Information Disclosure
Monthly
Out-of-bounds read in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated low-privilege attacker to disclose kernel memory contents across virtually all supported Windows desktop and server releases, from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. The flaw (CWE-125) requires no user interaction and carries high confidentiality impact, making it a viable KASLR-bypass or sensitive-data-leak primitive in a multi-stage local privilege escalation chain. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local information disclosure in the Windows MIDI Service Module allows a low-privileged authenticated local user to read sensitive system information outside its intended authorization boundary. Affecting Windows 11 versions 24H2, 25H2, and 26H1, the flaw (CWE-497) enables an attacker already present on the system to extract data that should be inaccessible to their privilege level. Microsoft has released patches for all three affected branches; no public exploit code or active exploitation has been identified.
Out-of-bounds read in Windows Imaging Component (WIC) allows a locally authenticated attacker with standard user-level privileges to read memory contents beyond allocated buffer boundaries, disclosing potentially sensitive in-process data. The vulnerability affects an exceptionally wide range of Windows releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, confirmed by EUVD/NVD version data and reported directly by Microsoft MSRC. Microsoft has released targeted patches per platform build; no public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds read in Windows Remote Desktop Client exposes sensitive client memory to a network-adjacent attacker who can induce a user to connect to a malicious RDP server. The vulnerability (CWE-125) produces high-confidentiality impact with no integrity or availability loss, yielding a CVSS 5.7 score. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Windows License Manager on multiple Windows 10, 11, and Server editions exposes sensitive system licensing data to locally authenticated low-privileged users due to CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). An attacker with an existing local session can read confidential licensing information — such as activation data, product identifiers, or licensing metadata — without authorization. No public exploit code and no CISA KEV listing have been identified; vendor patches are available for all affected versions, reducing urgency for patched environments.
Out-of-bounds memory read in the Microsoft Standard XPS (XML Paper Specification) component affects virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a locally authenticated user to disclose potentially sensitive memory contents. The flaw (CWE-125) carries CVSS 5.5 with high confidentiality impact but no integrity or availability consequence; scope is unchanged and no user interaction is required beyond the attacker's own session. No public exploit code or active exploitation has been identified, and Microsoft has released patched builds across all affected version lines.
Out-of-bounds read in the Windows Push Message Routing Service exposes process or kernel memory to a locally authenticated attacker, resulting in sensitive information disclosure. The vulnerability affects a wide range of Microsoft Windows releases spanning Windows 10 through Windows 11 and Windows Server 2016 through 2025, making patch surface substantial across enterprise environments. No public exploit code has been identified at time of analysis, and the attack is constrained to local execution with standard user privileges.
Windows DHCP Server on multiple Windows Server versions stores passwords in a recoverable format (CWE-257), enabling an authenticated low-privileged network attacker to extract those credentials over the network. The impact is a pure confidentiality breach - passwords held by the DHCP Server service can be recovered without cracking, potentially enabling lateral movement or privilege escalation through credential reuse. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing the flaw across the full affected version matrix.
Microsoft COM for Windows leaks sensitive information through error messages on a wide range of Windows 10, Windows 11, and Windows Server versions, allowing a locally authenticated attacker with standard user privileges to read high-confidentiality data. The flaw is rooted in CWE-209 (error message content exposure), where COM subsystem error paths disclose internal state that should not be visible to unprivileged callers. No public exploit or active exploitation has been identified at time of analysis, and Microsoft has released patches addressing all affected builds.
Windows GDI+ (Graphics Device Interface Plus) fails to initialize a resource before use (CWE-908), allowing a local low-privileged attacker to read residual memory contents and disclose potentially sensitive information from the affected system. The flaw spans virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - making it one of the broadest-footprint components affected. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog.
Local information disclosure in the Windows Connected User Experiences and Telemetry (DiagTrack) service allows a low-privileged authenticated local attacker to read sensitive data outside their authorized security scope. The CVSS scope-change metric (S:C) indicates the exposed data originates from a security domain beyond the telemetry component itself - likely higher-privileged OS subsystem data. Affecting Windows 10, Windows 11, and Windows Server 2019/2022/2025 across all mainstream support channels, Microsoft has released patches via the standard Patch Tuesday cadence. No public exploit identified at time of analysis.
Numeric truncation error in the Windows Internet Storage Name Service (iSNS) component enables a locally authenticated attacker to disclose sensitive information from affected systems. The flaw spans an exceptionally broad range of Microsoft Windows client and server editions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface management complex. No public exploit or active exploitation is known at time of analysis; a vendor patch is available.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) document processing stack enables a local low-privileged attacker to disclose sensitive memory contents under high-complexity conditions. The flaw spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2012 through Windows 11 25H2 and Server 2025 - making patch deployment across heterogeneous environments operationally significant. Microsoft has released patches via the standard update guide; no public exploit or active exploitation has been identified at time of analysis.
Use-after-free in the Windows Network Connection Broker service allows a local authenticated attacker to read stale heap memory, disclosing potentially sensitive information. The vulnerability spans every supported Windows client and server release from Windows 10 1607 and Windows Server 2016 through Windows 11 25H2 and Windows Server 2025, making the exposed surface extremely broad. Microsoft has shipped patched cumulative updates for all affected SKUs; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows XML Paper Specification (XPS) document handler allows a locally-authenticated standard user to disclose memory contents from the affected process. The flaw spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Out-of-bounds read in the Windows Program Compatibility Assistant (PCA) Service exposes high-confidence memory contents to authenticated network attackers across a broad swath of Windows 10, 11, and Windows Server releases. The flaw (CWE-125) allows a low-privileged user who triggers the right interaction to cause the service to read beyond a buffer boundary, leaking memory over the network with no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Sensitive information disclosure in the Windows Program Compatibility Assistant (PCA) Service allows a locally authenticated attacker with standard user privileges to read sensitive data written to log files. Affected systems include Windows 11 versions 23H2 through 26H1 and Windows Server 2025 in both full and Server Core configurations. No public exploit code or active exploitation has been identified at time of analysis, and vendor-released patches are available via Microsoft's update guide.
Uninitialized resource use in the Microsoft Account component on Windows allows a low-privileged local attacker to disclose sensitive information from memory. Affecting a broad swath of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - the flaw exposes high-confidentiality data (potentially account tokens, credentials, or session state) with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Out-of-bounds read in the Windows Bluetooth Port Driver (bthport.sys) allows a local, low-privileged authenticated attacker to disclose kernel memory contents under high-complexity conditions. Affected platforms span Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1), Windows Server 2022, and Windows Server 2025 across specific build thresholds confirmed by EUVD version data. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis, constraining real-world risk to post-compromise or insider scenarios.
Use-after-free (CWE-416) in Microsoft Office Word enables a locally authenticated attacker to disclose sensitive memory contents. Exploitation requires only low-privileged local access with no user interaction, yielding high confidentiality impact per the CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N vector. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update mechanism.
Information disclosure in the Windows MIDI Service Module affects Windows 11 versions 24H2, 25H2, and 26H1, allowing a locally authenticated low-privileged attacker to read sensitive system information that should remain within an authorized control sphere. The vulnerability (CWE-497) requires no user interaction and is limited to local attack vectors with no integrity or availability impact. Microsoft has released patches addressing all affected builds, and no public exploit or active exploitation has been identified at time of analysis.
Windows Defender Firewall Service on a broad range of Windows client and server editions exposes protected files or directories to low-privileged local attackers (CWE-552), enabling sensitive information disclosure. A local attacker holding a standard user account can access firewall service files - potentially including policy configuration, rule data, or service-level secrets - that should be restricted to privileged processes. Microsoft has released patches across the full affected version range; no public exploit has been identified at the time of analysis.
Symlink following in Windows UPnP Device Host (upnphost) allows a locally authenticated, low-privileged attacker to redirect the service's file access operations through crafted symbolic links or junctions, disclosing the contents of otherwise inaccessible files. The vulnerability spans an unusually wide set of affected Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - indicating a systemic deficiency in how the UPnP host service resolves paths before file access. Microsoft has released corrective patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server (versions 2017 through 2025) allows a low-privileged authenticated attacker to disclose sensitive information over the network by triggering a memory read beyond an allocated buffer boundary. The CVSS vector confirms network-accessible exploitation requiring only low-privilege credentials (PR:L), with no user interaction needed, resulting in high confidentiality impact. No public exploit code or active exploitation has been identified; Microsoft has released patches across all affected servicing branches.
Out-of-bounds memory read in Microsoft SQL Server exposes sensitive server-side data to authenticated network attackers. The flaw (CWE-125) spans four major SQL Server release lines - 2017 through 2025 - in both GDR and Cumulative Update servicing tracks, making it broadly present across enterprise environments. An attacker holding low-privilege SQL Server credentials can exploit this to read memory contents beyond an intended buffer boundary, achieving high confidentiality impact without any user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read (CWE-125) in Microsoft SQL Server 2017 through 2025 allows a low-privileged authenticated attacker to disclose potentially sensitive server memory contents over the network. The flaw spans all four supported major versions across both Cumulative Update (CU) and General Distribution Release (GDR) servicing tracks, producing a broad enterprise exposure surface. Microsoft has released patches for all affected version branches; no public exploit code or CISA KEV listing has been identified at the time of analysis.
Out-of-bounds read in Microsoft SQL Server exposes server memory to authenticated low-privileged network attackers, enabling information disclosure across SQL Server 2017 through 2025. The flaw (CWE-125) is reachable over the network without elevated privileges or user interaction, making it accessible to any valid SQL Server login. Microsoft has released patches across all affected servicing branches; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Out-of-bounds read (CWE-125) in Microsoft SQL Server enables an authenticated network attacker with low privileges to disclose sensitive server-side information. The flaw spans SQL Server 2017 through 2025 across both Cumulative Update and General Distribution Release servicing branches, representing a broad exposure across enterprise database deployments. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches across all affected servicing branches.
Out-of-bounds memory read in Microsoft SQL Server 2017 through 2025 allows network-authenticated, low-privilege database users to disclose sensitive server-side memory contents. The flaw (CWE-125) is reachable over the network with only a valid database account, requiring no user interaction, and affects all currently supported SQL Server release tracks - both Cumulative Update and General Distribution Release channels. Microsoft has released patches across all affected branches; no public exploit code has been identified at time of analysis.
Uninitialized memory exposure in Microsoft SQL Server 2017 through 2025 allows a network-authenticated low-privilege attacker to read sensitive server-side data. The root cause is CWE-908 (Use of Uninitialized Resource), where a memory region is accessed before initialization, potentially leaking residual contents from query buffers, session state, or internal structures. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patches are available across all affected version branches.
Uninitialized memory disclosure in Microsoft SQL Server 2017 through 2025 allows a low-privileged authenticated attacker to read sensitive server memory contents over a network connection. The CWE-908 flaw affects all major SQL Server release branches - 2017, 2019, 2022, and 2025 - across both GDR and Cumulative Update servicing tracks. Microsoft has released patches for all affected versions; no public exploit code or active exploitation is documented at time of analysis.
Out-of-bounds read in Microsoft SQL Server 2017 through 2025 exposes server memory contents to authenticated low-privilege network attackers, enabling information disclosure without integrity or availability impact. The flaw (CWE-125) requires only a valid low-privilege database account and network access, making it accessible to any SQL login holder - including application service accounts - against unpatched instances. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the breadth of affected versions across four major SQL Server release families widens the attack surface considerably.
Out-of-bounds read (CWE-125) in Microsoft SQL Server enables an authenticated, network-adjacent attacker to disclose sensitive in-process memory contents. Affecting SQL Server versions 2017 through 2025 across both GDR and Cumulative Update servicing tracks, exploitation requires valid database credentials but no elevated privileges. Microsoft has released patched builds for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server allows a low-privileged, authenticated attacker to remotely disclose sensitive memory contents over a network. Affected builds span SQL Server 2017 through 2025 across both Cumulative Update and GDR servicing branches. With a CVSS 6.5 and C:H, successful exploitation could expose confidential server-side data; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read (CWE-125) in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated low-privilege network attacker to disclose potentially sensitive server memory contents. The flaw is exploitable over the network with low complexity and requires only a valid database login - no user interaction or elevated privileges are needed. Microsoft has released patches across all six affected servicing branches; no public exploit code or CISA KEV active exploitation has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server 2022 and 2025 enables an authenticated, low-privileged attacker to disclose sensitive server memory contents over the network. The flaw (CWE-125) resides in the SQL Server engine and is reachable via crafted network queries, resulting in high confidentiality impact with no integrity or availability loss. No public exploit code or active exploitation has been identified at time of analysis, but a vendor-released patch is available.
Uninitialized memory disclosure in Microsoft SQL Server 2017 through 2025 allows a network-connected low-privilege authenticated attacker to read sensitive data from SQL Server memory. The flaw (CWE-908) arises when the engine allocates and uses memory without proper initialization, potentially exposing contents from adjacent queries, sessions, or internal data structures. Microsoft has released patches across all affected Cumulative Update and GDR servicing branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Information disclosure in Microsoft SQL Server 2025 allows an authenticated, low-privileged network attacker to extract sensitive data through crafted SQL error messages. Affected are the CU8 and GDR servicing branches of SQL Server 2025, with both patch channels receiving fixes. No active exploitation or public proof-of-concept has been identified at time of analysis, but the CVSS C:H rating indicates the potential for significant confidentiality breach once an attacker has any valid credential.
Out-of-bounds read (CWE-125) in Microsoft SQL Server 2025 allows an authenticated network attacker to disclose sensitive in-memory information. Affected versions span both the CU8 cumulative-update branch (below 17.0.4085.5) and the GDR branch (below 17.0.1135.8). No public exploit or CISA KEV listing exists at time of analysis; Microsoft has released patches for both branches.
Microsoft Teams for Android before build 1416/1.0.0.2026133602 inserts sensitive information into outbound network transmissions (CWE-201), enabling a low-privileged authenticated attacker to intercept and read confidential data over the network when a victim user performs an in-app action. The CVSS scope change (S:C) with high confidentiality impact (C:H) signals that the leaked data can cross trust boundaries beyond the attacker's own session, potentially exposing other users' or sessions' sensitive material. No public exploit identified at time of analysis; Microsoft has released a patch via the MSRC advisory.
Origin validation error (CWE-346) in Microsoft .NET enables network-based information disclosure where an unauthenticated remote attacker can read sensitive data from a .NET application by exploiting improper validation of request origins. Affected are multiple active .NET release trains (8.0, 9.0, 10.0, 11.0 RC1) and Microsoft Visual Studio 2022 and 2026 where bundled .NET runtimes are included. The CVSS vector (UI:R) indicates user interaction is required, consistent with a cross-origin attack pattern where a victim must visit an attacker-controlled page that triggers the malicious cross-origin request. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated information disclosure in TP-Link Omada Controller exposes an initialization API endpoint that remains reachable after setup completes, leaking account-related data to any remote unauthenticated user. The endpoint was designed for one-time use during initial controller configuration but lacks post-initialization access controls, allowing attackers to query it freely. Successful exploitation facilitates user enumeration, which can serve as a reconnaissance step toward credential-stuffing or targeted brute-force attacks against administrative accounts. No public exploit or CISA KEV listing is identified at time of analysis.
Field policy bypass in AshLua 0.1.0-0.2.1 allows authenticated Lua script executors to read actor-restricted fields by requesting them through aggregate operations (min, max, first, sum, avg, list) rather than as direct record fields, circumventing per-actor field policy authorization while remaining within the configured exposed-field allow-list. The Ash framework normally redacts forbidden fields on returned record structs with %Ash.ForbiddenField{}, but AshLua's read action did not apply this check when constructing ad-hoc Ash.Query.Aggregate instances, returning raw field values instead. No public exploit code exists and the vulnerability is not in CISA KEV; the CVSS 4.0 score of 6.0 reflects network-accessible but prerequisite-gated exploitation requiring authenticated script execution access.
Field policy bypass in ash_ai (versions 0.1.0 through < 1.0.3) allows authenticated, low-privilege actors to read per-actor-restricted fields - including sensitive PII - by invoking the aggregate result type (min, max, sum, avg) via the LLM read tool instead of direct record retrieval. Ash field policies redact forbidden fields on returned records by substituting %Ash.ForbiddenField{}, but this redaction mechanism was never applied to aggregate code paths; the tool's authorization check only tested field.public?, a static attribute orthogonal to per-actor policy evaluation. Patch version 1.0.3 is available via the vendor advisory; no CISA KEV listing or public exploit code has been identified at time of analysis.
Query statistics serialization on the MongoDB sharded cluster router (mongos) fails to apply redaction to search query literals, exposing sensitive data to holders of the monitoring privilege. An improper conditional check in the serialization logic causes the redaction mechanism to be bypassed specifically for search queries transiting the router, leaving raw query text - which may contain PII, credentials embedded in queries, or proprietary data - stored and accessible via the queryStats interface. Affected versions are MongoDB Server 8.3.0 through 8.3.8; a fix is available in 8.3.9. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Heap out-of-bounds read in MongoDB Server's query planning component allows an authenticated database user with read/write privileges to disclose partial server heap memory contents. Crafted query operations cause the server to read beyond allocated heap buffer boundaries during query plan construction, with leaked memory fragments surfacing through diagnostic query statistics output. Affected releases span MongoDB Server 7.0.0-7.0.40, 8.0.0-8.0.29, and 8.3.0-8.3.8, with fixed versions available across all three branches per vendor advisory SERVER-131562.
Credential interception via man-in-the-middle attack is possible against Nozomi Networks Guardian sensors using the Smart Polling feature, which establishes encrypted connections to polled OT/ICS devices without validating the remote host's identity and provides no configuration option to enable such validation. An attacker with network positioning between the sensor and a target device can impersonate the device, capture the authentication credentials transmitted during polling sessions, and replay those credentials to authenticate directly against the device or other devices sharing the same credentials. This enables unauthorized access, data manipulation, and operational disruption of monitored industrial devices. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated information disclosure in XenForo before 2.3.13 exposes private content metadata through the unfurl link-preview endpoint, which performs no session, user identity, or visibility checks on retrieved records. An unauthenticated remote attacker can enumerate predictable auto-increment integer IDs to retrieve rendered preview HTML, original URLs, and query strings generated from private conversations and other access-controlled forum areas. No public exploit has been identified at time of analysis, but the attack is trivially automatable through sequential ID iteration; the issue is fixed in XenForo 2.3.13.
Xen hypervisor on x86 PV (paravirtualized) guest configurations contains a race condition in memory page lifecycle management that allows a guest to write to pages already scrubbed by Xen. When a PV guest frees a memory page, Xen defers the TLB flush until the page is re-used - but scrubbing occurs before that flush, creating a window in which the guest's stale TLB entry remains valid for a page now considered clean. This permits the attacking PV guest to inject arbitrary data into a scrubbed page, which may subsequently be allocated to another guest, undermining Xen's inter-VM memory isolation guarantee. No public exploit has been identified at time of analysis, and SSVC assessment rates exploitation as none and non-automatable.
Stack buffer over-read in PX4 Autopilot through v1.17.0 exposes stack memory via the netman system command's interface name handling. Supplying an interface name of 74 bytes or more via the -i option bypasses missing length validation, causing reads beyond allocated buffer boundaries; the over-read data leaks to console output and may also be written into persistent network configuration files, risking both information disclosure and config corruption across reboots. No public exploit or active exploitation has been identified, but the upstream fix is available as a merged GitHub PR and commit.
Sensitive credential material - including authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions - was written to diagnostic log files across six Snowflake client drivers (Python, Go, JDBC, Node.js, PHP PDO, and ODBC) due to incomplete log-redaction coverage. An attacker with read access to the log destination, whether a local filesystem, a log aggregation pipeline, or a CI/CD artifact store, can extract valid credentials and decryption keys. Exploitation impact is bounded by credential lifetime and object scope, but successful use of harvested tokens provides authenticated access to the corresponding Snowflake account or cloud-storage objects. No public exploit is identified at time of analysis; vendor-released patches are available for all six drivers as of September 3, 2026.
Unstripped debug symbols in Siemens Reyrolle 7SR5 protection relay firmware (all versions prior to V2.70) expose internal function names, type definitions, and structure layouts to any party who downloads the publicly available firmware update packages. This does not directly compromise deployed devices but substantially reduces the skill and effort required for an attacker to identify exploitable weaknesses through static firmware analysis. No public exploit or active exploitation has been identified; Siemens has released firmware V2.70 as the fix per advisory SSA-142885.
Direct web-accessible SQL backup file exposure in code-projects Student Crud Operation 1.0 allows unauthenticated remote attackers to download the raw database dump `/card_activation.sql` from the web root. The file likely contains database schema and card activation records, exposing sensitive application data without any authentication. No public exploit identified at time of analysis is incorrect - publicly available exploit code exists per the referenced GitHub writeup, though no CISA KEV listing is present.
NTLM credential hash theft from Windows users running ASUS Armoury Crate is possible when a user visits an attacker-controlled web page that exploits the application's permissive cross-domain (CORS) policy. The local Armoury Crate service accepts cross-origin requests from untrusted web origins, allowing malicious JavaScript to inject a UNC path into a service call; Windows then automatically initiates SMB authentication to the attacker's server, transmitting the user's NTLMv2 hash without further interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the underlying coercion technique is well-understood and the attack requires only a single user click.
Uninitialized kernel memory disclosure through the ASUS Armoury Crate Windows driver allows a local low-privileged user to read sensitive data from previously used kernel buffers. The attacker crafts a malicious IOCTL request that bypasses the driver's built-in security verification mechanism, triggering a read of uncleared memory content (CWE-226). No active exploitation has been identified and no public exploit code is known at time of analysis; risk is bounded by the local access prerequisite and the AC:H complexity of defeating the security check.
Kernel virtual address disclosure in the ASUS Armoury Crate Windows driver enables a local low-privileged user to bypass the driver's IOCTL input verification through a crafted request, obtaining kernel virtual addresses and exposing the kernel memory layout. All versions of Armoury Crate are listed as affected per CPE cpe:2.3:a:asus:armoury_crate:*:*:*:*:*:*:*:*. While direct impact is limited to information disclosure, this class of kernel pointer leak is routinely used to defeat KASLR as a prerequisite step in local kernel privilege-escalation chains; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized administrative interface access in SAP Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server exposes sensitive system state to authenticated low-privileged users. Exploiting this flaw, an attacker with only a basic SAP account can query administrative endpoints normally restricted to higher-privilege roles, retrieving configuration details, system internals, or operational data that could serve as reconnaissance for follow-on attacks. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the low authentication bar (any valid low-privilege account) and direct network accessibility make the exposure surface meaningful in enterprise SAP environments.
Multi-tenant OAuth2 metadata cross-tenant leakage in ash_authentication_oauth2_server (versions 0.1.3 through before 0.3.1) causes shared HTTP caches to serve one tenant's RFC 8414/RFC 9728 discovery metadata - including issuer, authorization_endpoint, token_endpoint, and jwks_uri - to another tenant's clients for up to one hour. The vulnerability arises because the Phoenix ProtocolRouter sent all metadata responses with Cache-Control: public, max-age=3600 and no Vary header; when tenant identity is derived from a request header or Host (not the URL), shared caches key on URL alone, making cross-tenant cache poisoning trivially repeatable. Downstream impact extends beyond disclosure: affected clients may direct authorization codes and client secrets to the wrong tenant's token endpoint and validate tokens against the wrong JWKS keys. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Plaintext credential storage in Dell Secure Connect Gateway 5.0 exposes passwords to local low-privileged attackers, leading to information disclosure. Both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified; the CVSS score of 4.7 Medium reflects the local-only, high-complexity attack path.
IntelliJ IDEA before version 2026.2.2 leaks project metadata to JetBrains Marketplace due to a missing project-trust check, exposing potentially sensitive project information without developer consent. The flaw requires local access and user interaction - specifically, a developer must open an untrusted project for the metadata transmission to occur. No public exploit code exists and no active exploitation has been identified; the impact is limited to a low-severity confidentiality breach (CVSS 3.3).
Terminal command input written to idea.log in JetBrains IntelliJ IDEA before 2026.2.2 exposes sensitive command-line strings to any local party that can read the IDE's diagnostic log. Classified as CWE-532 (Insertion of Sensitive Information into Log File), the flaw means that developers who type passwords, API keys, or tokens as command-line arguments in IntelliJ's integrated terminal inadvertently persist those secrets on disk in a plaintext log file. No public exploit has been identified at time of analysis, and the vendor-assigned CVSS score of 2.8 accurately reflects the constrained local-only, user-interaction-dependent attack surface.
Credential exfiltration in JetBrains YouTrack before 2026.2.18769 allows a project administrator to redirect stored mailbox credentials to an attacker-controlled server by modifying the mailbox host setting without triggering re-authentication. The missing re-authentication gate means any project admin who has been compromised, is malicious, or has temporarily elevated access can silently capture email account credentials (username and password) already stored in YouTrack. No public exploit has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
IP spoofing via forged HTTP headers in JetBrains YouTrack before 2026.2.18634 allows unauthenticated remote attackers to bypass Bitbucket webhook source validation, causing YouTrack to process attacker-crafted webhook payloads as if they originated from a legitimate Bitbucket server. The root cause is CWE-291 - reliance on IP address for authentication - specifically trusting client-controlled headers such as X-Forwarded-For to gate webhook acceptance. No public exploit has been identified at time of analysis, and JetBrains has released a patched build.
Hard-coded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a local low-privileged attacker to decrypt protected data, leading to high-severity information disclosure. Both the Appliance form factor (prior to 5.36.00.16) and the Application form factor (prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis, and the local access requirement significantly constrains the attack surface.
Improper locking in Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application allows a low-privileged remote attacker to exploit a synchronization race condition, resulting in unauthorized filesystem access on the affected system. The vendor CVSS vector rates the primary impact as A:H (Availability), yet the description specifically references attacker filesystem access - a tension that suggests possible confidentiality or integrity impact beyond what the official score reflects. Dell has released fixed versions and published advisory DSA-2026-382; no public exploit or active CISA KEV listing exists at time of analysis.
Cleartext storage of sensitive information in Dell Secure Connect Gateway 5.0 exposes credentials or configuration secrets to any low-privileged local user on the host. Both the hardware Appliance (versions prior to 5.36.00.16) and the virtual Application (versions prior to 5.36.00.00) are affected, as confirmed by Dell Security Advisory DSA-2026-382. No public exploit identified at time of analysis, but the CVSS C:H rating indicates that successful exploitation yields full confidentiality compromise of the stored sensitive material.
Sensitive information exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged local attacker to read sensitive data written to application log files without sanitization. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected across all platforms. No public exploit code or active exploitation has been identified; Dell has released fixes via advisory DSA-2026-382.
Hardcoded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance and Application variants - allows a low-privileged local attacker to access protected data encrypted with the embedded key, leading to information disclosure. Affected versions include SCG 5.0 Appliance prior to 5.36.00.16 and SCG 5.0 Application prior to 5.36.00.00. Dell has released patched versions via DSA-2026-382; no public exploit or KEV listing has been identified at time of analysis.
Hard-coded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a local low-privileged attacker to decrypt data that was intended to be cryptographically protected, resulting in high-severity information disclosure. Both the Appliance form factor (versions prior to 5.36.00.16) and the Application form factor (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; Dell has released patches via advisory DSA-2026-382.
Information disclosure in light0011 CMS exposes database debug output to unauthenticated remote attackers by manipulating the DB_DEBUG argument processed by the Debug Mode component in App/Common/Conf/config.php. The flaw allows network-accessible attackers to retrieve database diagnostic data - potentially including SQL query traces, schema details, or connection metadata - with no authentication and no user interaction required. A public proof-of-concept exploit exists via GitHub issue #17, and the vendor has not yet responded to the coordinated disclosure report, leaving all deployed instances unpatched.
Organisation metadata enumeration in MISP ≤2.5.45 is possible for authenticated users when the `Security.hide_organisation_index_from_users` configuration option is enabled, because the dashboard organisation picker queries the full organisation table without applying the same ACL conditions enforced by the standard organisation index and per-organisation view endpoints. The picker returns organisation ID, UUID, and name for all organisations, bypassing the visibility restriction. Patch commit 8ca4486af from CIRCL adds the missing `Organisation::createConditions()` call to scope picker results to organisations the requesting user is already authorised to see. No public exploit code has been identified and this CVE is not listed in CISA KEV.
Authenticated information disclosure in MISP ≤2.5.45 allows any logged-in user to bypass email-address redaction by switching from the HTML interface to the REST/JSON representation of DashboardsController::listTemplates(). The query always fetched User.email columns, but the redaction logic only executed inside the non-REST rendering branch - meaning the same session that saw blank email fields in the browser received raw email addresses when requesting JSON. The fix, contributed by CIRCL (MISP's primary maintainer) and released in commit fd554c3bd, centralizes the privilege decision in a new User::canSeeEmails() static helper, conditioning email retrieval on site-admin role or the Security.disclose_user_emails instance setting.
Out-of-bounds read in the 92181 markdown C library's lds() function allows remote unauthenticated attackers to read memory beyond the intended buffer by supplying crafted markdown input. The flaw exists in md.c prior to commit c000d2f9cf390c315378d3717cf20911cf3e80a6, where the lds() function iterated over space characters without enforcing an end-of-buffer boundary. The CVSS 4.0 vector (6.9) reflects low confidentiality, integrity, and availability impact; no public exploit or CISA KEV listing exists at time of analysis.
Hospital Information System 1.0 by code-projects exposes its raw SQL database backup file at the web-accessible path `/HIS/his.sql`, allowing unauthenticated remote attackers to download the full database dump over HTTP with no prerequisites. The vulnerability (CWE-200) stems from placing the database export file inside the application's web root without access controls. A public proof-of-concept exploit document is available on GitHub, confirming practical exploitability; no KEV listing has been issued at time of analysis.
Out-of-bounds read in ModelCloud GPTQModel ≤7.2.0 allows an attacker who controls a GPTQ checkpoint file to trigger unauthorized GPU device memory reads during model inference. The Triton dequantization kernel in `tritonv2.py` indexes `scales`/`qzeros` buffers using the checkpoint-supplied `g_idx` tensor without any upper-bound guard, so a crafted entry ≥ `num_groups` reads past the allocated buffer on the device. A public proof-of-concept exists (GitHub issue #2949), and vendor-released fix v7.3.0 is available.
SQL identifier injection in jaychouchannel's Tourism-Management-System allows remote unauthenticated attackers to enumerate arbitrary database tables and columns by manipulating the `tableName` and `columnName` URL path parameters accepted by multiple endpoints in `CommonController.java`. All commits up to 8122bf020d91199eddfff3ee02d1632a70a9a132 are affected, and exploit code has been publicly disclosed via VulDB. A fix commit (d44ec3aa) is available, introducing a dedicated `SqlIdentifierValidator` to whitelist valid SQL identifiers across the affected controller.
Cleartext storage of sensitive database credentials and user data in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 exposes plaintext secrets via the `cict_portal.sql` file. The SQL dump file, commonly placed within the web-accessible directory in SourceCodester PHP projects, can be retrieved directly over the network without authentication, leaking whatever credentials or personal data it contains. A public proof-of-concept exploit is available on GitHub, confirmed by VulDB and the referenced researcher report, raising the practical exploitation risk above what the moderate CVSS 4.0 score of 6.9 might suggest at first glance.
Session fixation in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows unauthenticated remote attackers to pre-plant a session identifier via the auth_process.php login endpoint, then hijack the authenticated session after a victim logs in. The auth_process.php component fails to regenerate the session ID upon successful authentication, enabling full account takeover of any user who can be socially engineered into authenticating through a crafted link. A public exploit PoC exists on GitHub; no vendor patch has been released.
Local information disclosure in MediaTek's GeniZone trusted execution environment component allows a System-privileged attacker to read out-of-bounds memory due to a missing bounds check (CWE-125), potentially leaking confidential data from the TEE. The flaw affects seventeen MediaTek chipsets documented in the September 2026 security bulletin, and patches are available under IDs ALPS10867524 and ALPS10876355. No public exploit code or active exploitation has been identified at time of analysis, and SSVC assessment rates exploitation status as none.
Use-after-free in the MediaTek GPU kernel driver on chipsets MT6991 and MT8799 allows a local attacker with standard user privileges to read freed kernel or GPU memory, potentially exposing sensitive data such as pointers, credentials, or cryptographic material. The same condition may cause a full system crash, consistent with the Denial of Service tag and the 'system crash' language in the description. No public exploit has been identified and SSVC rates exploitation status as none, placing this in a lower real-world priority bracket despite the C:H rating.
Local information disclosure in MediaTek's Audio Hardware Abstraction Layer affects 63 distinct chipsets, from MT6761 to MT8910, allowing a process already operating at Android System privilege to bypass an absent permission check and extract audio HAL data without authorization. Patch ID ALPS11087632 (Issue MSV-8244) addresses the missing authorization gate, and MediaTek published remediation through the September 2026 security bulletin. SSVC assessment confirms no known exploitation and non-automatable attack path; no public exploit code identified at time of analysis.
Local information disclosure in MediaTek's Audio Hardware Abstraction Layer (HAL) exposes sensitive data to an attacker who has already escalated to System privilege on an affected Android device. Improper input validation (CWE-35 path-traversal class) in the audio subsystem allows a System-level process to read confidentiality-critical data it should not have access to, with no user interaction required. No public exploit code and no CISA KEV listing exist at time of analysis; SSVC assigns exploitation status 'none' and technical impact 'partial', positioning this as a post-compromise data-harvesting primitive rather than a primary attack vector.
CVE-2026-71223 is reported via Ubuntu's security channels, but no description, CVSS score, CWE classification, or affected product detail is available in the current dataset. The vulnerability cannot be characterized beyond its Ubuntu vendor attribution. Security teams should consult Ubuntu Security Notices (USN) or the Ubuntu CVE tracker directly for authoritative details before assessing exposure or priority.
CVE-2026-85218 is attributed to Ubuntu per the vendor intelligence source, but no public description, CVSS score, CWE classification, or technical detail has been released at the time of this analysis. The vulnerability type, affected component, attack vector, and impact are all unknown. No meaningful synthesis of exploitation conditions or attacker capability is possible from available data alone.
Stack buffer underflow in polkit's read_cookie() function, introduced as a regression by the fix for CVE-2026-4897, exposes Linux systems to potential memory corruption and privilege escalation via polkit's D-Bus authentication path. Systems that applied the CVE-2026-4897 patch are specifically affected, meaning the remediation for a prior vulnerability created new exposure. No public exploit code has been identified at time of analysis, but the target (polkit, a setuid/privileged authorization daemon) makes this class of memory corruption high-consequence.
Memory exhaustion via PKCS#7 certificate processing affects an Ubuntu-packaged cryptographic component, allowing crafted certificate containers to gradually leak heap memory. The vulnerable component is reported by Ubuntu but the specific library (e.g., OpenSSL, GnuTLS, or another ASN.1/PKCS#7 parser) is not identified in available data. An attacker capable of delivering malicious PKCS#7 containers to a vulnerable service - such as a TLS endpoint, S/MIME mail processor, or package verification daemon - could trigger sustained memory growth leading to service degradation or crash.
Undefined memory access in PKCS#7 container parsing affects an Ubuntu-packaged cryptographic library, potentially enabling denial of service or information disclosure when processing malformed PKCS#7 input. The specific library (OpenSSL, GnuTLS, NSS, or Linux kernel PKCS#7 module) is not identified in available data. No patch version, CVSS score, or CWE classification was provided, leaving severity and exploitability largely unquantified at time of analysis.
Insufficient data exists to characterize this vulnerability beyond its title. The only available intelligence is the description 'Memory Leak During Message Stringification' and a single Ubuntu vendor attribution. No affected product, version, CVSS score, CWE, CPE, references, or patch details have been provided. Memory leak vulnerabilities during message serialization or stringification operations typically result in heap exhaustion and denial of service, but the specific product, component, and exploitation context remain entirely unknown from available data.
Memory leak vulnerabilities in attribute certificate parsing expose affected cryptographic library users to potential denial-of-service via memory exhaustion. Attribute certificates (X.509v2 AC, RFC 5755) are distinct from public-key certificates and carry authorization attributes; parsing them from untrusted network input - for example during TLS handshakes or certificate validation workflows - would allow an unauthenticated remote attacker to trigger repeated leaks and exhaust process heap memory over time. Reported by Ubuntu, no active exploitation has been identified at time of analysis, and no CVSS score is yet assigned.
Improper access control in JeecgBoot's AI-RAG module (versions up to 3.9.3) permits a low-privileged authenticated user to invoke the exportXls endpoint in AiragModelController.java and extract LLM model credentials by manipulating the credential parameter beyond their authorization level. The attack is network-accessible and requires only a valid low-privileged session with no administrative rights. A public proof-of-concept is available via GitHub issue #9600, and a vendor patch has been released in version 3.9.5.
Out-of-bounds read in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated low-privilege attacker to disclose kernel memory contents across virtually all supported Windows desktop and server releases, from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. The flaw (CWE-125) requires no user interaction and carries high confidentiality impact, making it a viable KASLR-bypass or sensitive-data-leak primitive in a multi-stage local privilege escalation chain. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local information disclosure in the Windows MIDI Service Module allows a low-privileged authenticated local user to read sensitive system information outside its intended authorization boundary. Affecting Windows 11 versions 24H2, 25H2, and 26H1, the flaw (CWE-497) enables an attacker already present on the system to extract data that should be inaccessible to their privilege level. Microsoft has released patches for all three affected branches; no public exploit code or active exploitation has been identified.
Out-of-bounds read in Windows Imaging Component (WIC) allows a locally authenticated attacker with standard user-level privileges to read memory contents beyond allocated buffer boundaries, disclosing potentially sensitive in-process data. The vulnerability affects an exceptionally wide range of Windows releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, confirmed by EUVD/NVD version data and reported directly by Microsoft MSRC. Microsoft has released targeted patches per platform build; no public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds read in Windows Remote Desktop Client exposes sensitive client memory to a network-adjacent attacker who can induce a user to connect to a malicious RDP server. The vulnerability (CWE-125) produces high-confidentiality impact with no integrity or availability loss, yielding a CVSS 5.7 score. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Windows License Manager on multiple Windows 10, 11, and Server editions exposes sensitive system licensing data to locally authenticated low-privileged users due to CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). An attacker with an existing local session can read confidential licensing information — such as activation data, product identifiers, or licensing metadata — without authorization. No public exploit code and no CISA KEV listing have been identified; vendor patches are available for all affected versions, reducing urgency for patched environments.
Out-of-bounds memory read in the Microsoft Standard XPS (XML Paper Specification) component affects virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a locally authenticated user to disclose potentially sensitive memory contents. The flaw (CWE-125) carries CVSS 5.5 with high confidentiality impact but no integrity or availability consequence; scope is unchanged and no user interaction is required beyond the attacker's own session. No public exploit code or active exploitation has been identified, and Microsoft has released patched builds across all affected version lines.
Out-of-bounds read in the Windows Push Message Routing Service exposes process or kernel memory to a locally authenticated attacker, resulting in sensitive information disclosure. The vulnerability affects a wide range of Microsoft Windows releases spanning Windows 10 through Windows 11 and Windows Server 2016 through 2025, making patch surface substantial across enterprise environments. No public exploit code has been identified at time of analysis, and the attack is constrained to local execution with standard user privileges.
Windows DHCP Server on multiple Windows Server versions stores passwords in a recoverable format (CWE-257), enabling an authenticated low-privileged network attacker to extract those credentials over the network. The impact is a pure confidentiality breach - passwords held by the DHCP Server service can be recovered without cracking, potentially enabling lateral movement or privilege escalation through credential reuse. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing the flaw across the full affected version matrix.
Microsoft COM for Windows leaks sensitive information through error messages on a wide range of Windows 10, Windows 11, and Windows Server versions, allowing a locally authenticated attacker with standard user privileges to read high-confidentiality data. The flaw is rooted in CWE-209 (error message content exposure), where COM subsystem error paths disclose internal state that should not be visible to unprivileged callers. No public exploit or active exploitation has been identified at time of analysis, and Microsoft has released patches addressing all affected builds.
Windows GDI+ (Graphics Device Interface Plus) fails to initialize a resource before use (CWE-908), allowing a local low-privileged attacker to read residual memory contents and disclose potentially sensitive information from the affected system. The flaw spans virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - making it one of the broadest-footprint components affected. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog.
Local information disclosure in the Windows Connected User Experiences and Telemetry (DiagTrack) service allows a low-privileged authenticated local attacker to read sensitive data outside their authorized security scope. The CVSS scope-change metric (S:C) indicates the exposed data originates from a security domain beyond the telemetry component itself - likely higher-privileged OS subsystem data. Affecting Windows 10, Windows 11, and Windows Server 2019/2022/2025 across all mainstream support channels, Microsoft has released patches via the standard Patch Tuesday cadence. No public exploit identified at time of analysis.
Numeric truncation error in the Windows Internet Storage Name Service (iSNS) component enables a locally authenticated attacker to disclose sensitive information from affected systems. The flaw spans an exceptionally broad range of Microsoft Windows client and server editions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface management complex. No public exploit or active exploitation is known at time of analysis; a vendor patch is available.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) document processing stack enables a local low-privileged attacker to disclose sensitive memory contents under high-complexity conditions. The flaw spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2012 through Windows 11 25H2 and Server 2025 - making patch deployment across heterogeneous environments operationally significant. Microsoft has released patches via the standard update guide; no public exploit or active exploitation has been identified at time of analysis.
Use-after-free in the Windows Network Connection Broker service allows a local authenticated attacker to read stale heap memory, disclosing potentially sensitive information. The vulnerability spans every supported Windows client and server release from Windows 10 1607 and Windows Server 2016 through Windows 11 25H2 and Windows Server 2025, making the exposed surface extremely broad. Microsoft has shipped patched cumulative updates for all affected SKUs; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows XML Paper Specification (XPS) document handler allows a locally-authenticated standard user to disclose memory contents from the affected process. The flaw spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Out-of-bounds read in the Windows Program Compatibility Assistant (PCA) Service exposes high-confidence memory contents to authenticated network attackers across a broad swath of Windows 10, 11, and Windows Server releases. The flaw (CWE-125) allows a low-privileged user who triggers the right interaction to cause the service to read beyond a buffer boundary, leaking memory over the network with no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Sensitive information disclosure in the Windows Program Compatibility Assistant (PCA) Service allows a locally authenticated attacker with standard user privileges to read sensitive data written to log files. Affected systems include Windows 11 versions 23H2 through 26H1 and Windows Server 2025 in both full and Server Core configurations. No public exploit code or active exploitation has been identified at time of analysis, and vendor-released patches are available via Microsoft's update guide.
Uninitialized resource use in the Microsoft Account component on Windows allows a low-privileged local attacker to disclose sensitive information from memory. Affecting a broad swath of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - the flaw exposes high-confidentiality data (potentially account tokens, credentials, or session state) with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Out-of-bounds read in the Windows Bluetooth Port Driver (bthport.sys) allows a local, low-privileged authenticated attacker to disclose kernel memory contents under high-complexity conditions. Affected platforms span Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1), Windows Server 2022, and Windows Server 2025 across specific build thresholds confirmed by EUVD version data. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis, constraining real-world risk to post-compromise or insider scenarios.
Use-after-free (CWE-416) in Microsoft Office Word enables a locally authenticated attacker to disclose sensitive memory contents. Exploitation requires only low-privileged local access with no user interaction, yielding high confidentiality impact per the CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N vector. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update mechanism.
Information disclosure in the Windows MIDI Service Module affects Windows 11 versions 24H2, 25H2, and 26H1, allowing a locally authenticated low-privileged attacker to read sensitive system information that should remain within an authorized control sphere. The vulnerability (CWE-497) requires no user interaction and is limited to local attack vectors with no integrity or availability impact. Microsoft has released patches addressing all affected builds, and no public exploit or active exploitation has been identified at time of analysis.
Windows Defender Firewall Service on a broad range of Windows client and server editions exposes protected files or directories to low-privileged local attackers (CWE-552), enabling sensitive information disclosure. A local attacker holding a standard user account can access firewall service files - potentially including policy configuration, rule data, or service-level secrets - that should be restricted to privileged processes. Microsoft has released patches across the full affected version range; no public exploit has been identified at the time of analysis.
Symlink following in Windows UPnP Device Host (upnphost) allows a locally authenticated, low-privileged attacker to redirect the service's file access operations through crafted symbolic links or junctions, disclosing the contents of otherwise inaccessible files. The vulnerability spans an unusually wide set of affected Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - indicating a systemic deficiency in how the UPnP host service resolves paths before file access. Microsoft has released corrective patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server (versions 2017 through 2025) allows a low-privileged authenticated attacker to disclose sensitive information over the network by triggering a memory read beyond an allocated buffer boundary. The CVSS vector confirms network-accessible exploitation requiring only low-privilege credentials (PR:L), with no user interaction needed, resulting in high confidentiality impact. No public exploit code or active exploitation has been identified; Microsoft has released patches across all affected servicing branches.
Out-of-bounds memory read in Microsoft SQL Server exposes sensitive server-side data to authenticated network attackers. The flaw (CWE-125) spans four major SQL Server release lines - 2017 through 2025 - in both GDR and Cumulative Update servicing tracks, making it broadly present across enterprise environments. An attacker holding low-privilege SQL Server credentials can exploit this to read memory contents beyond an intended buffer boundary, achieving high confidentiality impact without any user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read (CWE-125) in Microsoft SQL Server 2017 through 2025 allows a low-privileged authenticated attacker to disclose potentially sensitive server memory contents over the network. The flaw spans all four supported major versions across both Cumulative Update (CU) and General Distribution Release (GDR) servicing tracks, producing a broad enterprise exposure surface. Microsoft has released patches for all affected version branches; no public exploit code or CISA KEV listing has been identified at the time of analysis.
Out-of-bounds read in Microsoft SQL Server exposes server memory to authenticated low-privileged network attackers, enabling information disclosure across SQL Server 2017 through 2025. The flaw (CWE-125) is reachable over the network without elevated privileges or user interaction, making it accessible to any valid SQL Server login. Microsoft has released patches across all affected servicing branches; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Out-of-bounds read (CWE-125) in Microsoft SQL Server enables an authenticated network attacker with low privileges to disclose sensitive server-side information. The flaw spans SQL Server 2017 through 2025 across both Cumulative Update and General Distribution Release servicing branches, representing a broad exposure across enterprise database deployments. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches across all affected servicing branches.
Out-of-bounds memory read in Microsoft SQL Server 2017 through 2025 allows network-authenticated, low-privilege database users to disclose sensitive server-side memory contents. The flaw (CWE-125) is reachable over the network with only a valid database account, requiring no user interaction, and affects all currently supported SQL Server release tracks - both Cumulative Update and General Distribution Release channels. Microsoft has released patches across all affected branches; no public exploit code has been identified at time of analysis.
Uninitialized memory exposure in Microsoft SQL Server 2017 through 2025 allows a network-authenticated low-privilege attacker to read sensitive server-side data. The root cause is CWE-908 (Use of Uninitialized Resource), where a memory region is accessed before initialization, potentially leaking residual contents from query buffers, session state, or internal structures. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patches are available across all affected version branches.
Uninitialized memory disclosure in Microsoft SQL Server 2017 through 2025 allows a low-privileged authenticated attacker to read sensitive server memory contents over a network connection. The CWE-908 flaw affects all major SQL Server release branches - 2017, 2019, 2022, and 2025 - across both GDR and Cumulative Update servicing tracks. Microsoft has released patches for all affected versions; no public exploit code or active exploitation is documented at time of analysis.
Out-of-bounds read in Microsoft SQL Server 2017 through 2025 exposes server memory contents to authenticated low-privilege network attackers, enabling information disclosure without integrity or availability impact. The flaw (CWE-125) requires only a valid low-privilege database account and network access, making it accessible to any SQL login holder - including application service accounts - against unpatched instances. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the breadth of affected versions across four major SQL Server release families widens the attack surface considerably.
Out-of-bounds read (CWE-125) in Microsoft SQL Server enables an authenticated, network-adjacent attacker to disclose sensitive in-process memory contents. Affecting SQL Server versions 2017 through 2025 across both GDR and Cumulative Update servicing tracks, exploitation requires valid database credentials but no elevated privileges. Microsoft has released patched builds for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server allows a low-privileged, authenticated attacker to remotely disclose sensitive memory contents over a network. Affected builds span SQL Server 2017 through 2025 across both Cumulative Update and GDR servicing branches. With a CVSS 6.5 and C:H, successful exploitation could expose confidential server-side data; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read (CWE-125) in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated low-privilege network attacker to disclose potentially sensitive server memory contents. The flaw is exploitable over the network with low complexity and requires only a valid database login - no user interaction or elevated privileges are needed. Microsoft has released patches across all six affected servicing branches; no public exploit code or CISA KEV active exploitation has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server 2022 and 2025 enables an authenticated, low-privileged attacker to disclose sensitive server memory contents over the network. The flaw (CWE-125) resides in the SQL Server engine and is reachable via crafted network queries, resulting in high confidentiality impact with no integrity or availability loss. No public exploit code or active exploitation has been identified at time of analysis, but a vendor-released patch is available.
Uninitialized memory disclosure in Microsoft SQL Server 2017 through 2025 allows a network-connected low-privilege authenticated attacker to read sensitive data from SQL Server memory. The flaw (CWE-908) arises when the engine allocates and uses memory without proper initialization, potentially exposing contents from adjacent queries, sessions, or internal data structures. Microsoft has released patches across all affected Cumulative Update and GDR servicing branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Information disclosure in Microsoft SQL Server 2025 allows an authenticated, low-privileged network attacker to extract sensitive data through crafted SQL error messages. Affected are the CU8 and GDR servicing branches of SQL Server 2025, with both patch channels receiving fixes. No active exploitation or public proof-of-concept has been identified at time of analysis, but the CVSS C:H rating indicates the potential for significant confidentiality breach once an attacker has any valid credential.
Out-of-bounds read (CWE-125) in Microsoft SQL Server 2025 allows an authenticated network attacker to disclose sensitive in-memory information. Affected versions span both the CU8 cumulative-update branch (below 17.0.4085.5) and the GDR branch (below 17.0.1135.8). No public exploit or CISA KEV listing exists at time of analysis; Microsoft has released patches for both branches.
Microsoft Teams for Android before build 1416/1.0.0.2026133602 inserts sensitive information into outbound network transmissions (CWE-201), enabling a low-privileged authenticated attacker to intercept and read confidential data over the network when a victim user performs an in-app action. The CVSS scope change (S:C) with high confidentiality impact (C:H) signals that the leaked data can cross trust boundaries beyond the attacker's own session, potentially exposing other users' or sessions' sensitive material. No public exploit identified at time of analysis; Microsoft has released a patch via the MSRC advisory.
Origin validation error (CWE-346) in Microsoft .NET enables network-based information disclosure where an unauthenticated remote attacker can read sensitive data from a .NET application by exploiting improper validation of request origins. Affected are multiple active .NET release trains (8.0, 9.0, 10.0, 11.0 RC1) and Microsoft Visual Studio 2022 and 2026 where bundled .NET runtimes are included. The CVSS vector (UI:R) indicates user interaction is required, consistent with a cross-origin attack pattern where a victim must visit an attacker-controlled page that triggers the malicious cross-origin request. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated information disclosure in TP-Link Omada Controller exposes an initialization API endpoint that remains reachable after setup completes, leaking account-related data to any remote unauthenticated user. The endpoint was designed for one-time use during initial controller configuration but lacks post-initialization access controls, allowing attackers to query it freely. Successful exploitation facilitates user enumeration, which can serve as a reconnaissance step toward credential-stuffing or targeted brute-force attacks against administrative accounts. No public exploit or CISA KEV listing is identified at time of analysis.
Field policy bypass in AshLua 0.1.0-0.2.1 allows authenticated Lua script executors to read actor-restricted fields by requesting them through aggregate operations (min, max, first, sum, avg, list) rather than as direct record fields, circumventing per-actor field policy authorization while remaining within the configured exposed-field allow-list. The Ash framework normally redacts forbidden fields on returned record structs with %Ash.ForbiddenField{}, but AshLua's read action did not apply this check when constructing ad-hoc Ash.Query.Aggregate instances, returning raw field values instead. No public exploit code exists and the vulnerability is not in CISA KEV; the CVSS 4.0 score of 6.0 reflects network-accessible but prerequisite-gated exploitation requiring authenticated script execution access.
Field policy bypass in ash_ai (versions 0.1.0 through < 1.0.3) allows authenticated, low-privilege actors to read per-actor-restricted fields - including sensitive PII - by invoking the aggregate result type (min, max, sum, avg) via the LLM read tool instead of direct record retrieval. Ash field policies redact forbidden fields on returned records by substituting %Ash.ForbiddenField{}, but this redaction mechanism was never applied to aggregate code paths; the tool's authorization check only tested field.public?, a static attribute orthogonal to per-actor policy evaluation. Patch version 1.0.3 is available via the vendor advisory; no CISA KEV listing or public exploit code has been identified at time of analysis.
Query statistics serialization on the MongoDB sharded cluster router (mongos) fails to apply redaction to search query literals, exposing sensitive data to holders of the monitoring privilege. An improper conditional check in the serialization logic causes the redaction mechanism to be bypassed specifically for search queries transiting the router, leaving raw query text - which may contain PII, credentials embedded in queries, or proprietary data - stored and accessible via the queryStats interface. Affected versions are MongoDB Server 8.3.0 through 8.3.8; a fix is available in 8.3.9. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Heap out-of-bounds read in MongoDB Server's query planning component allows an authenticated database user with read/write privileges to disclose partial server heap memory contents. Crafted query operations cause the server to read beyond allocated heap buffer boundaries during query plan construction, with leaked memory fragments surfacing through diagnostic query statistics output. Affected releases span MongoDB Server 7.0.0-7.0.40, 8.0.0-8.0.29, and 8.3.0-8.3.8, with fixed versions available across all three branches per vendor advisory SERVER-131562.
Credential interception via man-in-the-middle attack is possible against Nozomi Networks Guardian sensors using the Smart Polling feature, which establishes encrypted connections to polled OT/ICS devices without validating the remote host's identity and provides no configuration option to enable such validation. An attacker with network positioning between the sensor and a target device can impersonate the device, capture the authentication credentials transmitted during polling sessions, and replay those credentials to authenticate directly against the device or other devices sharing the same credentials. This enables unauthorized access, data manipulation, and operational disruption of monitored industrial devices. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated information disclosure in XenForo before 2.3.13 exposes private content metadata through the unfurl link-preview endpoint, which performs no session, user identity, or visibility checks on retrieved records. An unauthenticated remote attacker can enumerate predictable auto-increment integer IDs to retrieve rendered preview HTML, original URLs, and query strings generated from private conversations and other access-controlled forum areas. No public exploit has been identified at time of analysis, but the attack is trivially automatable through sequential ID iteration; the issue is fixed in XenForo 2.3.13.
Xen hypervisor on x86 PV (paravirtualized) guest configurations contains a race condition in memory page lifecycle management that allows a guest to write to pages already scrubbed by Xen. When a PV guest frees a memory page, Xen defers the TLB flush until the page is re-used - but scrubbing occurs before that flush, creating a window in which the guest's stale TLB entry remains valid for a page now considered clean. This permits the attacking PV guest to inject arbitrary data into a scrubbed page, which may subsequently be allocated to another guest, undermining Xen's inter-VM memory isolation guarantee. No public exploit has been identified at time of analysis, and SSVC assessment rates exploitation as none and non-automatable.
Stack buffer over-read in PX4 Autopilot through v1.17.0 exposes stack memory via the netman system command's interface name handling. Supplying an interface name of 74 bytes or more via the -i option bypasses missing length validation, causing reads beyond allocated buffer boundaries; the over-read data leaks to console output and may also be written into persistent network configuration files, risking both information disclosure and config corruption across reboots. No public exploit or active exploitation has been identified, but the upstream fix is available as a merged GitHub PR and commit.
Sensitive credential material - including authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions - was written to diagnostic log files across six Snowflake client drivers (Python, Go, JDBC, Node.js, PHP PDO, and ODBC) due to incomplete log-redaction coverage. An attacker with read access to the log destination, whether a local filesystem, a log aggregation pipeline, or a CI/CD artifact store, can extract valid credentials and decryption keys. Exploitation impact is bounded by credential lifetime and object scope, but successful use of harvested tokens provides authenticated access to the corresponding Snowflake account or cloud-storage objects. No public exploit is identified at time of analysis; vendor-released patches are available for all six drivers as of September 3, 2026.
Unstripped debug symbols in Siemens Reyrolle 7SR5 protection relay firmware (all versions prior to V2.70) expose internal function names, type definitions, and structure layouts to any party who downloads the publicly available firmware update packages. This does not directly compromise deployed devices but substantially reduces the skill and effort required for an attacker to identify exploitable weaknesses through static firmware analysis. No public exploit or active exploitation has been identified; Siemens has released firmware V2.70 as the fix per advisory SSA-142885.
Direct web-accessible SQL backup file exposure in code-projects Student Crud Operation 1.0 allows unauthenticated remote attackers to download the raw database dump `/card_activation.sql` from the web root. The file likely contains database schema and card activation records, exposing sensitive application data without any authentication. No public exploit identified at time of analysis is incorrect - publicly available exploit code exists per the referenced GitHub writeup, though no CISA KEV listing is present.
NTLM credential hash theft from Windows users running ASUS Armoury Crate is possible when a user visits an attacker-controlled web page that exploits the application's permissive cross-domain (CORS) policy. The local Armoury Crate service accepts cross-origin requests from untrusted web origins, allowing malicious JavaScript to inject a UNC path into a service call; Windows then automatically initiates SMB authentication to the attacker's server, transmitting the user's NTLMv2 hash without further interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the underlying coercion technique is well-understood and the attack requires only a single user click.
Uninitialized kernel memory disclosure through the ASUS Armoury Crate Windows driver allows a local low-privileged user to read sensitive data from previously used kernel buffers. The attacker crafts a malicious IOCTL request that bypasses the driver's built-in security verification mechanism, triggering a read of uncleared memory content (CWE-226). No active exploitation has been identified and no public exploit code is known at time of analysis; risk is bounded by the local access prerequisite and the AC:H complexity of defeating the security check.
Kernel virtual address disclosure in the ASUS Armoury Crate Windows driver enables a local low-privileged user to bypass the driver's IOCTL input verification through a crafted request, obtaining kernel virtual addresses and exposing the kernel memory layout. All versions of Armoury Crate are listed as affected per CPE cpe:2.3:a:asus:armoury_crate:*:*:*:*:*:*:*:*. While direct impact is limited to information disclosure, this class of kernel pointer leak is routinely used to defeat KASLR as a prerequisite step in local kernel privilege-escalation chains; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized administrative interface access in SAP Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server exposes sensitive system state to authenticated low-privileged users. Exploiting this flaw, an attacker with only a basic SAP account can query administrative endpoints normally restricted to higher-privilege roles, retrieving configuration details, system internals, or operational data that could serve as reconnaissance for follow-on attacks. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the low authentication bar (any valid low-privilege account) and direct network accessibility make the exposure surface meaningful in enterprise SAP environments.
Multi-tenant OAuth2 metadata cross-tenant leakage in ash_authentication_oauth2_server (versions 0.1.3 through before 0.3.1) causes shared HTTP caches to serve one tenant's RFC 8414/RFC 9728 discovery metadata - including issuer, authorization_endpoint, token_endpoint, and jwks_uri - to another tenant's clients for up to one hour. The vulnerability arises because the Phoenix ProtocolRouter sent all metadata responses with Cache-Control: public, max-age=3600 and no Vary header; when tenant identity is derived from a request header or Host (not the URL), shared caches key on URL alone, making cross-tenant cache poisoning trivially repeatable. Downstream impact extends beyond disclosure: affected clients may direct authorization codes and client secrets to the wrong tenant's token endpoint and validate tokens against the wrong JWKS keys. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Plaintext credential storage in Dell Secure Connect Gateway 5.0 exposes passwords to local low-privileged attackers, leading to information disclosure. Both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified; the CVSS score of 4.7 Medium reflects the local-only, high-complexity attack path.
IntelliJ IDEA before version 2026.2.2 leaks project metadata to JetBrains Marketplace due to a missing project-trust check, exposing potentially sensitive project information without developer consent. The flaw requires local access and user interaction - specifically, a developer must open an untrusted project for the metadata transmission to occur. No public exploit code exists and no active exploitation has been identified; the impact is limited to a low-severity confidentiality breach (CVSS 3.3).
Terminal command input written to idea.log in JetBrains IntelliJ IDEA before 2026.2.2 exposes sensitive command-line strings to any local party that can read the IDE's diagnostic log. Classified as CWE-532 (Insertion of Sensitive Information into Log File), the flaw means that developers who type passwords, API keys, or tokens as command-line arguments in IntelliJ's integrated terminal inadvertently persist those secrets on disk in a plaintext log file. No public exploit has been identified at time of analysis, and the vendor-assigned CVSS score of 2.8 accurately reflects the constrained local-only, user-interaction-dependent attack surface.
Credential exfiltration in JetBrains YouTrack before 2026.2.18769 allows a project administrator to redirect stored mailbox credentials to an attacker-controlled server by modifying the mailbox host setting without triggering re-authentication. The missing re-authentication gate means any project admin who has been compromised, is malicious, or has temporarily elevated access can silently capture email account credentials (username and password) already stored in YouTrack. No public exploit has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
IP spoofing via forged HTTP headers in JetBrains YouTrack before 2026.2.18634 allows unauthenticated remote attackers to bypass Bitbucket webhook source validation, causing YouTrack to process attacker-crafted webhook payloads as if they originated from a legitimate Bitbucket server. The root cause is CWE-291 - reliance on IP address for authentication - specifically trusting client-controlled headers such as X-Forwarded-For to gate webhook acceptance. No public exploit has been identified at time of analysis, and JetBrains has released a patched build.
Hard-coded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a local low-privileged attacker to decrypt protected data, leading to high-severity information disclosure. Both the Appliance form factor (prior to 5.36.00.16) and the Application form factor (prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis, and the local access requirement significantly constrains the attack surface.
Improper locking in Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application allows a low-privileged remote attacker to exploit a synchronization race condition, resulting in unauthorized filesystem access on the affected system. The vendor CVSS vector rates the primary impact as A:H (Availability), yet the description specifically references attacker filesystem access - a tension that suggests possible confidentiality or integrity impact beyond what the official score reflects. Dell has released fixed versions and published advisory DSA-2026-382; no public exploit or active CISA KEV listing exists at time of analysis.
Cleartext storage of sensitive information in Dell Secure Connect Gateway 5.0 exposes credentials or configuration secrets to any low-privileged local user on the host. Both the hardware Appliance (versions prior to 5.36.00.16) and the virtual Application (versions prior to 5.36.00.00) are affected, as confirmed by Dell Security Advisory DSA-2026-382. No public exploit identified at time of analysis, but the CVSS C:H rating indicates that successful exploitation yields full confidentiality compromise of the stored sensitive material.
Sensitive information exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged local attacker to read sensitive data written to application log files without sanitization. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected across all platforms. No public exploit code or active exploitation has been identified; Dell has released fixes via advisory DSA-2026-382.
Hardcoded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance and Application variants - allows a low-privileged local attacker to access protected data encrypted with the embedded key, leading to information disclosure. Affected versions include SCG 5.0 Appliance prior to 5.36.00.16 and SCG 5.0 Application prior to 5.36.00.00. Dell has released patched versions via DSA-2026-382; no public exploit or KEV listing has been identified at time of analysis.
Hard-coded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a local low-privileged attacker to decrypt data that was intended to be cryptographically protected, resulting in high-severity information disclosure. Both the Appliance form factor (versions prior to 5.36.00.16) and the Application form factor (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; Dell has released patches via advisory DSA-2026-382.
Information disclosure in light0011 CMS exposes database debug output to unauthenticated remote attackers by manipulating the DB_DEBUG argument processed by the Debug Mode component in App/Common/Conf/config.php. The flaw allows network-accessible attackers to retrieve database diagnostic data - potentially including SQL query traces, schema details, or connection metadata - with no authentication and no user interaction required. A public proof-of-concept exploit exists via GitHub issue #17, and the vendor has not yet responded to the coordinated disclosure report, leaving all deployed instances unpatched.
Organisation metadata enumeration in MISP ≤2.5.45 is possible for authenticated users when the `Security.hide_organisation_index_from_users` configuration option is enabled, because the dashboard organisation picker queries the full organisation table without applying the same ACL conditions enforced by the standard organisation index and per-organisation view endpoints. The picker returns organisation ID, UUID, and name for all organisations, bypassing the visibility restriction. Patch commit 8ca4486af from CIRCL adds the missing `Organisation::createConditions()` call to scope picker results to organisations the requesting user is already authorised to see. No public exploit code has been identified and this CVE is not listed in CISA KEV.
Authenticated information disclosure in MISP ≤2.5.45 allows any logged-in user to bypass email-address redaction by switching from the HTML interface to the REST/JSON representation of DashboardsController::listTemplates(). The query always fetched User.email columns, but the redaction logic only executed inside the non-REST rendering branch - meaning the same session that saw blank email fields in the browser received raw email addresses when requesting JSON. The fix, contributed by CIRCL (MISP's primary maintainer) and released in commit fd554c3bd, centralizes the privilege decision in a new User::canSeeEmails() static helper, conditioning email retrieval on site-admin role or the Security.disclose_user_emails instance setting.
Out-of-bounds read in the 92181 markdown C library's lds() function allows remote unauthenticated attackers to read memory beyond the intended buffer by supplying crafted markdown input. The flaw exists in md.c prior to commit c000d2f9cf390c315378d3717cf20911cf3e80a6, where the lds() function iterated over space characters without enforcing an end-of-buffer boundary. The CVSS 4.0 vector (6.9) reflects low confidentiality, integrity, and availability impact; no public exploit or CISA KEV listing exists at time of analysis.
Hospital Information System 1.0 by code-projects exposes its raw SQL database backup file at the web-accessible path `/HIS/his.sql`, allowing unauthenticated remote attackers to download the full database dump over HTTP with no prerequisites. The vulnerability (CWE-200) stems from placing the database export file inside the application's web root without access controls. A public proof-of-concept exploit document is available on GitHub, confirming practical exploitability; no KEV listing has been issued at time of analysis.
Out-of-bounds read in ModelCloud GPTQModel ≤7.2.0 allows an attacker who controls a GPTQ checkpoint file to trigger unauthorized GPU device memory reads during model inference. The Triton dequantization kernel in `tritonv2.py` indexes `scales`/`qzeros` buffers using the checkpoint-supplied `g_idx` tensor without any upper-bound guard, so a crafted entry ≥ `num_groups` reads past the allocated buffer on the device. A public proof-of-concept exists (GitHub issue #2949), and vendor-released fix v7.3.0 is available.
SQL identifier injection in jaychouchannel's Tourism-Management-System allows remote unauthenticated attackers to enumerate arbitrary database tables and columns by manipulating the `tableName` and `columnName` URL path parameters accepted by multiple endpoints in `CommonController.java`. All commits up to 8122bf020d91199eddfff3ee02d1632a70a9a132 are affected, and exploit code has been publicly disclosed via VulDB. A fix commit (d44ec3aa) is available, introducing a dedicated `SqlIdentifierValidator` to whitelist valid SQL identifiers across the affected controller.
Cleartext storage of sensitive database credentials and user data in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 exposes plaintext secrets via the `cict_portal.sql` file. The SQL dump file, commonly placed within the web-accessible directory in SourceCodester PHP projects, can be retrieved directly over the network without authentication, leaking whatever credentials or personal data it contains. A public proof-of-concept exploit is available on GitHub, confirmed by VulDB and the referenced researcher report, raising the practical exploitation risk above what the moderate CVSS 4.0 score of 6.9 might suggest at first glance.
Session fixation in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows unauthenticated remote attackers to pre-plant a session identifier via the auth_process.php login endpoint, then hijack the authenticated session after a victim logs in. The auth_process.php component fails to regenerate the session ID upon successful authentication, enabling full account takeover of any user who can be socially engineered into authenticating through a crafted link. A public exploit PoC exists on GitHub; no vendor patch has been released.
Local information disclosure in MediaTek's GeniZone trusted execution environment component allows a System-privileged attacker to read out-of-bounds memory due to a missing bounds check (CWE-125), potentially leaking confidential data from the TEE. The flaw affects seventeen MediaTek chipsets documented in the September 2026 security bulletin, and patches are available under IDs ALPS10867524 and ALPS10876355. No public exploit code or active exploitation has been identified at time of analysis, and SSVC assessment rates exploitation status as none.
Use-after-free in the MediaTek GPU kernel driver on chipsets MT6991 and MT8799 allows a local attacker with standard user privileges to read freed kernel or GPU memory, potentially exposing sensitive data such as pointers, credentials, or cryptographic material. The same condition may cause a full system crash, consistent with the Denial of Service tag and the 'system crash' language in the description. No public exploit has been identified and SSVC rates exploitation status as none, placing this in a lower real-world priority bracket despite the C:H rating.
Local information disclosure in MediaTek's Audio Hardware Abstraction Layer affects 63 distinct chipsets, from MT6761 to MT8910, allowing a process already operating at Android System privilege to bypass an absent permission check and extract audio HAL data without authorization. Patch ID ALPS11087632 (Issue MSV-8244) addresses the missing authorization gate, and MediaTek published remediation through the September 2026 security bulletin. SSVC assessment confirms no known exploitation and non-automatable attack path; no public exploit code identified at time of analysis.
Local information disclosure in MediaTek's Audio Hardware Abstraction Layer (HAL) exposes sensitive data to an attacker who has already escalated to System privilege on an affected Android device. Improper input validation (CWE-35 path-traversal class) in the audio subsystem allows a System-level process to read confidentiality-critical data it should not have access to, with no user interaction required. No public exploit code and no CISA KEV listing exist at time of analysis; SSVC assigns exploitation status 'none' and technical impact 'partial', positioning this as a post-compromise data-harvesting primitive rather than a primary attack vector.
CVE-2026-71223 is reported via Ubuntu's security channels, but no description, CVSS score, CWE classification, or affected product detail is available in the current dataset. The vulnerability cannot be characterized beyond its Ubuntu vendor attribution. Security teams should consult Ubuntu Security Notices (USN) or the Ubuntu CVE tracker directly for authoritative details before assessing exposure or priority.
CVE-2026-85218 is attributed to Ubuntu per the vendor intelligence source, but no public description, CVSS score, CWE classification, or technical detail has been released at the time of this analysis. The vulnerability type, affected component, attack vector, and impact are all unknown. No meaningful synthesis of exploitation conditions or attacker capability is possible from available data alone.
Stack buffer underflow in polkit's read_cookie() function, introduced as a regression by the fix for CVE-2026-4897, exposes Linux systems to potential memory corruption and privilege escalation via polkit's D-Bus authentication path. Systems that applied the CVE-2026-4897 patch are specifically affected, meaning the remediation for a prior vulnerability created new exposure. No public exploit code has been identified at time of analysis, but the target (polkit, a setuid/privileged authorization daemon) makes this class of memory corruption high-consequence.
Memory exhaustion via PKCS#7 certificate processing affects an Ubuntu-packaged cryptographic component, allowing crafted certificate containers to gradually leak heap memory. The vulnerable component is reported by Ubuntu but the specific library (e.g., OpenSSL, GnuTLS, or another ASN.1/PKCS#7 parser) is not identified in available data. An attacker capable of delivering malicious PKCS#7 containers to a vulnerable service - such as a TLS endpoint, S/MIME mail processor, or package verification daemon - could trigger sustained memory growth leading to service degradation or crash.
Undefined memory access in PKCS#7 container parsing affects an Ubuntu-packaged cryptographic library, potentially enabling denial of service or information disclosure when processing malformed PKCS#7 input. The specific library (OpenSSL, GnuTLS, NSS, or Linux kernel PKCS#7 module) is not identified in available data. No patch version, CVSS score, or CWE classification was provided, leaving severity and exploitability largely unquantified at time of analysis.
Insufficient data exists to characterize this vulnerability beyond its title. The only available intelligence is the description 'Memory Leak During Message Stringification' and a single Ubuntu vendor attribution. No affected product, version, CVSS score, CWE, CPE, references, or patch details have been provided. Memory leak vulnerabilities during message serialization or stringification operations typically result in heap exhaustion and denial of service, but the specific product, component, and exploitation context remain entirely unknown from available data.
Memory leak vulnerabilities in attribute certificate parsing expose affected cryptographic library users to potential denial-of-service via memory exhaustion. Attribute certificates (X.509v2 AC, RFC 5755) are distinct from public-key certificates and carry authorization attributes; parsing them from untrusted network input - for example during TLS handshakes or certificate validation workflows - would allow an unauthenticated remote attacker to trigger repeated leaks and exhaust process heap memory over time. Reported by Ubuntu, no active exploitation has been identified at time of analysis, and no CVSS score is yet assigned.
Improper access control in JeecgBoot's AI-RAG module (versions up to 3.9.3) permits a low-privileged authenticated user to invoke the exportXls endpoint in AiragModelController.java and extract LLM model credentials by manipulating the credential parameter beyond their authorization level. The attack is network-accessible and requires only a valid low-privileged session with no administrative rights. A public proof-of-concept is available via GitHub issue #9600, and a vendor patch has been released in version 3.9.5.