Information Disclosure
Monthly
Improper cleanup of IPComp fallback tunnel xfrm states in the Linux kernel's IPsec (xfrm) subsystem allows a local low-privileged attacker to trigger memory corruption (use-after-free) leading to full compromise of confidentiality, integrity, and availability. The flaw arises because fallback tunnel states were only deleted when the last user state was destroyed rather than deleted, so lingering skb references (via IP reassembly queues or deferred skb freeing) leave stale states on xfrm hashtables/lists, tripping the WARN in xfrm_state_fini and leaving dangling structures. This is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is very low at 0.05%, but the 7.8 CVSS and CIA-high impact make it a meaningful local privilege-escalation candidate.
Local privilege escalation / kernel memory corruption in the Linux kernel's AF_UNIX garbage collector arises because unix_add_edge() fails to initialise the new vertex's scc_index field. On kernels where GC has already run and grouped sockets into strongly-connected components, a freshly allocated in-flight socket inherits a stale SCC index (via heap spraying), causing unix_vertex_dead() to misjudge an alive in-flight socket as dead and garbage-collect its receive queue - a use-after-free. A detailed public reproducer exists (publicly available exploit code exists); it is not in CISA KEV and EPSS is very low (0.04%).
A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access.
Unauthenticated attackers can access configuration files from WordPress sites running the WebP Express plugin (≤0.25.9) on NGINX because the plugin generates predictable config file names, potentially exposing sensitive settings. No active exploitation or public exploit code has been identified, and the EPSS score of 0.06% indicates a low probability of exploitation.
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.
Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.
Identity impersonation in Envoy Proxy (1.33.12 and earlier, 1.34.0-1.34.10, 1.35.0-1.35.6, and 1.36.0-1.36.2) allows a client to be accepted under a different identity when Envoy is configured with require_client_certificate: true and an exact match_typed_subject_alt_names rule against an OTHERNAME SAN. Specifically, a certificate whose OTHERNAME value is encoded as BMPSTRING or UNIVERSALSTRING and carries an embedded null byte (for example 'victim\0evil') is truncated at the null during UTF-8 conversion and therefore matches an exact rule for 'victim', granting the attacker the access rights of that identity. Publicly available exploit code exists and the vendor has released patches, but EPSS is 0.00% and exploitation is gated on the attacker first obtaining a CA-signed certificate from a CA that Envoy trusts, so this is a precondition-heavy issue rather than a mass-exploitable one. Note authentication requirements: the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, indicating the attacker must already hold valid credentials (a trusted client certificate).
NVIDIA TAO contains a vulnerability where an attacker may cause a resource to be loaded via an uncontrolled search path. A successful exploit of this vulnerability may lead to escalation of privileges, data tampering, denial of service, information disclosure.
Side-channel information leakage in Navigation and Loading in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.
CVE-2025-12084 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle CONNECT requests, it accepts client data before issuing a 2xx response and forwards that data to the upstream TCP connection. If a forwarding proxy upstream from Envoy then responds with a non-2xx status, this can cause a de-synchronized CONNECT tunnel state. By default Envoy continues to allow early CONNECT data to avoid disrupting existing deployments. The envoy.reloadable_features.reject_early_connect_data runtime flag can be set to reject CONNECT requests that send data before a 2xx response when intermediaries upstream from Envoy may reject establishment of a CONNECT tunnel.
A security vulnerability in MCP Gateway (CVSS 9.6). Critical severity with potential for significant impact on affected systems. Vendor patch is available.
In Splunk Universal Forwarder for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory. This lets non-administrator users on the machine access the directory and all its contents.
In Splunk Enterprise for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Splunk Enterprise for Windows Installation directory. This lets non-administrator users on the machine access the directory and all its contents.
A security vulnerability in Splunk Enterprise (CVSS 5.3) that allows them. Remediation should follow standard vulnerability management procedures.
In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles and subscribes to mobile push notifications could receive notifications that disclose the title and description of the report or alert even if they do not have access to view the report or alert.
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.
Abacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory during an activation attempt.
A security vulnerability in opsre go-ldap-admin (CVSS 5.6). Remediation should follow standard vulnerability management procedures.
CVE-2025-39665 is a security vulnerability (CVSS 5.3) that allows an unauthenticated attacker. Remediation should follow standard vulnerability management procedures. Vendor patch is available.
Information disclosure in WebKitGTK allows remote websites to read arbitrary local files by exploiting a drag-and-drop mechanism that does not verify the drag operation originated from outside the browser. Attackers can leverage this by convincing a user to drag a file onto a malicious page, exposing data the user has permission to access. The flaw affects WebKitGTK before version 2.50.3; vendor patches are available and widely distributed, with no indication of active exploitation.
Unauthenticated sensitive information disclosure in MxChat for WordPress allows attackers to extract session values from upload filenames, enabling access to private AI chatbot conversation data. All versions up to 2.5.5 are affected. A public proof-of-concept exists, but no active exploitation has been reported; EPSS is very low (0.05%) suggesting limited current risk.
Vim is an open source, command line text editor. Prior to version 9.1.1947, an uncontrolled search path vulnerability on Windows allows Vim to execute malicious executables placed in the current working directory for the current edited file. On Windows, when using cmd.exe as a shell, Vim resolves external commands by searching the current working directory before system paths. When Vim invokes tools such as findstr for :grep, external commands or filters via :!, or compiler/:make commands, it may inadvertently run a malicious executable present in the same directory as the file being edited. The issue affects Vim for Windows prior to version 9.1.1947.
Local users on workstations where NMIS/BioDose V22.02 or earlier is installed with default insecure directory permissions can modify program executables and libraries, leading to high integrity and availability impact and low confidentiality impact. This flaw (CWE-732) is not remotely reachable; it requires local presence as a user on a client workstation and only affects certain deployment scenarios such as multi-user or shared workstations with permissive ACLs. The vendor has released a patch in version 23.0, and the EPSS score is 0.02% (percentile 4%), indicating low practical urgency; no public exploit identified at time of analysis.
Insecure default permissions on a Windows share in Mirion (EC2 Software) NMIS/BioDose V22.02 and earlier expose the embedded Microsoft SQL Server Express database files and configuration data to anyone who can reach that share on the network, allowing both disclosure and tampering with sensitive medical/health-physics data. The issue affects only networked, multi-client installations that use the embedded SQL Server Express, is remediated in version 23.0, and requires adjacent-network access to the share rather than internet exposure; no public exploit code has been identified at time of analysis, and the EPSS score is negligible (~0.04%, 11th percentile), so real-world urgency is well below what the 8.6 CVSS 4.0 base score suggests.
CVE-2025-61940 is a security vulnerability (CVSS 8.3). High severity vulnerability requiring prompt remediation.
Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) is vulnerable to SQL injection via the 'title' parameter in com.wanli.lvzhoucms.service.ContentService#findPage. The parameter is concatenated directly into a dynamic SQL query without sanitization or prepared statements, enabling attackers to read sensitive data from the database.
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.
Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
A security vulnerability in DevTools in Google Chrome (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
A remote code execution vulnerability in Apptainer (CVSS 4.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
A remote code execution vulnerability (CVSS 4.5). Remediation should follow standard vulnerability management procedures.
dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php.
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Co. Ltd PDF-XChange Editor 10.7.3.401. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
A security vulnerability in nocobase (CVSS 5.6). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Upload.am WordPress (CVSS 4.9). Remediation should follow standard vulnerability management procedures.
A privilege escalation vulnerability (CVSS 7.2) that allows a physically proximate attacker with elevated privileges. Risk factors: public PoC available.
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker (with elevated privileges) to read and modify the Appliance SSD contents (because they are unencrypted).
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker with root access to modify the Recovery Partition (because of a lack of integrity protection).
CVE-2025-59698 is a security vulnerability (CVSS 6.8) that allows a physically proximate attacker. Risk factors: public PoC available.
CVE-2025-59696 is a security vulnerability (CVSS 3.2) that allows a physically proximate attacker. Risk factors: public PoC available.
CVE-2025-59694 is a security vulnerability (CVSS 6.8) that allows a physically proximate attacker. Risk factors: public PoC available.
Horde Groupware v5.2.22 has a user enumeration vulnerability that allows an unauthenticated attacker to determine the existence of valid accounts on the system. To exploit the vulnerability, an HTTP request must be sent to ‘/imp/attachment.php’ including the parameters ‘id’ and ‘u’. If the specified user exists, the server will return the download of an empty file; if it does not exist, no download will be initiated, which unequivocally reveals the validity of the user.
User enumeration in TCMAN GIM versions prior to 20250304 allows unauthenticated remote attackers to determine whether a given username exists on the system. The flaw is exploited by sending a SOAP request with the 'pda:username' parameter and the 'GetUserQuestionAndAnswer' action to the '/WS/PDAWebService.asmx' endpoint, which responds differently based on account validity. The impact is limited to confidentiality-low, and no public exploit code or active exploitation is currently identified (EPSS 0.09%, percentile 26).
TCMAN GIM v11 (version 20250304 and earlier) contains a user enumeration vulnerability that allows unauthenticated remote attackers to determine whether a given username exists on the system. By sending a crafted SOAP request with the 'GetLastDatePasswordChange' action to the '/WS/PDAWebService.asmx' endpoint and observing the response to the 'pda:username' parameter, an attacker can distinguish valid from invalid accounts. No public exploit code has been identified, and the EPSS score is very low (0.09%), but the vendor has released a patch; exploitation requires only network reachability to the vulnerable web service.
Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier.This issue affects BILGER: before 2.4.9.
An out-of-bounds read in the Circutor SGE-PLC1000 and SGE-PLC50 power-line communication concentrators running firmware 9.0.2 allows an authenticated user of the device's management interface to read memory beyond the bounds of the internal FilesDownload array. The DownloadFile function passes an attacker-supplied parameter through atoi() and then uses the resulting value directly as an array index, so an unusually large numeric value causes an out-of-bounds access that discloses adjacent memory contents; impact is limited to confidentiality (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with no integrity or availability effect and no code execution. Credentials are required to reach the vulnerable code path, EPSS places exploitation likelihood at roughly 0.05% (14th percentile), and no public exploit or confirmed active exploitation was identified at time of analysis.
CVE-2025-41744 is a security vulnerability (CVSS 9.1) that allows an unprivileged remote attacker. Critical severity with potential for significant impact on affected systems.
Insufficient encryption strength in Sprecher Automation SPRECON-E-C, SPRECON-E-P, and SPRECON-E-T3 allows a local unprivileged attacker to extract data from update images and thus obtain limited information about the architecture and internal processes.
In gokey versions <0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any passwords/secrets that were derived from the seed file (using the -s option). Even if the input seed file stays the same, version 0.2.0 gokey will generate different secrets. Impact This vulnerability impacts generated keys/secrets using a seed file as an entropy input (using the -s option). Keys/secrets generated just from the master password (without the -s option) are not impacted. The confidentiality of the seed itself is also not impacted (it is not required to regenerate the seed itself). Specific impact includes: * keys/secrets generated from a seed file may have lower entropy: it was expected that the whole seed would be used to generate keys (240 bytes of entropy input), where in vulnerable versions only 28 bytes was used * a malicious entity could have recovered all passwords, generated from a particular seed, having only the seed file in possession without the knowledge of the seed master password Patches The code logic bug has been fixed in gokey version 0.2.0 and above. Due to the deterministic nature of gokey, fixed versions will produce different passwords/secrets using seed files, as all seed entropy will be used now. System secret rotation guidance It is advised for users to regenerate passwords/secrets using the patched version of gokey (0.2.0 and above), and provision/rotate these secrets into respective systems in place of the old secret. A specific rotation procedure is system-dependent, but most common patterns are described below. Systems that do not require the old password/secret for rotation Such systems usually have a "Forgot password" facility or a similar facility allowing users to rotate their password/secrets by sending a unique "magic" link to the user's email or phone. In such cases users are advised to use this facility and input the newly generated password secret, when prompted by the system. Systems that require the old password/secret for rotation Such systems usually have a modal password rotation window usually in the user settings section requiring the user to input the old and the new password sometimes with a confirmation. To generate/recover the old password in such cases users are advised to: * temporarily download gokey version 0.1.3 https://github.com/cloudflare/gokey/releases/tag/v0.1.3 for their respective operating system to recover the old password * use gokey version 0.2.0 or above to generate the new password * populate the system provided password rotation form Systems that allow multiple credentials for the same account to be provisioned Such systems usually require a secret or a cryptographic key as a credential for access, but allow several credentials at the same time. One example is SSH: a particular user may have several authorized public keys configured on the SSH server for access. For such systems users are advised to: * generate a new secret/key/credential using gokey version 0.2.0 or above * provision the new secret/key/credential in addition to the existing credential on the system * verify that the access or required system operation is still possible with the new secret/key/credential * revoke authorization for the existing/old credential from the system Credit This vulnerability was found by Théo Cusnir ( @mister_mime https://hackerone.com/mister_mime ) and responsibly disclosed through Cloudflare's bug bounty program.
A security vulnerability in Eclipse Paho Go MQTT (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
The Zigaform plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.6.5. This is due to the plugin exposing a public AJAX endpoint that retrieves form submission data without performing authorization checks to verify ownership or access rights. This makes it possible for unauthenticated attackers to extract sensitive form submission data including personal information, payment details, and other private data via the rocket_front_payment_seesummary action by enumerating sequential form_r_id values.
Insecure Storage of Sensitive Information vulnerability in MeetMe on iOS, Android allows Retrieve Embedded Sensitive Data. This issue affects MeetMe: through v2.2.5.
In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117741; Issue ID: MSV-4538.
In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184297; Issue ID: MSV-4759.
In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4805.
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01673760; Issue ID: MSV-4650.
Local privilege escalation in IBM Informix Dynamic Server 14.10 allows a user who already holds a low-privilege account on the database host to log into the Informix server as administrator without supplying a password, giving full control over the database engine and its data. The issue is strictly local - the assessed CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) requires pre-existing access to the host and no user interaction, so it is not remotely exploitable and cannot be triggered against a system the attacker cannot already log into. Risk signals point to a genuine but locally-scoped flaw rather than a remote emergency: EPSS is 0.02% (5th percentile), the CVE is not in CISA KEV, and no public exploit code has been identified at time of analysis.
Improper verification of the source of a communication channel in Samsung SmartTouchCall prior to version 1.0.1.1 lets a remote, unauthenticated attacker spoof a trusted communication origin and read sensitive information, but the victim must actively interact with the crafted communication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 6.5). Exploitation is constrained by the mandatory user-interaction step and the app-specific attack surface, and no public exploit has been identified at time of analysis; EPSS is 0.05% (17th percentile) and the issue is not in CISA KEV, marking it as moderate rather than urgent. Impact is limited to confidentiality - there is no integrity or availability effect.
A security vulnerability in Samsung Account (CVSS 4.0) that allows local attacker. Remediation should follow standard vulnerability management procedures.
A security vulnerability in Samsung Account (CVSS 4.0) that allows local attacker. Remediation should follow standard vulnerability management procedures.
A security vulnerability in Samsung Cloud Assistant (CVSS 4.0) that allows local attacker. Remediation should follow standard vulnerability management procedures.
A security vulnerability in Galaxy Store for Galaxy Watch (CVSS 5.9) that allows local attacker. Remediation should follow standard vulnerability management procedures.
A security vulnerability in MPLocalService of MotionPhoto (CVSS 7.3) that allows local attackers. High severity vulnerability requiring prompt remediation.
A security vulnerability in MPRemoteService of MotionPhoto (CVSS 7.3) that allows local attackers. High severity vulnerability requiring prompt remediation.
Information disclosure in Samsung Android's Quram image codec (libimagecodec.quram.so) allows unauthenticated remote attackers to read memory outside the bounds of the parsing buffer when a crafted malformed image is decoded, affecting Android 13, 14, 15 and 16 firmware prior to SMR Dec-2025 Release 1. Samsung and NVD rate the flaw 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), while our assessment treats it as requiring user interaction (UI:R) with low confidentiality impact (C:L), since the leak is bounded to memory adjacent to the parsing buffer and is most useful as a primitive chained with another bug. No public exploit code has been identified at time of analysis and EPSS is low (0.06%, 17th percentile), so broad exploitation is unlikely without a companion memory-corruption flaw.
An out-of-bounds read in the Samsung Android bootloader allows an attacker with physical possession of and hands-on access to an affected device to read out-of-bounds memory from the bootloader stage. Only devices running firmware builds below the SMR Dec-2025 Release 1 patch level (spanning Android 13, 14, 15 and 16 per the vendor advisory) are affected, and the physical-access prerequisite (CVSS AV:P, unauthenticated per PR:N, no user interaction per UI:N) is the decisive limiter - there is no remote or network exploitation path. Impact is confidentiality-only (C:H with I:N/A:N) with no described code-execution primitive, no public exploit code and no confirmed active exploitation (CISA KEV not listed); EPSS is 0.02% (6th percentile), consistent with a low real-world priority issue.
HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonation attacks after the fix for CVE-2025-52672, via several alternate techniques. Homoglyphs based impersonation has been independently reported by other HackerOne users, such as itz_hari_ and khoof.
Improper export of the Dynamic Lockscreen component on Samsung Android devices allows an app already installed and running on the phone to access files with Dynamic Lockscreen's privileges, producing high confidentiality and integrity impact on the data it exposes. The issue is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 7.1): the attacker must be able to install and run a low-privilege malicious app, after which no further user interaction is required, and there is no remote or network exploitation path. No public exploit code has been identified at time of analysis and EPSS is negligible (0.02%, 4th percentile), but the flaw is remediated only by Samsung's SMR Dec-2025 Release 1 update, so devices still on patch levels up to SMR Nov-2025 R1 remain vulnerable.
A security vulnerability in to forward the current HTTP request to another server. (CVSS 5.4). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This vulnerability is fixed in 13.2.1.
A security vulnerability in This admin (CVSS 6.5). Risk factors: public PoC available. Vendor patch is available.
Grav CMS before 1.8.0-beta.27 discloses bcrypt password hashes - including the administrator's - to an authenticated admin-panel account that has been granted read access to the user account management section, allowing those hashes to be read from the rendered profile page's source and cracked offline. The confirmed impact is a confidentiality loss, consistent with our assessment vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N; any actual privilege escalation is conditional on successfully cracking a bcrypt hash, which may be impractical against a strong admin password, and the exposure requires a non-default privileged read grant rather than anonymous access. Publicly available exploit code exists, EPSS is low (0.08%, ~23rd percentile), and there is no evidence of active exploitation; the vendor fixed the issue in 1.8.0-beta.27.
Server-side template injection in Grav CMS (all releases prior to 1.8.0-beta.27, including the 1.7.x line such as 1.7.48) lets an unauthenticated remote attacker dump the site's full configuration - including plugin settings and any secrets they contain - by posting a crafted Twig expression in the __unique_form_id__ parameter of any form rendered by the Forms plugin. The affected code path evaluates attacker-supplied form field values as Twig, and the pre-patch version of Grav shipped no meaningful blocklist for dangerous Twig functions, so the response returns var_dumped configuration data directly to the requester. Impact is confidentiality-only (no integrity or availability effect per the independent assessment) and does not require authentication or user interaction, but a public, Forms-plugin-backed form must exist on the target; publicly available exploit code exists (no confirmed active exploitation / CISA KEV listing), and EPSS is low at roughly 0.06% (19th percentile).
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CVE-2025-51682 is a security vulnerability (CVSS 9.8) that allows an attacker. Risk factors: public PoC available.
In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated users to use specially crafted requests to read documents from data streams without having the respective privileges.
Rejected reason: DO NOT USE THIS CVE RECORD. No vendor patch available.
Rejected reason: DO NOT USE THIS CVE RECORD. No vendor patch available.
nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints (such as /admin) even after the legitimate user has logged out, enabling session hijacking. Any version above 4.70 that is not 4.80.3 fixes the vulnerability.
A cleartext transmission vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can sniff network traffic to trigger this vulnerability.
Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. This lack of transport layer security allows a man-in-the-middle attacker to intercept and modify traffic between the client and the device.
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.
A remote code execution vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Improper cleanup of IPComp fallback tunnel xfrm states in the Linux kernel's IPsec (xfrm) subsystem allows a local low-privileged attacker to trigger memory corruption (use-after-free) leading to full compromise of confidentiality, integrity, and availability. The flaw arises because fallback tunnel states were only deleted when the last user state was destroyed rather than deleted, so lingering skb references (via IP reassembly queues or deferred skb freeing) leave stale states on xfrm hashtables/lists, tripping the WARN in xfrm_state_fini and leaving dangling structures. This is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is very low at 0.05%, but the 7.8 CVSS and CIA-high impact make it a meaningful local privilege-escalation candidate.
Local privilege escalation / kernel memory corruption in the Linux kernel's AF_UNIX garbage collector arises because unix_add_edge() fails to initialise the new vertex's scc_index field. On kernels where GC has already run and grouped sockets into strongly-connected components, a freshly allocated in-flight socket inherits a stale SCC index (via heap spraying), causing unix_vertex_dead() to misjudge an alive in-flight socket as dead and garbage-collect its receive queue - a use-after-free. A detailed public reproducer exists (publicly available exploit code exists); it is not in CISA KEV and EPSS is very low (0.04%).
A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access.
Unauthenticated attackers can access configuration files from WordPress sites running the WebP Express plugin (≤0.25.9) on NGINX because the plugin generates predictable config file names, potentially exposing sensitive settings. No active exploitation or public exploit code has been identified, and the EPSS score of 0.06% indicates a low probability of exploitation.
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.
Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.
Identity impersonation in Envoy Proxy (1.33.12 and earlier, 1.34.0-1.34.10, 1.35.0-1.35.6, and 1.36.0-1.36.2) allows a client to be accepted under a different identity when Envoy is configured with require_client_certificate: true and an exact match_typed_subject_alt_names rule against an OTHERNAME SAN. Specifically, a certificate whose OTHERNAME value is encoded as BMPSTRING or UNIVERSALSTRING and carries an embedded null byte (for example 'victim\0evil') is truncated at the null during UTF-8 conversion and therefore matches an exact rule for 'victim', granting the attacker the access rights of that identity. Publicly available exploit code exists and the vendor has released patches, but EPSS is 0.00% and exploitation is gated on the attacker first obtaining a CA-signed certificate from a CA that Envoy trusts, so this is a precondition-heavy issue rather than a mass-exploitable one. Note authentication requirements: the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, indicating the attacker must already hold valid credentials (a trusted client certificate).
NVIDIA TAO contains a vulnerability where an attacker may cause a resource to be loaded via an uncontrolled search path. A successful exploit of this vulnerability may lead to escalation of privileges, data tampering, denial of service, information disclosure.
Side-channel information leakage in Navigation and Loading in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.
CVE-2025-12084 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle CONNECT requests, it accepts client data before issuing a 2xx response and forwards that data to the upstream TCP connection. If a forwarding proxy upstream from Envoy then responds with a non-2xx status, this can cause a de-synchronized CONNECT tunnel state. By default Envoy continues to allow early CONNECT data to avoid disrupting existing deployments. The envoy.reloadable_features.reject_early_connect_data runtime flag can be set to reject CONNECT requests that send data before a 2xx response when intermediaries upstream from Envoy may reject establishment of a CONNECT tunnel.
A security vulnerability in MCP Gateway (CVSS 9.6). Critical severity with potential for significant impact on affected systems. Vendor patch is available.
In Splunk Universal Forwarder for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory. This lets non-administrator users on the machine access the directory and all its contents.
In Splunk Enterprise for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Splunk Enterprise for Windows Installation directory. This lets non-administrator users on the machine access the directory and all its contents.
A security vulnerability in Splunk Enterprise (CVSS 5.3) that allows them. Remediation should follow standard vulnerability management procedures.
In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles and subscribes to mobile push notifications could receive notifications that disclose the title and description of the report or alert even if they do not have access to view the report or alert.
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.
Abacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory during an activation attempt.
A security vulnerability in opsre go-ldap-admin (CVSS 5.6). Remediation should follow standard vulnerability management procedures.
CVE-2025-39665 is a security vulnerability (CVSS 5.3) that allows an unauthenticated attacker. Remediation should follow standard vulnerability management procedures. Vendor patch is available.
Information disclosure in WebKitGTK allows remote websites to read arbitrary local files by exploiting a drag-and-drop mechanism that does not verify the drag operation originated from outside the browser. Attackers can leverage this by convincing a user to drag a file onto a malicious page, exposing data the user has permission to access. The flaw affects WebKitGTK before version 2.50.3; vendor patches are available and widely distributed, with no indication of active exploitation.
Unauthenticated sensitive information disclosure in MxChat for WordPress allows attackers to extract session values from upload filenames, enabling access to private AI chatbot conversation data. All versions up to 2.5.5 are affected. A public proof-of-concept exists, but no active exploitation has been reported; EPSS is very low (0.05%) suggesting limited current risk.
Vim is an open source, command line text editor. Prior to version 9.1.1947, an uncontrolled search path vulnerability on Windows allows Vim to execute malicious executables placed in the current working directory for the current edited file. On Windows, when using cmd.exe as a shell, Vim resolves external commands by searching the current working directory before system paths. When Vim invokes tools such as findstr for :grep, external commands or filters via :!, or compiler/:make commands, it may inadvertently run a malicious executable present in the same directory as the file being edited. The issue affects Vim for Windows prior to version 9.1.1947.
Local users on workstations where NMIS/BioDose V22.02 or earlier is installed with default insecure directory permissions can modify program executables and libraries, leading to high integrity and availability impact and low confidentiality impact. This flaw (CWE-732) is not remotely reachable; it requires local presence as a user on a client workstation and only affects certain deployment scenarios such as multi-user or shared workstations with permissive ACLs. The vendor has released a patch in version 23.0, and the EPSS score is 0.02% (percentile 4%), indicating low practical urgency; no public exploit identified at time of analysis.
Insecure default permissions on a Windows share in Mirion (EC2 Software) NMIS/BioDose V22.02 and earlier expose the embedded Microsoft SQL Server Express database files and configuration data to anyone who can reach that share on the network, allowing both disclosure and tampering with sensitive medical/health-physics data. The issue affects only networked, multi-client installations that use the embedded SQL Server Express, is remediated in version 23.0, and requires adjacent-network access to the share rather than internet exposure; no public exploit code has been identified at time of analysis, and the EPSS score is negligible (~0.04%, 11th percentile), so real-world urgency is well below what the 8.6 CVSS 4.0 base score suggests.
CVE-2025-61940 is a security vulnerability (CVSS 8.3). High severity vulnerability requiring prompt remediation.
Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) is vulnerable to SQL injection via the 'title' parameter in com.wanli.lvzhoucms.service.ContentService#findPage. The parameter is concatenated directly into a dynamic SQL query without sanitization or prepared statements, enabling attackers to read sensitive data from the database.
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.
Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
A security vulnerability in DevTools in Google Chrome (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
A remote code execution vulnerability in Apptainer (CVSS 4.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
A remote code execution vulnerability (CVSS 4.5). Remediation should follow standard vulnerability management procedures.
dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php.
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Co. Ltd PDF-XChange Editor 10.7.3.401. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
A security vulnerability in nocobase (CVSS 5.6). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Upload.am WordPress (CVSS 4.9). Remediation should follow standard vulnerability management procedures.
A privilege escalation vulnerability (CVSS 7.2) that allows a physically proximate attacker with elevated privileges. Risk factors: public PoC available.
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker (with elevated privileges) to read and modify the Appliance SSD contents (because they are unencrypted).
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker with root access to modify the Recovery Partition (because of a lack of integrity protection).
CVE-2025-59698 is a security vulnerability (CVSS 6.8) that allows a physically proximate attacker. Risk factors: public PoC available.
CVE-2025-59696 is a security vulnerability (CVSS 3.2) that allows a physically proximate attacker. Risk factors: public PoC available.
CVE-2025-59694 is a security vulnerability (CVSS 6.8) that allows a physically proximate attacker. Risk factors: public PoC available.
Horde Groupware v5.2.22 has a user enumeration vulnerability that allows an unauthenticated attacker to determine the existence of valid accounts on the system. To exploit the vulnerability, an HTTP request must be sent to ‘/imp/attachment.php’ including the parameters ‘id’ and ‘u’. If the specified user exists, the server will return the download of an empty file; if it does not exist, no download will be initiated, which unequivocally reveals the validity of the user.
User enumeration in TCMAN GIM versions prior to 20250304 allows unauthenticated remote attackers to determine whether a given username exists on the system. The flaw is exploited by sending a SOAP request with the 'pda:username' parameter and the 'GetUserQuestionAndAnswer' action to the '/WS/PDAWebService.asmx' endpoint, which responds differently based on account validity. The impact is limited to confidentiality-low, and no public exploit code or active exploitation is currently identified (EPSS 0.09%, percentile 26).
TCMAN GIM v11 (version 20250304 and earlier) contains a user enumeration vulnerability that allows unauthenticated remote attackers to determine whether a given username exists on the system. By sending a crafted SOAP request with the 'GetLastDatePasswordChange' action to the '/WS/PDAWebService.asmx' endpoint and observing the response to the 'pda:username' parameter, an attacker can distinguish valid from invalid accounts. No public exploit code has been identified, and the EPSS score is very low (0.09%), but the vendor has released a patch; exploitation requires only network reachability to the vulnerable web service.
Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier.This issue affects BILGER: before 2.4.9.
An out-of-bounds read in the Circutor SGE-PLC1000 and SGE-PLC50 power-line communication concentrators running firmware 9.0.2 allows an authenticated user of the device's management interface to read memory beyond the bounds of the internal FilesDownload array. The DownloadFile function passes an attacker-supplied parameter through atoi() and then uses the resulting value directly as an array index, so an unusually large numeric value causes an out-of-bounds access that discloses adjacent memory contents; impact is limited to confidentiality (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with no integrity or availability effect and no code execution. Credentials are required to reach the vulnerable code path, EPSS places exploitation likelihood at roughly 0.05% (14th percentile), and no public exploit or confirmed active exploitation was identified at time of analysis.
CVE-2025-41744 is a security vulnerability (CVSS 9.1) that allows an unprivileged remote attacker. Critical severity with potential for significant impact on affected systems.
Insufficient encryption strength in Sprecher Automation SPRECON-E-C, SPRECON-E-P, and SPRECON-E-T3 allows a local unprivileged attacker to extract data from update images and thus obtain limited information about the architecture and internal processes.
In gokey versions <0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any passwords/secrets that were derived from the seed file (using the -s option). Even if the input seed file stays the same, version 0.2.0 gokey will generate different secrets. Impact This vulnerability impacts generated keys/secrets using a seed file as an entropy input (using the -s option). Keys/secrets generated just from the master password (without the -s option) are not impacted. The confidentiality of the seed itself is also not impacted (it is not required to regenerate the seed itself). Specific impact includes: * keys/secrets generated from a seed file may have lower entropy: it was expected that the whole seed would be used to generate keys (240 bytes of entropy input), where in vulnerable versions only 28 bytes was used * a malicious entity could have recovered all passwords, generated from a particular seed, having only the seed file in possession without the knowledge of the seed master password Patches The code logic bug has been fixed in gokey version 0.2.0 and above. Due to the deterministic nature of gokey, fixed versions will produce different passwords/secrets using seed files, as all seed entropy will be used now. System secret rotation guidance It is advised for users to regenerate passwords/secrets using the patched version of gokey (0.2.0 and above), and provision/rotate these secrets into respective systems in place of the old secret. A specific rotation procedure is system-dependent, but most common patterns are described below. Systems that do not require the old password/secret for rotation Such systems usually have a "Forgot password" facility or a similar facility allowing users to rotate their password/secrets by sending a unique "magic" link to the user's email or phone. In such cases users are advised to use this facility and input the newly generated password secret, when prompted by the system. Systems that require the old password/secret for rotation Such systems usually have a modal password rotation window usually in the user settings section requiring the user to input the old and the new password sometimes with a confirmation. To generate/recover the old password in such cases users are advised to: * temporarily download gokey version 0.1.3 https://github.com/cloudflare/gokey/releases/tag/v0.1.3 for their respective operating system to recover the old password * use gokey version 0.2.0 or above to generate the new password * populate the system provided password rotation form Systems that allow multiple credentials for the same account to be provisioned Such systems usually require a secret or a cryptographic key as a credential for access, but allow several credentials at the same time. One example is SSH: a particular user may have several authorized public keys configured on the SSH server for access. For such systems users are advised to: * generate a new secret/key/credential using gokey version 0.2.0 or above * provision the new secret/key/credential in addition to the existing credential on the system * verify that the access or required system operation is still possible with the new secret/key/credential * revoke authorization for the existing/old credential from the system Credit This vulnerability was found by Théo Cusnir ( @mister_mime https://hackerone.com/mister_mime ) and responsibly disclosed through Cloudflare's bug bounty program.
A security vulnerability in Eclipse Paho Go MQTT (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
The Zigaform plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.6.5. This is due to the plugin exposing a public AJAX endpoint that retrieves form submission data without performing authorization checks to verify ownership or access rights. This makes it possible for unauthenticated attackers to extract sensitive form submission data including personal information, payment details, and other private data via the rocket_front_payment_seesummary action by enumerating sequential form_r_id values.
Insecure Storage of Sensitive Information vulnerability in MeetMe on iOS, Android allows Retrieve Embedded Sensitive Data. This issue affects MeetMe: through v2.2.5.
In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117741; Issue ID: MSV-4538.
In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184297; Issue ID: MSV-4759.
In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4805.
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01673760; Issue ID: MSV-4650.
Local privilege escalation in IBM Informix Dynamic Server 14.10 allows a user who already holds a low-privilege account on the database host to log into the Informix server as administrator without supplying a password, giving full control over the database engine and its data. The issue is strictly local - the assessed CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) requires pre-existing access to the host and no user interaction, so it is not remotely exploitable and cannot be triggered against a system the attacker cannot already log into. Risk signals point to a genuine but locally-scoped flaw rather than a remote emergency: EPSS is 0.02% (5th percentile), the CVE is not in CISA KEV, and no public exploit code has been identified at time of analysis.
Improper verification of the source of a communication channel in Samsung SmartTouchCall prior to version 1.0.1.1 lets a remote, unauthenticated attacker spoof a trusted communication origin and read sensitive information, but the victim must actively interact with the crafted communication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 6.5). Exploitation is constrained by the mandatory user-interaction step and the app-specific attack surface, and no public exploit has been identified at time of analysis; EPSS is 0.05% (17th percentile) and the issue is not in CISA KEV, marking it as moderate rather than urgent. Impact is limited to confidentiality - there is no integrity or availability effect.
A security vulnerability in Samsung Account (CVSS 4.0) that allows local attacker. Remediation should follow standard vulnerability management procedures.
A security vulnerability in Samsung Account (CVSS 4.0) that allows local attacker. Remediation should follow standard vulnerability management procedures.
A security vulnerability in Samsung Cloud Assistant (CVSS 4.0) that allows local attacker. Remediation should follow standard vulnerability management procedures.
A security vulnerability in Galaxy Store for Galaxy Watch (CVSS 5.9) that allows local attacker. Remediation should follow standard vulnerability management procedures.
A security vulnerability in MPLocalService of MotionPhoto (CVSS 7.3) that allows local attackers. High severity vulnerability requiring prompt remediation.
A security vulnerability in MPRemoteService of MotionPhoto (CVSS 7.3) that allows local attackers. High severity vulnerability requiring prompt remediation.
Information disclosure in Samsung Android's Quram image codec (libimagecodec.quram.so) allows unauthenticated remote attackers to read memory outside the bounds of the parsing buffer when a crafted malformed image is decoded, affecting Android 13, 14, 15 and 16 firmware prior to SMR Dec-2025 Release 1. Samsung and NVD rate the flaw 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), while our assessment treats it as requiring user interaction (UI:R) with low confidentiality impact (C:L), since the leak is bounded to memory adjacent to the parsing buffer and is most useful as a primitive chained with another bug. No public exploit code has been identified at time of analysis and EPSS is low (0.06%, 17th percentile), so broad exploitation is unlikely without a companion memory-corruption flaw.
An out-of-bounds read in the Samsung Android bootloader allows an attacker with physical possession of and hands-on access to an affected device to read out-of-bounds memory from the bootloader stage. Only devices running firmware builds below the SMR Dec-2025 Release 1 patch level (spanning Android 13, 14, 15 and 16 per the vendor advisory) are affected, and the physical-access prerequisite (CVSS AV:P, unauthenticated per PR:N, no user interaction per UI:N) is the decisive limiter - there is no remote or network exploitation path. Impact is confidentiality-only (C:H with I:N/A:N) with no described code-execution primitive, no public exploit code and no confirmed active exploitation (CISA KEV not listed); EPSS is 0.02% (6th percentile), consistent with a low real-world priority issue.
HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonation attacks after the fix for CVE-2025-52672, via several alternate techniques. Homoglyphs based impersonation has been independently reported by other HackerOne users, such as itz_hari_ and khoof.
Improper export of the Dynamic Lockscreen component on Samsung Android devices allows an app already installed and running on the phone to access files with Dynamic Lockscreen's privileges, producing high confidentiality and integrity impact on the data it exposes. The issue is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 7.1): the attacker must be able to install and run a low-privilege malicious app, after which no further user interaction is required, and there is no remote or network exploitation path. No public exploit code has been identified at time of analysis and EPSS is negligible (0.02%, 4th percentile), but the flaw is remediated only by Samsung's SMR Dec-2025 Release 1 update, so devices still on patch levels up to SMR Nov-2025 R1 remain vulnerable.
A security vulnerability in to forward the current HTTP request to another server. (CVSS 5.4). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This vulnerability is fixed in 13.2.1.
A security vulnerability in This admin (CVSS 6.5). Risk factors: public PoC available. Vendor patch is available.
Grav CMS before 1.8.0-beta.27 discloses bcrypt password hashes - including the administrator's - to an authenticated admin-panel account that has been granted read access to the user account management section, allowing those hashes to be read from the rendered profile page's source and cracked offline. The confirmed impact is a confidentiality loss, consistent with our assessment vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N; any actual privilege escalation is conditional on successfully cracking a bcrypt hash, which may be impractical against a strong admin password, and the exposure requires a non-default privileged read grant rather than anonymous access. Publicly available exploit code exists, EPSS is low (0.08%, ~23rd percentile), and there is no evidence of active exploitation; the vendor fixed the issue in 1.8.0-beta.27.
Server-side template injection in Grav CMS (all releases prior to 1.8.0-beta.27, including the 1.7.x line such as 1.7.48) lets an unauthenticated remote attacker dump the site's full configuration - including plugin settings and any secrets they contain - by posting a crafted Twig expression in the __unique_form_id__ parameter of any form rendered by the Forms plugin. The affected code path evaluates attacker-supplied form field values as Twig, and the pre-patch version of Grav shipped no meaningful blocklist for dangerous Twig functions, so the response returns var_dumped configuration data directly to the requester. Impact is confidentiality-only (no integrity or availability effect per the independent assessment) and does not require authentication or user interaction, but a public, Forms-plugin-backed form must exist on the target; publicly available exploit code exists (no confirmed active exploitation / CISA KEV listing), and EPSS is low at roughly 0.06% (19th percentile).
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CVE-2025-51682 is a security vulnerability (CVSS 9.8) that allows an attacker. Risk factors: public PoC available.
In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated users to use specially crafted requests to read documents from data streams without having the respective privileges.
Rejected reason: DO NOT USE THIS CVE RECORD. No vendor patch available.
Rejected reason: DO NOT USE THIS CVE RECORD. No vendor patch available.
nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints (such as /admin) even after the legitimate user has logged out, enabling session hijacking. Any version above 4.70 that is not 4.80.3 fixes the vulnerability.
A cleartext transmission vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can sniff network traffic to trigger this vulnerability.
Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. This lack of transport layer security allows a man-in-the-middle attacker to intercept and modify traffic between the client and the device.
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.
A remote code execution vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.