Information Disclosure
Monthly
Information disclosure in Oracle SOA Suite (Integration Business Insight component), versions 12.2.1.4.0 and 14.1.2.0.0, allows a low-privileged attacker with HTTP network access to gain unauthorized access to all SOA Suite-accessible critical data, with a scope change that may significantly impact additional connected products. Oracle rates this CVSS 3.1 7.7 (High) with confidentiality-only impact and no integrity or availability effect. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the 'Authentication Bypass' tag hints at auth-weakening behavior but the CVSS vector confirms some privilege (PR:L) is still required.
Unauthorized data access in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets an attacker who already holds a login session on the host infrastructure read or take complete access to all data the product can reach, and because of a scope change the impact can extend to additional connected products. Addressed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.1 with confidentiality-only impact; no public exploit is identified at time of analysis and it is not listed in CISA KEV. The Oracle-supplied tag 'Authentication Bypass' suggests the flaw circumvents application-level access controls once local/infrastructure logon is obtained.
Information disclosure with scope change in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged remote attacker read all data accessible to the platform and impact additional connected products. The flaw is network-exploitable over HTTP with low attack complexity and only minimal existing privileges, and Oracle tags it as an authentication bypass affecting confidentiality only (no integrity or availability impact). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low exploitation barrier and cross-boundary scope change make it a meaningful risk in exposed telecom/messaging deployments.
Unauthorized data disclosure in Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 (Oracle Fusion Middleware, mod_proxy component) lets an unauthenticated remote attacker over HTTP read critical data and, because of a scope change, reach data belonging to other back-end products the proxy fronts. The confidentiality-only impact combined with S:C strongly indicates a proxy-side request-forwarding/SSRF-class weakness that exposes internal resources rather than a code-execution flaw. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Private organization member enumeration in Gitea allows any authenticated user to retrieve the full member roster - including emails - of a private organization via the /api/v1/orgs/{org}/members endpoint. The root cause is an incomplete fix: PR #38145 added visibility guards to ListPublicMembers and IsPublicMember but omitted the same guard from ListMembers, leaving a single missing HasOrgOrUserVisible check in routers/api/v1/org/member.go. Proof-of-concept code is publicly available in the GitHub Security Advisory; no active exploitation has been confirmed in CISA KEV, and the EPSS score of 0.16% (5th percentile) indicates low probability of widespread automated exploitation.
Remote unauthenticated denial-of-service and partial information disclosure affects Oracle MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1 (and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1) through the Server: X Plugin component. An attacker with only network access, using multiple protocols, can trigger a hang or repeatable crash (complete DoS) and read a subset of accessible data, carrying an Oracle-assigned CVSS 3.1 score of 8.2. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Oracle WebLogic Server (Oracle Fusion Middleware Core component) allows an unauthenticated attacker with network access via the SOAP protocol to fully compromise and take over the server. Affected releases are the actively supported 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions, and the flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but WebLogic RCE flaws of this class are historically weaponized rapidly.
Unauthorized data disclosure in Oracle WebLogic Server (WLS Web Services component) lets an unauthenticated remote attacker read all data accessible to the server over HTTP, with a scope change that can significantly impact additional products beyond WebLogic itself. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, addressed in Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 8.6 (confidentiality-only) and tagged as an authentication bypass; no public exploit identified at time of analysis.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) lets an unauthenticated attacker with only HTTP/2 network reachability fully compromise the affected data-grid instance. Supported versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and Oracle rates the flaw CVSS 9.8 with high confidentiality, integrity and availability impact. No public exploit has been identified at time of analysis and it is not in CISA KEV, but the easily exploitable, network-facing, unauthenticated nature makes this a top-priority patch.
Sensitive-data disclosure and partial denial of service in Oracle Payments (Oracle E-Business Suite File Transmission component, versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read all Oracle Payments-accessible data and partially disrupt the service. Oracle rates it CVSS 3.1 7.1 (C:H/A:L), and intelligence tags flag an authentication-bypass characteristic, though the CVSS vector confirms some privilege is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Hospitality Simphony (POS component) versions 19.8-19.8.5, 19.9-19.9.3, and 19.10 lets a remote, unauthenticated attacker read all data accessible to the application over HTTP. The flaw, tagged as an authentication bypass, requires no privileges or user interaction and yields high confidentiality impact (CVSS 3.1 base 7.5) with no impact to integrity or availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is currently theoretical but the low attack complexity makes it a real patching priority.
Out-of-bounds read and write in the Zephyr RTOS Bluetooth Classic (BR/EDR) L2CAP signaling handlers (l2cap_br_conf_req/rsp) lets an unauthenticated peer within Bluetooth radio range corrupt host memory and crash the device, affecting released versions including v4.4.0. Because the handlers checked the whole-PDU length (buf->len) instead of the per-command length (len), a packed CONF_REQ with a tiny header length underflows opt_len to ~0xFFFF and walks the option-parsing loop past the pooled ACL receive buffer. No public exploit is identified at time of analysis; a vendor patch and GHSA advisory exist and EPSS/KEV data were not provided.
Physical firmware compromise in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets an attacker with hands-on access exploit exposed NXP i.MX6 hardware recovery pins to boot unsigned, attacker-controlled code into memory. Once in recovery mode the attacker can dump, modify, or replace the device firmware and extract sensitive data such as credentials, keys, or configuration. Publicly available exploit code exists (published by CyberDanube), though there is no public exploit identified as being used in active campaigns and the flaw is not listed in CISA KEV.
Physical compromise of Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 is possible via an unprotected UART interface that lets an attacker halt boot and drop into the U-Boot bootloader. From the bootloader an attacker can rewrite boot configuration or the filesystem to gain full operating-system access on the charger. Publicly available exploit code exists (published by CyberDanube), though there is no public exploit identified as being used in active attacks and the flaw requires physical access.
Authorization token theft in Kubeflow Community Distribution before 26.03-rc.1 lets a low-privileged tenant hijack other users' sessions across the Dashboard, Pipelines API, and Notebooks, resulting in full account and data takeover. Any user holding the kubeflow-edit/Contributor role in any namespace - a role automatically granted when Automatic Profile Creation is enabled - can abuse overly broad Istio permissions to capture the auth tokens of other UI/API users. CVSS is 8.0 (High); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Filesystem access in the web-based management interface of HPE EdgeConnect SD-WAN Gateway (ECOS) allows an authenticated, highly privileged remote administrator to reach the underlying device filesystem beyond the intended management scope. Once exploited, an attacker can read sensitive files and tamper with or delete system data, undermining the confidentiality, integrity, and availability of the gateway. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is a vendor-reported (HPE) information-disclosure and data-tampering flaw with a CVSS base score of 7.2.
Identity-claim disclosure in Gitea (self-hosted Git server) before 1.27.0 lets any holder of a valid personal access token retrieve their email and organization/team membership from the OIDC userinfo endpoint (GET /login/oauth/userinfo) even when the token's scopes (e.g. only read:misc) would deny the equivalent REST API calls. The endpoint accepts API tokens as bearer credentials but skips the scope enforcement applied elsewhere, collapsing the authorization boundary that scoped tokens are meant to provide. Publicly available exploit code exists; the flaw is not in CISA KEV and EPSS is low (0.17%).
Private repository metadata leaks through the starred and watched repository API endpoints in Gitea versions prior to 1.27.0, allowing former collaborators to continue retrieving - and receiving live updates to - repository metadata after access revocation. Any authenticated user who starred a private Gitea repository while holding collaborator access can call GET /api/v1/user/starred with their existing API token and receive current repository metadata, including description changes made after their removal. A public proof-of-concept is available; the vulnerability is not in CISA KEV and EPSS indicates low observed exploitation activity at 0.15% (5th percentile).
Gitea's REST API leaks private organization membership through the `GET /orgs/{org}/public_members/{username}` endpoint, bypassing the visibility controls that correctly conceal this information in the web UI. All versions up to and including 1.26.4 are affected, permitting any user with a valid API token to confirm whether a specific user belongs to a hidden organization - data intentionally withheld from the web interface. No public exploit is confirmed in CISA KEV, though a detailed proof-of-concept with curl commands is documented in GHSA-jr5x-6h83-wrxf; EPSS stands at 0.16% (5th percentile), indicating low observed exploitation probability.
Gitea's Actions permission engine grants fork-PR task tokens unauthorized code-read access to third private repositories via a missing fork-PR discriminator in the collaborative-owner branch of `GetActionsUserRepoPermission`. All Gitea instances running versions up to and including 1.26.4 are affected when the collaborative-owner Actions feature is configured, as confirmed by vendor advisory GHSA-fj8v-hjwv-qm88 and EUVD-2026-58151. An attacker who has had at least one fork PR previously approved can exploit this to clone the full source of a private repository they were never authorized to access; impact is strictly read-only, with no write or code-execution capability. A functional PoC was included in the security advisory; this CVE is not in the CISA KEV catalog and no EPSS score was provided in the available data.
Broken authorization in MediaCMS 8.2.0 lets any authenticated user read private media metadata belonging to other users by injecting arbitrary media tokens into their own playlist. Because the playlist API skips ownership and state validation on PUT, an attacker who knows or guesses a target media token can then fetch their playlist and read otherwise-private fields (title, description, view/like counts, file size, author username, encoding status) via the unfiltered owner branch of the playlist detail view. No public exploit identified at time of analysis and the flaw is not in CISA KEV; a vendor patch is reported as available.
Persistent account takeover in Gitea (self-hosted Git service) versions up to and including 1.26.4 arises because a stolen Remember-Me cookie is never revoked after theft is detected. When the split-token (ID:Hash) design detects a hash mismatch - the canonical signal of a compromised token per the Paragonie remember-me guidance - CheckAuthToken only returns ErrAuthTokenInvalidHash and autoSignIn merely clears the victim's local cookie, leaving the attacker's rotated token live in the database. The result is indefinite attacker access to the victim's account. Fixed in 1.27.0; no public exploit identified at time of analysis, and EPSS is low at 0.16%.
Unauthorized information disclosure and case-attachment tampering in Elastic Kibana lets a low-privileged authenticated user with limited file-management permissions read, alter, or delete case attachments belonging to feature areas they should not reach, including sensitive Security Solution cases. The flaw stems from Kibana's file-access authorization check and its resource retrieval using two different resolution mechanisms, allowing the authorization gate to be bypassed. No public exploit identified at time of analysis; not listed in CISA KEV, and EPSS was not provided.
Privilege escalation in FileGator (the open-source self-hosted PHP web file manager) lets an authenticated user who holds the 'chmod' permission set arbitrary Unix file modes via the '/chmoditems' API endpoint, ultimately elevating to root. The endpoint forwards attacker-supplied values straight to PHP's chmod() through octdec() with no validation or allow-listing, so a low-privileged operator can make sensitive binaries or files setuid/world-writable and gain full control of the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV; EPSS was not provided.
Silent record suppression in AWS s2n-tls affects all TLS 1.3 connections (both client and server roles) because the AEAD implementation hardcodes the outer content_type (0x17) in the additional authenticated data instead of authenticating the actual wire byte, leaving that field outside the integrity tag. An active on-path attacker can selectively drop individual application_data records without either endpoint detecting tampering, causing HTTP request/response desynchronization or undetectable data loss on write-heavy workloads. Reported internally by Amazon (AMZN); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial-of-service via unbounded memory allocation and leak in the CImg C++ image-processing library affects all versions prior to 4.0.0. In _load_analyze(), a 4-byte attacker-controlled header_size field from an Analyze/NIfTI (.hdr/.img/.nii) file is passed straight to a heap allocation of up to ~4 GB with no check against real file size; when the subsequent short read throws a CImgIOException the buffer is never freed, leaking the full allocation on every call. No public exploit identified at time of analysis and no KEV/EPSS signals were provided, but a 6-byte crafted file reliably leaks ~1.3 GB per invocation, enabling memory-exhaustion DoS against any service that feeds untrusted files to CImg.
Denial of service in the Go golang.org/x/net/dns/dnsmessage package allows remote attackers to crash any application that parses attacker-supplied DNS responses by sending a malformed SVCB or HTTPS resource record. When the declared size of a service-parameter value exceeds the remaining DNS message buffer, the parser panics instead of returning an error, taking down the DNS client, resolver, or proxy embedding this library. EPSS is low (0.15%) and there is no public exploit identified at time of analysis, but a vendor patch is available and the pre-conditions are trivial for any host that resolves DNS through untrusted responders.
Out-of-bounds read in the Perl module Data::HashMap::Shared before 0.14 lets a local peer that can write the shared-memory backing file corrupt per-record offset and length values, causing the map to copy attacker-controlled regions out of the arena. The flaw affects the each, keys, values, pop, shift, take, swap, drain and cursor code paths and can leak adjacent process memory or crash the process. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 5th percentile).
Out-of-bounds read in the Data::RadixTree::Shared Perl module (all versions before 0.02) lets a local peer with write access to the shared memory-mapped backing file corrupt trusted node records and force a lookup to dereference attacker-controlled node and arena indices, leaking adjacent process memory or crashing the process. The attach-time validator rdx_validate_header checks the header and region layout but never bounds-checks the node records that rdx_find_locked subsequently trusts. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the flaw is not in CISA KEV.
Out-of-bounds memory read in the Perl module Data::SortedSet::Shared before 0.03 lets a local peer who can write the shared mmap-backed file poison tree link indices, causing the next rank, min, or max query to dereference an out-of-bounds node and leak adjacent process memory or crash. The flaw stems from an attach-time validator that checks only the root index, deferring the full structural check to a separate, rarely-invoked validate method. No public exploit has been identified at time of analysis, EPSS risk is low (0.16%, 5th percentile), and it is not on the CISA KEV list.
Out-of-bounds read in the Perl module Data::ReqRep::Shared before 0.05 lets a local peer with write access to the shared mmap-backed file leak adjacent process memory or crash the process. The flaw sits in reqrep_recv_locked, which trusts an arena offset and length read straight from the shared segment without bounding them against the arena capacity. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 5th percentile), and it is not listed in CISA KEV.
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets a local peer who can write the shared backing file leak adjacent process memory. The attach-time validator (si_validate_header) checks header magic, version, offsets, total_size and counts but never bounds-checks the slot, reverse, and arena arrays it subsequently trusts, so a poisoned index in si_idx_find drives a triple-indirection read past valid bounds. No public exploit is identified at time of analysis and EPSS risk is low (0.17%), but a vendor patch (0.02) is available.
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-admin user to read sensitive information from the underlying appliance database. Because any low-privileged authenticated account can trigger it over the network, the flaw effectively collapses the product's internal privilege boundaries and exposes vulnerability, asset, and configuration data held by the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor (Tenable) has released a fixed version.
Information disclosure in Atlassian Confluence Data Center allows an unauthenticated remote attacker to read sensitive information from affected instances, carrying a CVSS 4.0 score of 8.2 (High). The flaw was introduced across a wide span of releases (7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, 10.2.0) and was found internally by Atlassian. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, unauthenticated nature makes patching a priority for internet-facing deployments.
MAC tag forgery in Google Tink (tink-java and tink-android) is enabled by a non-constant-time comparison in the ChunkedMacVerification object, which leaks per-byte matching progress through response-timing differences. An attacker who can submit many verification attempts and measure timing can reconstruct a valid MAC tag byte-by-byte, defeating the integrity/authenticity guarantee the MAC is meant to provide. Reported by Google and tracked in tink-java issue #75; no public exploit identified at time of analysis, and the CVSS 4.0 score is 8.2 driven entirely by integrity impact.
Argument injection in Moby BuildKit lets a malicious Git source trigger crafted command invocation on the build host when a custom frontend or a client using the raw low-level API enables the non-default git.checkoutbundle=true option during Git source checkout. The flaw affects builds that opt into this experimental checkout behavior rather than standard Dockerfile builds, and a successful attack yields high-impact command execution in the build environment. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Integrity-protection bypass in libssh builds compiled against the OpenSSL crypto backend, caused by incorrect AES-GCM finalization checks that fail to verify the authentication tag. An in-path (man-in-the-middle) attacker positioned on an SSH session can silently alter plaintext bytes on the wire without triggering a MAC/integrity failure, defeating a core guarantee of the SSH transport layer. There is no public exploit identified at time of analysis, EPSS risk is low (0.28%, 20th percentile), and CISA SSVC rates exploitation as 'none' though 'automatable: yes'.
Memory-corrupting type confusion in Firefox's JavaScript JIT engine allows a remote attacker to serve a malicious web page that triggers a JIT miscompilation, corrupting memory to disclose sensitive data or achieve code execution in the content process; Mozilla fixed it in Firefox 153. No public exploit is identified at time of analysis, and the EPSS score is low (0.13%, 3rd percentile), indicating no observed weaponization yet despite the critical 9.8 CVSS rating.
Denial of service in Mozilla Firefox before version 153 arises from an invalid pointer access (CWE-824) in the PSM (Personal Security Manager) security component, which brokers TLS/certificate and NSS cryptographic operations. Remote content processed by the browser can trigger the invalid pointer dereference, crashing the affected process; the assigned CVSS 3.1 vector scopes impact to availability only (A:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.13% (3rd percentile), consistent with a stability/crash bug rather than a code-execution primitive.
Information disclosure in Mozilla Firefox's Networking: WebSockets component allows remote attackers to read sensitive data across origin or trust boundaries without authentication or user interaction. The flaw affects Firefox releases prior to 153 and the ESR line prior to 140.13, and is corrected in those fixed builds. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the network-reachable, no-privilege CVSS 7.5 profile makes it a broad exposure across the very large Firefox install base.
Information disclosure in Mozilla Firefox's DOM: Security component allows remote attackers to read sensitive cross-origin or in-process data via crafted web content, undermining the browser's same-origin and security boundary enforcement. Any Firefox version prior to 153 is affected, and exploitation is remote and unauthenticated with no user interaction beyond visiting a malicious page. The issue was reported and fixed by Mozilla; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.13%).
Cross-origin information disclosure in Mozilla Firefox's DOM: Navigation component allows a malicious web page to bypass site isolation (Fission) boundaries and read data belonging to another origin. The flaw affects Firefox versions prior to 153 and is remotely reachable over the network with no privileges required, though impact is limited to confidentiality. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.13%).
Information disclosure in Mozilla Firefox before version 153 stems from a site isolation weakness in the Graphics component, allowing a remote attacker to read cross-origin data that should be siloed between sites. The confidentiality-only flaw (CVSS 7.5, C:H) is network-reachable without authentication or user interaction, but carries no public exploit and a low EPSS score (0.13%, 3rd percentile), indicating theoretical rather than active risk. It is not listed in CISA KEV; no public exploit identified at time of analysis.
Integrity and availability impact in Firefox's JIT JavaScript engine allows remote attackers to cause malicious script outcomes or denial of service. Versions prior to 153 are affected. Exploitation requires a victim to visit a crafted
Information disclosure in Mozilla Firefox's Storage: IndexedDB component allows a remote attacker to leak sensitive data across origins or from other browsing contexts without authentication or user interaction. The flaw affects Firefox releases prior to 153 and ESR builds prior to 140.13; there is no public exploit identified at time of analysis, and its EPSS score (0.15%, 5th percentile) indicates low near-term exploitation likelihood despite a CVSS of 7.5. Mozilla has released fixed builds, so the practical priority is prompt browser updating rather than emergency response.
Sandbox escape in Mozilla Firefox's DOM: Networking component allows a remote attacker to break out of the content-process security boundary, fixed in Firefox 153. Rated CVSS 9.8, it maps to CWE-693 (Protection Mechanism Failure) and is tagged as an information-disclosure issue by Mozilla, meaning a compromised or malicious web page could bypass the browser's isolation to reach host resources. No public exploit identified at time of analysis, and the EPSS score is low (0.14%, 4th percentile), indicating no observed exploitation activity yet.
Information disclosure in Mozilla Firefox and Firefox ESR stems from a site isolation flaw in the Networking component, letting a malicious web page bypass cross-origin process/security boundaries and access data belonging to other sites. The issue was reported by Mozilla and fixed in Firefox 153 and Firefox ESR 140.13; no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.15% (5th percentile).
Information disclosure in Mozilla Firefox's Graphics WebGPU component allows a malicious web page to read uninitialized process memory, potentially leaking sensitive data such as heap contents, pointers, or cross-origin material, before the fix in Firefox 153. The flaw stems from WebGPU operating on memory that was never initialized (CWE-908), and while CVSS rates confidentiality impact High (7.5), EPSS is very low (0.14%, 4th percentile) with no public exploit and no CISA KEV listing. Exploitation is browser-based, requiring a victim to load attacker-controlled WebGPU content.
Information disclosure in Mozilla Firefox's Graphics WebGPU component allows a remote attacker to read leftover uninitialized memory, potentially exposing sensitive data such as other pages' content, GPU buffers, or process memory. The flaw stems from a WebGPU code path returning memory that was never zeroed, and is fixed in Firefox 153; there is no public exploit identified at time of analysis and the EPSS score is low (0.14%, 4th percentile).
Information disclosure in Mozilla Firefox's Graphics: WebGPU component allows remote attackers to read uninitialized memory contents via crafted WebGPU operations, potentially leaking sensitive process memory such as heap data, addresses, or other page content. The flaw is network-reachable without authentication or user interaction beyond visiting a malicious page, but carries no integrity or availability impact. There is no public exploit identified at time of analysis, and EPSS estimates a low 0.14% exploitation probability.
Cross-origin information disclosure in Mozilla Firefox arises from a site isolation weakness in the Graphics: WebRender rendering component, where origin boundaries are not correctly enforced during GPU-accelerated compositing. An attacker-controlled web page loaded by a victim could leak data belonging to a different origin, undermining the same-origin protections that site isolation is meant to guarantee. Mozilla fixed the issue in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).
Information disclosure in Mozilla Firefox before version 153 stems from an input-validation flaw in the DOM Copy & Paste and Drag & Drop component, allowing remote content to potentially read data that should remain isolated. The provided CVSS vector rates confidentiality impact as High with no privileges or user interaction, and Mozilla has shipped a fix in Firefox 153. There is no public exploit identified at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates low near-term exploitation likelihood.
Cross-origin information disclosure in Mozilla Firefox and Firefox ESR stems from a site isolation weakness in the Networking: HTTP component (CWE-346, origin validation error), letting a malicious web page bypass origin boundaries to read data belonging to another site. It affects Firefox before version 153 and Firefox ESR before 140.13 and is addressed in Mozilla advisories MFSA2026-68 and MFSA2026-70. There is no public exploit identified at time of analysis, and the EPSS score is low (0.15%, 5th percentile), indicating no observed weaponization despite the vendor's 9.8 CVSS rating.
Information disclosure in the Firefox DevTools Framework component allows an attacker to read data that should remain isolated, affecting Mozilla Firefox prior to 153 and Firefox ESR prior to 140.13. Reported by Mozilla and carrying a CVSS 7.5 (high) rating driven by high confidentiality impact, there is no public exploit identified at time of analysis and the EPSS probability is low at 0.15% (5th percentile). The issue is fixed and not listed in CISA KEV.
Information disclosure in the Privacy component of Mozilla Firefox for Android allows remote attackers to expose sensitive user data, with the flaw carrying a high confidentiality impact (CVSS 7.5). Mozilla self-reported and fixed the issue in Firefox 153 per advisory MFSA2026-68; there is no public exploit identified at time of analysis, and the EPSS probability is low (0.14%, 4th percentile). The Privacy component context suggests leakage of protected browsing state or user data that the browser is designed to isolate.
Sandbox escape via use-after-free in Mozilla Firefox's Disability Access (accessibility) APIs allows an attacker who has compromised the content process to break out of the browser sandbox and gain code execution at the host privilege level. It affects Firefox before 153 and the ESR 115.x and 140.x branches, was reported and patched by Mozilla, and carries no public exploit at time of analysis. EPSS is low (0.15%, 5th percentile) and it is not on CISA KEV, indicating no observed exploitation.
Memory corruption in Mozilla Firefox's JavaScript engine JIT compiler allows attackers to corrupt memory and potentially achieve arbitrary code execution when a victim visits a malicious web page. The flaw stems from a JIT miscompilation (type confusion, CWE-843) affecting Firefox before 153, ESR before 115.38, and ESR before 140.13, and carries CVSS 9.8. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).
Information disclosure in Mozilla Firefox's ImageLib graphics component allows remote attackers to read sensitive data (likely uninitialized or out-of-bounds process memory) when a victim renders attacker-controlled image content, per the CWE-200 classification and the C:H CVSS impact. Affected builds are Firefox before 153 and the ESR 115.x and 140.x branches, all fixed by Mozilla in Firefox 153, ESR 115.38, and ESR 140.13. There is no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile), consistent with a vendor-reported browser memory-disclosure issue rather than one under active exploitation.
Memory corruption in Mozilla Firefox's DOM Bindings (WebIDL) layer allows a remote attacker who serves malicious web content to trigger a use-after-free (CWE-416) via an invalid/dangling pointer, potentially leading to arbitrary code execution or information disclosure in the content process. All Firefox and Firefox ESR builds prior to the fixed releases are affected. There is no public exploit identified at time of analysis, and the low EPSS score (0.15%, 5th percentile) suggests exploitation is not yet observed in the wild, though Mozilla rates the memory-safety impact as high.
Memory-safety corruption in Mozilla Firefox stems from a JIT miscompilation in the JavaScript engine's WebAssembly component, fixed in Firefox 153 and Firefox ESR 140.13. An attacker who lures a victim to a malicious page can supply crafted WebAssembly that the Just-In-Time compiler translates incorrectly, corrupting engine state to disclose memory or achieve code execution in the content process. There is no public exploit identified at time of analysis and the EPSS score is very low (0.15%, 5th percentile), so no active exploitation is indicated despite the 9.8 rating.
Sandbox escape in Mozilla Firefox stems from a use-after-free in the Disability Access (accessibility) APIs, letting an attacker who already controls a sandboxed content process break out of the browser sandbox and compromise the host. It affects Firefox before 153 and the ESR 115.x and 140.x branches, with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the EPSS score is low (0.15%, 5th percentile), indicating no observed widespread exploitation.
Sandbox escape in Mozilla Firefox stems from a use-after-free (CWE-416) in the DOM: Navigation component, letting web-reachable content corrupt memory and cross the content-process sandbox boundary. Affected builds are Firefox before 153, Firefox ESR before 115.38, and Firefox ESR before 140.13; Mozilla self-reported the issue and shipped fixes across all three branches (MFSA-2026-68/69/70). There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), indicating no observed weaponization yet despite the 9.8 CVSS rating.
Use-after-free in the WebRTC Audio/Video component of Mozilla Firefox allows a remote attacker to corrupt memory and potentially achieve arbitrary code execution when a victim visits a malicious page or joins a crafted WebRTC session. All Firefox builds prior to 153 and ESR builds prior to 140.13 are affected, with high impact to confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the EPSS probability is low (0.15%), but browser memory-corruption bugs of this class are historically attractive exploitation targets.
Out-of-bounds memory read in Apache Fory (formerly Apache Fury) versions 0.5.0 up to 1.4.0 allows remote attackers to read beyond the underlying buffer via a flaw in readAlignedVarUint() when out-of-band zero-copy deserialization is used. Because the affected code relies on sun.misc.Unsafe for direct memory access, an attacker supplying crafted serialized data to an application that has enabled this opt-in feature can disclose adjacent heap memory or crash the process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fix (version 1.4.0) is available and the issue was reported by the Apache security team.
Unauthenticated media upload in the Membership Pro subscription extension for Joomla (all versions 1.0 through 4.6.1) lets remote attackers push arbitrary media assets to the server without any account or login, due to an insecure default configuration. The flaw carries a CVSS 9.1 rating and CISA's SSVC framework marks it as automatable with total technical impact, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It is fixed in version 4.6.2.
Data disclosure and tampering in Sony FeliCa IC chips manufactured in or before 2017 stems from a missing cryptographic step (CWE-325) in the chip's contactless security handling. An attacker with physical/NFC proximity to an affected card or device can read or alter data stored on the chip, undermining the confidentiality and integrity of stored credentials, balances, or identity data. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the CVSS 4.0 base score is 7.0 (High), driven entirely by high impact under a physical attack vector.
Information disclosure in DayuanJiang next-ai-draw-io 0.4.13, an open-source Next.js application that generates draw.io diagrams via AI providers, allows a remote attacker to obtain sensitive information through the x-ai-provider component. The flaw is reported as unauthenticated and network-reachable (CVSS 7.5, confidentiality-only), and no public exploit was identified at time of analysis, though a third-party technical write-up exists. EPSS is low (0.22%, 13th percentile) and the CVE is not listed in CISA KEV.
Information disclosure in aiflowy (an open-source Java/Spring-based AI workflow / low-code platform) versions 2.1.2 and earlier lets remote unauthenticated attackers extract sensitive information through the JobUtil.java scheduling component. The public technical writeup titled 'Any SpringBean invocation' indicates the flaw stems from unrestricted invocation of arbitrary Spring beans, which can be abused to read internal application state and secrets. No CISA KEV listing and a low EPSS score (0.19%, 9th percentile) suggest no observed mass exploitation, but a public technical analysis describing the technique exists.
Sensitive data exfiltration in Gitleaks before 8.30.1 lets an attacker who controls the report template read arbitrary host environment variables through non-hermetic Sprig functions (env, expandenv, getHostByName) and smuggle them out via attacker-triggered DNS lookups. Because Gitleaks runs in CI/CD with broad access to credentials, tokens, and API keys - including the very secrets it just discovered during a scan - a malicious template turns the scanner into an exfiltration channel. A detailed public write-up describing the technique and the fix exists; there is no CISA KEV listing, so this reflects a demonstrated technique rather than confirmed active exploitation.
Heap and stack memory disclosure in rsync versions prior to 3.4.3 lets a malicious sender leak process memory from a receiver by overflowing an unchecked 32-bit signed counter in the compressed-token decoder. The leaked contents can include environment variables, passwords, and heap/stack/library pointers, undermining ASLR and enabling follow-on exploitation. No public exploit is identified at time of analysis, there is no CISA KEV listing, and EPSS was not provided, so real-world exploitation should be treated as unproven but plausible.
Command-restriction bypass in Apache MINA SSHD (server-side) lets a user who authenticates with an OpenSSH user certificate carrying a force-command directive execute arbitrary commands instead of the single restricted command the certificate authority intended. The server accepts and honors such certificates but silently ignores the force-command and verify-required options, breaking the security model that certificate issuers rely on to constrain principals. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is confirmed and fixed by the Apache Software Foundation in versions 2.19.0 and 3.0.0-M5.
Anonymous account takeover in FreeScout help desk before 1.8.224 lets an unauthenticated attacker seize the lowest-id activated agent or administrator account by abusing the public POST /user-setup/{hash}/{invite_sent_at} endpoint. By supplying a single URL-encoded space as the invite hash and a plaintext numeric timestamp, the attacker overwrites the target's email and password and is logged in as that user. No public exploit is identified at time of analysis, but the mechanics are fully disclosed in the GitHub advisory and CVSS is 9.4.
Cleartext SFTP credential disclosure in VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 allows any unauthenticated remote attacker to harvest working SFTP logins by simply reading the HTTP responses of three exposed endpoints. The credentials appear whenever SFTP integration has been configured in the application, giving the attacker direct access to the backing SFTP server and whatever clinical or file data it holds. No public exploit or CISA KEV listing exists at time of analysis, but with a 9.0 CVSS and zero authentication required, exploitation is trivial once the endpoints are located.
Privilege escalation and information disclosure in Best Practical's Request Tracker (RT) 6.0.0-6.0.2 and versions before 5.0.10 lets a privileged but non-administrative user harvest other users' authentication credentials - including those of administrators - through the REST 2.0 API and replay them against RT's RSS/iCal feed endpoints to read data as those victims. Because the same credential-exposing request also rotates the tokens, exploitation is destructive: it silently invalidates every previously distributed feed URL across the instance. No public exploit has been identified at time of analysis; the flaw is fixed in RT 5.0.10 and 6.0.3.
Deadlock in the Linux kernel Bluetooth L2CAP subsystem during connection teardown can be triggered by an adjacent attacker via crafted Bluetooth traffic, leading to a denial of service. The vulnerability arises from an incorrect mutex acquisition order in l2cap_conn_del() and process_pending_rx(), as confirmed by a provided proof-of-concept and static analysis. While the official CVSS score indicates full compromise, the exploit only demonstrates a deadlock; no public exploitation outside of the PoC has been identified, and EPSS probability is low (0.16%).
Use-after-free in the Linux kernel's Qualcomm rmnet networking driver allows a local attacker with low privileges to escalate to kernel-level code execution. The flaw occurs when the rmnet endpoint is freed while still being referenced by concurrent receive path handlers, leading to memory corruption. No active exploitation or public exploit code has been identified, but the high CVSS score reflects a significant local privilege escalation risk.
TLS hostname verification bypass in the lettre Rust mailer library (0.10.1 through 0.11.21) exposes users of the boring-tls feature to man-in-the-middle attacks; an inverted boolean caused the default strict configuration to silently disable hostname checking. An on-path attacker holding any chain-valid certificate for any domain can transparently intercept SMTP submission, harvesting PLAIN/LOGIN credentials and full message contents. There is no public exploit identified at time of analysis, but the one-line root cause is visible in the public fix commit, making the flaw trivially understandable; native-tls and rustls backends are not affected.
NTLM credential theft and denial-of-service in Scille Parsec (parsec-cloud before 3.3.3-rc.0) arises because the Windows client mounts organization workspaces using their unsanitized names, and a workspace name containing backslashes can evaluate to a UNC path. A low-privileged organization member who names a workspace as an attacker-controlled UNC path (e.g. \\attacker\share) forces victim clients to reach out over SMB, leaking their NetNTLM hash to the attacker or hanging the application if the path is unreachable. Publicly available exploit code has not been identified and it is not in CISA KEV, though a fixed vendor release exists.
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbitrary Groovy code on the server by importing and starting a malicious BPMN process definition through the REST API. Because Flowable's Groovy scriptTasks execute with no sandbox in affected 3.0.x, 4.0.x, and 4.1.x releases, script code embedded in the process runs directly with the privileges of the Syncope core JVM. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path once an entitled admin account is reached makes it a strong candidate for post-compromise abuse and insider misuse.
Signature-verification bypass in Network-AI before 5.13.4 lets unauthenticated remote attackers forge APS delegation payloads and mint signed permission-grant tokens for privileged scopes, including SHELL_EXEC. The root cause is a default local verifier in APSAdapter that treats any non-empty string as a valid cryptographic signature, so no real key material or authentication is needed. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the trivial exploitation logic and network reachability make it a high-priority fix.
Client-side double-free (CWE-415) in FreeRDP's .rdp connection-file parser lets an attacker who tricks a victim into opening a malicious .rdp file corrupt heap memory, potentially leading to a crash or code execution in xfreerdp/sdl-freerdp/wlfreerdp. The flaw is in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c), where a non-owning pointer to the settings-owned MonitorIds array is freed on a strtoul error path without clearing settings->MonitorIds, so freerdp_settings_free() frees the same buffer again at teardown. All 3.x releases through 3.27.1 are affected in the default configuration and it is fixed in 3.28.0; there is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided.
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-active authenticated sessions via a TOCTOU race condition on the HTTP /rpc endpoint — the primary interface used by all official SurrealDB SDKs. Because concurrent requests share mutable authentication state, an unauthenticated request that races in before the state is cleared executes as the authenticated user, potentially escalating to root. No public exploit is identified at time of analysis, but the flaw is credited by VulnCheck and carries a high CVSS 4.0 score of 9.2.
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT permissions by traversing graph edges or REFERENCES TO back-references, reading full documents from tables defined with PERMISSIONS FOR select NONE. The root cause is that GraphEdgeScan and ReferenceScan fetched records directly from storage without evaluating the target table's permission expression. No public exploit identified at time of analysis and not listed in CISA KEV; impact is confidentiality-only and bounded to the caller's current database, but any table reachable through a chain of edges from a readable starting point is exposed.
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belonging to other namespaces and databases by manipulating the scope in the URL path. Because the server fails to validate namespace/database scope on custom API routes, an attacker holding valid credentials for one tenant can read sensitive data or trigger unintended operations in unrelated tenants. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the multi-tenant data-exposure impact is significant (CVSS 4.0 8.6).
Predictable session ID generation in the Dancer2 Perl web framework (all versions through 2.1.0) allows remote attackers to guess valid session identifiers and hijack user sessions. When both the Math::Random::ISAAC::XS and Crypt::URandom CSPRNG modules are absent, Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a SHA-1 hash of low-entropy, largely deterministic inputs (built-in rand(), module path, a counter, PID, an object memory address, and a rand-shuffled string). There is no public exploit identified at time of analysis, KEV lists no active exploitation, and EPSS is low (0.14%), but the flaw is rated CVSS 8.2 and CISA SSVC marks it automatable with partial technical impact.
Predictable salt generation in Crypt::Password through version 0.28 for Perl weakens the security of stored password hashes by seeding salts with Perl's built-in rand() function, which is not cryptographically secure. An attacker who obtains a password hash database can more easily precompute or predict salts, reducing the cost of offline cracking. There is no public exploit identified at time of analysis, EPSS is low (0.14%, 4th percentile), and CISA SSVC records no observed exploitation.
Timing side-channel in the Crypt::Password Perl module (versions through 0.28) allows attackers to incrementally guess a stored password hash because check_password compares values with Perl's short-circuiting eq operator instead of a constant-time comparison. The flaw is classic CWE-208 (Observable Timing Discrepancy); it carries a CVSS 7.5 but a very low EPSS (0.14%, 4th percentile) and no public exploit identified at time of analysis, and SSVC records exploitation status as none. A vendor patch is available.
Unauthenticated SQL injection in the Modern Event Calendar Pro and Modern Events Calendar Lite WordPress plugins (all versions before 7.34.0) lets remote attackers extract sensitive database contents by injecting into an unsanitized request parameter used within a SQL statement, reachable through an AJAX action open to unauthenticated users. Publicly available exploit code exists (reported by WPScan), and a vendor patch is available; the CVSS 8.6 rating reflects a scope-changed, high-confidentiality impact with no authentication or user interaction required. No EPSS score or CISA KEV listing was provided, so there is no public exploit identified as being actively exploited at time of analysis.
Information disclosure in FileThingie 2.5.7, a single-file PHP web-based file manager, lets a remote attacker retrieve sensitive information through the ft2.php component. The flaw is documented in a third-party vulnerability-research repository, indicating exploitation details are likely public, though it is not listed in CISA KEV. The published CVSS 9.9 rating overstates impact relative to the description, which describes only information disclosure rather than full compromise.
Use-after-free in Google Chrome desktop versions prior to 150.0.7871.128 allows a remote attacker to corrupt memory and potentially achieve renderer code execution after a victim visits a crafted web page. The flaw carries a critical CVSS 9.6 owing to its network vector, low complexity, and scope-changing impact, though it requires user interaction (loading a malicious page). No public exploit has been identified at time of analysis and the EPSS probability is low (0.23%, 14th percentile).
Information disclosure in Oracle SOA Suite (Integration Business Insight component), versions 12.2.1.4.0 and 14.1.2.0.0, allows a low-privileged attacker with HTTP network access to gain unauthorized access to all SOA Suite-accessible critical data, with a scope change that may significantly impact additional connected products. Oracle rates this CVSS 3.1 7.7 (High) with confidentiality-only impact and no integrity or availability effect. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the 'Authentication Bypass' tag hints at auth-weakening behavior but the CVSS vector confirms some privilege (PR:L) is still required.
Unauthorized data access in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets an attacker who already holds a login session on the host infrastructure read or take complete access to all data the product can reach, and because of a scope change the impact can extend to additional connected products. Addressed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.1 with confidentiality-only impact; no public exploit is identified at time of analysis and it is not listed in CISA KEV. The Oracle-supplied tag 'Authentication Bypass' suggests the flaw circumvents application-level access controls once local/infrastructure logon is obtained.
Information disclosure with scope change in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged remote attacker read all data accessible to the platform and impact additional connected products. The flaw is network-exploitable over HTTP with low attack complexity and only minimal existing privileges, and Oracle tags it as an authentication bypass affecting confidentiality only (no integrity or availability impact). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low exploitation barrier and cross-boundary scope change make it a meaningful risk in exposed telecom/messaging deployments.
Unauthorized data disclosure in Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 (Oracle Fusion Middleware, mod_proxy component) lets an unauthenticated remote attacker over HTTP read critical data and, because of a scope change, reach data belonging to other back-end products the proxy fronts. The confidentiality-only impact combined with S:C strongly indicates a proxy-side request-forwarding/SSRF-class weakness that exposes internal resources rather than a code-execution flaw. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Private organization member enumeration in Gitea allows any authenticated user to retrieve the full member roster - including emails - of a private organization via the /api/v1/orgs/{org}/members endpoint. The root cause is an incomplete fix: PR #38145 added visibility guards to ListPublicMembers and IsPublicMember but omitted the same guard from ListMembers, leaving a single missing HasOrgOrUserVisible check in routers/api/v1/org/member.go. Proof-of-concept code is publicly available in the GitHub Security Advisory; no active exploitation has been confirmed in CISA KEV, and the EPSS score of 0.16% (5th percentile) indicates low probability of widespread automated exploitation.
Remote unauthenticated denial-of-service and partial information disclosure affects Oracle MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1 (and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1) through the Server: X Plugin component. An attacker with only network access, using multiple protocols, can trigger a hang or repeatable crash (complete DoS) and read a subset of accessible data, carrying an Oracle-assigned CVSS 3.1 score of 8.2. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Oracle WebLogic Server (Oracle Fusion Middleware Core component) allows an unauthenticated attacker with network access via the SOAP protocol to fully compromise and take over the server. Affected releases are the actively supported 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions, and the flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but WebLogic RCE flaws of this class are historically weaponized rapidly.
Unauthorized data disclosure in Oracle WebLogic Server (WLS Web Services component) lets an unauthenticated remote attacker read all data accessible to the server over HTTP, with a scope change that can significantly impact additional products beyond WebLogic itself. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, addressed in Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 8.6 (confidentiality-only) and tagged as an authentication bypass; no public exploit identified at time of analysis.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) lets an unauthenticated attacker with only HTTP/2 network reachability fully compromise the affected data-grid instance. Supported versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and Oracle rates the flaw CVSS 9.8 with high confidentiality, integrity and availability impact. No public exploit has been identified at time of analysis and it is not in CISA KEV, but the easily exploitable, network-facing, unauthenticated nature makes this a top-priority patch.
Sensitive-data disclosure and partial denial of service in Oracle Payments (Oracle E-Business Suite File Transmission component, versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read all Oracle Payments-accessible data and partially disrupt the service. Oracle rates it CVSS 3.1 7.1 (C:H/A:L), and intelligence tags flag an authentication-bypass characteristic, though the CVSS vector confirms some privilege is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Hospitality Simphony (POS component) versions 19.8-19.8.5, 19.9-19.9.3, and 19.10 lets a remote, unauthenticated attacker read all data accessible to the application over HTTP. The flaw, tagged as an authentication bypass, requires no privileges or user interaction and yields high confidentiality impact (CVSS 3.1 base 7.5) with no impact to integrity or availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is currently theoretical but the low attack complexity makes it a real patching priority.
Out-of-bounds read and write in the Zephyr RTOS Bluetooth Classic (BR/EDR) L2CAP signaling handlers (l2cap_br_conf_req/rsp) lets an unauthenticated peer within Bluetooth radio range corrupt host memory and crash the device, affecting released versions including v4.4.0. Because the handlers checked the whole-PDU length (buf->len) instead of the per-command length (len), a packed CONF_REQ with a tiny header length underflows opt_len to ~0xFFFF and walks the option-parsing loop past the pooled ACL receive buffer. No public exploit is identified at time of analysis; a vendor patch and GHSA advisory exist and EPSS/KEV data were not provided.
Physical firmware compromise in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets an attacker with hands-on access exploit exposed NXP i.MX6 hardware recovery pins to boot unsigned, attacker-controlled code into memory. Once in recovery mode the attacker can dump, modify, or replace the device firmware and extract sensitive data such as credentials, keys, or configuration. Publicly available exploit code exists (published by CyberDanube), though there is no public exploit identified as being used in active campaigns and the flaw is not listed in CISA KEV.
Physical compromise of Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 is possible via an unprotected UART interface that lets an attacker halt boot and drop into the U-Boot bootloader. From the bootloader an attacker can rewrite boot configuration or the filesystem to gain full operating-system access on the charger. Publicly available exploit code exists (published by CyberDanube), though there is no public exploit identified as being used in active attacks and the flaw requires physical access.
Authorization token theft in Kubeflow Community Distribution before 26.03-rc.1 lets a low-privileged tenant hijack other users' sessions across the Dashboard, Pipelines API, and Notebooks, resulting in full account and data takeover. Any user holding the kubeflow-edit/Contributor role in any namespace - a role automatically granted when Automatic Profile Creation is enabled - can abuse overly broad Istio permissions to capture the auth tokens of other UI/API users. CVSS is 8.0 (High); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Filesystem access in the web-based management interface of HPE EdgeConnect SD-WAN Gateway (ECOS) allows an authenticated, highly privileged remote administrator to reach the underlying device filesystem beyond the intended management scope. Once exploited, an attacker can read sensitive files and tamper with or delete system data, undermining the confidentiality, integrity, and availability of the gateway. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is a vendor-reported (HPE) information-disclosure and data-tampering flaw with a CVSS base score of 7.2.
Identity-claim disclosure in Gitea (self-hosted Git server) before 1.27.0 lets any holder of a valid personal access token retrieve their email and organization/team membership from the OIDC userinfo endpoint (GET /login/oauth/userinfo) even when the token's scopes (e.g. only read:misc) would deny the equivalent REST API calls. The endpoint accepts API tokens as bearer credentials but skips the scope enforcement applied elsewhere, collapsing the authorization boundary that scoped tokens are meant to provide. Publicly available exploit code exists; the flaw is not in CISA KEV and EPSS is low (0.17%).
Private repository metadata leaks through the starred and watched repository API endpoints in Gitea versions prior to 1.27.0, allowing former collaborators to continue retrieving - and receiving live updates to - repository metadata after access revocation. Any authenticated user who starred a private Gitea repository while holding collaborator access can call GET /api/v1/user/starred with their existing API token and receive current repository metadata, including description changes made after their removal. A public proof-of-concept is available; the vulnerability is not in CISA KEV and EPSS indicates low observed exploitation activity at 0.15% (5th percentile).
Gitea's REST API leaks private organization membership through the `GET /orgs/{org}/public_members/{username}` endpoint, bypassing the visibility controls that correctly conceal this information in the web UI. All versions up to and including 1.26.4 are affected, permitting any user with a valid API token to confirm whether a specific user belongs to a hidden organization - data intentionally withheld from the web interface. No public exploit is confirmed in CISA KEV, though a detailed proof-of-concept with curl commands is documented in GHSA-jr5x-6h83-wrxf; EPSS stands at 0.16% (5th percentile), indicating low observed exploitation probability.
Gitea's Actions permission engine grants fork-PR task tokens unauthorized code-read access to third private repositories via a missing fork-PR discriminator in the collaborative-owner branch of `GetActionsUserRepoPermission`. All Gitea instances running versions up to and including 1.26.4 are affected when the collaborative-owner Actions feature is configured, as confirmed by vendor advisory GHSA-fj8v-hjwv-qm88 and EUVD-2026-58151. An attacker who has had at least one fork PR previously approved can exploit this to clone the full source of a private repository they were never authorized to access; impact is strictly read-only, with no write or code-execution capability. A functional PoC was included in the security advisory; this CVE is not in the CISA KEV catalog and no EPSS score was provided in the available data.
Broken authorization in MediaCMS 8.2.0 lets any authenticated user read private media metadata belonging to other users by injecting arbitrary media tokens into their own playlist. Because the playlist API skips ownership and state validation on PUT, an attacker who knows or guesses a target media token can then fetch their playlist and read otherwise-private fields (title, description, view/like counts, file size, author username, encoding status) via the unfiltered owner branch of the playlist detail view. No public exploit identified at time of analysis and the flaw is not in CISA KEV; a vendor patch is reported as available.
Persistent account takeover in Gitea (self-hosted Git service) versions up to and including 1.26.4 arises because a stolen Remember-Me cookie is never revoked after theft is detected. When the split-token (ID:Hash) design detects a hash mismatch - the canonical signal of a compromised token per the Paragonie remember-me guidance - CheckAuthToken only returns ErrAuthTokenInvalidHash and autoSignIn merely clears the victim's local cookie, leaving the attacker's rotated token live in the database. The result is indefinite attacker access to the victim's account. Fixed in 1.27.0; no public exploit identified at time of analysis, and EPSS is low at 0.16%.
Unauthorized information disclosure and case-attachment tampering in Elastic Kibana lets a low-privileged authenticated user with limited file-management permissions read, alter, or delete case attachments belonging to feature areas they should not reach, including sensitive Security Solution cases. The flaw stems from Kibana's file-access authorization check and its resource retrieval using two different resolution mechanisms, allowing the authorization gate to be bypassed. No public exploit identified at time of analysis; not listed in CISA KEV, and EPSS was not provided.
Privilege escalation in FileGator (the open-source self-hosted PHP web file manager) lets an authenticated user who holds the 'chmod' permission set arbitrary Unix file modes via the '/chmoditems' API endpoint, ultimately elevating to root. The endpoint forwards attacker-supplied values straight to PHP's chmod() through octdec() with no validation or allow-listing, so a low-privileged operator can make sensitive binaries or files setuid/world-writable and gain full control of the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV; EPSS was not provided.
Silent record suppression in AWS s2n-tls affects all TLS 1.3 connections (both client and server roles) because the AEAD implementation hardcodes the outer content_type (0x17) in the additional authenticated data instead of authenticating the actual wire byte, leaving that field outside the integrity tag. An active on-path attacker can selectively drop individual application_data records without either endpoint detecting tampering, causing HTTP request/response desynchronization or undetectable data loss on write-heavy workloads. Reported internally by Amazon (AMZN); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial-of-service via unbounded memory allocation and leak in the CImg C++ image-processing library affects all versions prior to 4.0.0. In _load_analyze(), a 4-byte attacker-controlled header_size field from an Analyze/NIfTI (.hdr/.img/.nii) file is passed straight to a heap allocation of up to ~4 GB with no check against real file size; when the subsequent short read throws a CImgIOException the buffer is never freed, leaking the full allocation on every call. No public exploit identified at time of analysis and no KEV/EPSS signals were provided, but a 6-byte crafted file reliably leaks ~1.3 GB per invocation, enabling memory-exhaustion DoS against any service that feeds untrusted files to CImg.
Denial of service in the Go golang.org/x/net/dns/dnsmessage package allows remote attackers to crash any application that parses attacker-supplied DNS responses by sending a malformed SVCB or HTTPS resource record. When the declared size of a service-parameter value exceeds the remaining DNS message buffer, the parser panics instead of returning an error, taking down the DNS client, resolver, or proxy embedding this library. EPSS is low (0.15%) and there is no public exploit identified at time of analysis, but a vendor patch is available and the pre-conditions are trivial for any host that resolves DNS through untrusted responders.
Out-of-bounds read in the Perl module Data::HashMap::Shared before 0.14 lets a local peer that can write the shared-memory backing file corrupt per-record offset and length values, causing the map to copy attacker-controlled regions out of the arena. The flaw affects the each, keys, values, pop, shift, take, swap, drain and cursor code paths and can leak adjacent process memory or crash the process. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 5th percentile).
Out-of-bounds read in the Data::RadixTree::Shared Perl module (all versions before 0.02) lets a local peer with write access to the shared memory-mapped backing file corrupt trusted node records and force a lookup to dereference attacker-controlled node and arena indices, leaking adjacent process memory or crashing the process. The attach-time validator rdx_validate_header checks the header and region layout but never bounds-checks the node records that rdx_find_locked subsequently trusts. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the flaw is not in CISA KEV.
Out-of-bounds memory read in the Perl module Data::SortedSet::Shared before 0.03 lets a local peer who can write the shared mmap-backed file poison tree link indices, causing the next rank, min, or max query to dereference an out-of-bounds node and leak adjacent process memory or crash. The flaw stems from an attach-time validator that checks only the root index, deferring the full structural check to a separate, rarely-invoked validate method. No public exploit has been identified at time of analysis, EPSS risk is low (0.16%, 5th percentile), and it is not on the CISA KEV list.
Out-of-bounds read in the Perl module Data::ReqRep::Shared before 0.05 lets a local peer with write access to the shared mmap-backed file leak adjacent process memory or crash the process. The flaw sits in reqrep_recv_locked, which trusts an arena offset and length read straight from the shared segment without bounding them against the arena capacity. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 5th percentile), and it is not listed in CISA KEV.
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets a local peer who can write the shared backing file leak adjacent process memory. The attach-time validator (si_validate_header) checks header magic, version, offsets, total_size and counts but never bounds-checks the slot, reverse, and arena arrays it subsequently trusts, so a poisoned index in si_idx_find drives a triple-indirection read past valid bounds. No public exploit is identified at time of analysis and EPSS risk is low (0.17%), but a vendor patch (0.02) is available.
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-admin user to read sensitive information from the underlying appliance database. Because any low-privileged authenticated account can trigger it over the network, the flaw effectively collapses the product's internal privilege boundaries and exposes vulnerability, asset, and configuration data held by the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor (Tenable) has released a fixed version.
Information disclosure in Atlassian Confluence Data Center allows an unauthenticated remote attacker to read sensitive information from affected instances, carrying a CVSS 4.0 score of 8.2 (High). The flaw was introduced across a wide span of releases (7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, 10.2.0) and was found internally by Atlassian. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, unauthenticated nature makes patching a priority for internet-facing deployments.
MAC tag forgery in Google Tink (tink-java and tink-android) is enabled by a non-constant-time comparison in the ChunkedMacVerification object, which leaks per-byte matching progress through response-timing differences. An attacker who can submit many verification attempts and measure timing can reconstruct a valid MAC tag byte-by-byte, defeating the integrity/authenticity guarantee the MAC is meant to provide. Reported by Google and tracked in tink-java issue #75; no public exploit identified at time of analysis, and the CVSS 4.0 score is 8.2 driven entirely by integrity impact.
Argument injection in Moby BuildKit lets a malicious Git source trigger crafted command invocation on the build host when a custom frontend or a client using the raw low-level API enables the non-default git.checkoutbundle=true option during Git source checkout. The flaw affects builds that opt into this experimental checkout behavior rather than standard Dockerfile builds, and a successful attack yields high-impact command execution in the build environment. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Integrity-protection bypass in libssh builds compiled against the OpenSSL crypto backend, caused by incorrect AES-GCM finalization checks that fail to verify the authentication tag. An in-path (man-in-the-middle) attacker positioned on an SSH session can silently alter plaintext bytes on the wire without triggering a MAC/integrity failure, defeating a core guarantee of the SSH transport layer. There is no public exploit identified at time of analysis, EPSS risk is low (0.28%, 20th percentile), and CISA SSVC rates exploitation as 'none' though 'automatable: yes'.
Memory-corrupting type confusion in Firefox's JavaScript JIT engine allows a remote attacker to serve a malicious web page that triggers a JIT miscompilation, corrupting memory to disclose sensitive data or achieve code execution in the content process; Mozilla fixed it in Firefox 153. No public exploit is identified at time of analysis, and the EPSS score is low (0.13%, 3rd percentile), indicating no observed weaponization yet despite the critical 9.8 CVSS rating.
Denial of service in Mozilla Firefox before version 153 arises from an invalid pointer access (CWE-824) in the PSM (Personal Security Manager) security component, which brokers TLS/certificate and NSS cryptographic operations. Remote content processed by the browser can trigger the invalid pointer dereference, crashing the affected process; the assigned CVSS 3.1 vector scopes impact to availability only (A:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.13% (3rd percentile), consistent with a stability/crash bug rather than a code-execution primitive.
Information disclosure in Mozilla Firefox's Networking: WebSockets component allows remote attackers to read sensitive data across origin or trust boundaries without authentication or user interaction. The flaw affects Firefox releases prior to 153 and the ESR line prior to 140.13, and is corrected in those fixed builds. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the network-reachable, no-privilege CVSS 7.5 profile makes it a broad exposure across the very large Firefox install base.
Information disclosure in Mozilla Firefox's DOM: Security component allows remote attackers to read sensitive cross-origin or in-process data via crafted web content, undermining the browser's same-origin and security boundary enforcement. Any Firefox version prior to 153 is affected, and exploitation is remote and unauthenticated with no user interaction beyond visiting a malicious page. The issue was reported and fixed by Mozilla; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.13%).
Cross-origin information disclosure in Mozilla Firefox's DOM: Navigation component allows a malicious web page to bypass site isolation (Fission) boundaries and read data belonging to another origin. The flaw affects Firefox versions prior to 153 and is remotely reachable over the network with no privileges required, though impact is limited to confidentiality. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.13%).
Information disclosure in Mozilla Firefox before version 153 stems from a site isolation weakness in the Graphics component, allowing a remote attacker to read cross-origin data that should be siloed between sites. The confidentiality-only flaw (CVSS 7.5, C:H) is network-reachable without authentication or user interaction, but carries no public exploit and a low EPSS score (0.13%, 3rd percentile), indicating theoretical rather than active risk. It is not listed in CISA KEV; no public exploit identified at time of analysis.
Integrity and availability impact in Firefox's JIT JavaScript engine allows remote attackers to cause malicious script outcomes or denial of service. Versions prior to 153 are affected. Exploitation requires a victim to visit a crafted
Information disclosure in Mozilla Firefox's Storage: IndexedDB component allows a remote attacker to leak sensitive data across origins or from other browsing contexts without authentication or user interaction. The flaw affects Firefox releases prior to 153 and ESR builds prior to 140.13; there is no public exploit identified at time of analysis, and its EPSS score (0.15%, 5th percentile) indicates low near-term exploitation likelihood despite a CVSS of 7.5. Mozilla has released fixed builds, so the practical priority is prompt browser updating rather than emergency response.
Sandbox escape in Mozilla Firefox's DOM: Networking component allows a remote attacker to break out of the content-process security boundary, fixed in Firefox 153. Rated CVSS 9.8, it maps to CWE-693 (Protection Mechanism Failure) and is tagged as an information-disclosure issue by Mozilla, meaning a compromised or malicious web page could bypass the browser's isolation to reach host resources. No public exploit identified at time of analysis, and the EPSS score is low (0.14%, 4th percentile), indicating no observed exploitation activity yet.
Information disclosure in Mozilla Firefox and Firefox ESR stems from a site isolation flaw in the Networking component, letting a malicious web page bypass cross-origin process/security boundaries and access data belonging to other sites. The issue was reported by Mozilla and fixed in Firefox 153 and Firefox ESR 140.13; no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.15% (5th percentile).
Information disclosure in Mozilla Firefox's Graphics WebGPU component allows a malicious web page to read uninitialized process memory, potentially leaking sensitive data such as heap contents, pointers, or cross-origin material, before the fix in Firefox 153. The flaw stems from WebGPU operating on memory that was never initialized (CWE-908), and while CVSS rates confidentiality impact High (7.5), EPSS is very low (0.14%, 4th percentile) with no public exploit and no CISA KEV listing. Exploitation is browser-based, requiring a victim to load attacker-controlled WebGPU content.
Information disclosure in Mozilla Firefox's Graphics WebGPU component allows a remote attacker to read leftover uninitialized memory, potentially exposing sensitive data such as other pages' content, GPU buffers, or process memory. The flaw stems from a WebGPU code path returning memory that was never zeroed, and is fixed in Firefox 153; there is no public exploit identified at time of analysis and the EPSS score is low (0.14%, 4th percentile).
Information disclosure in Mozilla Firefox's Graphics: WebGPU component allows remote attackers to read uninitialized memory contents via crafted WebGPU operations, potentially leaking sensitive process memory such as heap data, addresses, or other page content. The flaw is network-reachable without authentication or user interaction beyond visiting a malicious page, but carries no integrity or availability impact. There is no public exploit identified at time of analysis, and EPSS estimates a low 0.14% exploitation probability.
Cross-origin information disclosure in Mozilla Firefox arises from a site isolation weakness in the Graphics: WebRender rendering component, where origin boundaries are not correctly enforced during GPU-accelerated compositing. An attacker-controlled web page loaded by a victim could leak data belonging to a different origin, undermining the same-origin protections that site isolation is meant to guarantee. Mozilla fixed the issue in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).
Information disclosure in Mozilla Firefox before version 153 stems from an input-validation flaw in the DOM Copy & Paste and Drag & Drop component, allowing remote content to potentially read data that should remain isolated. The provided CVSS vector rates confidentiality impact as High with no privileges or user interaction, and Mozilla has shipped a fix in Firefox 153. There is no public exploit identified at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates low near-term exploitation likelihood.
Cross-origin information disclosure in Mozilla Firefox and Firefox ESR stems from a site isolation weakness in the Networking: HTTP component (CWE-346, origin validation error), letting a malicious web page bypass origin boundaries to read data belonging to another site. It affects Firefox before version 153 and Firefox ESR before 140.13 and is addressed in Mozilla advisories MFSA2026-68 and MFSA2026-70. There is no public exploit identified at time of analysis, and the EPSS score is low (0.15%, 5th percentile), indicating no observed weaponization despite the vendor's 9.8 CVSS rating.
Information disclosure in the Firefox DevTools Framework component allows an attacker to read data that should remain isolated, affecting Mozilla Firefox prior to 153 and Firefox ESR prior to 140.13. Reported by Mozilla and carrying a CVSS 7.5 (high) rating driven by high confidentiality impact, there is no public exploit identified at time of analysis and the EPSS probability is low at 0.15% (5th percentile). The issue is fixed and not listed in CISA KEV.
Information disclosure in the Privacy component of Mozilla Firefox for Android allows remote attackers to expose sensitive user data, with the flaw carrying a high confidentiality impact (CVSS 7.5). Mozilla self-reported and fixed the issue in Firefox 153 per advisory MFSA2026-68; there is no public exploit identified at time of analysis, and the EPSS probability is low (0.14%, 4th percentile). The Privacy component context suggests leakage of protected browsing state or user data that the browser is designed to isolate.
Sandbox escape via use-after-free in Mozilla Firefox's Disability Access (accessibility) APIs allows an attacker who has compromised the content process to break out of the browser sandbox and gain code execution at the host privilege level. It affects Firefox before 153 and the ESR 115.x and 140.x branches, was reported and patched by Mozilla, and carries no public exploit at time of analysis. EPSS is low (0.15%, 5th percentile) and it is not on CISA KEV, indicating no observed exploitation.
Memory corruption in Mozilla Firefox's JavaScript engine JIT compiler allows attackers to corrupt memory and potentially achieve arbitrary code execution when a victim visits a malicious web page. The flaw stems from a JIT miscompilation (type confusion, CWE-843) affecting Firefox before 153, ESR before 115.38, and ESR before 140.13, and carries CVSS 9.8. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).
Information disclosure in Mozilla Firefox's ImageLib graphics component allows remote attackers to read sensitive data (likely uninitialized or out-of-bounds process memory) when a victim renders attacker-controlled image content, per the CWE-200 classification and the C:H CVSS impact. Affected builds are Firefox before 153 and the ESR 115.x and 140.x branches, all fixed by Mozilla in Firefox 153, ESR 115.38, and ESR 140.13. There is no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile), consistent with a vendor-reported browser memory-disclosure issue rather than one under active exploitation.
Memory corruption in Mozilla Firefox's DOM Bindings (WebIDL) layer allows a remote attacker who serves malicious web content to trigger a use-after-free (CWE-416) via an invalid/dangling pointer, potentially leading to arbitrary code execution or information disclosure in the content process. All Firefox and Firefox ESR builds prior to the fixed releases are affected. There is no public exploit identified at time of analysis, and the low EPSS score (0.15%, 5th percentile) suggests exploitation is not yet observed in the wild, though Mozilla rates the memory-safety impact as high.
Memory-safety corruption in Mozilla Firefox stems from a JIT miscompilation in the JavaScript engine's WebAssembly component, fixed in Firefox 153 and Firefox ESR 140.13. An attacker who lures a victim to a malicious page can supply crafted WebAssembly that the Just-In-Time compiler translates incorrectly, corrupting engine state to disclose memory or achieve code execution in the content process. There is no public exploit identified at time of analysis and the EPSS score is very low (0.15%, 5th percentile), so no active exploitation is indicated despite the 9.8 rating.
Sandbox escape in Mozilla Firefox stems from a use-after-free in the Disability Access (accessibility) APIs, letting an attacker who already controls a sandboxed content process break out of the browser sandbox and compromise the host. It affects Firefox before 153 and the ESR 115.x and 140.x branches, with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the EPSS score is low (0.15%, 5th percentile), indicating no observed widespread exploitation.
Sandbox escape in Mozilla Firefox stems from a use-after-free (CWE-416) in the DOM: Navigation component, letting web-reachable content corrupt memory and cross the content-process sandbox boundary. Affected builds are Firefox before 153, Firefox ESR before 115.38, and Firefox ESR before 140.13; Mozilla self-reported the issue and shipped fixes across all three branches (MFSA-2026-68/69/70). There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), indicating no observed weaponization yet despite the 9.8 CVSS rating.
Use-after-free in the WebRTC Audio/Video component of Mozilla Firefox allows a remote attacker to corrupt memory and potentially achieve arbitrary code execution when a victim visits a malicious page or joins a crafted WebRTC session. All Firefox builds prior to 153 and ESR builds prior to 140.13 are affected, with high impact to confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the EPSS probability is low (0.15%), but browser memory-corruption bugs of this class are historically attractive exploitation targets.
Out-of-bounds memory read in Apache Fory (formerly Apache Fury) versions 0.5.0 up to 1.4.0 allows remote attackers to read beyond the underlying buffer via a flaw in readAlignedVarUint() when out-of-band zero-copy deserialization is used. Because the affected code relies on sun.misc.Unsafe for direct memory access, an attacker supplying crafted serialized data to an application that has enabled this opt-in feature can disclose adjacent heap memory or crash the process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fix (version 1.4.0) is available and the issue was reported by the Apache security team.
Unauthenticated media upload in the Membership Pro subscription extension for Joomla (all versions 1.0 through 4.6.1) lets remote attackers push arbitrary media assets to the server without any account or login, due to an insecure default configuration. The flaw carries a CVSS 9.1 rating and CISA's SSVC framework marks it as automatable with total technical impact, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It is fixed in version 4.6.2.
Data disclosure and tampering in Sony FeliCa IC chips manufactured in or before 2017 stems from a missing cryptographic step (CWE-325) in the chip's contactless security handling. An attacker with physical/NFC proximity to an affected card or device can read or alter data stored on the chip, undermining the confidentiality and integrity of stored credentials, balances, or identity data. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the CVSS 4.0 base score is 7.0 (High), driven entirely by high impact under a physical attack vector.
Information disclosure in DayuanJiang next-ai-draw-io 0.4.13, an open-source Next.js application that generates draw.io diagrams via AI providers, allows a remote attacker to obtain sensitive information through the x-ai-provider component. The flaw is reported as unauthenticated and network-reachable (CVSS 7.5, confidentiality-only), and no public exploit was identified at time of analysis, though a third-party technical write-up exists. EPSS is low (0.22%, 13th percentile) and the CVE is not listed in CISA KEV.
Information disclosure in aiflowy (an open-source Java/Spring-based AI workflow / low-code platform) versions 2.1.2 and earlier lets remote unauthenticated attackers extract sensitive information through the JobUtil.java scheduling component. The public technical writeup titled 'Any SpringBean invocation' indicates the flaw stems from unrestricted invocation of arbitrary Spring beans, which can be abused to read internal application state and secrets. No CISA KEV listing and a low EPSS score (0.19%, 9th percentile) suggest no observed mass exploitation, but a public technical analysis describing the technique exists.
Sensitive data exfiltration in Gitleaks before 8.30.1 lets an attacker who controls the report template read arbitrary host environment variables through non-hermetic Sprig functions (env, expandenv, getHostByName) and smuggle them out via attacker-triggered DNS lookups. Because Gitleaks runs in CI/CD with broad access to credentials, tokens, and API keys - including the very secrets it just discovered during a scan - a malicious template turns the scanner into an exfiltration channel. A detailed public write-up describing the technique and the fix exists; there is no CISA KEV listing, so this reflects a demonstrated technique rather than confirmed active exploitation.
Heap and stack memory disclosure in rsync versions prior to 3.4.3 lets a malicious sender leak process memory from a receiver by overflowing an unchecked 32-bit signed counter in the compressed-token decoder. The leaked contents can include environment variables, passwords, and heap/stack/library pointers, undermining ASLR and enabling follow-on exploitation. No public exploit is identified at time of analysis, there is no CISA KEV listing, and EPSS was not provided, so real-world exploitation should be treated as unproven but plausible.
Command-restriction bypass in Apache MINA SSHD (server-side) lets a user who authenticates with an OpenSSH user certificate carrying a force-command directive execute arbitrary commands instead of the single restricted command the certificate authority intended. The server accepts and honors such certificates but silently ignores the force-command and verify-required options, breaking the security model that certificate issuers rely on to constrain principals. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is confirmed and fixed by the Apache Software Foundation in versions 2.19.0 and 3.0.0-M5.
Anonymous account takeover in FreeScout help desk before 1.8.224 lets an unauthenticated attacker seize the lowest-id activated agent or administrator account by abusing the public POST /user-setup/{hash}/{invite_sent_at} endpoint. By supplying a single URL-encoded space as the invite hash and a plaintext numeric timestamp, the attacker overwrites the target's email and password and is logged in as that user. No public exploit is identified at time of analysis, but the mechanics are fully disclosed in the GitHub advisory and CVSS is 9.4.
Cleartext SFTP credential disclosure in VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 allows any unauthenticated remote attacker to harvest working SFTP logins by simply reading the HTTP responses of three exposed endpoints. The credentials appear whenever SFTP integration has been configured in the application, giving the attacker direct access to the backing SFTP server and whatever clinical or file data it holds. No public exploit or CISA KEV listing exists at time of analysis, but with a 9.0 CVSS and zero authentication required, exploitation is trivial once the endpoints are located.
Privilege escalation and information disclosure in Best Practical's Request Tracker (RT) 6.0.0-6.0.2 and versions before 5.0.10 lets a privileged but non-administrative user harvest other users' authentication credentials - including those of administrators - through the REST 2.0 API and replay them against RT's RSS/iCal feed endpoints to read data as those victims. Because the same credential-exposing request also rotates the tokens, exploitation is destructive: it silently invalidates every previously distributed feed URL across the instance. No public exploit has been identified at time of analysis; the flaw is fixed in RT 5.0.10 and 6.0.3.
Deadlock in the Linux kernel Bluetooth L2CAP subsystem during connection teardown can be triggered by an adjacent attacker via crafted Bluetooth traffic, leading to a denial of service. The vulnerability arises from an incorrect mutex acquisition order in l2cap_conn_del() and process_pending_rx(), as confirmed by a provided proof-of-concept and static analysis. While the official CVSS score indicates full compromise, the exploit only demonstrates a deadlock; no public exploitation outside of the PoC has been identified, and EPSS probability is low (0.16%).
Use-after-free in the Linux kernel's Qualcomm rmnet networking driver allows a local attacker with low privileges to escalate to kernel-level code execution. The flaw occurs when the rmnet endpoint is freed while still being referenced by concurrent receive path handlers, leading to memory corruption. No active exploitation or public exploit code has been identified, but the high CVSS score reflects a significant local privilege escalation risk.
TLS hostname verification bypass in the lettre Rust mailer library (0.10.1 through 0.11.21) exposes users of the boring-tls feature to man-in-the-middle attacks; an inverted boolean caused the default strict configuration to silently disable hostname checking. An on-path attacker holding any chain-valid certificate for any domain can transparently intercept SMTP submission, harvesting PLAIN/LOGIN credentials and full message contents. There is no public exploit identified at time of analysis, but the one-line root cause is visible in the public fix commit, making the flaw trivially understandable; native-tls and rustls backends are not affected.
NTLM credential theft and denial-of-service in Scille Parsec (parsec-cloud before 3.3.3-rc.0) arises because the Windows client mounts organization workspaces using their unsanitized names, and a workspace name containing backslashes can evaluate to a UNC path. A low-privileged organization member who names a workspace as an attacker-controlled UNC path (e.g. \\attacker\share) forces victim clients to reach out over SMB, leaking their NetNTLM hash to the attacker or hanging the application if the path is unreachable. Publicly available exploit code has not been identified and it is not in CISA KEV, though a fixed vendor release exists.
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbitrary Groovy code on the server by importing and starting a malicious BPMN process definition through the REST API. Because Flowable's Groovy scriptTasks execute with no sandbox in affected 3.0.x, 4.0.x, and 4.1.x releases, script code embedded in the process runs directly with the privileges of the Syncope core JVM. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path once an entitled admin account is reached makes it a strong candidate for post-compromise abuse and insider misuse.
Signature-verification bypass in Network-AI before 5.13.4 lets unauthenticated remote attackers forge APS delegation payloads and mint signed permission-grant tokens for privileged scopes, including SHELL_EXEC. The root cause is a default local verifier in APSAdapter that treats any non-empty string as a valid cryptographic signature, so no real key material or authentication is needed. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the trivial exploitation logic and network reachability make it a high-priority fix.
Client-side double-free (CWE-415) in FreeRDP's .rdp connection-file parser lets an attacker who tricks a victim into opening a malicious .rdp file corrupt heap memory, potentially leading to a crash or code execution in xfreerdp/sdl-freerdp/wlfreerdp. The flaw is in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c), where a non-owning pointer to the settings-owned MonitorIds array is freed on a strtoul error path without clearing settings->MonitorIds, so freerdp_settings_free() frees the same buffer again at teardown. All 3.x releases through 3.27.1 are affected in the default configuration and it is fixed in 3.28.0; there is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided.
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-active authenticated sessions via a TOCTOU race condition on the HTTP /rpc endpoint — the primary interface used by all official SurrealDB SDKs. Because concurrent requests share mutable authentication state, an unauthenticated request that races in before the state is cleared executes as the authenticated user, potentially escalating to root. No public exploit is identified at time of analysis, but the flaw is credited by VulnCheck and carries a high CVSS 4.0 score of 9.2.
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT permissions by traversing graph edges or REFERENCES TO back-references, reading full documents from tables defined with PERMISSIONS FOR select NONE. The root cause is that GraphEdgeScan and ReferenceScan fetched records directly from storage without evaluating the target table's permission expression. No public exploit identified at time of analysis and not listed in CISA KEV; impact is confidentiality-only and bounded to the caller's current database, but any table reachable through a chain of edges from a readable starting point is exposed.
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belonging to other namespaces and databases by manipulating the scope in the URL path. Because the server fails to validate namespace/database scope on custom API routes, an attacker holding valid credentials for one tenant can read sensitive data or trigger unintended operations in unrelated tenants. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the multi-tenant data-exposure impact is significant (CVSS 4.0 8.6).
Predictable session ID generation in the Dancer2 Perl web framework (all versions through 2.1.0) allows remote attackers to guess valid session identifiers and hijack user sessions. When both the Math::Random::ISAAC::XS and Crypt::URandom CSPRNG modules are absent, Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a SHA-1 hash of low-entropy, largely deterministic inputs (built-in rand(), module path, a counter, PID, an object memory address, and a rand-shuffled string). There is no public exploit identified at time of analysis, KEV lists no active exploitation, and EPSS is low (0.14%), but the flaw is rated CVSS 8.2 and CISA SSVC marks it automatable with partial technical impact.
Predictable salt generation in Crypt::Password through version 0.28 for Perl weakens the security of stored password hashes by seeding salts with Perl's built-in rand() function, which is not cryptographically secure. An attacker who obtains a password hash database can more easily precompute or predict salts, reducing the cost of offline cracking. There is no public exploit identified at time of analysis, EPSS is low (0.14%, 4th percentile), and CISA SSVC records no observed exploitation.
Timing side-channel in the Crypt::Password Perl module (versions through 0.28) allows attackers to incrementally guess a stored password hash because check_password compares values with Perl's short-circuiting eq operator instead of a constant-time comparison. The flaw is classic CWE-208 (Observable Timing Discrepancy); it carries a CVSS 7.5 but a very low EPSS (0.14%, 4th percentile) and no public exploit identified at time of analysis, and SSVC records exploitation status as none. A vendor patch is available.
Unauthenticated SQL injection in the Modern Event Calendar Pro and Modern Events Calendar Lite WordPress plugins (all versions before 7.34.0) lets remote attackers extract sensitive database contents by injecting into an unsanitized request parameter used within a SQL statement, reachable through an AJAX action open to unauthenticated users. Publicly available exploit code exists (reported by WPScan), and a vendor patch is available; the CVSS 8.6 rating reflects a scope-changed, high-confidentiality impact with no authentication or user interaction required. No EPSS score or CISA KEV listing was provided, so there is no public exploit identified as being actively exploited at time of analysis.
Information disclosure in FileThingie 2.5.7, a single-file PHP web-based file manager, lets a remote attacker retrieve sensitive information through the ft2.php component. The flaw is documented in a third-party vulnerability-research repository, indicating exploitation details are likely public, though it is not listed in CISA KEV. The published CVSS 9.9 rating overstates impact relative to the description, which describes only information disclosure rather than full compromise.
Use-after-free in Google Chrome desktop versions prior to 150.0.7871.128 allows a remote attacker to corrupt memory and potentially achieve renderer code execution after a victim visits a crafted web page. The flaw carries a critical CVSS 9.6 owing to its network vector, low complexity, and scope-changing impact, though it requires user interaction (loading a malicious page). No public exploit has been identified at time of analysis and the EPSS probability is low (0.23%, 14th percentile).