-certificate validation when fetching firmware over HTTPS, so an attacker holding a man-in-the-middle position on the network path can intercept the OTA session and potentially deliver modified firmware to the device. The weakness is remotely triggerable without authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, 7.4), but exploitation is conditional: the attacker must already control the network path and must catch the device during an actual firmware-download window. Exploit detail is publicly available, and EPSS is low at 0.18% (6th percentile); there is no indication of confirmed active exploitation (not in CISA KEV).
Local information disclosure in Zoom Rooms for macOS before version 6.6.0 allows an authenticated local user to exploit external control of a file name or path, potentially reading arbitrary files accessible to the Zoom Rooms process. The vulnerability requires an existing authenticated session on the host (PR:L) and cannot be triggered remotely or without authentication. With a CVSS base score of 5.5 and an EPSS score of 0.14%, it poses a low-priority risk; no public exploit code or active exploitation has been identified at time of analysis.
User enumeration in Pega Platform can reveal whether a supplied username is valid when the deprecated basic-credentials authentication service type is enabled, affecting versions 7.1.0 through Infinity 25.1.0. The issue depends on measurable response-time differences during authentication, and the independent assessment rates it low priority because it requires the deprecated service and reliable timing discrimination; no credentials, data, or system control are obtained. Patches are available in 24.1.4, 24.2.4, and 25.1.1; EPSS is 0.44% (36th percentile) and no public exploit identified at time of analysis.
Keycloak Admin REST API discloses sensitive role metadata through insufficient authorization checks on the /admin/realms/{realm}/roles endpoint, allowing high-privileged authenticated users to access role information they should not have permission to view. With a CVSS score of 2.7 and EPSS of 0.01%, this is a low-severity information disclosure affecting confidentiality only; no public exploit identified at time of analysis.
Wireless network compromise of EZCast Pro II dongles before version 1.17478.177 occurs because the device's Access Point mode uses a predictable default Wi-Fi password derived from observable identifiers, allowing any attacker within radio range to compute the credential and join the dongle's network. CVSS 4.0 score 9.3 reflects adjacent-network attack vector with no authentication required, and no public exploit identified at time of analysis, though the algorithm is reportedly reversible from broadcast data.
Remote code execution in Google Cloud Data Fusion (built on the CDAP platform) allows an authenticated principal who holds artifact-upload permissions on an instance to execute arbitrary code inside the core AppFabric component through unsafe deserialization of a crafted artifact. Successful exploitation gives the attacker control of the Data Fusion instance, enabling unauthorized access to sensitive data, tampering with data pipelines, and reconnaissance of the underlying infrastructure. No public exploit code has been identified at time of analysis, the EPSS score is low (0.44%, 36th percentile), and the issue is not listed in CISA KEV, so it is a credible but non-emergency authenticated RCE that still warrants prompt patching. Vendor-released fixes are available in CDAP 6.10.6+ and 6.11.1+.
The CNI portmap plugin versions 1.6.0 through 1.8.0 contain a traffic interception vulnerability when configured with the nftables backend, allowing containers to receive and intercept all traffic destined for their configured HostPort regardless of destination IP address. This affects Linux Foundation's CNI Network Plugins, and an attacker with local privileges and control over a container can intercept traffic intended for other containers or services on the same node. The vulnerability has a published patch available in version 1.9.0, an extremely low EPSS score of 0.02% indicates minimal real-world exploitation likelihood, and there is no indication of active exploitation in the wild.
Out-of-bounds read in Adobe Acrobat and Acrobat Reader (versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier across Classic and Continuous tracks) can lead to arbitrary code execution in the context of the current user when a crafted PDF file is opened. The attack vector is local (AV:L) and requires user interaction (UI:R) - no authentication (PR:N) or special configuration is needed, but the victim must be socially engineered into opening a malicious file, and code runs only at the user's privilege level (S:U). No public exploit code or confirmed active exploitation is identified at time of analysis; this is a genuine patch-priority issue for endpoints rather than an emergency for internet-facing infrastructure.
Privilege escalation in Microsoft Exchange Server 2016 (and Subscription Edition per vendor tagging) allows an authenticated attacker on the network to elevate privileges through improper input validation (CWE-20). The flaw carries a CVSS 7.5 score with high impact to confidentiality, integrity, and availability, though attack complexity is rated High. No public exploit identified at time of analysis.
Unauthenticated remote attackers who already know a target FortiWeb appliance's serial number can forge a cookie that the device accepts without integrity checking, allowing arbitrary operations through a single crafted HTTP or HTTPS request. Affected releases are FortiWeb 8.0.0 through 8.0.1, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11; no public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis. CVSS 3.1 scores this 8.1 with AC:H solely because of the serial-number prerequisite, which narrows opportunistic mass exploitation but does not protect a targeted attacker who can obtain or enumerate the serial, so this remains a real priority despite that mitigating access-complexity factor.
Local file inclusion in the Hara WordPress theme (versions <= 1.2.17) allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to sensitive data exposure, code execution via PHP file inclusion chains, or full site takeover. The attack requires high complexity, and no exploit code or active exploitation has been publicly identified at the time of analysis.
Local File Inclusion vulnerability in the Turitor WordPress theme before version 1.5.3 allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to information disclosure, code execution, or denial of service. No public exploit or active exploitation known at this time.
Local file inclusion vulnerability in thembay's Besa WordPress theme (versions <=2.3.15) allows authenticated users with low privileges to include arbitrary local files, potentially exposing sensitive data or enabling code execution. The CVSS 3.1 base score of 7.5 reflects high impact but requires authentication and high attack complexity. No active exploitation or public exploit code is known at the time of analysis.
Authenticated local file inclusion in the Fashion WordPress theme versions below 5.3.0 allows low-privilege attackers to read arbitrary files and potentially execute code through path traversal in include/require statements. No active exploitation or public proof of concept is known at this time; EPSS probability of exploitation is low (0.22%).
Local file inclusion in the Urna WordPress theme version 2.5.12 and earlier allows authenticated low-privilege users to include arbitrary local files, potentially leading to remote code execution. The vulnerability is not known to be actively exploited and has a very low EPSS score, though the CVSS base score is 7.5 due to potential for full system compromise.
Local File Inclusion in the Digiqole WordPress theme allows authenticated users to include arbitrary local files, leading to potential full system compromise. Versions prior to 2.2.7 are affected. The vulnerability has a high CVSS score but low EPSS exploitation probability and no known public exploit or active exploitation.
Local file inclusion in the ThimPress Sailing WordPress theme before version 4.4.6 allows authenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving remote code execution. The vulnerability carries a CVSS 3.1 base score of 7.5 (High) with a low EPSS probability (0.22%), indicating no active exploitation or publicly available exploit code at this time.
Authenticated local file inclusion in the ekommart WordPress theme before version 4.3.1 allows low-privileged users to read arbitrary files on the server, potentially leading to remote code execution. The vulnerability stems from improper validation of user-supplied input used in PHP include statements.
Local file inclusion in Jobmonster Elementor Addon up to 1.1.4 allows authenticated attackers with low privileges to include arbitrary local files. Successful exploitation can lead to high confidentiality, integrity, and availability impacts. No active exploitation or public exploit code is currently known; EPSS score is low.
Local File Inclusion in the Exhibz WordPress theme (version ≤ 3.0.9) allows authenticated attackers with low privileges to include arbitrary local files on the server, potentially leading to sensitive data exposure or-when combined with file upload-remote code execution. Exploitation requires high attack complexity and no user interaction; there is no evidence of active exploitation or public exploit code as of this analysis.
Local file inclusion in Jobmonster theme (≤4.8.2) allows authenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution via chaining. The vulnerability requires low-privileged access (PR:L) and high attack complexity (AC:H), reducing real-world exploitability. EPSS score 0.22% suggests low exploitation probability, and no active exploits are confirmed.
Authenticated local file inclusion in Select Core WordPress plugin versions <2.6 allows low-privileged attackers to include arbitrary local files. Under certain configurations, this can escalate to full site compromise, including information disclosure and code execution. At time of analysis, no public exploit or active exploitation has been identified; CVSS 7.5 and EPSS 0.22% indicate a high-severity but currently low-probability risk.
Local file inclusion in Wilmër WordPress theme versions before 3.5 allows authenticated attackers to include arbitrary local files, leading to sensitive information disclosure and potential remote code execution. No public exploit or active exploitation has been reported at time of analysis; EPSS score is low (0.22%).
Insertion of sensitive information into sent data in auxin-elements WordPress plugin versions up to 2.17.15 allows unauthenticated remote attackers to retrieve embedded sensitive data through network-accessible responses. The vulnerability exposes information with low confidentiality impact and affects the Shortcodes and extra features for Phlox theme plugin across all versions through 2.17.15, with EPSS scoring indicating 0.04% likelihood of exploitation.
Local file inclusion in WordPress UDesign Core plugin up to 4.14.0 allows authenticated low-privilege attackers to include arbitrary local files, potentially exposing sensitive data or enabling code execution. The vulnerability requires high attack complexity and is not known to be actively exploited, but carries high impact if successfully leveraged.
Custom Field Template WordPress plugin through version 2.7.6 exposes sensitive system information to high-privilege local users via embedded data retrieval, allowing administrators to access confidential data they should not have access to. The vulnerability requires high administrative privileges and local access, limiting real-world exploitation risk despite the complete confidentiality impact. EPSS probability is minimal at 0.02%, indicating low likelihood of opportunistic exploitation.
A local file inclusion vulnerability in the Ronneby Theme Core WordPress plugin (≤1.5.68) allows authenticated low-privilege attackers to include arbitrary local PHP files, potentially leading to sensitive data exposure or code execution. Exploitation requires an account on the WordPress site and high attack complexity due to filename manipulation. No active exploitation or public exploit code has been reported.
Authenticated information disclosure in ThimPress WP Hotel Booking plugin for WordPress up to version 2.2.7 allows low-privileged users to retrieve embedded sensitive data, such as configuration details. No active exploitation or public exploit code is known at this time, and EPSS indicates a very low probability of widespread exploitation.
Sensitive data exposure in the INFINITUM FORM Geo Controller (cf-geoplugin) WordPress plugin through version 8.9.4 allows unauthenticated remote attackers to retrieve embedded sensitive data via network requests. The vulnerability, categorized as CWE-201, has low detection complexity without user interaction. While no active exploitation (CISA KEV) or public proof-of-concept is reported, the EPSS probability is low at 0.06%, and the publicly disclosed Patchstack advisory indicates a fix is available.
A slab use-after-free in the Linux kernel's Intel AVS (Audio Voice Speech / Smart Sound Technology) ASoC driver lets a local user with access to a HOST HDAudio PCM stream corrupt kernel memory by racing PCM close against period-elapsed IRQ work. When avs_dai_fe_shutdown() frees the DAI's private context while the period-elapsed work is still servicing interrupts, the freed structure can be accessed concurrently, yielding a use-after-free with high confidentiality, integrity and availability impact (CVSS 7.8, AV:L). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.20%, 10th percentile), reflecting the local-only, hardware-specific nature of the flaw.
Denial-of-service (kernel use-after-free/double-free) in the Linux kernel's nvmet-fc NVMe-over-Fibre-Channel target driver allows a local privileged operator to crash the kernel by forcibly shutting down an NVMe target port via configfs. When a port is torn down, nvmet_port_subsys_drop_link() calls both nvmet_port_del_ctrls() and nvmet_disable_port(), each of which can schedule the same association-deletion work item; the first run frees all resources and the second reuses freed memory. This is a fix already merged upstream in the stable trees, with no public exploit identified at time of analysis and a low EPSS score (0.21%, 11th percentile).
Denial of service and potential memory corruption in the Linux kernel's NVMe over Fibre Channel (nvme-fc) transport arises because nvme_fc_create_association reads the remote port_state and increments the rport active count without holding a lock, racing against nvme_fc_unregister_remote which can free the remote port when no active association exists. An attacker or fault condition on the FC fabric able to trigger reconnect events concurrently with port teardown can drive a use-after-free style condition on the rport object. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile).
Data-integrity corruption in the Linux kernel's stmmac (Synopsys DesignWare/STMMAC) Ethernet driver allows malformed packets that failed hardware checksum validation to be accepted as valid by the network stack. When hardware checksum offload (CoE) is enabled, the Rx path marked known IP-ethertype frames as CHECKSUM_UNNECESSARY without honoring the hardware's reported header/payload checksum error, so corrupt frames bypass the stack's own validation. There is no public exploit identified at time of analysis, KEV status is not listed, and EPSS is low (0.20%, 11th percentile).
Local privilege-escalation and memory-disclosure flaw in the Linux kernel's DRM GPU SVM (Shared Virtual Memory) subsystem, where incorrect use of hmm_pfn_to_map_order() mishandles an HMM range that only partially covers a huge page (e.g. 2MB), causing the driver to map physical memory outside the intended range - memory that may not even belong to the faulting process's address space. Affecting recent kernels carrying the drm/gpusvm code (associated with the Intel Xe GPU driver's userptr/SVM path), a local user with GPU access can trigger cross-boundary mappings leading to information disclosure or memory corruption. There is no public exploit identified at time of analysis, and EPSS is low at 0.19% (9th percentile).
Local memory-safety flaw in the Linux kernel's AMD GPU (amdgpu) driver allows an authenticated local user to submit a user queue (userq) whose buffer virtual address and size are not validated against a legitimate VM mapping. Because the driver failed to confirm the userq object resides in a valid GPU virtual-memory mapping before use, a low-privileged process with GPU device access could reference out-of-bounds or unmapped memory, tagged as an information-disclosure issue with additional integrity and availability impact. No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile), consistent with a local-only kernel driver bug rather than a mass-exploited network flaw.
Use-after-free in the Linux kernel's SMB client (cifs) cached-directory handling lets a race between find_or_create_cached_dir() and smb2_close_cached_fid() free a cfid object while a new reference is being taken, corrupting kernel memory on a host mounting an SMB/CIFS share. The flaw is a reference-counting gap fixed by switching to kref_put_lock() so cfid_release() runs under cfid_list_lock. No public exploit identified at time of analysis, EPSS is low (0.20%, 11th percentile), and it is not listed in CISA KEV.
Remote code execution in Mozilla Firefox and Thunderbird (pre-146) allows unauthenticated network attackers to execute arbitrary code via a use-after-free flaw in the GMP (Gecko Media Plugin) audio/video component. Despite a critical CVSS 9.8 rating, EPSS probability remains low (0.08%, 23rd percentile), and no public exploit identified at time of analysis. Mozilla patched both products in version 146, with vendor advisories and technical details available via Bugzilla.
JIT compiler miscompilation in Mozilla Firefox and Thunderbird's JavaScript engine enables remote attackers to achieve limited confidentiality, integrity, and availability impact without authentication or user interaction. Affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird ESR < 140.6. Vendor-released patches available in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. No public exploit identified at time of analysis, with EPSS score of 0.11% (30th percentile) indicating low predicted exploitation probability.
Sandbox escape in Mozilla Firefox and Thunderbird's CanvasWebGL component allows remote attackers to bypass security boundaries via crafted web content with user interaction. Affects Firefox <146, Firefox ESR <115.31 and <140.6, Thunderbird <146 and Thunderbird ESR <140.6. EPSS probability is low (0.06%, 20th percentile), and no public exploit identified at time of analysis. The CVSS score of 8.0 reflects high confidentiality and integrity impact with scope change, though attack complexity is high and requires user interaction.
Remote code execution via use-after-free in Mozilla Firefox and Thunderbird WebRTC signaling allows unauthenticated network attackers to execute arbitrary code without user interaction. Affects Firefox <146, Firefox ESR <140.6, Thunderbird <146, and Thunderbird ESR <140.6. Vendor-released patches available (Firefox 146, Firefox ESR 140.6, Thunderbird 146, Thunderbird 140.6). CVSS 9.8 (critical) reflects maximum technical severity, though EPSS 0.09% (25th percentile) and absence from CISA KEV suggest limited real-world exploitation at time of analysis. No public exploit identified at time of analysis.
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.18 could disclose sensitive user credentials in log files.
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 stores unencrypted sensitive information in environmental variables files which can be obtained by an authenticated user.
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 is vulnerable to creation of temporary files without atomic operations which may expose sensitive information to an authenticated user due to race condition attacks.
A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction. NOTE: this is disputed by the Supplier because the product's objective is "to discourage automated scraping / bots, not guarantee resistance to determined attackers." The documentation states “the goal is not to provide a secure cryptographic algorithm but to use a proof-of-work mechanism that allows any capable device to decrypt the hidden data.”
A security vulnerability in NUT-14 (CVSS 9.1) that allows cashu tokens. Risk factors: public PoC available.
CVE-2025-14261 is a security vulnerability (CVSS 7.1). High severity vulnerability requiring prompt remediation.
In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
In ProcessArea of dng_misc_opcodes.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible configuration data leak due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In initDecoder of C2SoftDav1dDec.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Improper access controls in Ningyuanda TC155 firmware 57.0.2.0 ONVIF Device Management Service allows unauthenticated local network attackers to trigger a factory reset by manipulating the FactoryDefault argument with 'Hard' input, resulting in information disclosure and configuration loss. Publicly available exploit code exists; vendor has not responded to disclosure attempts.
Template injection in CTCMS up to version 2.1.2 allows authenticated remote attackers to bypass template engine protections via improper neutralization of special elements in the Frontend/Template Management Module. The vulnerability affects the CT_Parser.php library and enables information disclosure with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, though EPSS exploitation probability remains low at 0.09% (26th percentile), suggesting limited real-world weaponization despite POC availability.
Heap-based buffer overflow in Autodesk Shared Components - the shared file-parsing libraries used by multiple Autodesk applications to read CATIA V5 CATPRODUCT product/assembly files - allows an attacker who convinces a user to open a crafted file to crash the application, read sensitive memory contents, or execute arbitrary code in the context of the current process. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a local, user-interaction-driven attack: no authentication to the host is required, but the attacker must first deliver the file to the victim and the victim must explicitly open it, and impact stays within the privileges of the user running the Autodesk product. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Sensitive information disclosure in Hitron HI3120 firmware 7.2.4.5.2b1 exposes credentials or session data to a local low-privileged attacker through the device's web management interface Logout function in index.html. The root cause, indicated by the 'Insufficient Session Expiration' tag, is that the logout action fails to fully invalidate or clear sensitive session artifacts, leaving them recoverable post-logout. No active exploitation is confirmed (EPSS 0.11%, 1st percentile), and the attack surface is constrained to local access with low privileges, significantly limiting real-world impact despite the High confidentiality rating.
Sixun Shanghui Group Business Management System 4.10.24.3 allows unauthenticated remote attackers to access files and directories through the /ExportFiles/ endpoint due to improper access controls, resulting in information disclosure of sensitive data. The vulnerability requires high attack complexity and has publicly available exploit code, but remains difficult to exploit in practice with an EPSS score of 0.06% indicating minimal real-world exploitation probability.
Remote code execution via dynamic code resource manipulation in SamuNatsu HaloBot's Inter-plugin API allows authenticated remote attackers to execute arbitrary code by manipulating the action argument in the html_renderer plugin. The vulnerability affects unsupported legacy versions of the product (commit hash 026b01d4a896d93eaaf9d5163a287dc9f267515b and earlier), with publicly available exploit code disclosed but no vendor-released patch, as the maintainer has abandoned the project and did not respond to early disclosure.
Symlink following in the USB Handler of Ugreen DH2100+ firmware up to 5.3.0 enables a physically present attacker with high privileges to achieve full system compromise. Exploit code is publicly available but the attack cannot be executed remotely and requires administrative access. The low EPSS score (0.01%) reflects the limited exploitation conditions.
Improper access controls in DecoCMS Mesh up to 1.0.0-alpha.31 allow remote attackers to manipulate the domain argument in the createTool function of the Workspace Domain Handler, resulting in unauthorized information disclosure. The vulnerability requires high attack complexity and has published exploit code available, though real-world exploitation appears difficult. CVSS score of 2.9 reflects low severity with limited confidentiality impact, while EPSS scoring at 25th percentile suggests minimal real-world exploitation probability.
MartialBE one-hub up to version 0.14.27 uses a hard-coded cryptographic key in the SESSION_SECRET environment variable of its default docker-compose.yml configuration, allowing remote attackers to potentially decrypt or forge session tokens with high attack complexity. The vulnerability requires non-standard deployment configurations and affects confidentiality rather than integrity or availability. Exploit code has been disclosed publicly, though active exploitation remains unconfirmed by CISA, and the vendor explicitly recommends against using the default Docker Compose example in production environments.
Weak cryptographic hashing in the image_check function of Tenda AX9 firmware 22.03.01.46 allows remote attackers to compromise firmware integrity validation without authentication. The vulnerability has a CVSS score of 2.9 (very low severity) and publicly available exploit code exists, but the high attack complexity and difficult exploitability rating indicate practical barriers to successful exploitation. Real-world risk is minimal: while the vulnerability permits information disclosure related to hash values, it does not enable remote code execution or device takeover.
PHP object injection in Doubly Cross Domain Copy Paste plugin (≤1.0.46) allows authenticated attackers with Subscriber-level privileges to execute arbitrary code via deserialized untrusted input from uploaded ZIP archives. Exploitation requires administrators to explicitly enable Subscriber access. Available POP chains enable code execution, file deletion, and sensitive data retrieval. Attack vector requires low privilege (PR:L) authentication with network accessibility and no user interaction. No public exploit identified at time of analysis.
A buffer information disclosure vulnerability exists in the Aircompressor Java compression library affecting Snappy and LZ4 decompressor implementations. Versions 3.3 and below of Airlift Aircompressor allow remote attackers to read previous buffer contents through crafted compressed input, potentially leaking sensitive data from applications that reuse output buffers across multiple decompression operations. With an EPSS score of 0.19% (41st percentile), active exploitation appears low probability despite the network-accessible attack vector, and no public proof-of-concept is currently documented.
Improper file handling in macOS allows local applications to access protected user data through a logic flaw in the operating system's file access controls. The vulnerability affects macOS Sequoia, Sonoma, and Tahoe, requiring user interaction to trigger exploitation and resulting in unauthorized disclosure of sensitive information without the ability to modify or disable system access. Apple has released patched versions (macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2), with no public exploit code identified at time of analysis.
Local apps can access sensitive user data through improved privacy controls in Apple operating systems across iOS, iPadOS, macOS, visionOS, and watchOS. The vulnerability requires local network access and an authenticated user session (PR:L), limiting exposure to installed applications with explicit permissions. Confirmed patches are available across all affected platforms, and exploitation probability is very low (EPSS 0.02%), indicating this is a privacy-boundary issue rather than a critical security flaw.
Password field disclosure in Apple operating systems allows remote observation of credentials during FaceTime screen sharing sessions. Affects iOS/iPadOS 18.x through 18.7.2, iOS/iPadOS 26.0-26.1, macOS Sequoia through 15.7.2, macOS Tahoe through 26.1, and visionOS through 26.1. Attackers with network access to FaceTime sessions can view password fields that should be masked, creating credential exposure risk during remote support or collaboration scenarios. EPSS score of 0.03% (10th percentile) indicates low automated exploitation probability, and no public exploit identified at time of analysis.
Local apps can access sensitive user data through inadequate log redaction in Apple's operating systems, affecting iOS 18.7.2 and earlier, iPadOS 18.7.2 and earlier, iOS 26.1 and earlier, iPadOS 26.1 and earlier, macOS Sonoma 14.8.2 and earlier, macOS Tahoe 26.1 and earlier, visionOS 26.1 and earlier, and watchOS 26.1 and earlier. The vulnerability requires local app execution with limited user privileges but no interaction, resulting in unauthorized read access to sensitive data stored in application logs. While EPSS probability is minimal (0.01%), the local attack vector and high confidentiality impact warrant patching in environments where untrusted apps may be installed.
Local apps on Apple macOS and iPadOS can access sensitive user data through inadequate information disclosure controls, requiring local execution and low-level user privileges. Affected versions include iOS 18.7.2 and earlier, iPadOS 18.7.2 and earlier, macOS Sequoia 15.7.2 and earlier, macOS Sonoma 14.8.2 and earlier, and macOS Tahoe 26.1 and earlier. Apple has released patched versions (iOS 18.7.3, iPadOS 18.7.3, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2) with improved access controls to restrict unauthorized data exposure. With an EPSS score of 0.02% (4th percentile) and no public exploit code identified at time of analysis, this represents a low real-world exploitation probability despite the moderate CVSS score.
Local privilege escalation in macOS allows unprivileged applications to access sensitive user data through a permissions bypass. Affects macOS Sequoia versions prior to 15.7.3 and macOS Tahoe prior to 26.2. Attack requires local system access and user interaction (UI:R). EPSS exploitation probability is very low at 0.02%, and no public exploit code or active exploitation has been reported.
Intel-based Mac computers running macOS Sequoia prior to 15.7.3 or macOS Tahoe prior to 26.2 are vulnerable to a cryptographic downgrade attack that allows unprivileged local applications to bypass code-signing restrictions and access sensitive user data. The vulnerability exploits inadequate validation of signed components, enabling information disclosure through JWT or similar signed-data attacks. Active exploitation has not been confirmed, and the extremely low EPSS score (0.01%) indicates minimal real-world exploitation risk despite the local attack vector.
Local privilege escalation on Intel-based macOS systems allows unsigned or weakly-signed applications to access sensitive user data by downgrading code-signing protections through cryptographic validation bypass. The vulnerability affects macOS Sequoia prior to 15.7.3 and macOS Tahoe prior to 26.2, requires user interaction to execute a malicious app, and has an extremely low exploitation probability (EPSS 0.01%) despite moderate CVSS severity. No active exploitation or public exploit code has been identified.
Local privilege escalation in macOS allows authenticated applications to access sensitive user data through insufficient permission restrictions on Sequoia, Sonoma, and Tahoe versions. The vulnerability requires local access and low-privilege user context but enables high-impact confidentiality compromise without requiring user interaction or elevated privileges to trigger. A vendor-released patch is available across all affected macOS versions.
Local privilege escalation in Apple's spellcheck API allows authenticated users to inappropriately access files on macOS, iOS, and related platforms through a logic flaw in access controls. Affected versions include macOS Sonoma 14.x and earlier, macOS Sequoia 15.7.2 and earlier, iOS 18.x and earlier, iPadOS 18.x and earlier, and watchOS 11.x and earlier. This vulnerability requires local access and user-level privileges but carries a low EPSS score (0.01%, percentile 3%) indicating minimal real-world exploitation likelihood at present. No public exploit code or active exploitation has been identified.
macOS logging system fails to redact protected user data from log entries, allowing local authenticated applications to access sensitive information through log files across Sequoia, Sonoma, and Tahoe versions. Apple addressed this privacy issue by improving data redaction mechanisms in patched versions (macOS Sequoia 15.7.3, Sonoma 14.8.3, Tahoe 26.2). No public exploit identified at time of analysis, with EPSS exploitation probability at 0.01% (3rd percentile), indicating minimal real-world risk despite local attack vector.
Session fixation in macOS Voice Control allows authenticated local users to transcribe another user's activity on the same system, disclosing sensitive information without user interaction. The vulnerability affects macOS Sequoia, Sonoma, and Tahoe and is fixed in versions 15.7.3, 14.8.3, and 26.2 respectively. Real-world risk is minimal due to low EPSS (0.01%), requirement for local access and prior authentication, and the need for Voice Control to be explicitly enabled.
Local arbitrary applications on macOS can read sensitive location information due to a permissions validation flaw (CWE-284), affecting macOS Sequoia, Sonoma, and Tahoe. The vulnerability requires user interaction to trigger but grants unauthorized access to location data without proper authorization checks. Apple has released patches in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, and macOS Tahoe 26.2 to remediate the issue by removing the vulnerable code. No public exploit or active exploitation has been confirmed.
Improper data access control in macOS allows local applications to read sensitive user data without explicit user consent, exploitable through user interaction. The vulnerability affects macOS Sequoia (before 15.7.3), macOS Sonoma (before 14.8.3), and macOS Tahoe (before 26.2). No public exploit code or active exploitation has been identified; EPSS probability is extremely low at 0.01%, indicating minimal real-world attack likelihood despite the moderate CVSS score.
Sensitive user data exposure in Apple macOS allows a locally-installed application to bypass access controls and read data outside its authorized scope, exploiting improper state management. Affected systems include macOS Sequoia prior to 15.7.4, macOS Sonoma prior to 14.8.4, and macOS Tahoe prior to 26.1. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact (CVSS C:H) warrants prompt patching on systems where untrusted applications may execute.
Path traversal vulnerability in macOS directory path handling allows local apps with user privileges to read sensitive user data through improper path validation. Affects macOS Sequoia (before 15.7.3), Sonoma (before 14.8.3), and Tahoe (before 26.1). EPSS score of 0.01% indicates minimal real-world exploitation likelihood despite moderate CVSS severity.
Local authenticated applications can access protected user data on macOS due to improper access control restrictions (CWE-284). This affects macOS Sequoia, Sonoma, and Tahoe across multiple versions and is fixed in Sequoia 15.7.3, Sonoma 14.8.3, and Tahoe 26.2. The vulnerability requires local access and authenticated user privileges to exploit, limiting real-world risk despite the confidentiality impact; no public exploit code or confirmed active exploitation has been identified.
Improper cache handling in macOS allows attackers with physical access to recover deleted notes from memory. The vulnerability affects macOS Sequoia (before 15.7.2), macOS Sonoma (before 14.8.2), and macOS Tahoe (before 26.2), exposing sensitive user data through inadequate data sanitization. No public exploit code has been identified, and the extremely low EPSS score (0.02%) reflects the requirement for physical device access, making real-world exploitation unlikely outside of targeted scenarios involving stolen or temporarily compromised hardware.
Yalantis uCrop 2.2.11 contains an improperly exported Android application component (UCropActivity) in AndroidManifest.xml that allows local attackers with application-level privileges to access the component via intent manipulation, potentially disclosing sensitive information. The vulnerability requires local access and user application permissions but affects confidentiality with low impact. Public exploit code is available, though the EPSS score of 0.06% suggests limited real-world exploitation despite public disclosure.
FreePBX Endpoint Manager versions before 16.0.96 and 17.0.1 through 17.0.9 ship with a weak default app_password of only six numeric digits, which unauthenticated remote attackers can brute force to recover the credential; depending on local mapping that same password may grant access to extension, voicemail, User Manager, DPMA, or EPM phone admin functions. Severity is moderate and the impact is bounded to low confidentiality and integrity effects (CVSS v4.0 base 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N; the independent assessment confirms remote unauthenticated reach with low C/I impact and no availability impact). EPSS is 0.27% (17th percentile) and no public exploit or CISA KEV listing was identified at time of analysis. Vendor fixes are available in 16.0.96 and 17.0.10.
Okta Java SDK versions 11.0.0 through 20.0.0 allow concurrent ApiClient requests to cross-contaminate response status codes and headers, which can undermine access-control decisions in multithreaded applications. This is a timing-dependent race condition (CWE-362) that is not remotely exploitable against default deployments; exploitation requires an application that invokes ApiClient concurrently and bases authorization on its response status or headers. No public exploit or active exploitation has been identified, and EPSS is low at 0.21%, but a vendor patch is available in version 20.0.1 (GHSA text says 21.0.0+).
Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) firmware automatically collect and transmit sensitive information over the network in cleartext, with no user disclosure or opt-in, in the devices' default operating mode. Because the data is not encrypted, anyone positioned to observe the hubs' traffic - a device on the same LAN/Wi-Fi segment or an on-path upstream device - can read the collected information; no authentication or user interaction is required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N per this assessment; NVD rates it AV:N for 7.5). This is a privacy/data-protection weakness rather than a high-severity remote compromise: EPSS is 0.19% (8th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating active exploitation.
Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) accept firmware images without properly validating their signatures and rely on outdated cryptographic primitives that can be abused to forge a signature that passes verification, allowing a remote attacker to install arbitrary malicious firmware on the hub. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates no authentication or user interaction is needed, but high attack complexity because the attacker must be positioned to deliver the image to the device - typically by intercepting the OTA/update channel. Publicly available exploit code exists per the referenced report, but there is no evidence of confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile), so risk is serious in impact yet low in observed urgency for most defenders.
Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 fail to validate TLS server certificates in discovery services and CoAP gateway communications, enabling man-in-the-middle attacks that can control or monitor connected devices. An unauthenticated on-path attacker (e.g., with a compromised router or rogue access point) can exploit this without user interaction, though the high attack complexity (AC:H) reflects the need for a MITM position. Publicly available exploit code exists, but EPSS is low (0.18%), and no active exploitation is confirmed.
Aqara Hub devices - Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027) and Hub M3 (4.3.6_0025) - skip TLS server-certificate validation when fetching firmware over HTTPS, so an attacker holding a man-in-the-middle position on the network path can intercept the OTA session and potentially deliver modified firmware to the device. The weakness is remotely triggerable without authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, 7.4), but exploitation is conditional: the attacker must already control the network path and must catch the device during an actual firmware-download window. Exploit detail is publicly available, and EPSS is low at 0.18% (6th percentile); there is no indication of confirmed active exploitation (not in CISA KEV).
Local information disclosure in Zoom Rooms for macOS before version 6.6.0 allows an authenticated local user to exploit external control of a file name or path, potentially reading arbitrary files accessible to the Zoom Rooms process. The vulnerability requires an existing authenticated session on the host (PR:L) and cannot be triggered remotely or without authentication. With a CVSS base score of 5.5 and an EPSS score of 0.14%, it poses a low-priority risk; no public exploit code or active exploitation has been identified at time of analysis.
User enumeration in Pega Platform can reveal whether a supplied username is valid when the deprecated basic-credentials authentication service type is enabled, affecting versions 7.1.0 through Infinity 25.1.0. The issue depends on measurable response-time differences during authentication, and the independent assessment rates it low priority because it requires the deprecated service and reliable timing discrimination; no credentials, data, or system control are obtained. Patches are available in 24.1.4, 24.2.4, and 25.1.1; EPSS is 0.44% (36th percentile) and no public exploit identified at time of analysis.
Keycloak Admin REST API discloses sensitive role metadata through insufficient authorization checks on the /admin/realms/{realm}/roles endpoint, allowing high-privileged authenticated users to access role information they should not have permission to view. With a CVSS score of 2.7 and EPSS of 0.01%, this is a low-severity information disclosure affecting confidentiality only; no public exploit identified at time of analysis.
Wireless network compromise of EZCast Pro II dongles before version 1.17478.177 occurs because the device's Access Point mode uses a predictable default Wi-Fi password derived from observable identifiers, allowing any attacker within radio range to compute the credential and join the dongle's network. CVSS 4.0 score 9.3 reflects adjacent-network attack vector with no authentication required, and no public exploit identified at time of analysis, though the algorithm is reportedly reversible from broadcast data.
Remote code execution in Google Cloud Data Fusion (built on the CDAP platform) allows an authenticated principal who holds artifact-upload permissions on an instance to execute arbitrary code inside the core AppFabric component through unsafe deserialization of a crafted artifact. Successful exploitation gives the attacker control of the Data Fusion instance, enabling unauthorized access to sensitive data, tampering with data pipelines, and reconnaissance of the underlying infrastructure. No public exploit code has been identified at time of analysis, the EPSS score is low (0.44%, 36th percentile), and the issue is not listed in CISA KEV, so it is a credible but non-emergency authenticated RCE that still warrants prompt patching. Vendor-released fixes are available in CDAP 6.10.6+ and 6.11.1+.
The CNI portmap plugin versions 1.6.0 through 1.8.0 contain a traffic interception vulnerability when configured with the nftables backend, allowing containers to receive and intercept all traffic destined for their configured HostPort regardless of destination IP address. This affects Linux Foundation's CNI Network Plugins, and an attacker with local privileges and control over a container can intercept traffic intended for other containers or services on the same node. The vulnerability has a published patch available in version 1.9.0, an extremely low EPSS score of 0.02% indicates minimal real-world exploitation likelihood, and there is no indication of active exploitation in the wild.
Out-of-bounds read in Adobe Acrobat and Acrobat Reader (versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier across Classic and Continuous tracks) can lead to arbitrary code execution in the context of the current user when a crafted PDF file is opened. The attack vector is local (AV:L) and requires user interaction (UI:R) - no authentication (PR:N) or special configuration is needed, but the victim must be socially engineered into opening a malicious file, and code runs only at the user's privilege level (S:U). No public exploit code or confirmed active exploitation is identified at time of analysis; this is a genuine patch-priority issue for endpoints rather than an emergency for internet-facing infrastructure.
Privilege escalation in Microsoft Exchange Server 2016 (and Subscription Edition per vendor tagging) allows an authenticated attacker on the network to elevate privileges through improper input validation (CWE-20). The flaw carries a CVSS 7.5 score with high impact to confidentiality, integrity, and availability, though attack complexity is rated High. No public exploit identified at time of analysis.
Unauthenticated remote attackers who already know a target FortiWeb appliance's serial number can forge a cookie that the device accepts without integrity checking, allowing arbitrary operations through a single crafted HTTP or HTTPS request. Affected releases are FortiWeb 8.0.0 through 8.0.1, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11; no public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis. CVSS 3.1 scores this 8.1 with AC:H solely because of the serial-number prerequisite, which narrows opportunistic mass exploitation but does not protect a targeted attacker who can obtain or enumerate the serial, so this remains a real priority despite that mitigating access-complexity factor.
Local file inclusion in the Hara WordPress theme (versions <= 1.2.17) allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to sensitive data exposure, code execution via PHP file inclusion chains, or full site takeover. The attack requires high complexity, and no exploit code or active exploitation has been publicly identified at the time of analysis.
Local File Inclusion vulnerability in the Turitor WordPress theme before version 1.5.3 allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to information disclosure, code execution, or denial of service. No public exploit or active exploitation known at this time.
Local file inclusion vulnerability in thembay's Besa WordPress theme (versions <=2.3.15) allows authenticated users with low privileges to include arbitrary local files, potentially exposing sensitive data or enabling code execution. The CVSS 3.1 base score of 7.5 reflects high impact but requires authentication and high attack complexity. No active exploitation or public exploit code is known at the time of analysis.
Authenticated local file inclusion in the Fashion WordPress theme versions below 5.3.0 allows low-privilege attackers to read arbitrary files and potentially execute code through path traversal in include/require statements. No active exploitation or public proof of concept is known at this time; EPSS probability of exploitation is low (0.22%).
Local file inclusion in the Urna WordPress theme version 2.5.12 and earlier allows authenticated low-privilege users to include arbitrary local files, potentially leading to remote code execution. The vulnerability is not known to be actively exploited and has a very low EPSS score, though the CVSS base score is 7.5 due to potential for full system compromise.
Local File Inclusion in the Digiqole WordPress theme allows authenticated users to include arbitrary local files, leading to potential full system compromise. Versions prior to 2.2.7 are affected. The vulnerability has a high CVSS score but low EPSS exploitation probability and no known public exploit or active exploitation.
Local file inclusion in the ThimPress Sailing WordPress theme before version 4.4.6 allows authenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving remote code execution. The vulnerability carries a CVSS 3.1 base score of 7.5 (High) with a low EPSS probability (0.22%), indicating no active exploitation or publicly available exploit code at this time.
Authenticated local file inclusion in the ekommart WordPress theme before version 4.3.1 allows low-privileged users to read arbitrary files on the server, potentially leading to remote code execution. The vulnerability stems from improper validation of user-supplied input used in PHP include statements.
Local file inclusion in Jobmonster Elementor Addon up to 1.1.4 allows authenticated attackers with low privileges to include arbitrary local files. Successful exploitation can lead to high confidentiality, integrity, and availability impacts. No active exploitation or public exploit code is currently known; EPSS score is low.
Local File Inclusion in the Exhibz WordPress theme (version ≤ 3.0.9) allows authenticated attackers with low privileges to include arbitrary local files on the server, potentially leading to sensitive data exposure or-when combined with file upload-remote code execution. Exploitation requires high attack complexity and no user interaction; there is no evidence of active exploitation or public exploit code as of this analysis.
Local file inclusion in Jobmonster theme (≤4.8.2) allows authenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution via chaining. The vulnerability requires low-privileged access (PR:L) and high attack complexity (AC:H), reducing real-world exploitability. EPSS score 0.22% suggests low exploitation probability, and no active exploits are confirmed.
Authenticated local file inclusion in Select Core WordPress plugin versions <2.6 allows low-privileged attackers to include arbitrary local files. Under certain configurations, this can escalate to full site compromise, including information disclosure and code execution. At time of analysis, no public exploit or active exploitation has been identified; CVSS 7.5 and EPSS 0.22% indicate a high-severity but currently low-probability risk.
Local file inclusion in Wilmër WordPress theme versions before 3.5 allows authenticated attackers to include arbitrary local files, leading to sensitive information disclosure and potential remote code execution. No public exploit or active exploitation has been reported at time of analysis; EPSS score is low (0.22%).
Insertion of sensitive information into sent data in auxin-elements WordPress plugin versions up to 2.17.15 allows unauthenticated remote attackers to retrieve embedded sensitive data through network-accessible responses. The vulnerability exposes information with low confidentiality impact and affects the Shortcodes and extra features for Phlox theme plugin across all versions through 2.17.15, with EPSS scoring indicating 0.04% likelihood of exploitation.
Local file inclusion in WordPress UDesign Core plugin up to 4.14.0 allows authenticated low-privilege attackers to include arbitrary local files, potentially exposing sensitive data or enabling code execution. The vulnerability requires high attack complexity and is not known to be actively exploited, but carries high impact if successfully leveraged.
Custom Field Template WordPress plugin through version 2.7.6 exposes sensitive system information to high-privilege local users via embedded data retrieval, allowing administrators to access confidential data they should not have access to. The vulnerability requires high administrative privileges and local access, limiting real-world exploitation risk despite the complete confidentiality impact. EPSS probability is minimal at 0.02%, indicating low likelihood of opportunistic exploitation.
A local file inclusion vulnerability in the Ronneby Theme Core WordPress plugin (≤1.5.68) allows authenticated low-privilege attackers to include arbitrary local PHP files, potentially leading to sensitive data exposure or code execution. Exploitation requires an account on the WordPress site and high attack complexity due to filename manipulation. No active exploitation or public exploit code has been reported.
Authenticated information disclosure in ThimPress WP Hotel Booking plugin for WordPress up to version 2.2.7 allows low-privileged users to retrieve embedded sensitive data, such as configuration details. No active exploitation or public exploit code is known at this time, and EPSS indicates a very low probability of widespread exploitation.
Sensitive data exposure in the INFINITUM FORM Geo Controller (cf-geoplugin) WordPress plugin through version 8.9.4 allows unauthenticated remote attackers to retrieve embedded sensitive data via network requests. The vulnerability, categorized as CWE-201, has low detection complexity without user interaction. While no active exploitation (CISA KEV) or public proof-of-concept is reported, the EPSS probability is low at 0.06%, and the publicly disclosed Patchstack advisory indicates a fix is available.
A slab use-after-free in the Linux kernel's Intel AVS (Audio Voice Speech / Smart Sound Technology) ASoC driver lets a local user with access to a HOST HDAudio PCM stream corrupt kernel memory by racing PCM close against period-elapsed IRQ work. When avs_dai_fe_shutdown() frees the DAI's private context while the period-elapsed work is still servicing interrupts, the freed structure can be accessed concurrently, yielding a use-after-free with high confidentiality, integrity and availability impact (CVSS 7.8, AV:L). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.20%, 10th percentile), reflecting the local-only, hardware-specific nature of the flaw.
Denial-of-service (kernel use-after-free/double-free) in the Linux kernel's nvmet-fc NVMe-over-Fibre-Channel target driver allows a local privileged operator to crash the kernel by forcibly shutting down an NVMe target port via configfs. When a port is torn down, nvmet_port_subsys_drop_link() calls both nvmet_port_del_ctrls() and nvmet_disable_port(), each of which can schedule the same association-deletion work item; the first run frees all resources and the second reuses freed memory. This is a fix already merged upstream in the stable trees, with no public exploit identified at time of analysis and a low EPSS score (0.21%, 11th percentile).
Denial of service and potential memory corruption in the Linux kernel's NVMe over Fibre Channel (nvme-fc) transport arises because nvme_fc_create_association reads the remote port_state and increments the rport active count without holding a lock, racing against nvme_fc_unregister_remote which can free the remote port when no active association exists. An attacker or fault condition on the FC fabric able to trigger reconnect events concurrently with port teardown can drive a use-after-free style condition on the rport object. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile).
Data-integrity corruption in the Linux kernel's stmmac (Synopsys DesignWare/STMMAC) Ethernet driver allows malformed packets that failed hardware checksum validation to be accepted as valid by the network stack. When hardware checksum offload (CoE) is enabled, the Rx path marked known IP-ethertype frames as CHECKSUM_UNNECESSARY without honoring the hardware's reported header/payload checksum error, so corrupt frames bypass the stack's own validation. There is no public exploit identified at time of analysis, KEV status is not listed, and EPSS is low (0.20%, 11th percentile).
Local privilege-escalation and memory-disclosure flaw in the Linux kernel's DRM GPU SVM (Shared Virtual Memory) subsystem, where incorrect use of hmm_pfn_to_map_order() mishandles an HMM range that only partially covers a huge page (e.g. 2MB), causing the driver to map physical memory outside the intended range - memory that may not even belong to the faulting process's address space. Affecting recent kernels carrying the drm/gpusvm code (associated with the Intel Xe GPU driver's userptr/SVM path), a local user with GPU access can trigger cross-boundary mappings leading to information disclosure or memory corruption. There is no public exploit identified at time of analysis, and EPSS is low at 0.19% (9th percentile).
Local memory-safety flaw in the Linux kernel's AMD GPU (amdgpu) driver allows an authenticated local user to submit a user queue (userq) whose buffer virtual address and size are not validated against a legitimate VM mapping. Because the driver failed to confirm the userq object resides in a valid GPU virtual-memory mapping before use, a low-privileged process with GPU device access could reference out-of-bounds or unmapped memory, tagged as an information-disclosure issue with additional integrity and availability impact. No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile), consistent with a local-only kernel driver bug rather than a mass-exploited network flaw.
Use-after-free in the Linux kernel's SMB client (cifs) cached-directory handling lets a race between find_or_create_cached_dir() and smb2_close_cached_fid() free a cfid object while a new reference is being taken, corrupting kernel memory on a host mounting an SMB/CIFS share. The flaw is a reference-counting gap fixed by switching to kref_put_lock() so cfid_release() runs under cfid_list_lock. No public exploit identified at time of analysis, EPSS is low (0.20%, 11th percentile), and it is not listed in CISA KEV.
Remote code execution in Mozilla Firefox and Thunderbird (pre-146) allows unauthenticated network attackers to execute arbitrary code via a use-after-free flaw in the GMP (Gecko Media Plugin) audio/video component. Despite a critical CVSS 9.8 rating, EPSS probability remains low (0.08%, 23rd percentile), and no public exploit identified at time of analysis. Mozilla patched both products in version 146, with vendor advisories and technical details available via Bugzilla.
JIT compiler miscompilation in Mozilla Firefox and Thunderbird's JavaScript engine enables remote attackers to achieve limited confidentiality, integrity, and availability impact without authentication or user interaction. Affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird ESR < 140.6. Vendor-released patches available in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. No public exploit identified at time of analysis, with EPSS score of 0.11% (30th percentile) indicating low predicted exploitation probability.
Sandbox escape in Mozilla Firefox and Thunderbird's CanvasWebGL component allows remote attackers to bypass security boundaries via crafted web content with user interaction. Affects Firefox <146, Firefox ESR <115.31 and <140.6, Thunderbird <146 and Thunderbird ESR <140.6. EPSS probability is low (0.06%, 20th percentile), and no public exploit identified at time of analysis. The CVSS score of 8.0 reflects high confidentiality and integrity impact with scope change, though attack complexity is high and requires user interaction.
Remote code execution via use-after-free in Mozilla Firefox and Thunderbird WebRTC signaling allows unauthenticated network attackers to execute arbitrary code without user interaction. Affects Firefox <146, Firefox ESR <140.6, Thunderbird <146, and Thunderbird ESR <140.6. Vendor-released patches available (Firefox 146, Firefox ESR 140.6, Thunderbird 146, Thunderbird 140.6). CVSS 9.8 (critical) reflects maximum technical severity, though EPSS 0.09% (25th percentile) and absence from CISA KEV suggest limited real-world exploitation at time of analysis. No public exploit identified at time of analysis.
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.18 could disclose sensitive user credentials in log files.
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 stores unencrypted sensitive information in environmental variables files which can be obtained by an authenticated user.
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 is vulnerable to creation of temporary files without atomic operations which may expose sensitive information to an authenticated user due to race condition attacks.
A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction. NOTE: this is disputed by the Supplier because the product's objective is "to discourage automated scraping / bots, not guarantee resistance to determined attackers." The documentation states “the goal is not to provide a secure cryptographic algorithm but to use a proof-of-work mechanism that allows any capable device to decrypt the hidden data.”
A security vulnerability in NUT-14 (CVSS 9.1) that allows cashu tokens. Risk factors: public PoC available.
CVE-2025-14261 is a security vulnerability (CVSS 7.1). High severity vulnerability requiring prompt remediation.
In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
In ProcessArea of dng_misc_opcodes.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible configuration data leak due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In initDecoder of C2SoftDav1dDec.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.