Information Disclosure
Monthly
Local file enumeration in Keyfactor SignServer before 7.6.0 allows an authenticated administrator to confirm the existence and readability of arbitrary files on the application server by pointing configurable path properties at them and observing distinguishable error responses. The three affected properties are ATTRIBUTESFILE in PKCS11CryptoToken, KEYSTOREPATH in KeyStoreCryptoToken, and TRUSTSTOREPATH in RenewalWorker. No file contents are disclosed, exploitation requires a high-privileged admin account (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, base 2.3), and there is no public exploit identified at time of analysis; EPSS is 0.15% (5th percentile), consistent with a low-priority information-disclosure issue.
An issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set to any path, even one that points to a file that already exists. This gives a user (with admin access) the possibility to write files in arbitrary directories in the server filesystem and potentially overwrite files accessible by the local user JBoss.
An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accepted file (i.e., recognized with attributes). In this case, an error is thrown which - together with the error - also prints the content of the file to the application server log. This gives a user that has both SignServer admin access and access to read the output of the server log (i.e., if remote syslog shipping is configured), the possibility to read the content of files accessible by the local user JBoss.
Insufficient data exists to characterize this vulnerability. The only available intelligence is a CVE identifier, a two-word description ('security update'), and a single vendor attribution to Ubuntu. No affected product, component, version range, vulnerability class, impact, or attack vector has been disclosed in the provided data. No independent assessment of severity, exploitability, or remediation is possible from the available information.
Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.
In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.
SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve employee records belonging to other departments and users
DocsGPT through version 0.20.0 leaks OAuth connector session tokens and provider account emails to attacker-controlled windows via an insecure postMessage implementation. The callback-status endpoint broadcasts OAuth tokens using a wildcard target origin ('*') without validating the sender's origin, allowing any page acting as window.opener during the OAuth authorization flow to intercept the message payload. An attacker who tricks a victim into initiating an OAuth cloud storage connector flow from an attacker-controlled page can steal session tokens and subsequently disconnect the victim's cloud storage connectors. No public exploit has been identified at time of analysis; EPSS data not provided.
GrowthBook through version 5.0.1 leaks raw warehouse SQL queries, schema details, table names, filter values, and datasource identifiers via unauthenticated public report and experiment endpoints. Any party who obtains a publicly shared report or experiment identifier can retrieve these internal data warehouse details without authentication. No public exploit or active exploitation has been identified, but the exposed SQL and schema intelligence can directly inform subsequent attacks against the underlying data warehouse infrastructure.
ZITADEL 4.0.0 through 4.15.3 (and EOL 3.0.0 through 3.4.12) fails to fully revoke role assignments on Project Grants when an administrator deletes two or more project roles at the same time, letting affected users keep permissions that were supposed to be removed. The flaw is an off-by-one style error (CWE-193) in the cross-organization cascade cleanup that iterates a user's role list for User Grants on Granted Projects, so one or more deletions can be skipped and, if the retained role was administrative, the user may keep elevated rights inside that shared project. Publicly available exploit code exists (a public gist referencing the issue), but there is no CISA KEV listing; vendor patch 4.16.0 ships a database migration that automatically repairs residue left in the eventstore.
A buffer overflow in a PASE (Portable Application Solutions Environment) process on IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated local user to crash the affected process. Per IBM's own description, the impact is limited: the attacker can terminate their own process rather than disrupt other users or system-wide services, which is reflected in the low CVSS 3.3 and Availability-only impact. There is no public exploit code and no CISA KEV listing at time of analysis, and the flaw is classified as CWE-125 (out-of-bounds read).
A time-of-check to time-of-use (TOCTOU) race condition in IBM i releases 7.3, 7.4, 7.5, and 7.6 lets a local attacker win a race window during a privileged file-ownership operation and end up owning arbitrary file system objects on the system. Successful exploitation yields low-level confidentiality, integrity, and availability impact but crosses a security boundary (CVSS scope change), meaning objects outside the attacker's own authority can be reassigned. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the CVSS base score is 6.0.
Local information disclosure in Apple macOS allows a malicious application already running on the host to bypass permission validation and read restricted files. Affected versions are those prior to macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. No public exploit code has been identified, and EPSS is low (0.16%), but the flaw requires only local app execution with low privileges and no user interaction, yielding high confidentiality impact (CVSS 5.5).
An information-disclosure flaw in Apple's WebKit-based browser stack lets a malicious website infer which applications a user has installed across Safari, iOS/iPadOS, and macOS. Apple addressed it through improved state management in Safari 27, iOS 27 and iPadOS 27, and macOS Golden Gate 27, so any device still on an earlier release remains exposed. Exploitation requires the victim to visit the attacker's page (CVSS UI:R) and yields only low-confidentiality impact, with no public exploit code and no CISA KEV listing at time of analysis.
A race condition in Apple macOS kernel locking allows a local user with existing code execution on the host to read kernel memory, fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation requires local authenticated access and a high-complexity timing win in the kernel's locking path, so it is probabilistic rather than reliable, and the impact is limited to confidentiality (kernel memory disclosure) with no code execution, modification, or denial of service. There is no public exploit identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.19% (8th percentile), making this a genuine but low-priority issue.
A race condition in Apple macOS state management allows a locally executing application to read sensitive user data; the flaw is fixed in macOS Golden Gate 27, and all earlier macOS versions are affected. Exploitation requires an attacker-controlled or malicious app already running on the host (assessed as local, PR:L, not remote despite the vendor's AV:N/PR:N vector) and depends on winning a narrow timing window, which limits reliability. Impact is confidentiality-only - no integrity or availability effect - and no public exploit has been identified at time of analysis; EPSS is 0.14% (4th percentile), so opportunistic exploitation is unlikely, though the data-disclosure impact and Apple's ecosystem prominence keep patching worthwhile.
Local information disclosure in Apple iOS and iPadOS (and visionOS) before version 27 allows an app running on the device to read sensitive user data it should not be able to reach. Apple fixed the flaw through improved file handling in iOS 27, iPadOS 27 and visionOS 27. No public exploit code or active exploitation has been reported, and the EPSS score of 0.15% (5th percentile) plus SSVC 'exploitation: none' point to a low-volume, user-assisted local attack rather than a mass-exploited one.
A path validation weakness in Apple's iOS, iPadOS, and macOS allows a malicious application to reach files outside its intended sandbox and read user-sensitive data. Apple addressed the flaw with improved path validation in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8, so all older releases remain exposed until updated. Exploitation requires a locally installed app and some user interaction (CVSS AV:L/UI:R), exploit probability is currently very low (EPSS 0.20%, 10th percentile), and no public exploit code or CISA KEV entry has been identified at time of analysis.
A permissions-validation flaw (CWE-863) in Apple macOS versions prior to 27 (Golden Gate) and Xcode versions prior to 27 allows a locally installed app to reach user-sensitive data it should not be authorized to read. The issue is a local, confidentiality-only defect rated CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N): no privileges are needed, but the attack requires the victim to run the malicious application. Apple has released fixes in macOS 27 and Xcode 27; there is no CISA KEV listing, no public exploit code identified at time of analysis, and EPSS is very low at 0.16% (5th percentile), so real-world exploitation is unlikely to be widespread.
Apple fixed a kernel uninitialized-memory flaw (CWE-457) across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS in which a locally installed app can determine kernel memory layout, defeating address-space randomization. The impact is information disclosure only - high confidentiality, no integrity or availability impact - and exploitation requires a local app plus user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 5.5). Apple shipped patches on [dates not specified] for iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27; no public exploit code or active exploitation is indicated, and EPSS is low (0.21%, 11th percentile).
A race condition in Apple's kernel state handling lets a locally installed app corrupt kernel memory or trigger unexpected system termination across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple addressed the flaw in iOS 18.7.10 and 26.6, iPadOS 18.7.10 and 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, and tvOS/visionOS/watchOS 26.6, so exploitation is limited to unpatched devices running a malicious app plus user interaction. No public exploit code and no active exploitation are known; EPSS is 0.17% (6th percentile) and CVSS rates it 6.3, reflecting a local, high-complexity attack with no confidentiality impact.
A race condition in core Apple operating system components lets a locally installed app trigger an unexpected system termination on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Apple fixed the flaw through improved state handling in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Impact is availability-only (no data exposure or modification), exploitation requires a local malicious app and winning a timing window, EPSS is a low 0.21%, and no public exploit code or active exploitation has been identified at time of analysis.
Apple macOS contains an improper input validation flaw (CWE-20) that a remote attacker can leverage to crash affected system components, producing a denial-of-service condition on the host. Apple addressed the issue in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7, so all earlier builds of those release trains remain vulnerable. Exploitation requires the victim to interact with attacker-supplied content (CVSS UI:R), and there is no public exploit identified at time of analysis, though the CVSS 3.1 base score of 6.5 reflects a high availability impact with no confidentiality or integrity loss.
An out-of-bounds read in Apple's font parsing code lets a maliciously crafted font file leak process memory on unpatched builds of iOS, iPadOS, macOS, tvOS, visionOS and watchOS, with all affected platforms fixed in the version 27 releases. Triggering it requires the victim to render attacker-supplied content containing the crafted font — an email, document, web page or message preview — but no credentials or elevated privileges are needed once that interaction happens, and the resulting confidentiality impact is rated high with no integrity or availability effect. No public exploit code or active exploitation has been identified, and EPSS sits at a low 0.20% (10th percentile), so this is best handled as a scheduled platform update rather than an emergency response.
An out-of-bounds read in the font-parsing path of Apple's operating systems lets a remote attacker disclose the contents of process memory when a victim processes a maliciously crafted font. All Apple platforms are affected prior to the version 27 releases — iOS and iPadOS, macOS Golden Gate, tvOS, visionOS and watchOS — and Apple has shipped fixes for each. There is no CISA KEV listing and no public exploit code identified, and the EPSS score of 0.17% (7th percentile) indicates a low probability of near-term exploitation; because the sole impact is memory disclosure and exploitation requires the victim to open or render attacker-supplied content, this is a moderate-priority patch rather than an emergency.
Information disclosure in Apple's iOS, iPadOS, macOS, tvOS and watchOS platforms allows an app running on the device to reach sensitive user data that the operating system's data protection mechanisms were supposed to keep isolated from it. Apple resolved the issue with improved data protection in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27 and watchOS 27, with vendor advisories published across seven support pages. No public exploit code or active exploitation has been reported, EPSS is low at 0.20% (10th percentile), and the issue is not listed in CISA KEV, so this reads as a routine hardening fix rather than an urgent emergency-patch event.
A use-after-free memory-management flaw affects Apple's operating system family prior to the 26.6 releases — iOS and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6 and watchOS 26.6 — and allows a locally installed app to trigger unexpected system termination (a denial-of-service condition). The vulnerability is rated CVSS 5.5 with a local attack vector, low complexity and low privileges required, but no confidentiality or integrity impact; EPSS is only 0.19 percent and there is no CISA KEV listing and no publicly available exploit code identified at time of analysis. Apple has shipped fixes in all four platform advisories, so the practical risk is concentrated on unpatched devices rather than on active exploitation.
Connecting an Apple device to an attacker-controlled NFS server can cause the kernel NFS client to mishandle memory and return out-of-bounds kernel memory to the malicious server, an information-disclosure issue tracked as CVE-2026-43687. All shipping Apple platforms are affected — iOS/iPadOS before 26.7 and 27, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27 — while the fix is distributed across Apple's 26.7/27 update wave. Exploitation requires the victim to initiate a connection to the hostile server (UI:R), which keeps real-world risk moderate: EPSS is only 0.18% (7th percentile), CISA KEV does not list it, SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code was identified at time of analysis.
Local applications running on Apple macOS releases prior to Tahoe 26.6 can exploit a race condition in the validation path guarding protected user data, allowing an app to read data it should not be able to reach. The flaw is mitigated in macOS Tahoe 26.6 per Apple's advisory, and the attack is timing-dependent and local-only (CVSS 4.7, AV:L/AC:H/PR:L), which keeps practical risk moderate. EPSS is very low at 0.14% (4th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis.
A race condition in Apple's state-handling code allows a locally installed app to crash the system or cause unexpected termination of system processes on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. The flaw carries a CVSS 3.1 score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) — availability-only impact, local attack vector, high complexity — and is fixed in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and tvOS, visionOS and watchOS 27. Neither public exploit code nor CISA KEV activity has been recorded, and EPSS puts exploitation probability at roughly 0.2% (10th percentile), so this is a patching-hygiene item rather than an emergency.
Kernel memory disclosure in Apple's client operating systems - iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.8 and macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6 - allows a locally installed, low-privilege application to read portions of kernel memory that should have been redacted, leaking sensitive data from kernel address space. The flaw is rated CVSS 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and is bounded to confidentiality loss with no integrity or availability impact and no arbitrary kernel read. There is no public exploit identified at time of analysis, EPSS is only 0.20% (10th percentile), and the issue is not in CISA KEV; Apple has released fixes across all affected platforms. Because the attacker must already have a malicious or compromised app installed and running on the device, this is best treated as a low-priority information-disclosure building block rather than a standalone compromise path.
Information disclosure in Apple iOS and iPadOS (versions before 26.7 and before 27) lets a locally installed app determine which other apps the user has installed, exposing a device-fingerprinting and privacy surface rather than files, credentials, or user data. The root cause is a state-management defect (CWE-200) that Apple fixed in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires the victim to install and run a malicious sandboxed app on the target device (CVSS AV:L, PR:L), so there is no remote or unauthenticated path; no public exploit code has been identified at time of analysis, and EPSS is 0.17% (7th percentile), consistent with a low-severity, low-priority finding.
Processing a maliciously crafted file on Apple macOS versions below Golden Gate 27 can crash the affected component, causing a denial-of-service, and may potentially leak partial memory contents. The bug is an integer overflow (CWE-190) corrected through improved input validation, and exploitation requires a local victim to actually open or handle the attacker-supplied file, so both a local attack vector and user interaction are prerequisites. Severity is assessed as moderate (assessed CVSS 6.6-level, availability-high with limited-confidentiality impact); EPSS is low at 0.17% (7th percentile), CISA SSVC records no exploitation, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
A malicious application running on Apple macOS (versions prior to 27) or watchOS (versions prior to 27) can leak sensitive user information because the operating system fails to properly manage internal state. Apple addressed the flaw in macOS Golden Gate 27 and watchOS 27, so all earlier releases on both platforms remain exposed. The issue is rated CVSS 5.5 (local vector, low privileges, high confidentiality impact), EPSS is only 0.16% (5th percentile), and there is no public exploit code identified at time of analysis.
An out-of-bounds read in Apple's kernel, fixed across iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27, allows a locally installed application to disclose kernel memory to user space. The flaw (CWE-125) stems from insufficient input validation in a kernel code path reached by app-supplied data, and yields high confidentiality impact only - no integrity or availability loss. Apple has released patches for all affected platforms; EPSS is very low (0.15%, 5th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
Improper certificate validation in Apple macOS allows an attacker positioned on the network path between the victim and a remote endpoint to intercept and potentially modify traffic that should have been protected by TLS. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate versions before 27, and is rated CVSS 4.8 (network vector but high attack complexity), with an EPSS score of only 0.12% (2nd percentile) and no public exploit or CISA KEV listing at time of analysis. Apple addressed the issue with improved certificate validation in the three corresponding releases, so the primary defense is straightforward patching; no public exploit code has been identified.
Opening a maliciously crafted file on an unpatched Apple device can crash the parsing process or disclose its memory contents, an out-of-bounds read that Apple addressed with improved input validation and fixed in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L), exploitation is unauthenticated from the network but hinges entirely on user interaction - the victim must open the crafted file - and impact is confined to the vulnerable process as a limited read-only disclosure or denial of service, with no code execution or data modification. EPSS is 0.18% (7th percentile), no public exploit has been identified at time of analysis, and vendor patches are already available, making this a low-priority issue despite the network attack vector.
Local applications on unpatched macOS can read sensitive user data from insufficiently redacted log files, affecting versions prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. Exploitation requires a malicious or compromised app already running with standard user privileges (AV:L/PR:L), yields confidentiality-only impact, and has no public exploit identified at time of analysis; EPSS is 0.17% (6th percentile). This is a genuinely low-priority, defensible-but-not-urgent issue per the independent assessment.
Processing a maliciously crafted image on unpatched Apple platforms can leak uninitialized process memory, exposing small, non-deterministic fragments of data that happened to be in memory at decode time. Affected are iOS and iPadOS before 26.7 and before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, plus tvOS, visionOS, and watchOS before 27; the CVSS vector (AV:N/AC:L/PR:N/UI:R) means no credentials or special configuration are needed but the victim must open, preview, or otherwise trigger decoding of the attacker-supplied image. Impact is limited to confidentiality (C:L) with no integrity or availability effect, EPSS is a low 0.18% (8th percentile), and no public exploit has been identified at time of analysis; Apple has shipped fixed versions for every affected platform, so the practical priority is routine patch cadence rather than emergency response.
A memory-safety defect (out-of-bounds read, CWE-125) in Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS can be triggered by a locally running application and causes an unexpected system termination - a denial-of-service/availability impact with no confidentiality or integrity loss. Affected versions are those prior to the fixed releases: iOS/iPadOS before 26.7 (and before 27), macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27, plus tvOS, visionOS, and watchOS before 27. Exploitation requires the attacker to already have a malicious app running on the device with its own app-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, scored 5.5); no public exploit code has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and there is no CISA KEV entry. Apple has released patched versions, so the practical exposure is limited to unpatched devices running a hostile app - a low-to-moderate priority issue.
Unexpected system termination in Apple macOS is caused by an out-of-bounds read in the SMB client that is triggered when a user initiates a connection to a malicious or spoofed SMB server. The affected versions are macOS releases before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27; the issue is not in CISA KEV, no public exploit code has been identified at time of analysis, and EPSS is a low 0.17% (6th percentile). An attacker who controls or spoofs the SMB endpoint the victim reaches can force a crash, with no privilege escalation, code execution, or data disclosure assessed.
A privacy flaw in Apple operating systems lets a malicious application already running on the device determine the user's current location, because location data was not properly redacted from log entries (CWE-532). The issue is local-only: the CVSS vector (AV:L, PR:L, UI:N, C:H/I:N/A:N) means an attacker must first get a malicious app installed and executing on the target device, after which no further user interaction is needed, and the impact is confined to confidentiality - the user's location is disclosed with no integrity or availability effect. Apple has fixed the flaw in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27; there is no public exploit identified at time of analysis, EPSS is very low (0.21%, 11th percentile), and the practical barrier is Apple's app-distribution controls rather than any remote attack path.
Kernel memory corruption in Apple's operating systems lets an app running on the device crash the system or corrupt kernel memory, with the independent assessment scoring integrity and availability impact as High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). Every unpatched device is exposed once a user launches a malicious or compromised app: no network vector, no user interaction beyond app execution, and no special configuration is required. There is no confirmed active exploitation (CISA KEV does not list this CVE) and no public exploit code identified at time of analysis, and EPSS is low at 0.21% (11th percentile), so real-world urgency is modest even though the flaw sits in the kernel. Apple has shipped fixed builds across all affected platforms: iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
Local apps on iOS, iPadOS, and visionOS can bypass certain Privacy preference controls and reach sensitive data they were never authorized to see; Apple addressed it by removing sensitive data from the reachable location. Affected are iOS and iPadOS before 26.7 and before 27, plus visionOS before 27, with fixes shipped in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, and visionOS 27. Exploitation is local-only and requires a malicious or overprivileged app to already be installed and running on the device (CVSS 3.3, AV:L/PR:L/UI:N, low confidentiality impact); there is no public exploit identified at time of analysis and EPSS is negligible at 0.17% (7th percentile).
Kernel memory disclosure on unpatched Apple devices allows a locally running, low-privilege app to read kernel memory that it should not be able to access, potentially exposing sensitive kernel-side data. The issue - an information-disclosure weakness (CWE-200) caused by improper memory management - affects iOS and iPadOS before 26.7 and before 27, macOS Tahoe before 26.7 and macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27, and is fixed in the corresponding 26.7/27 releases. Exploitation requires the attacker to already be executing code inside a sandboxed app on the target device (CVSS 3.1 3.3, AV:L/AC:L/PR:L/UI:N, confidentiality-only impact), so overall risk is low; no public exploit identified at time of analysis, with an EPSS score of roughly 0.2% (10th percentile) and no CISA KEV listing.
A use-after-free in macOS memory management allows a locally running application to crash the operating system, resulting in unexpected termination and loss of unsaved work. The flaw affects macOS Tahoe before 26.6, macOS Sequoia before 15.7.8, and macOS Sonoma before 14.8.8, with exploitation requiring only low privileges (CVSS PR:L) and no additional user interaction. Apple has released fixes (patch available per vendor advisories), and although EPSS is very low at 0.19% (9th percentile) with no CISA KEV listing, no public exploit code identified at time of analysis, the flaw is a memory-safety bug that carries inherent risk of escalation beyond a simple denial of service.
Uninitialized kernel memory disclosure in Apple's operating system family allows a local app that already holds root privileges to read residual data left in kernel memory buffers, an information-leak primitive that exposes potentially sensitive kernel memory contents. The flaw is fixed across iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, so affected users should update promptly. No public exploit code has been identified at time of analysis, and EPSS places the probability of exploitation at roughly 0.17% (7th percentile), consistent with the assessment that the mandatory root prerequisite - the attacker must already be running code at the highest local privilege level - makes this a post-compromise leak rather than an initial-access or privilege-escalation primitive, and a genuinely low real-world priority despite the 6.2 Medium base score.
Apple macOS devices running versions below Sonoma 14.8.8 can retain a silently persisted Apple Account after the device is erased, because the erase/factory-reset workflow fails to fully clear that state. Exploitation requires physical possession of the Mac and interaction with the wipe process itself - no credentials or user interaction are needed once the hardware is in hand (CVSS:3.1/AV:P/AC:L/PR:N/UI:N), which confines realistic risk to lost, stolen, resold, or refurbished hardware rather than remote attack. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.17% (7th percentile), and this is a moderate, physically-gated issue that does not warrant emergency prioritization.
Conditionally exploitable information disclosure affects Apple macOS versions below Sequoia 15.8, Tahoe 26.7, and Golden Gate 27, where an attacker who already occupies a privileged network position - such as a rogue or compromised Wi-Fi access point, a controlled router or proxy, or a host performing ARP/DNS spoofing - can leak sensitive user information. The issue is rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), is confidentiality-only with no integrity or availability impact, requires no authentication and no user interaction, and is gated by the AC:H precondition that the attacker can actively intercept traffic. Apple fixed it in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code has been identified at time of analysis, EPSS is 0.19% (9th percentile), and this is a moderate-severity, conditionally exploitable flaw rather than a top-tier priority.
Locally installed apps on unpatched Apple platforms (iOS and iPadOS before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27) can read sensitive user data that the system wrote into logs without adequate redaction. Apple fixed the flaw by improving data redaction in the release train listed in its security advisories. Impact is confidentiality-only and strictly local, with no network attack path, and a low EPSS of 0.18% (7th percentile) reflects that; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. One prerequisite discrepancy is worth noting: the published vector requires user interaction (UI:R), while our assessed vector treats the app as already installed and running without interaction.
Mounting a maliciously crafted exFAT volume on an unpatched macOS system (versions before Golden Gate 27) can trigger an out-of-bounds read in the kernel, leading to kernel memory disclosure or unexpected system termination. Exploitation requires user interaction to mount the attacker-supplied volume, and no public exploit code or active exploitation has been identified at time of analysis (EPSS 0.16%).
iCloud Private Relay on Apple platforms could disclose a user's real IP address to a website even while the privacy proxy is active, because of a state-management flaw in the relay implementation. The issue affects iOS and iPadOS before 18.7.10 and before 26.6.1, macOS Tahoe before 26.6.2, and visionOS before 26.6.1, and requires the victim to browse to attacker-controlled web content (UI:R, no privileges needed). Severity is modest (CVSS 4.3, confidentiality-only) and there is no CISA KEV listing or public exploit identified at time of analysis, but the privacy impact is disproportionate for users who depend on Private Relay for anonymity.
An integer underflow in the macOS SMB client allows a malicious SMB server to crash the operating system, resulting in a denial of service, when a user connects to a shared folder or mount. The flaw affects macOS releases prior to Golden Gate 27, Sequoia 15.8 and Tahoe 26.7, and is fixed in those versions. Exploitation requires the victim to initiate a connection to an attacker-controlled SMB endpoint (CVSS UI:R), there is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is very low at 0.19% (9th percentile), so real-world exploitation pressure is currently minimal.
An information disclosure flaw in Apple's iCloud Private Relay lets a website determine a visitor's real IP address even when Private Relay is switched on, defeating the core privacy guarantee of the feature. The issue affects iOS and iPadOS before 26.6.1, macOS before 26.6.2 (Tahoe), and visionOS before 26.6.1, and is reachable from the network but requires the victim to browse to an attacker-controlled page. Apple addressed it through improved state management, and no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in Apple iOS and iPadOS versions before 27 allows a locally installed malicious or compromised app to access sensitive user data after the user installs and opens it. The flaw is a permissions issue (CWE-200) that Apple addressed with additional restrictions in iOS 27 and iPadOS 27. No public exploit identified at time of analysis and EPSS is 0.17% (7th percentile), but the CVSS score of 5.5 reflects the high confidentiality impact; exploitation requires local app execution and user interaction, with no remote path.
Sensitive user data can be read by a malicious or compromised app on unpatched Apple devices because a logic-validation flaw lets the app cross its data-access boundary. Affected platforms are iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7 and before Golden Gate 27, tvOS before 27, and visionOS before 27; the assessed vector (AV:L/AC:L/PR:N/UI:R/C:H/I:N/A:N) shows the attacker must first get a hostile app onto the device and the user must run it, with confidentiality-only impact. Vendor patches are available for every platform, EPSS rates exploitation probability at roughly 0.18% (7th percentile), and no public exploit has been identified at time of analysis.
A use-after-free (CWE-416) in the Apple macOS SMB client allows a maliciously crafted SMB network share to crash the operating system, causing system termination. Exploitation requires the user to mount the attacker-controlled share (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5), so impact is limited to denial of service with no confidentiality or integrity loss. Apple has released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7; there is no CISA KEV listing and no public exploit code identified, and EPSS is low at 0.17% (6th percentile).
Improper access control in Apple iOS and iPadOS, macOS Tahoe, and visionOS lets a locally installed app read user-sensitive data that it should not be able to reach. The flaw (CWE-284) stems from insufficient validation checks and is remediated in iOS/iPadOS 26.6, macOS Tahoe 26.6, and visionOS 26.6; the assessed vector (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) means exploitation requires the victim to install and launch a malicious app on an unpatched build, with no remote attack path and no integrity or availability impact. The attacker's app needs no special privileges, but there is no public exploit identified at time of analysis and EPSS is low at 0.19% (9th percentile), so this is a genuine but low-priority confidentiality issue.
Improper access control (CWE-284) in Apple iOS, iPadOS, and macOS allows a locally installed app to read user-sensitive data outside the permission boundary the operating system is supposed to enforce, an information-disclosure impact rated CVSS 5.5 (confidentiality High, integrity None, availability None). Exploitation is local and requires user interaction: the attacker must first get a malicious or compromised app onto the device and convince the user to launch it (AV:L, PR:N, UI:R), so there is no remote, network-triggerable, or self-propagating path. Apple has released fixes in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code has been identified at time of analysis and EPSS is low at 0.17 percent (7th percentile), with no CISA KEV listing.
Information disclosure in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS allows a locally installed and running app to read a persistent account identifier that the operating system should have kept out of its reach. The root cause is a permissions/sandbox restriction gap (CWE-200), fixed by Apple with additional access restrictions in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; successful exploitation requires the user to install and launch a malicious local app (AV:L/PR:N/UI:R), so a remote, unauthenticated network attack is not possible. There is no public exploit identified at time of analysis and EPSS is 0.18% (8th percentile), making this low-to-moderate risk rather than an urgent priority, with impact confined to the confidentiality of one identifier and no integrity or availability effect.
An out-of-bounds read in Apple's macOS SMB client allows a malicious SMB server to leak kernel memory to an attacker when a user connects to a shared folder, fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Exploitation requires the victim to initiate a connection to an attacker-controlled or compromised SMB share (CVSS UI:R), so it is user-interaction dependent rather than wormable, and the raw impact is confidentiality only — kernel memory disclosure, not code execution. EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit code has been identified; SSVC rates exploitation as 'none', automatable as 'no', and technical impact as 'partial'.
Local information disclosure in Apple macOS lets a malicious or compromised application read sensitive user data on hosts running versions earlier than macOS Sequoia 15.8, macOS Tahoe 26.7 or macOS Golden Gate 27. Apple fixed the issue with improved checks in three separate security advisories covering each release train. Exploitation requires the attacker to get an app running on the target Mac with user-level privileges; no public exploit code has been identified at time of analysis and EPSS is 0.17% (6th percentile), so this is a low-volume, targeted local threat rather than a mass-exploitation event.
Missing origin validation in IBM Verify Identity Access and Security Verify Access (including their container editions) lets an unauthenticated, remote attacker ride an authenticated user's live session and carry out operations as that victim, potentially enabling follow-on attacks against the deployment. Exploitation requires the victim - a logged-in Verify Identity Access / Security Verify Access user - to be lured into visiting attacker-controlled web content while their session is active (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, 5.4), so confidentiality and integrity impact is limited to the victim's own privilege scope with no availability loss. No public exploit code has been identified and the flaw is not confirmed actively exploited (CISA KEV); EPSS is 0.15% (4th percentile), and vendor-released fixes are available per IBM's advisory, making this a moderate-severity, likely low-priority issue in real-world terms.
Out-of-bounds read in FFmpeg's convolution video filter (libavfilter/vf_convolution.c, function setup_3x3) affects releases 4.4.0–4.4.6, 5.1.0–5.1.8, 6.1.0–6.1.4, 7.1.0–7.1.3 and 8.0.0–8.0.1, allowing crafted media input to read past allocated buffers and potentially disclose memory or crash the process. Publicly available exploit code exists via the FFmpeg issue tracker, and the fix commit (8970658472d1 / e24b9820b4) has been published, with corrected releases 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0. Impact is limited: CVSS 2.1, and exploitation requires the non-default convolution filter to be applied to attacker-influenced input, so this is a low-severity hardening issue rather than an urgent patch-now event.
Improper validation of the WebSocket origin in IBM i 7.3, 7.4, 7.5, and 7.6 allows a remote attacker to read limited sensitive information by luring a logged-in user into a cross-origin WebSocket connection. The vulnerability requires user interaction (the victim must visit an attacker-controlled page) and yields only low confidentiality impact, giving a CVSS 3.1 base score of 4.3. There is no public exploit identified at time of analysis and CISA SSVC reports no active exploitation, so this is a low-urgency information-disclosure defect rather than an emergency patch item.
Incorrect privilege assignment in the checkShellCommand permission check (src/capabilities/permissions.ts) of cosmicstack-labs mercury-agent through 1.2.0 lets a low-privileged remote caller obtain shell-command capabilities it should not have. Publicly available exploit code exists, and the maintainers have not responded to the issue report, so no fixed release is confirmed. Impact is limited to low confidentiality exposure per the CVSS 4.0 vector (VC:L, VI:N, VA:N), making this a modest-severity exposure rather than a full compromise.
Mercury Agent versions through 1.1.13 gate shell execution by validating commands before canonicalizing them, so a caller with low privileges can craft input that passes the raw-string permission check yet resolves to a protected target, disclosing restricted data over the network. The flaw is a validate-before-canonicalize ordering error (CWE-180) in checkShellCommand within src/capabilities/permissions.ts, and publicly available exploit code exists via the project's own issue tracker. The project was notified early but has not responded, so no vendor fix is available, and the CVSS 4.0 base score of 2.1 reflects only a limited confidentiality impact.
A local information-disclosure weakness in cosmicstack-labs mercury-agent through version 1.2.0 lets a low-privileged local user manipulate the Shell Permission Manifest so that PermissionManager.checkShellCommand in mercury-agent/src/capabilities/permissions.ts mis-evaluates which shell commands are permitted. Successful abuse exposes sensitive data readable through the agent's shell capability, though integrity and availability are unaffected. Public exploit code exists (linked issue report) and the vendor has not yet responded, but exploitation is limited to hosts already running the agent and requires local access, giving a very low CVSS 4.0 base score of 1.9.
A race condition in the IBM i WebSocket handshake process allows a remote authenticated attacker to obtain sensitive information on IBM i 7.6, 7.5, 7.4, and 7.3. The flaw requires valid credentials and a precisely timed concurrent request pattern (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.2), so it is a low-severity, non-automatable issue rather than a mass-exploitation candidate. CISA's SSVC assessment rates exploitation as 'none' with no automatable path, and no public exploit code has been identified at time of analysis; IBM has published a vendor patch.
Link-following (symlink) handling in NanoClaw's agent-to-agent attachment forwarding lets an authenticated, low-privileged user cause the service to read or modify files outside the intended attachment directory. The flaw is in forwardAttachedFiles() in src/modules/agent-to-agent/agent-route.ts and affects every NanoClaw release from 2.1.0 through 2.1.17; the attack is network-reachable and requires no user interaction. Public exploit code exists and the vendor fix is identified as commit 3f9ed607b7e7a4872747295f75286f1c377d7c33, but real-world risk is currently low (CVSS 4.0 base 2.1, EPSS 0.29%, no CISA KEV listing).
Local unprivileged users on hosts running the System Security Services Daemon (SSSD) can crash or destabilize the NSS responder by sending a crafted zero-length request to its socket, degrading name-service lookups for every process on the machine. The defect is an integer underflow (CWE-191) in the responder's request parsing, and it is scored CVSS 4.0 because only availability is impacted and the attack requires local access to the host. There is no evidence of active exploitation or public exploit code at the time of analysis, and no vendor-listed fix version is available in the supplied intelligence.
An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).
Cross-tenant sender alias disclosure in Froxlor before 2.3.7 allows any authenticated customer to enumerate and read other customers' allowed sender alias values via an IDOR flaw in the delete-confirmation flow of `customer_email.php`. The query fetching `allowed_sender` uses only the global auto-increment `senderid` parameter without scoping it to the requesting customer, making all sender alias records on the instance accessible to any authenticated tenant. Publicly available exploit code exists, verified against Froxlor 2.3.6 with `mail.enable_allow_sender` enabled; no active exploitation has been identified.
Apache Syncope, the Apache open-source identity governance and administration (IGA) platform, writes audit events to its configured audit store without adequately masking sensitive values carried in event payloads, so an operator with administrative access to that store can read credentials and other secrets that should have been redacted. All releases from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 are affected. The vulnerability is rated 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/C:H/I:N/A:N), is not listed in CISA KEV, and no public exploit code has been identified at time of analysis.
Sensitive information exposure in Apache Syncope allows a privileged administrator with Derived Schema entitlements to craft a malicious JEXL (Java Expression Language) expression that, when evaluated during User read operations, leaks LinkedAccount or Manager sensitive data - including hashed credentials - to any admin with User read access. Affected versions span three release lines: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No public exploit code has been identified and CISA has not listed this in KEV; exploitation requires high-privilege access, limiting real-world risk to insider threats or compromised admin accounts.
The YAMAP - Social Trekking GPS App for Android exposes users to information leakage and unauthorized redirects through an improperly controlled WebView (in-app browser) implementation. The vulnerability stems from insufficient access control over which URLs or communication sources the WebView will process, allowing a crafted link or external input to steer the browser toward attacker-controlled content or harvest app-internal data. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at the time of analysis, but user interaction is required, making social engineering the realistic attack vector.
Plaintext credential storage in CONTEC's CONPROSYS nano Series industrial remote I/O devices exposes passwords to attackers with physical device access. Affecting multiple coupler unit models (server-type, EtherNet/IP adapter, and software PLC variants), the flaw means credentials are recoverable without decryption from device storage. No public exploit code or active exploitation has been identified; the physical access prerequisite and high attack complexity substantially limit real-world risk.
Directory listing exposure in CONTEC CONPROSYS PAC Series enables unauthenticated network attackers to enumerate internal directory structures by requesting a specific URL on the device's embedded web server. Affected models include the Integrated Type CPS-PC341 and Configurable Type CPS-PCS341, both deployed in industrial automation environments. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; impact is limited to information disclosure that could assist subsequent reconnaissance against the device.
Directory listing exposure in Contec's CONPROSYS M2M Gateway and M2M Controller Series allows a remote attacker to enumerate server-side directory structures by accessing a specific URL on the device's web interface. The affected hardware includes both integrated and configurable variants of the CPS-MG341, CPS-MGS341, CPS-MC341, and CPS-MCS341 product lines. Exposed directory listings reveal file and path structures that can facilitate reconnaissance for follow-on attacks against these industrial gateway devices. No public exploit or active exploitation has been identified at time of analysis.
Database field disclosure in four Regular Labs Joomla extensions - Advanced Module Manager, Conditional Content, Content Templater, and ReReplacer - allows an authenticated high-privilege user to read arbitrary database fields outside the intended scope. The Conditions editor feature accepts user-supplied database table and column names from the HTTP request, which are quoted as SQL identifiers (preventing SQL injection) but are not restricted to the tables and columns supported by Regular Labs integrations. An attacker with administrative access can therefore query unrelated database fields, potentially exposing sensitive Joomla database content such as user records or configuration values. No public exploit code or active exploitation is identified at time of analysis.
Improper SSH host key validation in andreashappe/cochise through version 0.4.1 allows a network-positioned attacker to perform Man-in-the-Middle attacks against SSH sessions established by the tool. The vulnerable component is the `asyncssh.connect()` call in `src/cochise/ssh_connection.py`, where the SSH Host Key Handler fails to verify server host keys, enabling silent impersonation of target SSH hosts. A public proof-of-concept exists as GitHub issue #13; no vendor patch has been released and the maintainer had not responded to the disclosure at time of reporting.
Untrusted pointer dereference in the camera driver of Samsung Exynos 1580 and 2500 mobile processors allows a local low-privileged attacker to cause denial of service or leak limited kernel information across security boundaries by sending a malformed message to the driver. The scope-changed CVSS vector (S:C) indicates impact extends beyond the immediate process context into privileged system components. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read in the Wi-Fi driver subsystem of Samsung Exynos mobile processors allows a local low-privileged attacker to leak kernel memory by sending a malformed Netlink command, potentially exposing sensitive in-kernel data. Affected processors span Samsung's mid-range and flagship mobile lineup plus wearable chips: Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930. No public exploit has been identified at time of analysis, and Samsung has published a product security advisory addressing the issue.
SMTP evasion via incomplete state reset in an Ubuntu-reported component allows an attacker to bypass protocol-level security controls by exploiting improper state machine cleanup between SMTP sessions or command sequences. The vulnerability enables crafted SMTP interactions to carry over state from a prior transaction into a new one, potentially allowing filter evasion, spoofed sender identity acceptance, or bypass of per-message security checks. No CVSS score, CWE, or patch version is currently assigned in NVD, and data is extremely sparse - the analysis below reflects significant inference from the vulnerability class.
IPv4/IPv6 hash collision in Suricata's IPPair tracking mechanism causes the engine to reuse state belonging to the wrong IP pair, leading to incorrect stateful evaluation of network traffic. The vulnerability affects deployments where both IPv4 and IPv6 traffic is processed and IPPair-based rules or datasets are active. An attacker who can craft traffic that induces a hash collision may cause Suricata to apply the wrong connection state, potentially bypassing detection rules that depend on per-pair tracking. No public exploit or CISA KEV listing has been identified at time of analysis.
Samsung Exynos camera driver firmware on eight mobile processor variants leaks sensitive information through debug instrumentation that was not removed from production builds (CWE-215). The flaw affects Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680 SoCs - processors found in Samsung Galaxy smartphones and tablets - allowing a local low-privileged attacker to read sensitive data that crosses the kernel-to-userspace security boundary. No public exploit code exists and the vendor-assigned CVSS score of 2.8 (Low) accurately reflects the narrow, local-only attack surface and limited confidentiality impact.
Out-of-bounds memory access in Samsung's CustOS Driver on Exynos 1580 processors exposes a local low-privileged attacker to cross-TEE-boundary memory read and write primitives. The fault is triggered by submitting an oversized shared memory allocation request to the custos_iwc inter-world communication device, which the driver services without adequate bounds validation, potentially leaking secure-world data or corrupting CustOS runtime state. No public exploit code has been identified and CISA has not listed this in KEV at time of analysis.
The Storm UI topology REST endpoint (`GET /api/v1/topology/{id}`) in Apache Storm 3.0.0 returned a merged Nimbus daemon and topology configuration without credential redaction, exposing ZooKeeper authentication payloads and TLS keystore/truststore passwords to any principal holding topology read-only access. This privilege gap is significant because the dedicated `getNimbusConf` API already redacted these secrets and required elevated `nimbus.users` membership, yet the topology page - which merges in strictly more daemon state - was unprotected. No public exploit is identified at time of analysis, but exploitation requires only a single authenticated HTTP GET call, making the effective complexity trivially low for any principal with read-only cluster access.
Two authorization and redaction failures in Apache Storm 3.0.0 expose credential-bearing cluster configuration to under-privileged or entirely ungated callers. The Nimbus `getNimbusConf` Thrift API serves the full daemon configuration-including ZooKeeper authentication payloads and TLS keystore and truststore passwords-after only a user-level authorization check, silently omitting the credential masking applied everywhere else in the product. The Storm UI REST endpoint `/api/v1/cluster/configuration` is worse: the missing `@AuthNimbusOp` annotation causes the authorization filter to treat the endpoint as ungated, proxying requests under the UI daemon's own principal so that any caller passing `ui.filter` receives the full unredacted configuration regardless of their privilege level. No public exploit has been identified and this CVE is not in CISA KEV.
Unauthenticated password reset in jaychouchannel's Tourism-Management-System allows any remote attacker to overwrite an arbitrary user's credentials by supplying only a known username to the resetPass endpoint - no current password, token, or session is required. All three Java Spring controllers (UsersController, DaoyouController, YonghuController) share the vulnerable pattern, enabling forced account lockout or, if the API response includes the newly generated random password, full account takeover. Publicly disclosed exploit code exists and the upstream fix is available via commit 9cb6215.
Local file enumeration in Keyfactor SignServer before 7.6.0 allows an authenticated administrator to confirm the existence and readability of arbitrary files on the application server by pointing configurable path properties at them and observing distinguishable error responses. The three affected properties are ATTRIBUTESFILE in PKCS11CryptoToken, KEYSTOREPATH in KeyStoreCryptoToken, and TRUSTSTOREPATH in RenewalWorker. No file contents are disclosed, exploitation requires a high-privileged admin account (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, base 2.3), and there is no public exploit identified at time of analysis; EPSS is 0.15% (5th percentile), consistent with a low-priority information-disclosure issue.
An issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set to any path, even one that points to a file that already exists. This gives a user (with admin access) the possibility to write files in arbitrary directories in the server filesystem and potentially overwrite files accessible by the local user JBoss.
An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accepted file (i.e., recognized with attributes). In this case, an error is thrown which - together with the error - also prints the content of the file to the application server log. This gives a user that has both SignServer admin access and access to read the output of the server log (i.e., if remote syslog shipping is configured), the possibility to read the content of files accessible by the local user JBoss.
Insufficient data exists to characterize this vulnerability. The only available intelligence is a CVE identifier, a two-word description ('security update'), and a single vendor attribution to Ubuntu. No affected product, component, version range, vulnerability class, impact, or attack vector has been disclosed in the provided data. No independent assessment of severity, exploitability, or remediation is possible from the available information.
Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.
In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.
SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve employee records belonging to other departments and users
DocsGPT through version 0.20.0 leaks OAuth connector session tokens and provider account emails to attacker-controlled windows via an insecure postMessage implementation. The callback-status endpoint broadcasts OAuth tokens using a wildcard target origin ('*') without validating the sender's origin, allowing any page acting as window.opener during the OAuth authorization flow to intercept the message payload. An attacker who tricks a victim into initiating an OAuth cloud storage connector flow from an attacker-controlled page can steal session tokens and subsequently disconnect the victim's cloud storage connectors. No public exploit has been identified at time of analysis; EPSS data not provided.
GrowthBook through version 5.0.1 leaks raw warehouse SQL queries, schema details, table names, filter values, and datasource identifiers via unauthenticated public report and experiment endpoints. Any party who obtains a publicly shared report or experiment identifier can retrieve these internal data warehouse details without authentication. No public exploit or active exploitation has been identified, but the exposed SQL and schema intelligence can directly inform subsequent attacks against the underlying data warehouse infrastructure.
ZITADEL 4.0.0 through 4.15.3 (and EOL 3.0.0 through 3.4.12) fails to fully revoke role assignments on Project Grants when an administrator deletes two or more project roles at the same time, letting affected users keep permissions that were supposed to be removed. The flaw is an off-by-one style error (CWE-193) in the cross-organization cascade cleanup that iterates a user's role list for User Grants on Granted Projects, so one or more deletions can be skipped and, if the retained role was administrative, the user may keep elevated rights inside that shared project. Publicly available exploit code exists (a public gist referencing the issue), but there is no CISA KEV listing; vendor patch 4.16.0 ships a database migration that automatically repairs residue left in the eventstore.
A buffer overflow in a PASE (Portable Application Solutions Environment) process on IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated local user to crash the affected process. Per IBM's own description, the impact is limited: the attacker can terminate their own process rather than disrupt other users or system-wide services, which is reflected in the low CVSS 3.3 and Availability-only impact. There is no public exploit code and no CISA KEV listing at time of analysis, and the flaw is classified as CWE-125 (out-of-bounds read).
A time-of-check to time-of-use (TOCTOU) race condition in IBM i releases 7.3, 7.4, 7.5, and 7.6 lets a local attacker win a race window during a privileged file-ownership operation and end up owning arbitrary file system objects on the system. Successful exploitation yields low-level confidentiality, integrity, and availability impact but crosses a security boundary (CVSS scope change), meaning objects outside the attacker's own authority can be reassigned. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the CVSS base score is 6.0.
Local information disclosure in Apple macOS allows a malicious application already running on the host to bypass permission validation and read restricted files. Affected versions are those prior to macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. No public exploit code has been identified, and EPSS is low (0.16%), but the flaw requires only local app execution with low privileges and no user interaction, yielding high confidentiality impact (CVSS 5.5).
An information-disclosure flaw in Apple's WebKit-based browser stack lets a malicious website infer which applications a user has installed across Safari, iOS/iPadOS, and macOS. Apple addressed it through improved state management in Safari 27, iOS 27 and iPadOS 27, and macOS Golden Gate 27, so any device still on an earlier release remains exposed. Exploitation requires the victim to visit the attacker's page (CVSS UI:R) and yields only low-confidentiality impact, with no public exploit code and no CISA KEV listing at time of analysis.
A race condition in Apple macOS kernel locking allows a local user with existing code execution on the host to read kernel memory, fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation requires local authenticated access and a high-complexity timing win in the kernel's locking path, so it is probabilistic rather than reliable, and the impact is limited to confidentiality (kernel memory disclosure) with no code execution, modification, or denial of service. There is no public exploit identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.19% (8th percentile), making this a genuine but low-priority issue.
A race condition in Apple macOS state management allows a locally executing application to read sensitive user data; the flaw is fixed in macOS Golden Gate 27, and all earlier macOS versions are affected. Exploitation requires an attacker-controlled or malicious app already running on the host (assessed as local, PR:L, not remote despite the vendor's AV:N/PR:N vector) and depends on winning a narrow timing window, which limits reliability. Impact is confidentiality-only - no integrity or availability effect - and no public exploit has been identified at time of analysis; EPSS is 0.14% (4th percentile), so opportunistic exploitation is unlikely, though the data-disclosure impact and Apple's ecosystem prominence keep patching worthwhile.
Local information disclosure in Apple iOS and iPadOS (and visionOS) before version 27 allows an app running on the device to read sensitive user data it should not be able to reach. Apple fixed the flaw through improved file handling in iOS 27, iPadOS 27 and visionOS 27. No public exploit code or active exploitation has been reported, and the EPSS score of 0.15% (5th percentile) plus SSVC 'exploitation: none' point to a low-volume, user-assisted local attack rather than a mass-exploited one.
A path validation weakness in Apple's iOS, iPadOS, and macOS allows a malicious application to reach files outside its intended sandbox and read user-sensitive data. Apple addressed the flaw with improved path validation in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8, so all older releases remain exposed until updated. Exploitation requires a locally installed app and some user interaction (CVSS AV:L/UI:R), exploit probability is currently very low (EPSS 0.20%, 10th percentile), and no public exploit code or CISA KEV entry has been identified at time of analysis.
A permissions-validation flaw (CWE-863) in Apple macOS versions prior to 27 (Golden Gate) and Xcode versions prior to 27 allows a locally installed app to reach user-sensitive data it should not be authorized to read. The issue is a local, confidentiality-only defect rated CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N): no privileges are needed, but the attack requires the victim to run the malicious application. Apple has released fixes in macOS 27 and Xcode 27; there is no CISA KEV listing, no public exploit code identified at time of analysis, and EPSS is very low at 0.16% (5th percentile), so real-world exploitation is unlikely to be widespread.
Apple fixed a kernel uninitialized-memory flaw (CWE-457) across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS in which a locally installed app can determine kernel memory layout, defeating address-space randomization. The impact is information disclosure only - high confidentiality, no integrity or availability impact - and exploitation requires a local app plus user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 5.5). Apple shipped patches on [dates not specified] for iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27; no public exploit code or active exploitation is indicated, and EPSS is low (0.21%, 11th percentile).
A race condition in Apple's kernel state handling lets a locally installed app corrupt kernel memory or trigger unexpected system termination across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple addressed the flaw in iOS 18.7.10 and 26.6, iPadOS 18.7.10 and 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, and tvOS/visionOS/watchOS 26.6, so exploitation is limited to unpatched devices running a malicious app plus user interaction. No public exploit code and no active exploitation are known; EPSS is 0.17% (6th percentile) and CVSS rates it 6.3, reflecting a local, high-complexity attack with no confidentiality impact.
A race condition in core Apple operating system components lets a locally installed app trigger an unexpected system termination on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Apple fixed the flaw through improved state handling in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Impact is availability-only (no data exposure or modification), exploitation requires a local malicious app and winning a timing window, EPSS is a low 0.21%, and no public exploit code or active exploitation has been identified at time of analysis.
Apple macOS contains an improper input validation flaw (CWE-20) that a remote attacker can leverage to crash affected system components, producing a denial-of-service condition on the host. Apple addressed the issue in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7, so all earlier builds of those release trains remain vulnerable. Exploitation requires the victim to interact with attacker-supplied content (CVSS UI:R), and there is no public exploit identified at time of analysis, though the CVSS 3.1 base score of 6.5 reflects a high availability impact with no confidentiality or integrity loss.
An out-of-bounds read in Apple's font parsing code lets a maliciously crafted font file leak process memory on unpatched builds of iOS, iPadOS, macOS, tvOS, visionOS and watchOS, with all affected platforms fixed in the version 27 releases. Triggering it requires the victim to render attacker-supplied content containing the crafted font — an email, document, web page or message preview — but no credentials or elevated privileges are needed once that interaction happens, and the resulting confidentiality impact is rated high with no integrity or availability effect. No public exploit code or active exploitation has been identified, and EPSS sits at a low 0.20% (10th percentile), so this is best handled as a scheduled platform update rather than an emergency response.
An out-of-bounds read in the font-parsing path of Apple's operating systems lets a remote attacker disclose the contents of process memory when a victim processes a maliciously crafted font. All Apple platforms are affected prior to the version 27 releases — iOS and iPadOS, macOS Golden Gate, tvOS, visionOS and watchOS — and Apple has shipped fixes for each. There is no CISA KEV listing and no public exploit code identified, and the EPSS score of 0.17% (7th percentile) indicates a low probability of near-term exploitation; because the sole impact is memory disclosure and exploitation requires the victim to open or render attacker-supplied content, this is a moderate-priority patch rather than an emergency.
Information disclosure in Apple's iOS, iPadOS, macOS, tvOS and watchOS platforms allows an app running on the device to reach sensitive user data that the operating system's data protection mechanisms were supposed to keep isolated from it. Apple resolved the issue with improved data protection in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27 and watchOS 27, with vendor advisories published across seven support pages. No public exploit code or active exploitation has been reported, EPSS is low at 0.20% (10th percentile), and the issue is not listed in CISA KEV, so this reads as a routine hardening fix rather than an urgent emergency-patch event.
A use-after-free memory-management flaw affects Apple's operating system family prior to the 26.6 releases — iOS and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6 and watchOS 26.6 — and allows a locally installed app to trigger unexpected system termination (a denial-of-service condition). The vulnerability is rated CVSS 5.5 with a local attack vector, low complexity and low privileges required, but no confidentiality or integrity impact; EPSS is only 0.19 percent and there is no CISA KEV listing and no publicly available exploit code identified at time of analysis. Apple has shipped fixes in all four platform advisories, so the practical risk is concentrated on unpatched devices rather than on active exploitation.
Connecting an Apple device to an attacker-controlled NFS server can cause the kernel NFS client to mishandle memory and return out-of-bounds kernel memory to the malicious server, an information-disclosure issue tracked as CVE-2026-43687. All shipping Apple platforms are affected — iOS/iPadOS before 26.7 and 27, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27 — while the fix is distributed across Apple's 26.7/27 update wave. Exploitation requires the victim to initiate a connection to the hostile server (UI:R), which keeps real-world risk moderate: EPSS is only 0.18% (7th percentile), CISA KEV does not list it, SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code was identified at time of analysis.
Local applications running on Apple macOS releases prior to Tahoe 26.6 can exploit a race condition in the validation path guarding protected user data, allowing an app to read data it should not be able to reach. The flaw is mitigated in macOS Tahoe 26.6 per Apple's advisory, and the attack is timing-dependent and local-only (CVSS 4.7, AV:L/AC:H/PR:L), which keeps practical risk moderate. EPSS is very low at 0.14% (4th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis.
A race condition in Apple's state-handling code allows a locally installed app to crash the system or cause unexpected termination of system processes on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. The flaw carries a CVSS 3.1 score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) — availability-only impact, local attack vector, high complexity — and is fixed in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and tvOS, visionOS and watchOS 27. Neither public exploit code nor CISA KEV activity has been recorded, and EPSS puts exploitation probability at roughly 0.2% (10th percentile), so this is a patching-hygiene item rather than an emergency.
Kernel memory disclosure in Apple's client operating systems - iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.8 and macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6 - allows a locally installed, low-privilege application to read portions of kernel memory that should have been redacted, leaking sensitive data from kernel address space. The flaw is rated CVSS 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and is bounded to confidentiality loss with no integrity or availability impact and no arbitrary kernel read. There is no public exploit identified at time of analysis, EPSS is only 0.20% (10th percentile), and the issue is not in CISA KEV; Apple has released fixes across all affected platforms. Because the attacker must already have a malicious or compromised app installed and running on the device, this is best treated as a low-priority information-disclosure building block rather than a standalone compromise path.
Information disclosure in Apple iOS and iPadOS (versions before 26.7 and before 27) lets a locally installed app determine which other apps the user has installed, exposing a device-fingerprinting and privacy surface rather than files, credentials, or user data. The root cause is a state-management defect (CWE-200) that Apple fixed in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires the victim to install and run a malicious sandboxed app on the target device (CVSS AV:L, PR:L), so there is no remote or unauthenticated path; no public exploit code has been identified at time of analysis, and EPSS is 0.17% (7th percentile), consistent with a low-severity, low-priority finding.
Processing a maliciously crafted file on Apple macOS versions below Golden Gate 27 can crash the affected component, causing a denial-of-service, and may potentially leak partial memory contents. The bug is an integer overflow (CWE-190) corrected through improved input validation, and exploitation requires a local victim to actually open or handle the attacker-supplied file, so both a local attack vector and user interaction are prerequisites. Severity is assessed as moderate (assessed CVSS 6.6-level, availability-high with limited-confidentiality impact); EPSS is low at 0.17% (7th percentile), CISA SSVC records no exploitation, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
A malicious application running on Apple macOS (versions prior to 27) or watchOS (versions prior to 27) can leak sensitive user information because the operating system fails to properly manage internal state. Apple addressed the flaw in macOS Golden Gate 27 and watchOS 27, so all earlier releases on both platforms remain exposed. The issue is rated CVSS 5.5 (local vector, low privileges, high confidentiality impact), EPSS is only 0.16% (5th percentile), and there is no public exploit code identified at time of analysis.
An out-of-bounds read in Apple's kernel, fixed across iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27, allows a locally installed application to disclose kernel memory to user space. The flaw (CWE-125) stems from insufficient input validation in a kernel code path reached by app-supplied data, and yields high confidentiality impact only - no integrity or availability loss. Apple has released patches for all affected platforms; EPSS is very low (0.15%, 5th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
Improper certificate validation in Apple macOS allows an attacker positioned on the network path between the victim and a remote endpoint to intercept and potentially modify traffic that should have been protected by TLS. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate versions before 27, and is rated CVSS 4.8 (network vector but high attack complexity), with an EPSS score of only 0.12% (2nd percentile) and no public exploit or CISA KEV listing at time of analysis. Apple addressed the issue with improved certificate validation in the three corresponding releases, so the primary defense is straightforward patching; no public exploit code has been identified.
Opening a maliciously crafted file on an unpatched Apple device can crash the parsing process or disclose its memory contents, an out-of-bounds read that Apple addressed with improved input validation and fixed in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L), exploitation is unauthenticated from the network but hinges entirely on user interaction - the victim must open the crafted file - and impact is confined to the vulnerable process as a limited read-only disclosure or denial of service, with no code execution or data modification. EPSS is 0.18% (7th percentile), no public exploit has been identified at time of analysis, and vendor patches are already available, making this a low-priority issue despite the network attack vector.
Local applications on unpatched macOS can read sensitive user data from insufficiently redacted log files, affecting versions prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. Exploitation requires a malicious or compromised app already running with standard user privileges (AV:L/PR:L), yields confidentiality-only impact, and has no public exploit identified at time of analysis; EPSS is 0.17% (6th percentile). This is a genuinely low-priority, defensible-but-not-urgent issue per the independent assessment.
Processing a maliciously crafted image on unpatched Apple platforms can leak uninitialized process memory, exposing small, non-deterministic fragments of data that happened to be in memory at decode time. Affected are iOS and iPadOS before 26.7 and before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, plus tvOS, visionOS, and watchOS before 27; the CVSS vector (AV:N/AC:L/PR:N/UI:R) means no credentials or special configuration are needed but the victim must open, preview, or otherwise trigger decoding of the attacker-supplied image. Impact is limited to confidentiality (C:L) with no integrity or availability effect, EPSS is a low 0.18% (8th percentile), and no public exploit has been identified at time of analysis; Apple has shipped fixed versions for every affected platform, so the practical priority is routine patch cadence rather than emergency response.
A memory-safety defect (out-of-bounds read, CWE-125) in Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS can be triggered by a locally running application and causes an unexpected system termination - a denial-of-service/availability impact with no confidentiality or integrity loss. Affected versions are those prior to the fixed releases: iOS/iPadOS before 26.7 (and before 27), macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27, plus tvOS, visionOS, and watchOS before 27. Exploitation requires the attacker to already have a malicious app running on the device with its own app-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, scored 5.5); no public exploit code has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and there is no CISA KEV entry. Apple has released patched versions, so the practical exposure is limited to unpatched devices running a hostile app - a low-to-moderate priority issue.
Unexpected system termination in Apple macOS is caused by an out-of-bounds read in the SMB client that is triggered when a user initiates a connection to a malicious or spoofed SMB server. The affected versions are macOS releases before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27; the issue is not in CISA KEV, no public exploit code has been identified at time of analysis, and EPSS is a low 0.17% (6th percentile). An attacker who controls or spoofs the SMB endpoint the victim reaches can force a crash, with no privilege escalation, code execution, or data disclosure assessed.
A privacy flaw in Apple operating systems lets a malicious application already running on the device determine the user's current location, because location data was not properly redacted from log entries (CWE-532). The issue is local-only: the CVSS vector (AV:L, PR:L, UI:N, C:H/I:N/A:N) means an attacker must first get a malicious app installed and executing on the target device, after which no further user interaction is needed, and the impact is confined to confidentiality - the user's location is disclosed with no integrity or availability effect. Apple has fixed the flaw in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27; there is no public exploit identified at time of analysis, EPSS is very low (0.21%, 11th percentile), and the practical barrier is Apple's app-distribution controls rather than any remote attack path.
Kernel memory corruption in Apple's operating systems lets an app running on the device crash the system or corrupt kernel memory, with the independent assessment scoring integrity and availability impact as High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). Every unpatched device is exposed once a user launches a malicious or compromised app: no network vector, no user interaction beyond app execution, and no special configuration is required. There is no confirmed active exploitation (CISA KEV does not list this CVE) and no public exploit code identified at time of analysis, and EPSS is low at 0.21% (11th percentile), so real-world urgency is modest even though the flaw sits in the kernel. Apple has shipped fixed builds across all affected platforms: iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
Local apps on iOS, iPadOS, and visionOS can bypass certain Privacy preference controls and reach sensitive data they were never authorized to see; Apple addressed it by removing sensitive data from the reachable location. Affected are iOS and iPadOS before 26.7 and before 27, plus visionOS before 27, with fixes shipped in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, and visionOS 27. Exploitation is local-only and requires a malicious or overprivileged app to already be installed and running on the device (CVSS 3.3, AV:L/PR:L/UI:N, low confidentiality impact); there is no public exploit identified at time of analysis and EPSS is negligible at 0.17% (7th percentile).
Kernel memory disclosure on unpatched Apple devices allows a locally running, low-privilege app to read kernel memory that it should not be able to access, potentially exposing sensitive kernel-side data. The issue - an information-disclosure weakness (CWE-200) caused by improper memory management - affects iOS and iPadOS before 26.7 and before 27, macOS Tahoe before 26.7 and macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27, and is fixed in the corresponding 26.7/27 releases. Exploitation requires the attacker to already be executing code inside a sandboxed app on the target device (CVSS 3.1 3.3, AV:L/AC:L/PR:L/UI:N, confidentiality-only impact), so overall risk is low; no public exploit identified at time of analysis, with an EPSS score of roughly 0.2% (10th percentile) and no CISA KEV listing.
A use-after-free in macOS memory management allows a locally running application to crash the operating system, resulting in unexpected termination and loss of unsaved work. The flaw affects macOS Tahoe before 26.6, macOS Sequoia before 15.7.8, and macOS Sonoma before 14.8.8, with exploitation requiring only low privileges (CVSS PR:L) and no additional user interaction. Apple has released fixes (patch available per vendor advisories), and although EPSS is very low at 0.19% (9th percentile) with no CISA KEV listing, no public exploit code identified at time of analysis, the flaw is a memory-safety bug that carries inherent risk of escalation beyond a simple denial of service.
Uninitialized kernel memory disclosure in Apple's operating system family allows a local app that already holds root privileges to read residual data left in kernel memory buffers, an information-leak primitive that exposes potentially sensitive kernel memory contents. The flaw is fixed across iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, so affected users should update promptly. No public exploit code has been identified at time of analysis, and EPSS places the probability of exploitation at roughly 0.17% (7th percentile), consistent with the assessment that the mandatory root prerequisite - the attacker must already be running code at the highest local privilege level - makes this a post-compromise leak rather than an initial-access or privilege-escalation primitive, and a genuinely low real-world priority despite the 6.2 Medium base score.
Apple macOS devices running versions below Sonoma 14.8.8 can retain a silently persisted Apple Account after the device is erased, because the erase/factory-reset workflow fails to fully clear that state. Exploitation requires physical possession of the Mac and interaction with the wipe process itself - no credentials or user interaction are needed once the hardware is in hand (CVSS:3.1/AV:P/AC:L/PR:N/UI:N), which confines realistic risk to lost, stolen, resold, or refurbished hardware rather than remote attack. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.17% (7th percentile), and this is a moderate, physically-gated issue that does not warrant emergency prioritization.
Conditionally exploitable information disclosure affects Apple macOS versions below Sequoia 15.8, Tahoe 26.7, and Golden Gate 27, where an attacker who already occupies a privileged network position - such as a rogue or compromised Wi-Fi access point, a controlled router or proxy, or a host performing ARP/DNS spoofing - can leak sensitive user information. The issue is rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), is confidentiality-only with no integrity or availability impact, requires no authentication and no user interaction, and is gated by the AC:H precondition that the attacker can actively intercept traffic. Apple fixed it in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code has been identified at time of analysis, EPSS is 0.19% (9th percentile), and this is a moderate-severity, conditionally exploitable flaw rather than a top-tier priority.
Locally installed apps on unpatched Apple platforms (iOS and iPadOS before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27) can read sensitive user data that the system wrote into logs without adequate redaction. Apple fixed the flaw by improving data redaction in the release train listed in its security advisories. Impact is confidentiality-only and strictly local, with no network attack path, and a low EPSS of 0.18% (7th percentile) reflects that; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. One prerequisite discrepancy is worth noting: the published vector requires user interaction (UI:R), while our assessed vector treats the app as already installed and running without interaction.
Mounting a maliciously crafted exFAT volume on an unpatched macOS system (versions before Golden Gate 27) can trigger an out-of-bounds read in the kernel, leading to kernel memory disclosure or unexpected system termination. Exploitation requires user interaction to mount the attacker-supplied volume, and no public exploit code or active exploitation has been identified at time of analysis (EPSS 0.16%).
iCloud Private Relay on Apple platforms could disclose a user's real IP address to a website even while the privacy proxy is active, because of a state-management flaw in the relay implementation. The issue affects iOS and iPadOS before 18.7.10 and before 26.6.1, macOS Tahoe before 26.6.2, and visionOS before 26.6.1, and requires the victim to browse to attacker-controlled web content (UI:R, no privileges needed). Severity is modest (CVSS 4.3, confidentiality-only) and there is no CISA KEV listing or public exploit identified at time of analysis, but the privacy impact is disproportionate for users who depend on Private Relay for anonymity.
An integer underflow in the macOS SMB client allows a malicious SMB server to crash the operating system, resulting in a denial of service, when a user connects to a shared folder or mount. The flaw affects macOS releases prior to Golden Gate 27, Sequoia 15.8 and Tahoe 26.7, and is fixed in those versions. Exploitation requires the victim to initiate a connection to an attacker-controlled SMB endpoint (CVSS UI:R), there is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is very low at 0.19% (9th percentile), so real-world exploitation pressure is currently minimal.
An information disclosure flaw in Apple's iCloud Private Relay lets a website determine a visitor's real IP address even when Private Relay is switched on, defeating the core privacy guarantee of the feature. The issue affects iOS and iPadOS before 26.6.1, macOS before 26.6.2 (Tahoe), and visionOS before 26.6.1, and is reachable from the network but requires the victim to browse to an attacker-controlled page. Apple addressed it through improved state management, and no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in Apple iOS and iPadOS versions before 27 allows a locally installed malicious or compromised app to access sensitive user data after the user installs and opens it. The flaw is a permissions issue (CWE-200) that Apple addressed with additional restrictions in iOS 27 and iPadOS 27. No public exploit identified at time of analysis and EPSS is 0.17% (7th percentile), but the CVSS score of 5.5 reflects the high confidentiality impact; exploitation requires local app execution and user interaction, with no remote path.
Sensitive user data can be read by a malicious or compromised app on unpatched Apple devices because a logic-validation flaw lets the app cross its data-access boundary. Affected platforms are iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7 and before Golden Gate 27, tvOS before 27, and visionOS before 27; the assessed vector (AV:L/AC:L/PR:N/UI:R/C:H/I:N/A:N) shows the attacker must first get a hostile app onto the device and the user must run it, with confidentiality-only impact. Vendor patches are available for every platform, EPSS rates exploitation probability at roughly 0.18% (7th percentile), and no public exploit has been identified at time of analysis.
A use-after-free (CWE-416) in the Apple macOS SMB client allows a maliciously crafted SMB network share to crash the operating system, causing system termination. Exploitation requires the user to mount the attacker-controlled share (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5), so impact is limited to denial of service with no confidentiality or integrity loss. Apple has released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7; there is no CISA KEV listing and no public exploit code identified, and EPSS is low at 0.17% (6th percentile).
Improper access control in Apple iOS and iPadOS, macOS Tahoe, and visionOS lets a locally installed app read user-sensitive data that it should not be able to reach. The flaw (CWE-284) stems from insufficient validation checks and is remediated in iOS/iPadOS 26.6, macOS Tahoe 26.6, and visionOS 26.6; the assessed vector (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) means exploitation requires the victim to install and launch a malicious app on an unpatched build, with no remote attack path and no integrity or availability impact. The attacker's app needs no special privileges, but there is no public exploit identified at time of analysis and EPSS is low at 0.19% (9th percentile), so this is a genuine but low-priority confidentiality issue.
Improper access control (CWE-284) in Apple iOS, iPadOS, and macOS allows a locally installed app to read user-sensitive data outside the permission boundary the operating system is supposed to enforce, an information-disclosure impact rated CVSS 5.5 (confidentiality High, integrity None, availability None). Exploitation is local and requires user interaction: the attacker must first get a malicious or compromised app onto the device and convince the user to launch it (AV:L, PR:N, UI:R), so there is no remote, network-triggerable, or self-propagating path. Apple has released fixes in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code has been identified at time of analysis and EPSS is low at 0.17 percent (7th percentile), with no CISA KEV listing.
Information disclosure in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS allows a locally installed and running app to read a persistent account identifier that the operating system should have kept out of its reach. The root cause is a permissions/sandbox restriction gap (CWE-200), fixed by Apple with additional access restrictions in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; successful exploitation requires the user to install and launch a malicious local app (AV:L/PR:N/UI:R), so a remote, unauthenticated network attack is not possible. There is no public exploit identified at time of analysis and EPSS is 0.18% (8th percentile), making this low-to-moderate risk rather than an urgent priority, with impact confined to the confidentiality of one identifier and no integrity or availability effect.
An out-of-bounds read in Apple's macOS SMB client allows a malicious SMB server to leak kernel memory to an attacker when a user connects to a shared folder, fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Exploitation requires the victim to initiate a connection to an attacker-controlled or compromised SMB share (CVSS UI:R), so it is user-interaction dependent rather than wormable, and the raw impact is confidentiality only — kernel memory disclosure, not code execution. EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit code has been identified; SSVC rates exploitation as 'none', automatable as 'no', and technical impact as 'partial'.
Local information disclosure in Apple macOS lets a malicious or compromised application read sensitive user data on hosts running versions earlier than macOS Sequoia 15.8, macOS Tahoe 26.7 or macOS Golden Gate 27. Apple fixed the issue with improved checks in three separate security advisories covering each release train. Exploitation requires the attacker to get an app running on the target Mac with user-level privileges; no public exploit code has been identified at time of analysis and EPSS is 0.17% (6th percentile), so this is a low-volume, targeted local threat rather than a mass-exploitation event.
Missing origin validation in IBM Verify Identity Access and Security Verify Access (including their container editions) lets an unauthenticated, remote attacker ride an authenticated user's live session and carry out operations as that victim, potentially enabling follow-on attacks against the deployment. Exploitation requires the victim - a logged-in Verify Identity Access / Security Verify Access user - to be lured into visiting attacker-controlled web content while their session is active (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, 5.4), so confidentiality and integrity impact is limited to the victim's own privilege scope with no availability loss. No public exploit code has been identified and the flaw is not confirmed actively exploited (CISA KEV); EPSS is 0.15% (4th percentile), and vendor-released fixes are available per IBM's advisory, making this a moderate-severity, likely low-priority issue in real-world terms.
Out-of-bounds read in FFmpeg's convolution video filter (libavfilter/vf_convolution.c, function setup_3x3) affects releases 4.4.0–4.4.6, 5.1.0–5.1.8, 6.1.0–6.1.4, 7.1.0–7.1.3 and 8.0.0–8.0.1, allowing crafted media input to read past allocated buffers and potentially disclose memory or crash the process. Publicly available exploit code exists via the FFmpeg issue tracker, and the fix commit (8970658472d1 / e24b9820b4) has been published, with corrected releases 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0. Impact is limited: CVSS 2.1, and exploitation requires the non-default convolution filter to be applied to attacker-influenced input, so this is a low-severity hardening issue rather than an urgent patch-now event.
Improper validation of the WebSocket origin in IBM i 7.3, 7.4, 7.5, and 7.6 allows a remote attacker to read limited sensitive information by luring a logged-in user into a cross-origin WebSocket connection. The vulnerability requires user interaction (the victim must visit an attacker-controlled page) and yields only low confidentiality impact, giving a CVSS 3.1 base score of 4.3. There is no public exploit identified at time of analysis and CISA SSVC reports no active exploitation, so this is a low-urgency information-disclosure defect rather than an emergency patch item.
Incorrect privilege assignment in the checkShellCommand permission check (src/capabilities/permissions.ts) of cosmicstack-labs mercury-agent through 1.2.0 lets a low-privileged remote caller obtain shell-command capabilities it should not have. Publicly available exploit code exists, and the maintainers have not responded to the issue report, so no fixed release is confirmed. Impact is limited to low confidentiality exposure per the CVSS 4.0 vector (VC:L, VI:N, VA:N), making this a modest-severity exposure rather than a full compromise.
Mercury Agent versions through 1.1.13 gate shell execution by validating commands before canonicalizing them, so a caller with low privileges can craft input that passes the raw-string permission check yet resolves to a protected target, disclosing restricted data over the network. The flaw is a validate-before-canonicalize ordering error (CWE-180) in checkShellCommand within src/capabilities/permissions.ts, and publicly available exploit code exists via the project's own issue tracker. The project was notified early but has not responded, so no vendor fix is available, and the CVSS 4.0 base score of 2.1 reflects only a limited confidentiality impact.
A local information-disclosure weakness in cosmicstack-labs mercury-agent through version 1.2.0 lets a low-privileged local user manipulate the Shell Permission Manifest so that PermissionManager.checkShellCommand in mercury-agent/src/capabilities/permissions.ts mis-evaluates which shell commands are permitted. Successful abuse exposes sensitive data readable through the agent's shell capability, though integrity and availability are unaffected. Public exploit code exists (linked issue report) and the vendor has not yet responded, but exploitation is limited to hosts already running the agent and requires local access, giving a very low CVSS 4.0 base score of 1.9.
A race condition in the IBM i WebSocket handshake process allows a remote authenticated attacker to obtain sensitive information on IBM i 7.6, 7.5, 7.4, and 7.3. The flaw requires valid credentials and a precisely timed concurrent request pattern (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.2), so it is a low-severity, non-automatable issue rather than a mass-exploitation candidate. CISA's SSVC assessment rates exploitation as 'none' with no automatable path, and no public exploit code has been identified at time of analysis; IBM has published a vendor patch.
Link-following (symlink) handling in NanoClaw's agent-to-agent attachment forwarding lets an authenticated, low-privileged user cause the service to read or modify files outside the intended attachment directory. The flaw is in forwardAttachedFiles() in src/modules/agent-to-agent/agent-route.ts and affects every NanoClaw release from 2.1.0 through 2.1.17; the attack is network-reachable and requires no user interaction. Public exploit code exists and the vendor fix is identified as commit 3f9ed607b7e7a4872747295f75286f1c377d7c33, but real-world risk is currently low (CVSS 4.0 base 2.1, EPSS 0.29%, no CISA KEV listing).
Local unprivileged users on hosts running the System Security Services Daemon (SSSD) can crash or destabilize the NSS responder by sending a crafted zero-length request to its socket, degrading name-service lookups for every process on the machine. The defect is an integer underflow (CWE-191) in the responder's request parsing, and it is scored CVSS 4.0 because only availability is impacted and the attack requires local access to the host. There is no evidence of active exploitation or public exploit code at the time of analysis, and no vendor-listed fix version is available in the supplied intelligence.
An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).
Cross-tenant sender alias disclosure in Froxlor before 2.3.7 allows any authenticated customer to enumerate and read other customers' allowed sender alias values via an IDOR flaw in the delete-confirmation flow of `customer_email.php`. The query fetching `allowed_sender` uses only the global auto-increment `senderid` parameter without scoping it to the requesting customer, making all sender alias records on the instance accessible to any authenticated tenant. Publicly available exploit code exists, verified against Froxlor 2.3.6 with `mail.enable_allow_sender` enabled; no active exploitation has been identified.
Apache Syncope, the Apache open-source identity governance and administration (IGA) platform, writes audit events to its configured audit store without adequately masking sensitive values carried in event payloads, so an operator with administrative access to that store can read credentials and other secrets that should have been redacted. All releases from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 are affected. The vulnerability is rated 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/C:H/I:N/A:N), is not listed in CISA KEV, and no public exploit code has been identified at time of analysis.
Sensitive information exposure in Apache Syncope allows a privileged administrator with Derived Schema entitlements to craft a malicious JEXL (Java Expression Language) expression that, when evaluated during User read operations, leaks LinkedAccount or Manager sensitive data - including hashed credentials - to any admin with User read access. Affected versions span three release lines: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No public exploit code has been identified and CISA has not listed this in KEV; exploitation requires high-privilege access, limiting real-world risk to insider threats or compromised admin accounts.
The YAMAP - Social Trekking GPS App for Android exposes users to information leakage and unauthorized redirects through an improperly controlled WebView (in-app browser) implementation. The vulnerability stems from insufficient access control over which URLs or communication sources the WebView will process, allowing a crafted link or external input to steer the browser toward attacker-controlled content or harvest app-internal data. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at the time of analysis, but user interaction is required, making social engineering the realistic attack vector.
Plaintext credential storage in CONTEC's CONPROSYS nano Series industrial remote I/O devices exposes passwords to attackers with physical device access. Affecting multiple coupler unit models (server-type, EtherNet/IP adapter, and software PLC variants), the flaw means credentials are recoverable without decryption from device storage. No public exploit code or active exploitation has been identified; the physical access prerequisite and high attack complexity substantially limit real-world risk.
Directory listing exposure in CONTEC CONPROSYS PAC Series enables unauthenticated network attackers to enumerate internal directory structures by requesting a specific URL on the device's embedded web server. Affected models include the Integrated Type CPS-PC341 and Configurable Type CPS-PCS341, both deployed in industrial automation environments. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; impact is limited to information disclosure that could assist subsequent reconnaissance against the device.
Directory listing exposure in Contec's CONPROSYS M2M Gateway and M2M Controller Series allows a remote attacker to enumerate server-side directory structures by accessing a specific URL on the device's web interface. The affected hardware includes both integrated and configurable variants of the CPS-MG341, CPS-MGS341, CPS-MC341, and CPS-MCS341 product lines. Exposed directory listings reveal file and path structures that can facilitate reconnaissance for follow-on attacks against these industrial gateway devices. No public exploit or active exploitation has been identified at time of analysis.
Database field disclosure in four Regular Labs Joomla extensions - Advanced Module Manager, Conditional Content, Content Templater, and ReReplacer - allows an authenticated high-privilege user to read arbitrary database fields outside the intended scope. The Conditions editor feature accepts user-supplied database table and column names from the HTTP request, which are quoted as SQL identifiers (preventing SQL injection) but are not restricted to the tables and columns supported by Regular Labs integrations. An attacker with administrative access can therefore query unrelated database fields, potentially exposing sensitive Joomla database content such as user records or configuration values. No public exploit code or active exploitation is identified at time of analysis.
Improper SSH host key validation in andreashappe/cochise through version 0.4.1 allows a network-positioned attacker to perform Man-in-the-Middle attacks against SSH sessions established by the tool. The vulnerable component is the `asyncssh.connect()` call in `src/cochise/ssh_connection.py`, where the SSH Host Key Handler fails to verify server host keys, enabling silent impersonation of target SSH hosts. A public proof-of-concept exists as GitHub issue #13; no vendor patch has been released and the maintainer had not responded to the disclosure at time of reporting.
Untrusted pointer dereference in the camera driver of Samsung Exynos 1580 and 2500 mobile processors allows a local low-privileged attacker to cause denial of service or leak limited kernel information across security boundaries by sending a malformed message to the driver. The scope-changed CVSS vector (S:C) indicates impact extends beyond the immediate process context into privileged system components. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read in the Wi-Fi driver subsystem of Samsung Exynos mobile processors allows a local low-privileged attacker to leak kernel memory by sending a malformed Netlink command, potentially exposing sensitive in-kernel data. Affected processors span Samsung's mid-range and flagship mobile lineup plus wearable chips: Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930. No public exploit has been identified at time of analysis, and Samsung has published a product security advisory addressing the issue.
SMTP evasion via incomplete state reset in an Ubuntu-reported component allows an attacker to bypass protocol-level security controls by exploiting improper state machine cleanup between SMTP sessions or command sequences. The vulnerability enables crafted SMTP interactions to carry over state from a prior transaction into a new one, potentially allowing filter evasion, spoofed sender identity acceptance, or bypass of per-message security checks. No CVSS score, CWE, or patch version is currently assigned in NVD, and data is extremely sparse - the analysis below reflects significant inference from the vulnerability class.
IPv4/IPv6 hash collision in Suricata's IPPair tracking mechanism causes the engine to reuse state belonging to the wrong IP pair, leading to incorrect stateful evaluation of network traffic. The vulnerability affects deployments where both IPv4 and IPv6 traffic is processed and IPPair-based rules or datasets are active. An attacker who can craft traffic that induces a hash collision may cause Suricata to apply the wrong connection state, potentially bypassing detection rules that depend on per-pair tracking. No public exploit or CISA KEV listing has been identified at time of analysis.
Samsung Exynos camera driver firmware on eight mobile processor variants leaks sensitive information through debug instrumentation that was not removed from production builds (CWE-215). The flaw affects Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680 SoCs - processors found in Samsung Galaxy smartphones and tablets - allowing a local low-privileged attacker to read sensitive data that crosses the kernel-to-userspace security boundary. No public exploit code exists and the vendor-assigned CVSS score of 2.8 (Low) accurately reflects the narrow, local-only attack surface and limited confidentiality impact.
Out-of-bounds memory access in Samsung's CustOS Driver on Exynos 1580 processors exposes a local low-privileged attacker to cross-TEE-boundary memory read and write primitives. The fault is triggered by submitting an oversized shared memory allocation request to the custos_iwc inter-world communication device, which the driver services without adequate bounds validation, potentially leaking secure-world data or corrupting CustOS runtime state. No public exploit code has been identified and CISA has not listed this in KEV at time of analysis.
The Storm UI topology REST endpoint (`GET /api/v1/topology/{id}`) in Apache Storm 3.0.0 returned a merged Nimbus daemon and topology configuration without credential redaction, exposing ZooKeeper authentication payloads and TLS keystore/truststore passwords to any principal holding topology read-only access. This privilege gap is significant because the dedicated `getNimbusConf` API already redacted these secrets and required elevated `nimbus.users` membership, yet the topology page - which merges in strictly more daemon state - was unprotected. No public exploit is identified at time of analysis, but exploitation requires only a single authenticated HTTP GET call, making the effective complexity trivially low for any principal with read-only cluster access.
Two authorization and redaction failures in Apache Storm 3.0.0 expose credential-bearing cluster configuration to under-privileged or entirely ungated callers. The Nimbus `getNimbusConf` Thrift API serves the full daemon configuration-including ZooKeeper authentication payloads and TLS keystore and truststore passwords-after only a user-level authorization check, silently omitting the credential masking applied everywhere else in the product. The Storm UI REST endpoint `/api/v1/cluster/configuration` is worse: the missing `@AuthNimbusOp` annotation causes the authorization filter to treat the endpoint as ungated, proxying requests under the UI daemon's own principal so that any caller passing `ui.filter` receives the full unredacted configuration regardless of their privilege level. No public exploit has been identified and this CVE is not in CISA KEV.
Unauthenticated password reset in jaychouchannel's Tourism-Management-System allows any remote attacker to overwrite an arbitrary user's credentials by supplying only a known username to the resetPass endpoint - no current password, token, or session is required. All three Java Spring controllers (UsersController, DaoyouController, YonghuController) share the vulnerable pattern, enabling forced account lockout or, if the API response includes the newly generated random password, full account takeover. Publicly disclosed exploit code exists and the upstream fix is available via commit 9cb6215.