Information Disclosure
Monthly
Unauthenticated SQL injection in JoomShaper's SP Property extension for Joomla (versions before 4.1.4) lets remote attackers inject SQL through the property search and map-filtering query builders. The zipcode, sorting, price_range_dropdown, and psize_range_dropdown parameters are concatenated directly into WHERE and ORDER BY clauses without quoting or type casting, enabling boolean- and time-based blind extraction of database contents. No public exploit has been identified and the flaw is not in CISA KEV, but the unauthenticated network-reachable vector makes it a high-priority patch.
Authorization bypass in Countly Server's DBViewer plugin allows authenticated low-privilege users to read data from restricted MongoDB collections, including plaintext password-reset tokens, by exploiting a logic flaw in the aggregation-pipeline sanitizer. The `/o/db` aggregation endpoint's stage sanitizer misclassifies branches containing unrecognized MongoDB-internal operators (such as `$_internalInhibitOptimization`) as generic arrays rather than sub-pipelines, causing it to skip enforcement entirely for that branch. This lets a user holding only DBViewer read permission inject `$lookup` stages inside `$facet` sub-pipelines, cross-join into restricted collections such as `members`, and extract sensitive fields including `prid` (password-reset tokens), which are directly usable for account takeover. No public exploit has been identified at time of analysis, but the GitHub PR diff exposes sufficient technical detail to reconstruct the technique.
Authentication replay in GeoVision GV-LPC2211 license-plate-recognition cameras (firmware V1.13, marketed as GV-LPCLPC2011/2211) lets an attacker who captures a single WS-Security UsernameToken re-submit its PasswordDigest to authenticate arbitrary ONVIF operations. Because the device does not track UsernameToken nonces or enforce timestamp freshness, a passively observed token grants ongoing control of the camera's ONVIF interface without ever recovering the plaintext credential. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthenticated information disclosure in Ultimate Gift Cards for WooCommerce (WordPress plugin, versions 3.0.3 through 3.2.9) exposes customer PII, gift card balances, and transaction dates tied to arbitrary orders with no authorization check. Version 3.2.9 raises the severity significantly: the live redemption code is also leaked, allowing any anonymous attacker who retrieves it to spend the gift card balance, crossing from information disclosure into tangible financial fraud. A publicly available proof-of-concept was published by WPScan, and the vulnerability is automatable per CISA SSVC, making mass enumeration of orders and gift card theft realistic.
Out-of-bounds read in libxls 1.6.3 allows a remote, unauthenticated attacker to leak heap memory contents by supplying a maliciously crafted XLS file with manipulated OLE Property Set Stream offsets. The vulnerability resides in xls_dumpSummary(), which dereferences file-controlled section and property offsets against a 4096-byte OLE summary buffer without first validating that those offsets remain within buffer bounds. Any server-side or automated pipeline that parses untrusted XLS files via libxls is exposed; no public exploit code has been identified and EPSS stands at 0.15%, indicating low current exploitation activity.
Path traversal in @openhop/server (npm, versions ≤0.3.5) allows unauthenticated remote attackers to read or permanently delete arbitrary `.yaml` files accessible to the OpenHop process outside its configured flow data directory. The root cause is that `FlowStore.filePath()` passes caller-supplied HTTP route parameters directly to Node.js `path.join()` without any sanitization or allowlist validation, and Fastify's underlying `find-my-way` router URL-decodes the parameter before it reaches application code, enabling `..%2F`-encoded directory traversal. A fully functional PoC is publicly available with Docker-based reproduction steps; no KEV listing at time of analysis. Docker deployments expose the server on all interfaces by default, enabling direct network exploitation without user interaction.
nuxt-ollama versions 1.2.26 through 1.3.0 unconditionally places the Ollama cloud API key into Nuxt's public runtime config, causing it to appear verbatim in every server-rendered HTML page inside the `window.__NUXT__` script block, readable by any unauthenticated HTTP client. Any visitor or web crawler that fetches any page of an affected application can extract the `api_key` from the serialized SSR payload with a single GET request, then impersonate the operator against the Ollama cloud API to incur billing charges, exhaust rate limits, or exfiltrate stored model data. A publicly available PoC using Docker and Python has dynamically confirmed the leak; no public exploit identified at time of analysis for active KEV-level exploitation.
DNS rebinding SSRF in Open WebUI versions 0.9.6 through 0.11.0 allows authenticated users who control authoritative DNS to bypass hostname validation in SafePlaywrightURLLoader and reach internal services or cloud metadata endpoints. The flaw exists because Python validates the resolved hostname at check time, then the Playwright browser independently re-resolves the same hostname at use time - enabling an attacker to serve a public IP during validation and a private or link-local IP for the actual fetch. The issue is fixed in v0.11.1 by routing all fetches through the SSRF-safe requests session, eliminating the second resolution. No public exploit code or CISA KEV listing is present.
Unauthenticated information disclosure in the Magefan Blog GraphQL extension for Magento 2 (magefan/module-blog-graph-ql, versions through 2.2.1) exposes blog commenter email addresses alongside internal customer and admin identifiers via a simple POST request to the /graphql endpoint. The blogComments GraphQL query resolver fails to enforce authorization checks on sensitive fields, allowing any remote unauthenticated actor to enumerate user data from affected Magento stores. No active exploitation is confirmed in CISA KEV, but SSVC rates the attack as automatable, and a researcher gist publicly documenting the issue is included in the references.
SJRC F11 / SJ-GPS-PRO drones running firmware build 2019-09-17 expose an inetd service that spawns the helper binary /app/sh_for_telnet, giving anyone who can reach that port unauthenticated access to a shell and thus to sensitive data stored on the device (CWE-200). The flaw is remotely triggerable with no credentials or user interaction (CVSS 7.5, AV:N/PR:N/UI:N), but impact is limited to confidentiality — integrity and availability are unaffected. It is not listed in CISA KEV, EPSS is only 0.21% (11th percentile), and while a public GitHub advisory/repository documents the issue, no confirmed exploit code or in-the-wild activity was identified at time of analysis.
The krb5 crypto subsystem in the Linux kernel fails to zero derived Kerberos key material before freeing memory buffers, leaving sensitive cryptographic keys resident in freed slab allocator objects. Both `crypto_krb5_prepare_encryption()` and `crypto_krb5_prepare_checksum()` call plain `kfree()` instead of the security-aware `kfree_sensitive()` wrapper, which would first zero the allocation. Systems using Kerberos-authenticated kernel services - primarily NFSv4 with sec=krb5 or CIFS/SMB with Kerberos - on kernel versions from commit 3936f02b through the stable fixes are affected; no public exploit or active exploitation has been identified.
Unauthorized cryptographic hardware access in KVM for s390 (IBM Z) nested virtualization allows a low-privileged nested guest to access AP queues (hardware crypto devices) that were explicitly revoked from its allocation. When the KVM VSIE subsystem shadows a format0 APCB (Adjunct Processor Control Block) from a crycb type 0 or 1 structure, it only copies bits 0-63 but leaves bits 64-255 unchanged from whatever stale state existed in the vsie shadow page. A nested (L2) guest exploiting this retains access to cryptographic devices beyond those granted by the host hypervisor, potentially exposing cryptographic keys and operations belonging to other workloads. No public exploit has been identified at time of analysis and no CISA KEV listing exists.
Remote heap information disclosure in eProsima Fast DDS lets unauthenticated attackers leak adjacent heap memory by sending a crafted RTPS DATA_FRAG submessage. Affected versions before 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fail to validate that the received datagram is large enough before a memcpy() in the last-fragment reassembly path, so bytes past the UDP buffer (potentially pointers useful for ASLR bypass) are copied into the reassembly buffer and, in Discovery Server deployments, relayed to other participants. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.
Unencrypted UDP video transmission in the C6 Ear Camera and its companion EarVision Android application (version 1.3.1 / firmware 1.3.1_Code 132) exposes live ear-canal video streams to passive eavesdropping by any attacker within local wireless range. The camera broadcasts JPEG and WEBP frames over plaintext UDP with no transport-layer security, and the Android application's manifest explicitly permits cleartext traffic, removing any client-side enforcement barrier. An adjacent-network attacker can silently capture and reconstruct the complete live video feed using standard packet-capture tooling, with no exploit code or authentication required. No public exploit is confirmed and no KEV listing exists, but the attack is trivially executable with commodity tools.
Incorrect permission assignment on a critical resource in Pardus LightDM Greeter allows a local low-privileged user to read sensitive authentication material or tamper with greeter configuration, achieving high confidentiality and integrity impact without elevated rights. All versions before 0.4.15 of the greeter - a graphical login component shipped with Pardus, the Turkish government-backed Linux distribution maintained by TÜBİTAK BİLGEM - are affected. No public exploit or active exploitation has been identified; a vendor-released patch is available. No special configuration is required beyond having a local user account on an affected system.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 expose both the Appliance and Application deployments to unauthenticated remote information disclosure. Any attacker who discovers or reverse-engineers the embedded static credentials - which cannot be changed by administrators - can authenticate to the gateway without valid user accounts and access sensitive information. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no privileges or user interaction; no public exploit or CISA KEV listing is recorded at time of analysis.
Path traversal in the knowns npm documentation tool (versions ≤ 0.29.1) enables remote unauthenticated attackers to read, create, overwrite, or delete arbitrary files with a .md extension anywhere on the host filesystem, and to create arbitrary directories via os.MkdirAll. The Document API's sanitization function cleanDocPath() strips slashes and .md suffixes but leaves ../ sequences intact, allowing filepath.Join() to resolve paths outside the intended documents directory. In the default deployment - where the Management API binds to all interfaces without authentication - this is directly exploitable with a single crafted HTTP request, and the arbitrary-write primitive may be chained toward code execution. No confirmed active exploitation or public exploit code identified at time of analysis.
License key exposure in Snipe-IT before 8.7.0 allows any authenticated low-privilege user to bypass the viewKeys authorization gate and retrieve all product license keys stored in the system. Two distinct exploitation paths exist: bulk extraction via the CSV export endpoint and a key-validation oracle via observable API response discrepancies, making CWE-204 an accurate root-cause classification for the latter. No public exploit code or CISA KEV listing exists at time of analysis; the patch is available in version 8.7.0.
Server-side request forgery and arbitrary file read in Snipe-IT before 8.7.0 allow any authenticated user to exfiltrate sensitive server files - including the Laravel `.env` file containing `APP_KEY` - by injecting markdown image syntax into checkout acceptance note fields. The injected syntax survives HTML escaping, is expanded by the CommonMark parser, and subsequently resolved by the laravel-mail-auto-embed library via `file_get_contents()` (local paths) or `curl` (remote URLs) when email notifications are generated. Vendor-released patch is available in version 8.7.0; no public exploit has been identified at time of analysis, but compromise of `APP_KEY` can facilitate escalation to remote code execution via Laravel cookie/session decryption.
Arbitrary file read and SSRF in Snipe-IT before 8.7.0 allow low-privileged users to exfiltrate sensitive server files - including .env credential files - via unsanitized EULA text fields. An attacker with category-edit permissions injects markdown image syntax or raw HTML img tags referencing local file paths or remote URLs; the mail auto-embed library resolves these references server-side during checkout confirmation email generation and returns the resolved content as email attachments. No public exploit has been identified at time of analysis, and a vendor patch is available at 8.7.0.
Hard-coded credentials embedded in Dell Secure Connect Gateway 5.0 allow a remote, unauthenticated attacker to authenticate to the service using the static credentials and access sensitive information. Both the Appliance variant (all versions prior to 5.36.00.16) and the Application variant (all versions prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified, but CWE-798 credentials are static across all unpatched installations worldwide, meaning any party with knowledge of them can exploit any exposed instance without further effort.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 expose sensitive information to unauthenticated remote attackers across both the Appliance and Application deployment variants. The vulnerability (CWE-798) allows an attacker who discovers or possesses the embedded credentials to authenticate without authorization and access confidential data. Dell has released patched versions under advisory DSA-2026-382, and no public exploits or CISA KEV listing have been identified at time of analysis.
External control of file name or path (CWE-73) in Dell Secure Connect Gateway (SCG) 5.0 enables unauthenticated remote attackers to influence filesystem path resolution, resulting in unauthorized filesystem access. Both the Appliance form factor (versions before 5.36.00.16) and the Application form factor (versions before 5.36.00.00) are affected. Dell has released patched versions and published advisory DSA-2026-382; no public exploit code or active exploitation has been identified at this time.
Missing brute-force rate-limiting in Dell Secure Connect Gateway (SCG) 5.0 Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) exposes authentication endpoints to unlimited credential-guessing by unauthenticated remote attackers over the network. Successful exploitation allows an attacker to enumerate and compromise valid credentials, with Dell indicating the resulting access can enable client-side request forgery. No public exploit code or CISA KEV listing has been identified at time of analysis.
Argument injection in GitPython 3.1.59's high-level diff API allows low-privileged remote attackers to read arbitrary filesystem paths by passing the unsanitized `--no-index` flag to the underlying git diff command. By chaining `--no-index` with the `-I`/`--ignore-matching-lines` regex filter, an attacker can construct a content-dependent Boolean oracle - issuing repeated queries that distinguish between regex match and mismatch responses to recover single-line secrets from local files. No active exploitation has been confirmed (not in CISA KEV), but the technique is deterministic and requires only authenticated API access. Patch-upgraded version 3.1.60 is available.
Read-only mode bypass in SiYuan ≤ 3.8.1 allows an authenticated administrator to submit arbitrary SQL against the blocks database via POST /api/search/fullTextSearchBlock (method=2), circumventing the workspace's --readonly=true protection that correctly blocks the dedicated /api/query/sql endpoint. The prior fix for CVE-2026-32767 added an admin-role gate but omitted the model.CheckReadonly and CheckReadonlyStatementInBox calls, leaving the SQL code path unguarded. Vendor-released patch available in v3.8.2; no public exploit identified at time of analysis.
Out-of-bounds read in zstd-jni versions 1.2.0 through 1.5.7-13 allows attackers who can supply dictionary constructor parameters to crash the JVM and potentially read limited native heap memory. The ZstdDictCompress constructor passed unvalidated offset and length values directly to the C JNI layer, where out-of-range values cause the native code to read beyond the allocated Java heap array. No CISA KEV listing or public exploit has been identified; the CVSS 4.0 score of 8.8 reflects high availability impact via reliable JVM crash and limited confidentiality exposure from native heap reads.
Payment-confirmation forgery in PayTR's Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0 to before v9.0.3) lets remote unauthenticated attackers spoof a trusted payment identifier so the module treats an unpaid or attacker-controlled transaction as legitimately settled. Reported by TR-CERT, it stems from the module relying on a less-trusted, client-influenceable source instead of server-to-server verification of PayTR's callback. No public exploit is identified at time of analysis, and no EPSS or KEV data was supplied.
Unauthenticated information disclosure in the Loops & Logic WordPress plugin (all versions before 4.3.0) exposes arbitrary user records - including email addresses and role assignments - and arbitrary site configuration options to any unauthenticated visitor. The plugin's public template-data AJAX action fails to enforce access controls, permitting unauthenticated HTTP requests to retrieve data restricted to privileged users. A publicly available proof-of-concept exists per the WPScan advisory; however, EPSS at 0.17% (7th percentile) and SSVC 'exploitation: none' indicate no confirmed active exploitation at time of analysis.
Out-of-bounds write in HarmonyOS 6.1.0's rendering and composition module allows a locally executing process to corrupt adjacent memory, with vendor-stated impact to availability and a CVSS vector also indicating potential confidentiality exposure. Affected devices are those running Huawei HarmonyOS version 6.1.0 as confirmed by EUVD-2026-74596. No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
Local File Inclusion in the Eventin WordPress event management plugin (versions ≤4.1.22) allows authenticated contributors to include and execute arbitrary PHP files on the server via the unsanitized 'event_layout' parameter, achieving full remote code execution. The etn_manage_event capability is assigned to WordPress Contributors by default, meaning any registered Contributor can set the malicious parameter value through the REST API without any site-specific configuration change. Exploitation requires a PHP file to already be present on the server, reflected in the AC:H CVSS rating; no public exploit or CISA KEV listing has been identified at time of analysis.
Local File Inclusion in the Eventin Event Calendar WordPress plugin (all versions through 4.1.22) allows authenticated attackers with custom-level WordPress access to include and execute arbitrary PHP files by supplying a crafted path via the unsanitized `event_layout` parameter in the plugin's event template and REST API endpoints. Successful code execution requires the attacker to first place a PHP file on the server - a two-stage exploit chain reflected in the CVSS AC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported this with direct source code line references, indicating the attack surface is well-documented.
Plaintext recovery and content forgery in OpenIDC/cjose 0.6.1 through 0.6.2.5 occurs because the library zero-fills the content-encryption key (CEK) instead of randomizing it whenever a JWE is built with an AES-CBC-HMAC enc (A128CBC-HS256/A192CBC-HS384/A256CBC-HS512) and a key-management algorithm that generates a fresh CEK. Every affected ciphertext is therefore encrypted and authenticated under an all-zero, publicly known key, so anyone who obtains the JWE can decrypt it and forge or modify its contents. Fixed in 0.6.2.6; no public exploit identified at time of analysis, but the flaw is trivially demonstrable and confirmed by the vendor GitHub Security Advisory.
Out-of-bounds read in ANGLE, Chrome's cross-platform graphics abstraction layer, enables sandbox escape and potential remote code execution on the host system for Chrome versions prior to 153.0.8010.36. This is a staged, second-phase exploit: an attacker must first compromise the renderer process through a separate vulnerability before leveraging this ANGLE flaw to break out of Chrome's sandbox via a crafted HTML page. No public exploit has been identified and no CISA KEV listing exists; EPSS at 0.21% (12th percentile) reflects minimal observed exploitation activity at time of analysis.
Out-of-bounds read in the WebGL component of Google Chrome before 153.0.8010.36 lets a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the browser sandbox. Chromium rates the security severity as High, and a vendor patch is available; no public exploit has been identified and CISA SSVC records exploitation as none, with EPSS at a low 0.28% (20th percentile).
Out-of-bounds read in Google Chrome's Media component (versions prior to 153.0.8010.36) enables remote code execution confined within the browser sandbox when a user visits a specially crafted HTML page. The vulnerability stems from improper bounds checking during media processing, allowing a remote attacker to read memory beyond intended buffer limits and leverage the resulting data to achieve arbitrary code execution. No public exploit has been identified at time of analysis and EPSS is low (0.35%), but the attack surface is broad given Chrome's ubiquity.
User impersonation in Apache Impala 4.0.0 through 4.5.1 lets a remote attacker act as any user because the final step of SAML2 authentication on the hs2-http interface never verifies the Bearer token's signature. An attacker who can reach a SAML2-enabled hs2-http endpoint can forge or tamper with the token's asserted username and gain that user's identity and privileges. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not in CISA KEV.
Administrative takeover of the Eclipse aeriOS Identity Manager (IdM) is possible because the current development-version deployment exposes its Keycloak server and PostgreSQL backing database to the network (Kubernetes NodePort services, and PostgreSQL bound to all interfaces under Docker Compose) while shipping fixed, publicly documented default credentials for the Keycloak admin and the PostgreSQL user. An attacker who can reach these services logs in with the published defaults to read or modify identity data - users, roles, client credentials, sessions, and cryptographic material - and can mint privileged identities or tokens trusted by other aeriOS components. No official release exists yet; there is no CISA KEV listing and no public exploit identified at time of analysis, though the credentials are effectively public in the source repository.
Credential leakage in the Okta Hyperdrive Integration installer (versions 1.2.0 through 1.5.1) exposes the OAuth client secret in plaintext across three Windows logging surfaces - the MSI installer log, the Windows Application Event Log, and the process command line - whenever the secret is supplied as an MSI property at install time. An authenticated local user on the workstation can read any of these surfaces and extract the credential without elevated privileges. The leaked OAuth client secret can then be used to authenticate against Okta services outside the local machine, explaining the scope change in the CVSS vector and elevating the effective impact beyond a simple local information disclosure. No public exploit has been identified and the vulnerability is not listed in CISA KEV; Okta has released a patch at version 1.5.2.
Arbitrary file system read in Adobe ColdFusion 2023 (Update ≤23) and ColdFusion 2025 (Update ≤12) exposes sensitive files and directories outside the intended access scope to unauthenticated remote attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable exploitation requiring no credentials and no user interaction, with high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity raises concern for rapid weaponization.
Local information disclosure in Android Wear (Wear OS) versions 14, 16, and 17 lets a co-resident application read sensitive device state data because checkReadPermission in PermissionsManager.java fails to enforce a required permission. No additional execution privileges or user interaction are needed, so any installed app can silently monitor protected state. No public exploit identified at time of analysis, and the flaw is fixed in the September 2026 Wear security patch level.
Out-of-bounds read in Microsoft Excel's file-parsing engine allows code execution when a victim opens a specially crafted workbook. Affected builds span Excel 2016 through Office LTSC 2024 and their Mac equivalents, making the exposure broad across both perpetual-license and subscription deployments. No public exploit code has been identified at time of analysis, but Microsoft has released patched builds for all affected product lines.
Out-of-bounds read (CWE-125) in Microsoft Office Excel's file-parsing engine enables local code execution when a victim opens a specially crafted spreadsheet. Affects a wide range of Microsoft Office products from version 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise, on both Windows and Mac platforms. No public exploit identified at time of analysis, but the low attack complexity combined with full confidentiality, integrity, and availability impact makes phishing-delivered document lures a realistic and proven delivery vector.
Hard-coded cryptographic key (CWE-321) in AVEVA Pipeline Integrity Monitor through version 2025 SP1 P1 (build 7.1.9580.8513) enables any local user with read access to PIMBoards project files to decrypt and view sensitive protected content. The CVSS 4.0 vector's subsequent-system impacts (SC:H/SI:H) indicate the decrypted material - likely credentials, connection strings, or configuration data - is sufficient to compromise downstream pipeline control or monitoring infrastructure, making this a lateral-movement enabler in OT/ICS environments. Reported by ICS-CERT (ics-cert@hq.dhs.gov) with a vendor advisory from AVEVA; no public exploit is identified at time of analysis.
Information disclosure in Visual Studio Code allows an unauthenticated remote attacker to exfiltrate sensitive data via a crafted file or workspace that triggers incorrect name or reference resolution (CWE-706). Affected versions span 1.0.0 through all releases before 1.136.2. The scope change (S:C) in the CVSS vector indicates the confidentiality impact reaches beyond the VS Code process itself - potentially exposing system files, environment variables, or workspace secrets to a remote origin. No public exploit code or KEV listing is identified at time of analysis, but the broad affected version range and VS Code's developer-centric user base make this a meaningful supply-chain adjacent risk.
Insufficient protection of stored or transmitted credentials in GitHub Copilot and Visual Studio Code before 1.136.2 allows a network-positioned attacker to disclose sensitive information, including authentication tokens, with a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N). Microsoft (secure@microsoft.com) is the assigning CNA and a vendored patch is available, but CISA SSVC rates exploitation as 'none' and automatable as 'no', and EPSS is only 0.62% (47th percentile), indicating elevated theoretical severity without observed attacker activity. No public exploit code has been identified at time of analysis.
Credential disclosure in Microsoft Azure CycleCloud allows an authenticated low-privileged attacker to retrieve insufficiently protected credentials over the network, potentially gaining access to additional Azure or HPC infrastructure resources. Affected versions are Azure CycleCloud below 8.9.2, and the scope change in the CVSS vector (S:C) indicates that disclosed credentials can be leveraged against systems beyond the vulnerable CycleCloud instance itself. No public exploit identified at time of analysis; a vendor-released patch is available.
Local privilege escalation in Windows NTFS via an out-of-bounds read (CWE-125) enables a low-privileged local attacker to gain full system-level access across a broad range of Windows desktop and server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local user account with no user interaction and no special configuration. EPSS sits at 0.27% (19th percentile), suggesting limited opportunistic exploitation at this time, and no active exploitation is confirmed via CISA KEV.
Unauthenticated remote information disclosure in Windows Failover Cluster exposes sensitive process memory to network attackers via a use of uninitialized resource flaw (CWE-908). Affected builds span Windows Server 2019, 2022, and 2025 as well as Windows 10 Version 1809 - all reachable without credentials per the AV:N/PR:N CVSS vector. Microsoft has released patches through the standard MSRC update guide; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated network information disclosure in the Windows Services for NFS ONCRPC XDR Driver allows a remote attacker to obtain sensitive system information without any credentials or user interaction. The vulnerability, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), affects a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature releases. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS AV:N/AC:L/PR:N/UI:N profile indicates straightforward network exploitability wherever the NFS feature is enabled.
Information disclosure in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to unauthenticated network attackers across a vast range of Windows Server and client editions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is improper null termination (CWE-170), a memory safety defect where string buffers are read beyond their intended boundary, leaking adjacent memory to a remote caller before any authentication handshake completes. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and breadth of affected systems make this a high-priority patch for any organization with RDP exposed.
Out-of-bounds read in the Windows Mobile Broadband driver stack enables unauthenticated remote attackers to disclose sensitive memory contents over a cellular network connection. Affected systems span Windows 10 (21H2, 22H2) and Windows 11 (23H2 through 26H1) before their respective patched builds. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS PR:N/AV:N vector indicates no authentication or user interaction is required for exploitation.
Privilege escalation via out-of-bounds read in the Windows Virtual Hard Disk (VHD) Miniport Driver affects a broad range of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authorized local attacker exploiting this CWE-125 flaw can achieve full control of the affected system - gaining high confidentiality, integrity, and availability impact - by reading kernel memory beyond legitimate buffer boundaries within the driver. No public exploit code has been identified at time of analysis, but the breadth of affected Windows builds and low attack complexity make this a significant enterprise patching priority.
Local privilege escalation in Windows Spaceport.sys - the kernel-mode Storage Spaces driver - allows a low-privileged authenticated local user to achieve SYSTEM-level control on Windows 11 and Windows Server 2022/2025 systems. The driver performs an out-of-bounds read (CWE-125) that can expose kernel memory contents and serve as a stepping stone to full kernel-level code execution, yielding high confidentiality, integrity, and availability impact. Microsoft has released patched builds via Windows Update; no public exploit or active exploitation confirmed at time of analysis.
Out-of-bounds read in the Windows DHCP Server component allows unauthenticated network attackers to disclose potentially sensitive server memory contents by sending a specially crafted DHCP packet. The flaw spans a broad range of Windows releases from Server 2012 through Server 2025 and certain Windows 10 builds, with Microsoft-confirmed patches available and exact fix build numbers documented by ENISA EUVD-2026-73249. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.77% (53rd percentile) reflects low current exploitation probability despite the trivially low attack complexity.
Out-of-bounds read in the Windows DHCP Server service exposes server memory contents to unauthenticated remote attackers via crafted DHCP packets. Confirmed via EUVD/MSRC data, the flaw spans Windows Server 2012 through 2025 across both full and Server Core installations, as well as select Windows 10 versions running the DHCP Server role. Microsoft has released patched builds; no public exploit code or CISA KEV listing exists at time of analysis, keeping near-term exploitation risk moderate.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service exposes server memory to unauthenticated remote attackers across Windows Server 2012 through 2025 and select Windows 10 builds. A crafted DHCP request packet triggers a read beyond the allocated buffer in the server's packet-processing code, leaking potentially sensitive memory contents with no integrity or availability impact. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS of 0.77% (53rd percentile) reflects below-median exploitation probability despite the zero-authentication network vector.
Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is possible through a time-of-check time-of-use (TOCTOU) race condition. An authenticated local attacker with low privileges can win the race window to escalate to higher privilege levels, achieving full confidentiality, integrity, and availability impact on the affected system. No public exploit code has been identified at time of analysis, but the breadth of affected Windows versions — spanning Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025 — gives this vulnerability a large attack surface.
Local privilege escalation in Windows Win32K - the kernel-mode graphics and windowing subsystem - allows a low-privileged local user to gain SYSTEM-level access via an out-of-bounds read (CWE-125). The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K LPE flaws are historically high-value targets for post-exploitation privilege escalation chains.
Out-of-bounds memory read in the Windows DHCP Server service exposes potentially sensitive server memory to unauthenticated remote attackers who send specially crafted DHCP packets. The flaw (CWE-125) spans Microsoft Windows Server 2012 through 2025 and select Windows 10 builds where the DHCP Server role is installed, with Microsoft assigning CVSS 7.5 reflecting full network accessibility and zero authentication requirement. No active exploitation or public proof-of-concept has been identified; EPSS sits at 0.77% (53rd percentile) and a vendor-supplied patch is available.
Out-of-bounds read in Microsoft Office (2016 through 365 Apps for Enterprise and LTSC 2024) enables an unauthenticated remote attacker to disclose sensitive memory contents over a network, per the provided CVSS vector. Affected products span both perpetual-license and subscription editions across x64 and x86 architectures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and Microsoft has released patches across all affected version lines.
Privilege escalation via an out-of-bounds read in the Windows NTFS kernel driver (CWE-125) enables a local attacker with standard user-level access to gain SYSTEM-level control of the affected host. The vulnerability spans an exceptionally broad range of Windows versions - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making virtually every unpatched Windows environment in the field potentially exposed. Microsoft has confirmed and released patches via MSRC; no public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Privilege escalation via out-of-bounds read in Windows NTFS affects a broad range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized (low-privilege) network attacker who can trigger specific NTFS parsing behavior - requiring user interaction - can achieve full compromise of confidentiality, integrity, and availability, effectively gaining system-level access. No public exploit has been identified at the time of analysis, but a vendor-released patch is available and should be prioritized given the breadth of affected OS versions.
Privilege escalation via out-of-bounds read in Windows BitLocker affects a broad swath of Microsoft operating systems from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates. A low-privileged network-authenticated attacker who can induce user interaction can trigger CWE-125 memory reads beyond buffer boundaries in the BitLocker component, ultimately achieving elevation of privileges with full confidentiality, integrity, and availability impact (CVSS 8.0). No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all confirmed affected versions.
Out-of-bounds read in the Windows Device Health Attestation (DHA) service exposes sensitive memory contents to unauthenticated remote attackers. The flaw affects Windows 10 Version 1809, Windows Server 2019, 2022, and 2025, where a crafted network request can trigger the read beyond an allocated buffer, leaking high-confidentiality data. Microsoft has released patches for all affected builds, and no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation via out-of-bounds read in the Windows Local Security Authority Server (lsasrv) allows a low-privileged authenticated attacker to elevate to higher system access over a network. Affected across a wide range of Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 builds, this vulnerability targets the core Windows authentication subsystem. Vendor patch is available; no public exploit or CISA KEV listing identified at time of analysis.
Privilege escalation via out-of-bounds read (CWE-125) in the Windows NTFS kernel driver affects virtually every current Windows release - from Windows 10 1607 and Server 2012 through Windows 11 26H2 and Server 2025 - allowing a low-privileged network attacker to achieve full CIA compromise of the target system. The vulnerability is reachable over the network (consistent with NTFS driver exposure via SMB), requires only low-level authentication and some user interaction, and can yield SYSTEM-level access. Microsoft has released patched builds for all affected versions; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Privilege escalation to SYSTEM in the Windows NTFS kernel driver affects virtually every supported Windows desktop and server release via an out-of-bounds read (CWE-125). An authenticated local attacker with only standard user privileges can exploit this memory-safety flaw in the NTFS driver to achieve full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated low-privilege attacker to execute arbitrary code over the network with scope-changed impact. The CWE-125 memory safety flaw in the database engine is reachable via standard SQL Server network access, and the scope-changed CVSS vector (S:C) indicates successful exploitation can escape the SQL Server process boundary to affect the underlying host. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the AC:H metric signals non-trivial exploitation complexity, but the breadth of affected versions across three major SQL Server release branches demands priority patching.
Cryptographic signature verification failure in the Remote Desktop client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) exposes session or authentication material to network-based interception. The 'Jwt Attack' technique tag combined with CWE-347 indicates the client insufficiently validates JWT signatures used in modern RDP authentication flows - likely those tied to Azure AD/Entra ID single-sign-on - permitting an attacker to intercept or substitute cryptographic tokens. No active exploitation confirmed at time of analysis, but the unauthenticated network vector and high confidentiality impact make this a meaningful priority for organizations relying on the standalone desktop client for cloud or VDI connectivity.
Local privilege escalation in Microsoft's Trace Data Helper (TDH) component - a Windows Event Tracing subsystem library - allows a low-privileged authenticated local user on Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 to gain full SYSTEM-level control. The root cause is an out-of-bounds read (CWE-125) that enables disclosure of kernel memory contents sufficient to defeat address-space layout randomization and chain into a full privilege escalation, yielding C:H/I:H/A:H impact. No active exploitation has been identified and no public proof-of-concept is available; Microsoft has released patched builds across all affected OS versions.
Improper certificate hostname validation (CWE-297) in Fortinet FortiOS and FortiProxy enables network-adjacent attackers to conduct man-in-the-middle attacks against outbound TLS connections made by affected devices. Fortinet FortiOS versions 7.6.1 through 7.6.6 and FortiProxy 7.6.2 through 7.6.6 fail to verify that a presented certificate matches the intended hostname, allowing a suitably positioned attacker to intercept and potentially tamper with encrypted traffic. Proof-of-concept code exists (E:P in temporal CVSS), and an official fix has been released per vendor advisory FG-IR-26-174.
Unauthenticated remote access control bypass in Fortinet FortiSandbox 4.2.x through 5.0.x - and its Cloud and PaaS variants - allows network-reachable attackers to retrieve sensitive information and disrupt availability by sending crafted HTTP requests, with no credentials or user interaction required. Fortinet's confirmed CVSS temporal metrics include E:P (proof-of-concept exploit code exists) alongside RL:O (official remediation available) and RC:C (confirmed), establishing this as an actively documented, patchable risk against sandboxing infrastructure that processes enterprise malware submissions. The scope-changed vector (S:C) combined with high availability impact (A:H) indicates the access control failure cascades beyond the directly targeted HTTP endpoint to other components within the FortiSandbox platform.
MongoDB Server's diagnostic reporting interface exposes cleartext credentials from in-flight administrative operations to any authenticated user holding monitoring-level privileges, creating a lateral-movement and privilege-escalation path via impersonation of higher-privileged accounts. Affected versions span the 7.0.x branch (before 7.0.41), 8.0.x branch (before 8.0.30), and 8.3.x branch (before 8.3.9). The server's log subsystem correctly redacts credential material, but an equivalent sanitization pass is absent from the diagnostic interface's serialization path, producing an inconsistent security boundary across two observability outputs for the same underlying data.
Missing authorization (CWE-862) in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to reach protected API endpoints without authorization checks. Per NVIDIA's own description, successful exploitation can lead to information disclosure, data tampering, and denial of service - though the vendor's CVSS vector scores only A:H (Availability: High), creating a notable discrepancy with the stated impact breadth. No public exploit code or CISA KEV listing exists at time of analysis.
Workload Identity Federation authentication in all major Snowflake client drivers transmits cloud attestation tokens to the configured host without first verifying that host is a recognized Snowflake endpoint, enabling token exfiltration and replay. An attacker who can modify connection configuration redirects the driver to an attacker-controlled server, which receives a freshly minted cloud workload-identity token that can be replayed against real Snowflake accounts for the token's remaining lifetime. On Azure, the attack surface is wider: the driver also fetches a Managed Identity access token scoped to an arbitrary Azure resource chosen by the attacker, extending potential impact beyond Snowflake to any Azure service that workload identity can reach. No public exploit has been identified at time of analysis, but vendor-confirmed patches were released September 3, 2026 across all eight affected driver packages.
Apache Parquet Hadoop's envelope encryption subsystem (org.apache.parquet.crypto.keytools, versions 1.12-1.18.0) can leak KMS authentication tokens to an attacker-controlled endpoint when a crafted Parquet file embeds a malicious KMS URL and the reader application relies on file-controlled URL resolution. The pluggable KmsClient receives the file-embedded URL without host validation, allowing a file author to silently redirect KMS token requests to an arbitrary server. No public exploit has been identified at time of analysis; the fix ships in version 1.18.1, which disables file-controlled KMS URLs by default.
Unbounded memory exhaustion in Xen's OCaml xenstore daemon (oxenstored) allows a malicious or compromised guest VM to trigger a system-wide denial of service by repeatedly sending xenbus reconnect requests without clearing the global watch trie. Each reconnect cycle purges only the per-domain hashtable, leaving stale watch entries to accumulate indefinitely in the global trie. All Xen deployments from 4.6 onwards using the OCaml oxenstored implementation are affected; no public exploit has been identified, but the attack surface is accessible to any guest with standard xenbus connectivity and no mitigations exist.
Missing authorization in the Apache Nutch Server (Nutch REST API) lets remote unauthenticated attackers read crawl data and interrupt or shut down running crawl jobs and their backing resources across Nutch 1.10 through 1.22. Because the REST API ships without access control, anyone able to reach the service can invoke management operations. No public exploit identified at time of analysis and EPSS is low (0.20%), but the fix is drastic: version 1.23 removes the Nutch Server component entirely.
JWT token forgery in yfexam-exam v2.0 exposes any authenticated session to impersonation because the signing secret is derived entirely from the username and the current calendar month - two low-entropy, often-public values - rather than a server-side cryptographic secret. An attacker who knows or can enumerate a target's username can deterministically compute the signing secret (only 12 possible month values) and mint forged tokens claiming arbitrary privileges without ever knowing the target's password. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.14% (4th percentile), but a public GitHub writeup by fangtang7 documents the technique, materially lowering the bar for any attacker who targets this application.
Unauthenticated account takeover in WWBN AVideo (through commit e01e41ecc) stems from get_api_preauthorize in plugin/API/API.php, a second, undocumented login path that performs the same credential check as get_api_signIn but omits the 10-attempts-per-5-minutes throttle enforced by checkRateLimit(). This lets remote attackers brute-force any account - including admin - without rate limiting, and the endpoint doubles as a credential oracle whose users_id field (1 vs 0) discloses password validity even though the message always reads 'Invalid credentials'. No public exploit identified at time of analysis, and no vendor-released patch is available.
Unauthenticated information disclosure in AVideo through 29.0 exposes private live-stream credentials - including stream keys and m3u8 playlist URLs - to any network-accessible attacker who queries the unprotected `plugin/Live/stats.json.php` endpoint. The `hidden_applications` array in the JSON response contains metadata for private, unlisted, and group-restricted live streams that the platform explicitly intends to conceal from unauthorized viewers. No public exploit has been identified at time of analysis, but the vulnerability is trivially reachable given its zero-precondition CVSS 4.0 profile (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.7).
Authenticated streamers on AVideo through version 29.0 can harvest source stream keys and identity information belonging to all other active streamers by querying the restreamsActive.json.php endpoint, which applies no per-user ownership filtering. The exposed stream keys are live transmission credentials that can be used to impersonate affected streamers on third-party platforms such as YouTube Live or Twitch, enabling broadcast hijacking or session disruption. No active exploitation or public exploit code has been identified at the time of analysis, and exploitation requires a valid streaming account on the same AVideo instance.
Timing side-channel in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0-v9.0.3) enables unauthenticated remote attackers to perform black-box reverse engineering of internal secret values - such as HMAC keys or API signing tokens - by measuring statistically distinguishable response-time differences across repeated crafted requests. The CWE-208 root cause is a non-constant-time comparison operation in the module's payment verification logic, which leaks information about secret material byte-by-byte through observable latency variations. No public exploit code or CISA KEV listing has been identified, but the network-exposed nature of the payment endpoint makes the attack surface broadly reachable for any operator of the affected module.
Unauthenticated credential disclosure in Netis NX10 routers (firmware V4.0.1.5808 and V3.0.0.4142) lets remote attackers retrieve the administrator password by sending a request to the 'sysinfo' action of the web management interface without any session. The exposed credential can then be replayed against the login handler to establish a fully authenticated administrator session, yielding complete device takeover. Publicly available exploit code exists (published by VulnCheck/hackwithmike), and the network-reachable, no-auth nature makes this straightforward to weaponize.
Race condition exploitation in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture Kernel Drivers allows any local non-privileged process to perform improper GPU memory operations, yielding kernel-level sensitive information disclosure or denial of service. All three driver families are affected across broad version ranges spanning multiple major release trains - Bifrost from r12p0, Valhall from r19p0, and 5th Gen from r41p0 - covering a large installed base of Mali GPU-equipped devices. No public exploit or active exploitation has been confirmed at time of analysis; the low EPSS score (0.11%, percentile 1%) reflects limited observed exploitation interest.
Sensitive kernel memory is exposed to local non-privileged user processes through improper GPU memory processing operations in Arm's Valhall GPU Kernel Driver and 5th Gen GPU Architecture Kernel Driver. The flaw spans a wide driver revision range - Valhall from r29p0 through r55p0 and 5th Gen from r41p0 through r55p0 - covering Mali-G series and Immortalis GPU generations deployed across hundreds of millions of Android and embedded devices. No public exploit code has been identified and EPSS sits at 0.14% (4th percentile), but the kernel-level confidentiality impact and the OEM-dependent patch delivery path make timely remediation structurally difficult.
Path traversal in Commvault CommServe allows unauthenticated remote attackers with sufficient complexity to read sensitive files outside intended directory boundaries, resulting in high-impact information disclosure. Affected versions span four active release trains of Commvault Cloud (11.36, 11.40, 11.44, 11.46), making this relevant across a broad enterprise backup customer base. No public exploit or active exploitation has been identified at time of analysis; vendor has released patched maintenance releases.
Unauthenticated remote access to Commvault Cloud's CommServe management server allows an attacker to bypass access authorization controls and disclose sensitive information. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) confirms fully network-exposed, zero-prerequisite exploitation against the CommServe component across four active version branches (11.36.x, 11.40.x, 11.44.x, 11.46.x). Commvault has released maintenance updates and no public exploit has been identified at time of analysis.
HTTP/1.1 request smuggling in Eclipse Jetty allows unauthenticated remote attackers to desynchronize request boundary parsing between Jetty and an upstream proxy, enabling manipulation of other users' HTTP sessions. The root cause is Jetty's acceptance of a bare LF character (\n) as a line terminator during chunked transfer encoding parsing - specifically in chunk extensions, chunk data termination, or trailer termination - where RFC 7230 mandates CRLF (\r\n). Depending on the Jetty version and configured HTTP compliance mode, a crafted request can cause the proxy and Jetty to disagree on where one request ends and the next begins, enabling request injection against co-located tenants. No public exploit has been identified at time of analysis.
Unauthenticated SQL injection in JoomShaper's SP Property extension for Joomla (versions before 4.1.4) lets remote attackers inject SQL through the property search and map-filtering query builders. The zipcode, sorting, price_range_dropdown, and psize_range_dropdown parameters are concatenated directly into WHERE and ORDER BY clauses without quoting or type casting, enabling boolean- and time-based blind extraction of database contents. No public exploit has been identified and the flaw is not in CISA KEV, but the unauthenticated network-reachable vector makes it a high-priority patch.
Authorization bypass in Countly Server's DBViewer plugin allows authenticated low-privilege users to read data from restricted MongoDB collections, including plaintext password-reset tokens, by exploiting a logic flaw in the aggregation-pipeline sanitizer. The `/o/db` aggregation endpoint's stage sanitizer misclassifies branches containing unrecognized MongoDB-internal operators (such as `$_internalInhibitOptimization`) as generic arrays rather than sub-pipelines, causing it to skip enforcement entirely for that branch. This lets a user holding only DBViewer read permission inject `$lookup` stages inside `$facet` sub-pipelines, cross-join into restricted collections such as `members`, and extract sensitive fields including `prid` (password-reset tokens), which are directly usable for account takeover. No public exploit has been identified at time of analysis, but the GitHub PR diff exposes sufficient technical detail to reconstruct the technique.
Authentication replay in GeoVision GV-LPC2211 license-plate-recognition cameras (firmware V1.13, marketed as GV-LPCLPC2011/2211) lets an attacker who captures a single WS-Security UsernameToken re-submit its PasswordDigest to authenticate arbitrary ONVIF operations. Because the device does not track UsernameToken nonces or enforce timestamp freshness, a passively observed token grants ongoing control of the camera's ONVIF interface without ever recovering the plaintext credential. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthenticated information disclosure in Ultimate Gift Cards for WooCommerce (WordPress plugin, versions 3.0.3 through 3.2.9) exposes customer PII, gift card balances, and transaction dates tied to arbitrary orders with no authorization check. Version 3.2.9 raises the severity significantly: the live redemption code is also leaked, allowing any anonymous attacker who retrieves it to spend the gift card balance, crossing from information disclosure into tangible financial fraud. A publicly available proof-of-concept was published by WPScan, and the vulnerability is automatable per CISA SSVC, making mass enumeration of orders and gift card theft realistic.
Out-of-bounds read in libxls 1.6.3 allows a remote, unauthenticated attacker to leak heap memory contents by supplying a maliciously crafted XLS file with manipulated OLE Property Set Stream offsets. The vulnerability resides in xls_dumpSummary(), which dereferences file-controlled section and property offsets against a 4096-byte OLE summary buffer without first validating that those offsets remain within buffer bounds. Any server-side or automated pipeline that parses untrusted XLS files via libxls is exposed; no public exploit code has been identified and EPSS stands at 0.15%, indicating low current exploitation activity.
Path traversal in @openhop/server (npm, versions ≤0.3.5) allows unauthenticated remote attackers to read or permanently delete arbitrary `.yaml` files accessible to the OpenHop process outside its configured flow data directory. The root cause is that `FlowStore.filePath()` passes caller-supplied HTTP route parameters directly to Node.js `path.join()` without any sanitization or allowlist validation, and Fastify's underlying `find-my-way` router URL-decodes the parameter before it reaches application code, enabling `..%2F`-encoded directory traversal. A fully functional PoC is publicly available with Docker-based reproduction steps; no KEV listing at time of analysis. Docker deployments expose the server on all interfaces by default, enabling direct network exploitation without user interaction.
nuxt-ollama versions 1.2.26 through 1.3.0 unconditionally places the Ollama cloud API key into Nuxt's public runtime config, causing it to appear verbatim in every server-rendered HTML page inside the `window.__NUXT__` script block, readable by any unauthenticated HTTP client. Any visitor or web crawler that fetches any page of an affected application can extract the `api_key` from the serialized SSR payload with a single GET request, then impersonate the operator against the Ollama cloud API to incur billing charges, exhaust rate limits, or exfiltrate stored model data. A publicly available PoC using Docker and Python has dynamically confirmed the leak; no public exploit identified at time of analysis for active KEV-level exploitation.
DNS rebinding SSRF in Open WebUI versions 0.9.6 through 0.11.0 allows authenticated users who control authoritative DNS to bypass hostname validation in SafePlaywrightURLLoader and reach internal services or cloud metadata endpoints. The flaw exists because Python validates the resolved hostname at check time, then the Playwright browser independently re-resolves the same hostname at use time - enabling an attacker to serve a public IP during validation and a private or link-local IP for the actual fetch. The issue is fixed in v0.11.1 by routing all fetches through the SSRF-safe requests session, eliminating the second resolution. No public exploit code or CISA KEV listing is present.
Unauthenticated information disclosure in the Magefan Blog GraphQL extension for Magento 2 (magefan/module-blog-graph-ql, versions through 2.2.1) exposes blog commenter email addresses alongside internal customer and admin identifiers via a simple POST request to the /graphql endpoint. The blogComments GraphQL query resolver fails to enforce authorization checks on sensitive fields, allowing any remote unauthenticated actor to enumerate user data from affected Magento stores. No active exploitation is confirmed in CISA KEV, but SSVC rates the attack as automatable, and a researcher gist publicly documenting the issue is included in the references.
SJRC F11 / SJ-GPS-PRO drones running firmware build 2019-09-17 expose an inetd service that spawns the helper binary /app/sh_for_telnet, giving anyone who can reach that port unauthenticated access to a shell and thus to sensitive data stored on the device (CWE-200). The flaw is remotely triggerable with no credentials or user interaction (CVSS 7.5, AV:N/PR:N/UI:N), but impact is limited to confidentiality — integrity and availability are unaffected. It is not listed in CISA KEV, EPSS is only 0.21% (11th percentile), and while a public GitHub advisory/repository documents the issue, no confirmed exploit code or in-the-wild activity was identified at time of analysis.
The krb5 crypto subsystem in the Linux kernel fails to zero derived Kerberos key material before freeing memory buffers, leaving sensitive cryptographic keys resident in freed slab allocator objects. Both `crypto_krb5_prepare_encryption()` and `crypto_krb5_prepare_checksum()` call plain `kfree()` instead of the security-aware `kfree_sensitive()` wrapper, which would first zero the allocation. Systems using Kerberos-authenticated kernel services - primarily NFSv4 with sec=krb5 or CIFS/SMB with Kerberos - on kernel versions from commit 3936f02b through the stable fixes are affected; no public exploit or active exploitation has been identified.
Unauthorized cryptographic hardware access in KVM for s390 (IBM Z) nested virtualization allows a low-privileged nested guest to access AP queues (hardware crypto devices) that were explicitly revoked from its allocation. When the KVM VSIE subsystem shadows a format0 APCB (Adjunct Processor Control Block) from a crycb type 0 or 1 structure, it only copies bits 0-63 but leaves bits 64-255 unchanged from whatever stale state existed in the vsie shadow page. A nested (L2) guest exploiting this retains access to cryptographic devices beyond those granted by the host hypervisor, potentially exposing cryptographic keys and operations belonging to other workloads. No public exploit has been identified at time of analysis and no CISA KEV listing exists.
Remote heap information disclosure in eProsima Fast DDS lets unauthenticated attackers leak adjacent heap memory by sending a crafted RTPS DATA_FRAG submessage. Affected versions before 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fail to validate that the received datagram is large enough before a memcpy() in the last-fragment reassembly path, so bytes past the UDP buffer (potentially pointers useful for ASLR bypass) are copied into the reassembly buffer and, in Discovery Server deployments, relayed to other participants. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.
Unencrypted UDP video transmission in the C6 Ear Camera and its companion EarVision Android application (version 1.3.1 / firmware 1.3.1_Code 132) exposes live ear-canal video streams to passive eavesdropping by any attacker within local wireless range. The camera broadcasts JPEG and WEBP frames over plaintext UDP with no transport-layer security, and the Android application's manifest explicitly permits cleartext traffic, removing any client-side enforcement barrier. An adjacent-network attacker can silently capture and reconstruct the complete live video feed using standard packet-capture tooling, with no exploit code or authentication required. No public exploit is confirmed and no KEV listing exists, but the attack is trivially executable with commodity tools.
Incorrect permission assignment on a critical resource in Pardus LightDM Greeter allows a local low-privileged user to read sensitive authentication material or tamper with greeter configuration, achieving high confidentiality and integrity impact without elevated rights. All versions before 0.4.15 of the greeter - a graphical login component shipped with Pardus, the Turkish government-backed Linux distribution maintained by TÜBİTAK BİLGEM - are affected. No public exploit or active exploitation has been identified; a vendor-released patch is available. No special configuration is required beyond having a local user account on an affected system.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 expose both the Appliance and Application deployments to unauthenticated remote information disclosure. Any attacker who discovers or reverse-engineers the embedded static credentials - which cannot be changed by administrators - can authenticate to the gateway without valid user accounts and access sensitive information. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no privileges or user interaction; no public exploit or CISA KEV listing is recorded at time of analysis.
Path traversal in the knowns npm documentation tool (versions ≤ 0.29.1) enables remote unauthenticated attackers to read, create, overwrite, or delete arbitrary files with a .md extension anywhere on the host filesystem, and to create arbitrary directories via os.MkdirAll. The Document API's sanitization function cleanDocPath() strips slashes and .md suffixes but leaves ../ sequences intact, allowing filepath.Join() to resolve paths outside the intended documents directory. In the default deployment - where the Management API binds to all interfaces without authentication - this is directly exploitable with a single crafted HTTP request, and the arbitrary-write primitive may be chained toward code execution. No confirmed active exploitation or public exploit code identified at time of analysis.
License key exposure in Snipe-IT before 8.7.0 allows any authenticated low-privilege user to bypass the viewKeys authorization gate and retrieve all product license keys stored in the system. Two distinct exploitation paths exist: bulk extraction via the CSV export endpoint and a key-validation oracle via observable API response discrepancies, making CWE-204 an accurate root-cause classification for the latter. No public exploit code or CISA KEV listing exists at time of analysis; the patch is available in version 8.7.0.
Server-side request forgery and arbitrary file read in Snipe-IT before 8.7.0 allow any authenticated user to exfiltrate sensitive server files - including the Laravel `.env` file containing `APP_KEY` - by injecting markdown image syntax into checkout acceptance note fields. The injected syntax survives HTML escaping, is expanded by the CommonMark parser, and subsequently resolved by the laravel-mail-auto-embed library via `file_get_contents()` (local paths) or `curl` (remote URLs) when email notifications are generated. Vendor-released patch is available in version 8.7.0; no public exploit has been identified at time of analysis, but compromise of `APP_KEY` can facilitate escalation to remote code execution via Laravel cookie/session decryption.
Arbitrary file read and SSRF in Snipe-IT before 8.7.0 allow low-privileged users to exfiltrate sensitive server files - including .env credential files - via unsanitized EULA text fields. An attacker with category-edit permissions injects markdown image syntax or raw HTML img tags referencing local file paths or remote URLs; the mail auto-embed library resolves these references server-side during checkout confirmation email generation and returns the resolved content as email attachments. No public exploit has been identified at time of analysis, and a vendor patch is available at 8.7.0.
Hard-coded credentials embedded in Dell Secure Connect Gateway 5.0 allow a remote, unauthenticated attacker to authenticate to the service using the static credentials and access sensitive information. Both the Appliance variant (all versions prior to 5.36.00.16) and the Application variant (all versions prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified, but CWE-798 credentials are static across all unpatched installations worldwide, meaning any party with knowledge of them can exploit any exposed instance without further effort.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 expose sensitive information to unauthenticated remote attackers across both the Appliance and Application deployment variants. The vulnerability (CWE-798) allows an attacker who discovers or possesses the embedded credentials to authenticate without authorization and access confidential data. Dell has released patched versions under advisory DSA-2026-382, and no public exploits or CISA KEV listing have been identified at time of analysis.
External control of file name or path (CWE-73) in Dell Secure Connect Gateway (SCG) 5.0 enables unauthenticated remote attackers to influence filesystem path resolution, resulting in unauthorized filesystem access. Both the Appliance form factor (versions before 5.36.00.16) and the Application form factor (versions before 5.36.00.00) are affected. Dell has released patched versions and published advisory DSA-2026-382; no public exploit code or active exploitation has been identified at this time.
Missing brute-force rate-limiting in Dell Secure Connect Gateway (SCG) 5.0 Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) exposes authentication endpoints to unlimited credential-guessing by unauthenticated remote attackers over the network. Successful exploitation allows an attacker to enumerate and compromise valid credentials, with Dell indicating the resulting access can enable client-side request forgery. No public exploit code or CISA KEV listing has been identified at time of analysis.
Argument injection in GitPython 3.1.59's high-level diff API allows low-privileged remote attackers to read arbitrary filesystem paths by passing the unsanitized `--no-index` flag to the underlying git diff command. By chaining `--no-index` with the `-I`/`--ignore-matching-lines` regex filter, an attacker can construct a content-dependent Boolean oracle - issuing repeated queries that distinguish between regex match and mismatch responses to recover single-line secrets from local files. No active exploitation has been confirmed (not in CISA KEV), but the technique is deterministic and requires only authenticated API access. Patch-upgraded version 3.1.60 is available.
Read-only mode bypass in SiYuan ≤ 3.8.1 allows an authenticated administrator to submit arbitrary SQL against the blocks database via POST /api/search/fullTextSearchBlock (method=2), circumventing the workspace's --readonly=true protection that correctly blocks the dedicated /api/query/sql endpoint. The prior fix for CVE-2026-32767 added an admin-role gate but omitted the model.CheckReadonly and CheckReadonlyStatementInBox calls, leaving the SQL code path unguarded. Vendor-released patch available in v3.8.2; no public exploit identified at time of analysis.
Out-of-bounds read in zstd-jni versions 1.2.0 through 1.5.7-13 allows attackers who can supply dictionary constructor parameters to crash the JVM and potentially read limited native heap memory. The ZstdDictCompress constructor passed unvalidated offset and length values directly to the C JNI layer, where out-of-range values cause the native code to read beyond the allocated Java heap array. No CISA KEV listing or public exploit has been identified; the CVSS 4.0 score of 8.8 reflects high availability impact via reliable JVM crash and limited confidentiality exposure from native heap reads.
Payment-confirmation forgery in PayTR's Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0 to before v9.0.3) lets remote unauthenticated attackers spoof a trusted payment identifier so the module treats an unpaid or attacker-controlled transaction as legitimately settled. Reported by TR-CERT, it stems from the module relying on a less-trusted, client-influenceable source instead of server-to-server verification of PayTR's callback. No public exploit is identified at time of analysis, and no EPSS or KEV data was supplied.
Unauthenticated information disclosure in the Loops & Logic WordPress plugin (all versions before 4.3.0) exposes arbitrary user records - including email addresses and role assignments - and arbitrary site configuration options to any unauthenticated visitor. The plugin's public template-data AJAX action fails to enforce access controls, permitting unauthenticated HTTP requests to retrieve data restricted to privileged users. A publicly available proof-of-concept exists per the WPScan advisory; however, EPSS at 0.17% (7th percentile) and SSVC 'exploitation: none' indicate no confirmed active exploitation at time of analysis.
Out-of-bounds write in HarmonyOS 6.1.0's rendering and composition module allows a locally executing process to corrupt adjacent memory, with vendor-stated impact to availability and a CVSS vector also indicating potential confidentiality exposure. Affected devices are those running Huawei HarmonyOS version 6.1.0 as confirmed by EUVD-2026-74596. No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
Local File Inclusion in the Eventin WordPress event management plugin (versions ≤4.1.22) allows authenticated contributors to include and execute arbitrary PHP files on the server via the unsanitized 'event_layout' parameter, achieving full remote code execution. The etn_manage_event capability is assigned to WordPress Contributors by default, meaning any registered Contributor can set the malicious parameter value through the REST API without any site-specific configuration change. Exploitation requires a PHP file to already be present on the server, reflected in the AC:H CVSS rating; no public exploit or CISA KEV listing has been identified at time of analysis.
Local File Inclusion in the Eventin Event Calendar WordPress plugin (all versions through 4.1.22) allows authenticated attackers with custom-level WordPress access to include and execute arbitrary PHP files by supplying a crafted path via the unsanitized `event_layout` parameter in the plugin's event template and REST API endpoints. Successful code execution requires the attacker to first place a PHP file on the server - a two-stage exploit chain reflected in the CVSS AC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported this with direct source code line references, indicating the attack surface is well-documented.
Plaintext recovery and content forgery in OpenIDC/cjose 0.6.1 through 0.6.2.5 occurs because the library zero-fills the content-encryption key (CEK) instead of randomizing it whenever a JWE is built with an AES-CBC-HMAC enc (A128CBC-HS256/A192CBC-HS384/A256CBC-HS512) and a key-management algorithm that generates a fresh CEK. Every affected ciphertext is therefore encrypted and authenticated under an all-zero, publicly known key, so anyone who obtains the JWE can decrypt it and forge or modify its contents. Fixed in 0.6.2.6; no public exploit identified at time of analysis, but the flaw is trivially demonstrable and confirmed by the vendor GitHub Security Advisory.
Out-of-bounds read in ANGLE, Chrome's cross-platform graphics abstraction layer, enables sandbox escape and potential remote code execution on the host system for Chrome versions prior to 153.0.8010.36. This is a staged, second-phase exploit: an attacker must first compromise the renderer process through a separate vulnerability before leveraging this ANGLE flaw to break out of Chrome's sandbox via a crafted HTML page. No public exploit has been identified and no CISA KEV listing exists; EPSS at 0.21% (12th percentile) reflects minimal observed exploitation activity at time of analysis.
Out-of-bounds read in the WebGL component of Google Chrome before 153.0.8010.36 lets a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the browser sandbox. Chromium rates the security severity as High, and a vendor patch is available; no public exploit has been identified and CISA SSVC records exploitation as none, with EPSS at a low 0.28% (20th percentile).
Out-of-bounds read in Google Chrome's Media component (versions prior to 153.0.8010.36) enables remote code execution confined within the browser sandbox when a user visits a specially crafted HTML page. The vulnerability stems from improper bounds checking during media processing, allowing a remote attacker to read memory beyond intended buffer limits and leverage the resulting data to achieve arbitrary code execution. No public exploit has been identified at time of analysis and EPSS is low (0.35%), but the attack surface is broad given Chrome's ubiquity.
User impersonation in Apache Impala 4.0.0 through 4.5.1 lets a remote attacker act as any user because the final step of SAML2 authentication on the hs2-http interface never verifies the Bearer token's signature. An attacker who can reach a SAML2-enabled hs2-http endpoint can forge or tamper with the token's asserted username and gain that user's identity and privileges. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not in CISA KEV.
Administrative takeover of the Eclipse aeriOS Identity Manager (IdM) is possible because the current development-version deployment exposes its Keycloak server and PostgreSQL backing database to the network (Kubernetes NodePort services, and PostgreSQL bound to all interfaces under Docker Compose) while shipping fixed, publicly documented default credentials for the Keycloak admin and the PostgreSQL user. An attacker who can reach these services logs in with the published defaults to read or modify identity data - users, roles, client credentials, sessions, and cryptographic material - and can mint privileged identities or tokens trusted by other aeriOS components. No official release exists yet; there is no CISA KEV listing and no public exploit identified at time of analysis, though the credentials are effectively public in the source repository.
Credential leakage in the Okta Hyperdrive Integration installer (versions 1.2.0 through 1.5.1) exposes the OAuth client secret in plaintext across three Windows logging surfaces - the MSI installer log, the Windows Application Event Log, and the process command line - whenever the secret is supplied as an MSI property at install time. An authenticated local user on the workstation can read any of these surfaces and extract the credential without elevated privileges. The leaked OAuth client secret can then be used to authenticate against Okta services outside the local machine, explaining the scope change in the CVSS vector and elevating the effective impact beyond a simple local information disclosure. No public exploit has been identified and the vulnerability is not listed in CISA KEV; Okta has released a patch at version 1.5.2.
Arbitrary file system read in Adobe ColdFusion 2023 (Update ≤23) and ColdFusion 2025 (Update ≤12) exposes sensitive files and directories outside the intended access scope to unauthenticated remote attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable exploitation requiring no credentials and no user interaction, with high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity raises concern for rapid weaponization.
Local information disclosure in Android Wear (Wear OS) versions 14, 16, and 17 lets a co-resident application read sensitive device state data because checkReadPermission in PermissionsManager.java fails to enforce a required permission. No additional execution privileges or user interaction are needed, so any installed app can silently monitor protected state. No public exploit identified at time of analysis, and the flaw is fixed in the September 2026 Wear security patch level.
Out-of-bounds read in Microsoft Excel's file-parsing engine allows code execution when a victim opens a specially crafted workbook. Affected builds span Excel 2016 through Office LTSC 2024 and their Mac equivalents, making the exposure broad across both perpetual-license and subscription deployments. No public exploit code has been identified at time of analysis, but Microsoft has released patched builds for all affected product lines.
Out-of-bounds read (CWE-125) in Microsoft Office Excel's file-parsing engine enables local code execution when a victim opens a specially crafted spreadsheet. Affects a wide range of Microsoft Office products from version 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise, on both Windows and Mac platforms. No public exploit identified at time of analysis, but the low attack complexity combined with full confidentiality, integrity, and availability impact makes phishing-delivered document lures a realistic and proven delivery vector.
Hard-coded cryptographic key (CWE-321) in AVEVA Pipeline Integrity Monitor through version 2025 SP1 P1 (build 7.1.9580.8513) enables any local user with read access to PIMBoards project files to decrypt and view sensitive protected content. The CVSS 4.0 vector's subsequent-system impacts (SC:H/SI:H) indicate the decrypted material - likely credentials, connection strings, or configuration data - is sufficient to compromise downstream pipeline control or monitoring infrastructure, making this a lateral-movement enabler in OT/ICS environments. Reported by ICS-CERT (ics-cert@hq.dhs.gov) with a vendor advisory from AVEVA; no public exploit is identified at time of analysis.
Information disclosure in Visual Studio Code allows an unauthenticated remote attacker to exfiltrate sensitive data via a crafted file or workspace that triggers incorrect name or reference resolution (CWE-706). Affected versions span 1.0.0 through all releases before 1.136.2. The scope change (S:C) in the CVSS vector indicates the confidentiality impact reaches beyond the VS Code process itself - potentially exposing system files, environment variables, or workspace secrets to a remote origin. No public exploit code or KEV listing is identified at time of analysis, but the broad affected version range and VS Code's developer-centric user base make this a meaningful supply-chain adjacent risk.
Insufficient protection of stored or transmitted credentials in GitHub Copilot and Visual Studio Code before 1.136.2 allows a network-positioned attacker to disclose sensitive information, including authentication tokens, with a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N). Microsoft (secure@microsoft.com) is the assigning CNA and a vendored patch is available, but CISA SSVC rates exploitation as 'none' and automatable as 'no', and EPSS is only 0.62% (47th percentile), indicating elevated theoretical severity without observed attacker activity. No public exploit code has been identified at time of analysis.
Credential disclosure in Microsoft Azure CycleCloud allows an authenticated low-privileged attacker to retrieve insufficiently protected credentials over the network, potentially gaining access to additional Azure or HPC infrastructure resources. Affected versions are Azure CycleCloud below 8.9.2, and the scope change in the CVSS vector (S:C) indicates that disclosed credentials can be leveraged against systems beyond the vulnerable CycleCloud instance itself. No public exploit identified at time of analysis; a vendor-released patch is available.
Local privilege escalation in Windows NTFS via an out-of-bounds read (CWE-125) enables a low-privileged local attacker to gain full system-level access across a broad range of Windows desktop and server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local user account with no user interaction and no special configuration. EPSS sits at 0.27% (19th percentile), suggesting limited opportunistic exploitation at this time, and no active exploitation is confirmed via CISA KEV.
Unauthenticated remote information disclosure in Windows Failover Cluster exposes sensitive process memory to network attackers via a use of uninitialized resource flaw (CWE-908). Affected builds span Windows Server 2019, 2022, and 2025 as well as Windows 10 Version 1809 - all reachable without credentials per the AV:N/PR:N CVSS vector. Microsoft has released patches through the standard MSRC update guide; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated network information disclosure in the Windows Services for NFS ONCRPC XDR Driver allows a remote attacker to obtain sensitive system information without any credentials or user interaction. The vulnerability, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), affects a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature releases. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS AV:N/AC:L/PR:N/UI:N profile indicates straightforward network exploitability wherever the NFS feature is enabled.
Information disclosure in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to unauthenticated network attackers across a vast range of Windows Server and client editions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is improper null termination (CWE-170), a memory safety defect where string buffers are read beyond their intended boundary, leaking adjacent memory to a remote caller before any authentication handshake completes. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and breadth of affected systems make this a high-priority patch for any organization with RDP exposed.
Out-of-bounds read in the Windows Mobile Broadband driver stack enables unauthenticated remote attackers to disclose sensitive memory contents over a cellular network connection. Affected systems span Windows 10 (21H2, 22H2) and Windows 11 (23H2 through 26H1) before their respective patched builds. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS PR:N/AV:N vector indicates no authentication or user interaction is required for exploitation.
Privilege escalation via out-of-bounds read in the Windows Virtual Hard Disk (VHD) Miniport Driver affects a broad range of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authorized local attacker exploiting this CWE-125 flaw can achieve full control of the affected system - gaining high confidentiality, integrity, and availability impact - by reading kernel memory beyond legitimate buffer boundaries within the driver. No public exploit code has been identified at time of analysis, but the breadth of affected Windows builds and low attack complexity make this a significant enterprise patching priority.
Local privilege escalation in Windows Spaceport.sys - the kernel-mode Storage Spaces driver - allows a low-privileged authenticated local user to achieve SYSTEM-level control on Windows 11 and Windows Server 2022/2025 systems. The driver performs an out-of-bounds read (CWE-125) that can expose kernel memory contents and serve as a stepping stone to full kernel-level code execution, yielding high confidentiality, integrity, and availability impact. Microsoft has released patched builds via Windows Update; no public exploit or active exploitation confirmed at time of analysis.
Out-of-bounds read in the Windows DHCP Server component allows unauthenticated network attackers to disclose potentially sensitive server memory contents by sending a specially crafted DHCP packet. The flaw spans a broad range of Windows releases from Server 2012 through Server 2025 and certain Windows 10 builds, with Microsoft-confirmed patches available and exact fix build numbers documented by ENISA EUVD-2026-73249. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.77% (53rd percentile) reflects low current exploitation probability despite the trivially low attack complexity.
Out-of-bounds read in the Windows DHCP Server service exposes server memory contents to unauthenticated remote attackers via crafted DHCP packets. Confirmed via EUVD/MSRC data, the flaw spans Windows Server 2012 through 2025 across both full and Server Core installations, as well as select Windows 10 versions running the DHCP Server role. Microsoft has released patched builds; no public exploit code or CISA KEV listing exists at time of analysis, keeping near-term exploitation risk moderate.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service exposes server memory to unauthenticated remote attackers across Windows Server 2012 through 2025 and select Windows 10 builds. A crafted DHCP request packet triggers a read beyond the allocated buffer in the server's packet-processing code, leaking potentially sensitive memory contents with no integrity or availability impact. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS of 0.77% (53rd percentile) reflects below-median exploitation probability despite the zero-authentication network vector.
Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is possible through a time-of-check time-of-use (TOCTOU) race condition. An authenticated local attacker with low privileges can win the race window to escalate to higher privilege levels, achieving full confidentiality, integrity, and availability impact on the affected system. No public exploit code has been identified at time of analysis, but the breadth of affected Windows versions — spanning Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025 — gives this vulnerability a large attack surface.
Local privilege escalation in Windows Win32K - the kernel-mode graphics and windowing subsystem - allows a low-privileged local user to gain SYSTEM-level access via an out-of-bounds read (CWE-125). The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K LPE flaws are historically high-value targets for post-exploitation privilege escalation chains.
Out-of-bounds memory read in the Windows DHCP Server service exposes potentially sensitive server memory to unauthenticated remote attackers who send specially crafted DHCP packets. The flaw (CWE-125) spans Microsoft Windows Server 2012 through 2025 and select Windows 10 builds where the DHCP Server role is installed, with Microsoft assigning CVSS 7.5 reflecting full network accessibility and zero authentication requirement. No active exploitation or public proof-of-concept has been identified; EPSS sits at 0.77% (53rd percentile) and a vendor-supplied patch is available.
Out-of-bounds read in Microsoft Office (2016 through 365 Apps for Enterprise and LTSC 2024) enables an unauthenticated remote attacker to disclose sensitive memory contents over a network, per the provided CVSS vector. Affected products span both perpetual-license and subscription editions across x64 and x86 architectures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and Microsoft has released patches across all affected version lines.
Privilege escalation via an out-of-bounds read in the Windows NTFS kernel driver (CWE-125) enables a local attacker with standard user-level access to gain SYSTEM-level control of the affected host. The vulnerability spans an exceptionally broad range of Windows versions - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making virtually every unpatched Windows environment in the field potentially exposed. Microsoft has confirmed and released patches via MSRC; no public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Privilege escalation via out-of-bounds read in Windows NTFS affects a broad range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized (low-privilege) network attacker who can trigger specific NTFS parsing behavior - requiring user interaction - can achieve full compromise of confidentiality, integrity, and availability, effectively gaining system-level access. No public exploit has been identified at the time of analysis, but a vendor-released patch is available and should be prioritized given the breadth of affected OS versions.
Privilege escalation via out-of-bounds read in Windows BitLocker affects a broad swath of Microsoft operating systems from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates. A low-privileged network-authenticated attacker who can induce user interaction can trigger CWE-125 memory reads beyond buffer boundaries in the BitLocker component, ultimately achieving elevation of privileges with full confidentiality, integrity, and availability impact (CVSS 8.0). No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all confirmed affected versions.
Out-of-bounds read in the Windows Device Health Attestation (DHA) service exposes sensitive memory contents to unauthenticated remote attackers. The flaw affects Windows 10 Version 1809, Windows Server 2019, 2022, and 2025, where a crafted network request can trigger the read beyond an allocated buffer, leaking high-confidentiality data. Microsoft has released patches for all affected builds, and no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation via out-of-bounds read in the Windows Local Security Authority Server (lsasrv) allows a low-privileged authenticated attacker to elevate to higher system access over a network. Affected across a wide range of Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 builds, this vulnerability targets the core Windows authentication subsystem. Vendor patch is available; no public exploit or CISA KEV listing identified at time of analysis.
Privilege escalation via out-of-bounds read (CWE-125) in the Windows NTFS kernel driver affects virtually every current Windows release - from Windows 10 1607 and Server 2012 through Windows 11 26H2 and Server 2025 - allowing a low-privileged network attacker to achieve full CIA compromise of the target system. The vulnerability is reachable over the network (consistent with NTFS driver exposure via SMB), requires only low-level authentication and some user interaction, and can yield SYSTEM-level access. Microsoft has released patched builds for all affected versions; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Privilege escalation to SYSTEM in the Windows NTFS kernel driver affects virtually every supported Windows desktop and server release via an out-of-bounds read (CWE-125). An authenticated local attacker with only standard user privileges can exploit this memory-safety flaw in the NTFS driver to achieve full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated low-privilege attacker to execute arbitrary code over the network with scope-changed impact. The CWE-125 memory safety flaw in the database engine is reachable via standard SQL Server network access, and the scope-changed CVSS vector (S:C) indicates successful exploitation can escape the SQL Server process boundary to affect the underlying host. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the AC:H metric signals non-trivial exploitation complexity, but the breadth of affected versions across three major SQL Server release branches demands priority patching.
Cryptographic signature verification failure in the Remote Desktop client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) exposes session or authentication material to network-based interception. The 'Jwt Attack' technique tag combined with CWE-347 indicates the client insufficiently validates JWT signatures used in modern RDP authentication flows - likely those tied to Azure AD/Entra ID single-sign-on - permitting an attacker to intercept or substitute cryptographic tokens. No active exploitation confirmed at time of analysis, but the unauthenticated network vector and high confidentiality impact make this a meaningful priority for organizations relying on the standalone desktop client for cloud or VDI connectivity.
Local privilege escalation in Microsoft's Trace Data Helper (TDH) component - a Windows Event Tracing subsystem library - allows a low-privileged authenticated local user on Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 to gain full SYSTEM-level control. The root cause is an out-of-bounds read (CWE-125) that enables disclosure of kernel memory contents sufficient to defeat address-space layout randomization and chain into a full privilege escalation, yielding C:H/I:H/A:H impact. No active exploitation has been identified and no public proof-of-concept is available; Microsoft has released patched builds across all affected OS versions.
Improper certificate hostname validation (CWE-297) in Fortinet FortiOS and FortiProxy enables network-adjacent attackers to conduct man-in-the-middle attacks against outbound TLS connections made by affected devices. Fortinet FortiOS versions 7.6.1 through 7.6.6 and FortiProxy 7.6.2 through 7.6.6 fail to verify that a presented certificate matches the intended hostname, allowing a suitably positioned attacker to intercept and potentially tamper with encrypted traffic. Proof-of-concept code exists (E:P in temporal CVSS), and an official fix has been released per vendor advisory FG-IR-26-174.
Unauthenticated remote access control bypass in Fortinet FortiSandbox 4.2.x through 5.0.x - and its Cloud and PaaS variants - allows network-reachable attackers to retrieve sensitive information and disrupt availability by sending crafted HTTP requests, with no credentials or user interaction required. Fortinet's confirmed CVSS temporal metrics include E:P (proof-of-concept exploit code exists) alongside RL:O (official remediation available) and RC:C (confirmed), establishing this as an actively documented, patchable risk against sandboxing infrastructure that processes enterprise malware submissions. The scope-changed vector (S:C) combined with high availability impact (A:H) indicates the access control failure cascades beyond the directly targeted HTTP endpoint to other components within the FortiSandbox platform.
MongoDB Server's diagnostic reporting interface exposes cleartext credentials from in-flight administrative operations to any authenticated user holding monitoring-level privileges, creating a lateral-movement and privilege-escalation path via impersonation of higher-privileged accounts. Affected versions span the 7.0.x branch (before 7.0.41), 8.0.x branch (before 8.0.30), and 8.3.x branch (before 8.3.9). The server's log subsystem correctly redacts credential material, but an equivalent sanitization pass is absent from the diagnostic interface's serialization path, producing an inconsistent security boundary across two observability outputs for the same underlying data.
Missing authorization (CWE-862) in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to reach protected API endpoints without authorization checks. Per NVIDIA's own description, successful exploitation can lead to information disclosure, data tampering, and denial of service - though the vendor's CVSS vector scores only A:H (Availability: High), creating a notable discrepancy with the stated impact breadth. No public exploit code or CISA KEV listing exists at time of analysis.
Workload Identity Federation authentication in all major Snowflake client drivers transmits cloud attestation tokens to the configured host without first verifying that host is a recognized Snowflake endpoint, enabling token exfiltration and replay. An attacker who can modify connection configuration redirects the driver to an attacker-controlled server, which receives a freshly minted cloud workload-identity token that can be replayed against real Snowflake accounts for the token's remaining lifetime. On Azure, the attack surface is wider: the driver also fetches a Managed Identity access token scoped to an arbitrary Azure resource chosen by the attacker, extending potential impact beyond Snowflake to any Azure service that workload identity can reach. No public exploit has been identified at time of analysis, but vendor-confirmed patches were released September 3, 2026 across all eight affected driver packages.
Apache Parquet Hadoop's envelope encryption subsystem (org.apache.parquet.crypto.keytools, versions 1.12-1.18.0) can leak KMS authentication tokens to an attacker-controlled endpoint when a crafted Parquet file embeds a malicious KMS URL and the reader application relies on file-controlled URL resolution. The pluggable KmsClient receives the file-embedded URL without host validation, allowing a file author to silently redirect KMS token requests to an arbitrary server. No public exploit has been identified at time of analysis; the fix ships in version 1.18.1, which disables file-controlled KMS URLs by default.
Unbounded memory exhaustion in Xen's OCaml xenstore daemon (oxenstored) allows a malicious or compromised guest VM to trigger a system-wide denial of service by repeatedly sending xenbus reconnect requests without clearing the global watch trie. Each reconnect cycle purges only the per-domain hashtable, leaving stale watch entries to accumulate indefinitely in the global trie. All Xen deployments from 4.6 onwards using the OCaml oxenstored implementation are affected; no public exploit has been identified, but the attack surface is accessible to any guest with standard xenbus connectivity and no mitigations exist.
Missing authorization in the Apache Nutch Server (Nutch REST API) lets remote unauthenticated attackers read crawl data and interrupt or shut down running crawl jobs and their backing resources across Nutch 1.10 through 1.22. Because the REST API ships without access control, anyone able to reach the service can invoke management operations. No public exploit identified at time of analysis and EPSS is low (0.20%), but the fix is drastic: version 1.23 removes the Nutch Server component entirely.
JWT token forgery in yfexam-exam v2.0 exposes any authenticated session to impersonation because the signing secret is derived entirely from the username and the current calendar month - two low-entropy, often-public values - rather than a server-side cryptographic secret. An attacker who knows or can enumerate a target's username can deterministically compute the signing secret (only 12 possible month values) and mint forged tokens claiming arbitrary privileges without ever knowing the target's password. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.14% (4th percentile), but a public GitHub writeup by fangtang7 documents the technique, materially lowering the bar for any attacker who targets this application.
Unauthenticated account takeover in WWBN AVideo (through commit e01e41ecc) stems from get_api_preauthorize in plugin/API/API.php, a second, undocumented login path that performs the same credential check as get_api_signIn but omits the 10-attempts-per-5-minutes throttle enforced by checkRateLimit(). This lets remote attackers brute-force any account - including admin - without rate limiting, and the endpoint doubles as a credential oracle whose users_id field (1 vs 0) discloses password validity even though the message always reads 'Invalid credentials'. No public exploit identified at time of analysis, and no vendor-released patch is available.
Unauthenticated information disclosure in AVideo through 29.0 exposes private live-stream credentials - including stream keys and m3u8 playlist URLs - to any network-accessible attacker who queries the unprotected `plugin/Live/stats.json.php` endpoint. The `hidden_applications` array in the JSON response contains metadata for private, unlisted, and group-restricted live streams that the platform explicitly intends to conceal from unauthorized viewers. No public exploit has been identified at time of analysis, but the vulnerability is trivially reachable given its zero-precondition CVSS 4.0 profile (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.7).
Authenticated streamers on AVideo through version 29.0 can harvest source stream keys and identity information belonging to all other active streamers by querying the restreamsActive.json.php endpoint, which applies no per-user ownership filtering. The exposed stream keys are live transmission credentials that can be used to impersonate affected streamers on third-party platforms such as YouTube Live or Twitch, enabling broadcast hijacking or session disruption. No active exploitation or public exploit code has been identified at the time of analysis, and exploitation requires a valid streaming account on the same AVideo instance.
Timing side-channel in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0-v9.0.3) enables unauthenticated remote attackers to perform black-box reverse engineering of internal secret values - such as HMAC keys or API signing tokens - by measuring statistically distinguishable response-time differences across repeated crafted requests. The CWE-208 root cause is a non-constant-time comparison operation in the module's payment verification logic, which leaks information about secret material byte-by-byte through observable latency variations. No public exploit code or CISA KEV listing has been identified, but the network-exposed nature of the payment endpoint makes the attack surface broadly reachable for any operator of the affected module.
Unauthenticated credential disclosure in Netis NX10 routers (firmware V4.0.1.5808 and V3.0.0.4142) lets remote attackers retrieve the administrator password by sending a request to the 'sysinfo' action of the web management interface without any session. The exposed credential can then be replayed against the login handler to establish a fully authenticated administrator session, yielding complete device takeover. Publicly available exploit code exists (published by VulnCheck/hackwithmike), and the network-reachable, no-auth nature makes this straightforward to weaponize.
Race condition exploitation in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture Kernel Drivers allows any local non-privileged process to perform improper GPU memory operations, yielding kernel-level sensitive information disclosure or denial of service. All three driver families are affected across broad version ranges spanning multiple major release trains - Bifrost from r12p0, Valhall from r19p0, and 5th Gen from r41p0 - covering a large installed base of Mali GPU-equipped devices. No public exploit or active exploitation has been confirmed at time of analysis; the low EPSS score (0.11%, percentile 1%) reflects limited observed exploitation interest.
Sensitive kernel memory is exposed to local non-privileged user processes through improper GPU memory processing operations in Arm's Valhall GPU Kernel Driver and 5th Gen GPU Architecture Kernel Driver. The flaw spans a wide driver revision range - Valhall from r29p0 through r55p0 and 5th Gen from r41p0 through r55p0 - covering Mali-G series and Immortalis GPU generations deployed across hundreds of millions of Android and embedded devices. No public exploit code has been identified and EPSS sits at 0.14% (4th percentile), but the kernel-level confidentiality impact and the OEM-dependent patch delivery path make timely remediation structurally difficult.
Path traversal in Commvault CommServe allows unauthenticated remote attackers with sufficient complexity to read sensitive files outside intended directory boundaries, resulting in high-impact information disclosure. Affected versions span four active release trains of Commvault Cloud (11.36, 11.40, 11.44, 11.46), making this relevant across a broad enterprise backup customer base. No public exploit or active exploitation has been identified at time of analysis; vendor has released patched maintenance releases.
Unauthenticated remote access to Commvault Cloud's CommServe management server allows an attacker to bypass access authorization controls and disclose sensitive information. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) confirms fully network-exposed, zero-prerequisite exploitation against the CommServe component across four active version branches (11.36.x, 11.40.x, 11.44.x, 11.46.x). Commvault has released maintenance updates and no public exploit has been identified at time of analysis.
HTTP/1.1 request smuggling in Eclipse Jetty allows unauthenticated remote attackers to desynchronize request boundary parsing between Jetty and an upstream proxy, enabling manipulation of other users' HTTP sessions. The root cause is Jetty's acceptance of a bare LF character (\n) as a line terminator during chunked transfer encoding parsing - specifically in chunk extensions, chunk data termination, or trailer termination - where RFC 7230 mandates CRLF (\r\n). Depending on the Jetty version and configured HTTP compliance mode, a crafted request can cause the proxy and Jetty to disagree on where one request ends and the next begins, enabling request injection against co-located tenants. No public exploit has been identified at time of analysis.