Microsoft
Monthly
Missing authorization controls in Microsoft Edge (Chromium-based) allow a local attacker without any system privileges to bypass authorization and perform tampering actions against the browser. The flaw (CWE-862) results in high confidentiality impact per the CVSS vector, though the description characterizes the effect as tampering - a discrepancy addressed in confidence notes below. No public exploit code has been identified and Microsoft has released an official patch through the MSRC advisory portal.
Code injection (CWE-94) in Microsoft Edge (Chromium-based) enables network-based spoofing attacks against users who interact with attacker-controlled content. An unauthorized remote attacker can exploit improper code generation controls to inject and execute code within the browser's execution context, crossing security scope boundaries (S:C) to spoof content or interfaces presented to the victim. No public exploit has been identified at time of analysis (E:U temporal metric), and Microsoft has released an official fix via the MSRC update guide.
Spoofing via origin validation failure in Microsoft Edge (Chromium-based) allows a network-adjacent unauthenticated attacker to deceive users or systems about the true origin of web content or requests. All Chromium-based Edge versions are affected per the wildcard CPE, and a vendor-released patch is confirmed via the Microsoft Security Response Center. No public exploit code exists and active exploitation is not confirmed - the CVSS temporal metric E:U (exploit unproven) and absence of CISA KEV listing reinforce a currently theoretical risk level.
Microsoft Edge (Chromium-based) is affected by a Time-of-Check Time-of-Use (TOCTOU) race condition that allows a remote, unauthenticated attacker to disclose sensitive information over the network, contingent on user interaction. The flaw exploits the timing gap between a security check and subsequent resource use within the Chromium-based browser engine, potentially exposing cross-origin data or internal browser state. No active exploitation has been confirmed by CISA KEV, and the temporal CVSS metrics (E:U) confirm no proven exploit code exists at time of analysis; a vendor patch is available via MSRC.
Origin validation error in Microsoft Edge (Chromium-based) enables a local, unauthenticated attacker to bypass cross-origin restrictions and perform data tampering. The CVSS vector (AV:L/PR:N) indicates that any unprivileged local user - including guest or kiosk session users - can trigger this flaw without requiring prior authentication or user interaction. With a high confidentiality impact (C:H) and low integrity impact (I:L), exploitation could expose sensitive browser-held data while also permitting limited content manipulation. No public exploit code has been identified and CISA KEV does not list this CVE; the temporal metric E:U corroborates no known active exploitation at time of analysis.
Man-in-the-middle interception of SSH sessions and file transfers is possible through the EMR SSH helper commands in Amazon AWS CLI v1 before 1.45.28 and v2 before 2.35.3 due to missing entity authentication during the SSH key exchange. Network-positioned attackers - requiring no privileges or user interaction - can substitute their own key material during the handshake and silently relay or inspect the session. No active exploitation is confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the impact on downstream EMR cluster confidentiality is rated high (SC:H in the CVSS 4.0 vector).
UI spoofing in the Google Chrome Updater component on Windows (prior to 151.0.7922.72) enables a local attacker to present a falsified interface to users by placing a malicious file in a location the Updater processes. Chromium's own team rates this 'Low' severity, consistent with the 4.0 CVSS score, EPSS of 0.10% (1st percentile), and SSVC exploitation status of 'none'. No public exploit exists at time of analysis, and a vendor-confirmed patch is available in Chrome 151.0.7922.72.
Uninitialized memory use in Skia, Chrome's 2D graphics rendering engine, exposes process memory contents to remote attackers on Windows via crafted HTML pages in Google Chrome versions prior to 151.0.7922.72. The flaw is strictly an information disclosure issue (CWE-457), with no integrity or availability impact, affecting only the Windows platform per the vulnerability description. No public exploit code has been identified, EPSS places exploitation probability at 0.19% (9th percentile), and SSVC classifies exploitation as none with partial technical impact - collectively suggesting limited real-world risk despite the CVSS C:H rating.
Use-after-free in Chrome's DataTransfer component on Windows exposes process memory to local attackers who can deliver a crafted HTML page to a victim. The flaw affects all Chrome versions on Windows prior to 151.0.7922.72 and results in high-confidence confidentiality loss with no integrity or availability impact. No public exploit code has been identified and EPSS sits at 0.11% (2nd percentile), consistent with CISA SSVC classifying exploitation as 'none' and technical impact as 'partial' - making this a low operational priority despite the High confidentiality CVSS sub-score.
Sandbox escape in Google Chrome's Printing component on Windows enables a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on Windows. No public exploit has been identified, EPSS sits at the 7th percentile (0.17%), CISA SSVC rates exploitation as none and the attack as non-automatable, making this a low-urgency patching item despite the sandbox-escape classification.
Cross-origin data leakage in the Enterprise policy implementation of Google Chrome on Windows (versions prior to 151.0.7922.72) enables a remote attacker to extract data across origin boundaries by delivering a malicious file to a victim user. The CWE-346 (Origin Validation Error) root cause indicates Chrome's Enterprise component fails to enforce same-origin boundaries in this specific code path, exposing data that should be restricted. No public exploit has been identified and EPSS sits at the 6th percentile, with CISA SSVC confirming no current exploitation; this is a low-urgency but real information disclosure risk for enterprise Chrome deployments on Windows.
Cross-origin data leak in Google Chrome on Windows (prior to 151.0.7922.72) stems from uninitialized memory use in the WebNN subsystem, exposing fragments of memory that may contain data from other origins. A remote attacker can trigger this flaw by luring a victim to a crafted HTML page, requiring no authentication but necessitating user interaction. No public exploit identified at time of analysis; EPSS sits at just 0.20% (10th percentile), consistent with a medium-severity information disclosure with no code execution potential.
Same-origin policy bypass in Google Chrome for Windows (prior to 151.0.7922.72) allows a remote attacker who has already compromised the Chrome renderer process to circumvent cross-origin isolation controls via a crafted HTML page exploiting an origin validation flaw (CWE-346) in the Media component. This is a second-stage, chained exploitation capability - not a standalone entry point - requiring a prior renderer compromise to weaponize, which substantially constrains its independent risk. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile); the vendor patch is available in Chrome 151.0.7922.72.
Uninitialized memory read in ANGLE (Chrome's graphics abstraction layer) on Windows exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. Affected are all Google Chrome releases on Windows prior to 151.0.7922.72. An attacker who persuades a user to visit a malicious page can trigger the ANGLE component to read and potentially leak uninitialized memory, risking disclosure of in-process data. No public exploit code has been identified and EPSS stands at 0.23% (14th percentile), indicating low observed exploitation probability despite the broad deployment footprint of Chrome.
Uninitialized memory disclosure in Google Chrome's Media component on Windows exposes process memory to attackers who have already achieved renderer process compromise. Versions prior to 151.0.7922.72 are affected. A renderer-compromised attacker delivers a crafted HTML page to trigger a CWE-457 uninitialized variable read, potentially leaking sensitive in-memory data such as credentials, tokens, or cryptographic material. No public exploit has been identified at time of analysis, SSVC rates exploitation as none, and EPSS sits at 0.31% - indicating low observed exploitation pressure despite the High CVSS confidentiality impact.
Cross-origin data leakage in Google Chrome's Media component on Windows (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a crafted HTML page. The flaw is rooted in insufficient input validation (CWE-20) in the Media subsystem, exploitable only on Windows and only as a second-stage primitive following a prior renderer compromise. No public exploit code has been identified and EPSS is low at 0.29% (21st percentile), placing this firmly in the targeted-attacker rather than mass-exploitation threat category.
Cross-Site Request Forgery in the Facturación Electrónica Costa Rica WordPress plugin (all versions through 2.0.2) allows unauthenticated attackers to overwrite critical plugin configuration - including API tokens, Hacienda environment mode, and invoice emission flags - by tricking a logged-in site administrator into clicking a malicious link. The flaw stems from missing nonce validation in the admin configuration handler exposed via fvcr_admin_page_html, confirmed by Wordfence with direct source references to admin/configuration.php and functions.php. No public exploit or active exploitation has been identified at time of analysis, though the financial-system integration amplifies the business impact of a successful attack.
SQL injection in the Advocate Office Management System 1.0 (a SourceCodester PHP application) lets remote unauthenticated attackers inject arbitrary SQL through the 'id' GET parameter of control/activate_case.php. Publicly available exploit code exists (SSVC exploitation status: poc), with confirmed error-based and time-based blind techniques enabling full database extraction; the 'remote code execution' framing in the report is not substantiated by the provided sqlmap payloads. EPSS is low (0.16%, 6th percentile) and the flaw is not on CISA KEV, so no active exploitation is confirmed.
Improper input validation in Edge for Android allows a remote attacker to tamper with data over a network by convincing a user to interact with malicious content. Exploitation requires user interaction and results in low confidentiality and integrity impact, with no availability loss. No public exploit or active exploitation is known; an official vendor patch is available.
A spoofing vulnerability in Microsoft Edge (Chromium-based) allows remote attackers to bypass origin validation, enabling them to trick users into believing they are interacting with a trusted website. The flaw, tracked as CVE-2026-57978, affects all pre-patch versions of Edge and can be exploited via a malicious site with user interaction. No active exploitation or public exploit code has been identified, and Microsoft has released a patch.
Microsoft Graph exposes sensitive information to authenticated network attackers through an information disclosure flaw classified under CWE-200. Any attacker holding a valid low-privilege credential can query the Microsoft Graph API over the network to retrieve data they should not have access to, without requiring additional user interaction or elevated rights. No active exploitation is confirmed (not in CISA KEV), and Microsoft has released an official fix; however, the high confidentiality impact and low attack complexity make this a meaningful risk for any organization relying on Microsoft 365 services.
Privilege abuse in Tridium Niagara Framework and Niagara Enterprise Security allows an authenticated high-privileged user on an adjacent network to improperly access confidential data and perform limited unauthorized modifications beyond their sanctioned scope. Affected platforms span Windows, Linux, and QNX, and versions prior to 4.14.6 and 4.15.5 are vulnerable. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Uncontrolled resource consumption in dompdf's BMP image processing pipeline allows any unauthenticated attacker who can submit HTML to a dompdf-powered endpoint to exhaust server memory and stall PHP-FPM worker pools with a 169-byte HTTP request. The library trusts attacker-controlled BMP header dimensions without bounding width × height, causing PHP's GD extension to allocate a full native pixel canvas - bypassing PHP's memory_limit entirely because GD allocates through its own native allocator. A publicly available, verified proof-of-concept demonstrates ~12× memory amplification (34 MB control vs ~412 MB attack peak RSS) from identically-sized requests, making this a high-impact, low-effort denial-of-service primitive. No active exploitation confirmed in CISA KEV at time of analysis.
Server-side request forgery in Progress Telerik UI for ASP.NET AJAX's RadEditor PDF export feature enables authenticated attackers to force the web server to issue outbound HTTP requests to arbitrary attacker-controlled hosts. Because the affected product runs on Windows, those outbound connections can carry Windows NTLM authentication material, exposing credentials for potential relay or offline cracking attacks. The vulnerability affects all versions prior to v2026.2.708 and carries a vendor-confirmed CVSS 6.5 (High confidentiality impact) with no public exploit identified at time of analysis.
Shell sandbox bypass in the optional @n8n/computer-use package for n8n exposes the full host filesystem and network to any privileged user who can invoke a computer-use workflow on Linux or Windows, because sandboxing was only implemented for macOS. Affected are n8n versions before 2.29.8 and 2.30.x before 2.30.1; standard n8n installations without the @n8n/computer-use package are entirely unaffected. No public exploit has been identified at time of analysis, but the subsequent-system impact is rated High across confidentiality, integrity, and availability in the vendor-sourced CVSS 4.0 vector.
Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) exposes a network-exploitable flaw in its Outlook Sync Win 32 component that allows low-privileged authenticated users to perform unauthorized data reads, writes, and cause a partial denial of service via HTTP. Oracle classified this as easily exploitable, with low attack complexity and no user interaction required beyond holding a valid low-level account. No public exploit identified at time of analysis and it does not appear in the CISA KEV catalog, but the low barrier to exploitation makes it a credible insider or compromised-credential threat for affected EBS deployments.
Unauthorized data manipulation via authentication bypass in Oracle Siebel CRM Integration's Siebel Server Sync for Exchange component allows unauthenticated remote attackers to insert, update, or delete a subset of CRM-accessible data over HTTP. All versions from 17.0 through 26.5 are affected, with exploitation constrained by high attack complexity that substantially reduces real-world risk. No public exploit code or active exploitation has been identified at time of analysis, consistent with the low CVSS score of 3.7 reflecting limited, integrity-only impact.
Public-only personal access token scope enforcement in Gitea's REST API is inconsistently applied across two organization endpoints, allowing a token holder to enumerate private organization memberships and retrieve detailed permission data (ownership, admin status, write access, repository-creation capability) that the public-only restriction was explicitly designed to block. All Gitea versions prior to 1.27.0 are affected via GET /api/v1/user/orgs and GET /api/v1/users/{username}/orgs/{org}/permissions. Publicly available exploit code with full HTTP request/response traces is confirmed in the GHSA advisory; no CISA KEV listing exists, indicating no confirmed opportunistic mass exploitation at time of analysis.
Cross-repository information disclosure in Gitea's org-level Actions API exposes workflow run and job metadata from private repositories to any authenticated organization member, regardless of per-repository access rights. The endpoints GET /api/v1/orgs/{org}/actions/runs and GET /api/v1/orgs/{org}/actions/jobs bypass per-repo ACL checks entirely, allowing low-privileged org members with no team or repository assignments to enumerate private repo names, commit SHAs, branch names, workflow file paths, contributor identities, CI timing, and commit messages across the entire organization. No CISA KEV listing or separately published exploit tool has been identified, but the detailed advisory with curl reproduction commands substantially lowers the exploitation barrier.
Draft release attachment disclosure in Gitea exposes files uploaded to draft releases to unauthenticated network callers via UUID-based web endpoints, bypassing access controls that correctly gate the parallel API handlers. This is an incomplete fix for CVE-2026-27660: that advisory's PR #36659 added `canAccessReleaseDraft` checks to every API code path but left the web-side `ServeAttachment` handler ungated, allowing anyone who obtains an attachment UUID to download its contents with no authentication. A working proof-of-concept is documented in the advisory and confirmed against Gitea v1.27.0+dev; no public exploit identified at time of analysis beyond the advisory PoC, and the vulnerability does not appear in CISA KEV.
Out-of-bounds heap read in libssh exposes small amounts of server memory during GSSAPI key exchange, exploitable by remote unauthenticated attackers. When a client submits a Curve25519 public key shorter than the expected 32 bytes during server-side GSSAPI key exchange, libssh copies the key without validating its length, triggering a read beyond the intended buffer boundary. No public exploit has been identified at time of analysis; exploitation is constrained to servers with GSSAPI key exchange explicitly enabled, which is a non-default configuration.
Cross-tenant self-service signup bypass in Microsoft Azure API Management (through 2025-10-17) lets remote unauthenticated actors register developer-portal accounts against a tenant where signup was disabled in the UI, by swapping the Host header or tenant identifier to reuse another tenant's still-live registration endpoint. Publicly available proof-of-concept exploit code exists (GHSA-vcwf-73jp-r7mv), but Microsoft evaluated the report and determined the behavior did not cross a security boundary, calling it a configuration/state issue rather than a product vulnerability affecting tenant isolation. No public in-the-wild exploitation has been identified, and the EPSS probability is low (0.18%, 7th percentile).
Arbitrary host file disclosure in BuildKit's WCOW (Windows Container on Windows) worker mode allows an untrusted build author to read any file reachable by the BuildKit daemon process. By placing NTFS directory junctions inside the cache mount root - a technique the `source=` selector fails to detect on Windows - a malicious Dockerfile can redirect cache access to traverse outside the container's expected filesystem boundary. This affects any multi-tenant or shared CI/CD environment running a WCOW-configured BuildKit daemon where untrusted users can submit builds; no active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() A DIRECTORY entry's value field is used as the dir_offset for a recursive call into __tb_property_parse_dir() with no depth counter. A crafted peer that chains DIRECTORY entries into a back-reference loop drives the parser until the kernel stack is exhausted and the guard page fires. Any untrusted XDomain peer (cable, dock, in-line inspector, adjacent host) that reaches the PROPERTIES_REQUEST control-plane exchange can trigger this without authentication. Thread a depth counter through tb_property_parse() and __tb_property_parse_dir(), and reject blocks that exceed TB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any observed legitimate XDomain layout. Operators who do not need XDomain host-to-host discovery can disable the path entirely with thunderbolt.xdomain=0 on the kernel command line.
Authentication bypass in Microsoft Edge (Chromium-based) allows an unauthenticated remote attacker to perform network-based tampering through an alternate path or channel that circumvents access controls (CWE-288). Affected users must interact with attacker-controlled content for exploitation to succeed (UI:R per CVSS), limiting opportunistic automation but keeping phishing-based delivery viable. No public exploit identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.
SQL injection in the Azure Synapse connector of Amazon aws-athena-query-federation allows authenticated remote users to exfiltrate unintended data from connected Azure Synapse databases by supplying crafted table names that are improperly neutralized before inclusion in SQL commands. Affected versions span v2022.20.1 through v2026.19.1, and the scope of data exposure extends beyond Athena itself into the downstream Synapse database. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires valid Athena credentials with sufficient privilege to invoke the Synapse connector.
DLL hijacking in HCL Traveler for Microsoft Outlook (HTMO) permits a local, high-privileged attacker to replace or plant a malicious DLL in a directory searched by the application at load time, enabling arbitrary code execution within the HTMO process context. The CVSS vector (AV:L/AC:L/PR:H/UI:R) confirms the attack is constrained to local access with elevated privileges and requires a user to trigger application load, substantially limiting real-world exploitability despite the full C/I/A:H impact ratings. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds memory read in YAML::Syck's bundled libsyck C library for Perl exposes any application calling Load() or LoadFile() on untrusted YAML to a one-byte heap over-read. The root flaw (CVE-2025-11683) resided in the libsyck block-scalar lexer's newline scanning logic; the patch issued for that CVE was incomplete, leaving a second lexer path uncovered - subsequently disclosed as CVE-2026-57077. Both are resolved in YAML-Syck 1.47 (released July 13, 2026). No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog.
Stored or reflected cross-site scripting in Microsoft SharePoint Server allows an authenticated low-privileged attacker to inject malicious script content that executes in a victim's browser, enabling spoofing attacks over a network. Affected deployments span SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. No public exploit code or active CISA KEV listing has been identified; the CVSS 4.6 Medium rating reflects the dual prerequisites of authentication and victim interaction, which materially constrain real-world exploitability.
Cross-site scripting in Microsoft Windows Admin Center enables network-based spoofing attacks against users who interact with attacker-controlled content. The CVSS vector (AV:N/PR:N/UI:R/S:C) confirms that an unauthenticated remote attacker can deliver a crafted payload that executes in the victim's browser context once user interaction occurs, enabling session hijacking or administrative action spoofing within the management interface. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.
Lenovo Smart Connect for Windows exposes an improper access control flaw that permits a local authenticated user to read files belonging to other users on the same machine. Discovered through Lenovo's own internal security assessment and documented under advisory LEN-218281, the flaw carries a CVSS 4.0 score of 6.8 with a local, low-privilege attack vector and high confidentiality impact. No public exploit code and no CISA KEV listing exist at time of analysis, limiting immediate risk to multi-user Windows environments where Lenovo Smart Connect is installed.
Session-squatting and memory exhaustion in Microsoft UFO's WebSocket server allow any authenticated client to permanently deny legitimate task owners access to their sessions or flood the shared session store with phantom entries. The COMMAND_RESULTS handler in ufo/server/ws/handler.py invoked get_or_create_session with a caller-supplied session_id but omitted the owner_client_id binding, and the message type carried no role gate - meaning any authenticated peer could pre-register arbitrary session IDs before their intended owners. This issue is not in CISA KEV and no public exploit has been identified, though the fix commit's regression tests provide a near-complete exploitation blueprint.
Cross-device system_info disclosure in Microsoft UFO's WebSocket server allows any authenticated DEVICE-role client to retrieve another enrolled device's server-side system_info - including hostname, IP address, and metadata tags - by supplying an arbitrary target_id in a DEVICE_INFO_REQUEST message. Affected versions 3.0.0 through 3.0.5 authenticate the caller's role but omit object-level authorization in handle_device_info_request and get_device_info (ufo/server/ws/handler.py), meaning DEVICE clients can enumerate peers that only CONSTELLATION controllers should be able to query. No public exploit identified at time of analysis; vendor-released patch is version 3.0.6.
Insecure Direct Object Reference (IDOR) in Microsoft SimpleChat exposes any authenticated user's profile data to other authenticated users without authorization checks. The GET /api/user/info/<user_id> and GET /api/user/profile-image/<user_id> endpoints in route_backend_users.py accept a caller-supplied user_id and query the Cosmos DB user-settings document directly, bypassing object-level authorization - enabling enumeration of email addresses, display names, and profile images across the entire user base. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog; the vendor-released fix is version 0.241.203.
ToolHive's hand-maintained SSRF guard (`networking.IsPrivateIP`) omits IPv6 NAT64 prefixes `64:ff9b::/96` (RFC 6052) and `64:ff9b:1::/48` (RFC 8215), allowing addresses like `64:ff9b:1::a9fe:a9fe` - the NAT64 encoding of the cloud metadata endpoint `169.254.169.254` - to be misclassified as globally routable and pass unchecked. On ToolHive deployments behind a NAT64/DNS64 gateway (the default in IPv6-only Kubernetes clusters and several IPv6-only cloud environments), an unauthenticated attacker can submit a crafted OAuth `client_id` URL that causes ToolHive's CIMD fetcher to dial internal or link-local addresses the guard is intended to block, achieving a blind internal-reachability oracle. Practical impact is limited to TCP/TLS connection probing rather than credential exfiltration due to HTTPS-only enforcement and TLS verification on the attacker-controlled path; a complete proof-of-concept is publicly available in the vendor advisory, and no public exploit identified at time of analysis as a KEV-listed active campaign.
Full-read SSRF in Koel's podcast subscription feature allows any authenticated user to coerce the server into fetching internal HTTP endpoints - including cloud instance metadata services - and receive the full response. The vulnerability exists because PHP's `filter_var` with `FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE` does not unwrap NAT64 (`64:ff9b::/96`) or 6to4 (`2002::/16`) IPv6 transition addresses, both of which deterministically embed a private IPv4 that the OS kernel routes internally. This affects all Koel deployments through v9.7.0 on NAT64 or dual-stack networks (the default for IPv6-only AWS and GCP subnets); a detailed proof-of-concept with verbatim server output is published in the advisory. No public exploit code is in KEV at time of analysis, but the PoC substantially lowers the exploitation barrier.
Process memory disclosure in Google Chrome's Media component on Windows (prior to 150.0.7871.125) enables an attacker who has already compromised the renderer process to read sensitive data from Chrome's memory via a crafted HTML page. This is a chained vulnerability - it is a second-stage exploit requiring a pre-compromised renderer, making it a useful component in multi-stage browser attack chains rather than a standalone threat. No public exploit identified at time of analysis, EPSS is 0.30% (22nd percentile), and SSVC exploitation status is 'none,' confirming no current active exploitation.
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to manipulate encoded output, enabling content or identity spoofing with high integrity impact. Affected products span three active .NET generations plus Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7), creating a broad enterprise attack surface. A publicly available proof-of-concept exploit exists on GitHub; however, CISA SSVC reports exploitation status as none and EPSS sits at 0.41% (34th percentile), suggesting opportunistic rather than widespread active threat activity at time of analysis.
Local tampering via symbolic-link following in Microsoft .NET (versions 8.0, 9.0, and 10.0) and the bundled toolchain in Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7) allows an authorized local attacker to redirect a privileged file operation to an unintended target, corrupting or replacing files outside their normal permissions. Microsoft (the reporter) has released a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. The high CVSS 3.1 base score of 7.0 is tempered by high attack complexity and the requirement for existing low-level local access.
Devolutions Server 2026.1.22.0 and 2026.2.11.0 exposes Azure Key Vault client secrets in cleartext within Recovery Kit response files, defeating an explicit 'exclude sensitive data' option that administrators rely on. Any party who obtains a copy of the generated response file can trivially read the credential without any decryption or tooling. No public exploit code exists and the vulnerability is not in CISA KEV; however, because successful exploitation yields a reusable cloud credential, the downstream blast radius in Azure environments substantially exceeds what the 3.3 CVSS base score suggests. A vendor-released patch is available.
Memory parsing across Microsoft Office and SharePoint Server products is susceptible to a CWE-125 out-of-bounds read that, when triggered by opening a specially crafted Office document, produces local information disclosure or application availability loss. The affected surface is broad - spanning Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024 on both Windows and macOS, and SharePoint Enterprise Server 2016, 2019, and Subscription Edition - but real-world exploitation pressure is low: EPSS sits at 0.36% (28th percentile), CISA SSVC rates exploitation as none and the attack as non-automatable, and no public exploit has been identified at time of analysis. Vendor-released patches are available for all affected product lines.
Windows Boot Loader across Windows 10, Windows 11, and Windows Server 2012 through 2025 omits a required cryptographic integrity step (CWE-325), enabling a locally authenticated attacker to bypass boot-time security features. The CVSS vector (AV:L/PR:L) confirms exploitation requires an existing local foothold - remote unauthenticated attacks are not possible. No active exploitation is recorded (SSVC: none, EPSS 0.23%), but SSVC rates technical impact as total, reflecting that a successful boot-level security bypass can undermine the entire trusted boot chain and enable persistent pre-OS compromise.
Privilege escalation in the Windows USB Print Driver affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025, exploitable by a physically-present attacker with low-privilege credentials via a race condition in the driver's shared resource handling. The flaw requires both physical device access and precise timing to win the synchronization window, making exploitation non-trivial. No public exploit identified at time of analysis; EPSS stands at 0.17% (7th percentile), and SSVC rates exploitation as none - consistent with high attack complexity and the physical access prerequisite.
Windows Kernel security feature bypass across Windows 10, 11, and Server 2012 through 2025 allows a local authenticated attacker to circumvent kernel-enforced access controls, resulting in high-confidence disclosure of sensitive information (C:H). Rooted in CWE-284 (Improper Access Control), the flaw enables a privilege-constrained local user to read protected data beyond their authorization boundary. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.25% (16th percentile) and SSVC assigns exploitation status 'none,' consistently characterizing this as a standard patch-cycle priority rather than an emergency response item.
Windows Remote Desktop Protocol (RDP) across a broad range of Windows 10, 11, and Server editions discloses potentially sensitive memory contents over the network due to an uninitialized resource flaw (CWE-908), exploitable by remote unauthenticated attackers when a user interacts with an RDP session. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates network-wide reachability with no attacker privilege requirement, though mandatory user interaction (UI:R) prevents automated mass exploitation. No public exploit has been identified at time of analysis; EPSS at 0.51% (40th percentile) and SSVC exploitation status of 'none' confirm low current threat activity despite Windows RDP's ubiquitous enterprise attack surface.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) exposes kernel memory contents to an attacker who physically connects a crafted USB audio device to an unpatched system. Affected systems span Windows 10 (1809 through 22H2), Windows 11 (24H2 through 26H1), and Windows Server 2019/2022/2025, as confirmed by EUVD-2026-44284 and the MSRC advisory. No public exploit code has been identified at time of analysis, and EPSS at 0.42% (34th percentile) reflects low automated exploitation probability consistent with the mandatory physical access requirement.
Information disclosure via uninitialized resource use in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to authenticated remote attackers across a wide range of Microsoft Windows desktop and server editions. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms this is exploitable over the network by any low-privileged authenticated user with no complexity or interaction requirements, yielding high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation and the ubiquitous deployment of Windows RDP make this a meaningful patching priority.
Tampering via a time-of-check time-of-use (TOCTOU) race condition in Windows Subsystem for Linux 2 (WSL2) enables a locally authorized, low-privileged attacker to manipulate file system or resource state between the moment a security check is performed and the moment the resource is actually used. Affected versions run below 2.7.10, and Microsoft has released a fix. No public exploit code has been identified and CISA has not added this to the KEV catalog, but the SSVC framework assesses technical impact as total if the race is won, making the integrity risk significant despite a medium CVSS score.
Cross-site scripting in Microsoft Visual Studio Code lets an attacker who tricks a local user into opening crafted content bypass a built-in security feature and gain high-impact code execution within the editor context. The flaw (CWE-79) carries a CVSS 3.1 base score of 7.1 with a local attack vector requiring user interaction, and Microsoft has published an advisory with a fix. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Information disclosure in Windows Print Spooler Components exposes memory contents to locally authenticated attackers via an out-of-bounds read (CWE-125). The flaw affects a sweeping range of Windows releases from Server 2012 through Windows 11 26H1 and Server 2025, making the affected surface extremely broad. Microsoft has released patched builds and the SSVC assessment confirms no observed exploitation, with EPSS at 0.31% (22nd percentile) corroborating a low immediate threat posture; however, Print Spooler's historical exploitation history (PrintNightmare family) warrants prompt patching given attacker familiarity with the component.
Information disclosure in Windows File Explorer exposes sensitive memory contents to local attackers due to CWE-908 use of an uninitialized resource. Triggered when a local user interacts with File Explorer, the flaw allows memory contents - potentially including sensitive data from other processes or the OS - to be read without elevated privileges. No public exploit code has been identified and CISA has not listed this in KEV, but the breadth of affected platforms (Windows 10 through 11 and Windows Server 2012 through 2025) makes patching broadly applicable.
Uninitialized memory exposure in the Microsoft Windows Codecs Library enables a local attacker to disclose sensitive process memory contents on affected Windows systems. The flaw (CWE-908) requires user interaction - specifically opening or processing a specially crafted media file - but demands no elevated privileges. No public exploit code exists and no active exploitation is confirmed; EPSS sits at 0.51% (40th percentile), consistent with SSVC's 'Exploitation: none' assessment, making this a medium-severity, low-urgency issue relative to the breadth of affected platforms.
Out-of-bounds read in Microsoft Office exposes sensitive memory contents to a local, unauthenticated attacker who can induce a user to open a malicious document. Affected products span the full current Office portfolio - Office 2016 through LTSC 2024 on both Windows and macOS - making the blast radius broad despite the local attack vector. No public exploit identified at time of analysis and SSVC classifies exploitation as none and not automatable, though the high confidentiality impact (C:H) and near-universal deployment of Office keep this a meaningful patching priority.
Out-of-bounds read in Microsoft Office and SharePoint exposes process memory contents locally when a user opens a specially crafted document. Affected products span the full Office suite - Office 2016, 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise (Windows and Mac), and SharePoint Server 2016, 2019, and Subscription Edition - covering virtually the entire active Office install base. No public exploit code exists and CISA SSVC rates exploitation as none, making this a patch-and-monitor priority rather than an emergency response.
Information disclosure in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) arises from an out-of-bounds read (CWE-125) that lets an attacker who convinces a victim to open a crafted file read memory beyond an intended buffer boundary. Exploitation is local and requires user interaction, and there is no public exploit identified at time of analysis and no CISA KEV listing. Disclosed memory can leak sensitive data such as heap contents or pointer addresses useful for defeating ASLR in a follow-on exploit chain.
Information disclosure in Microsoft Windows Schannel (the Secure Channel TLS/SSL provider) lets an authenticated, network-adjacent attacker read memory beyond an allocated buffer and leak sensitive data across a network connection. The flaw spans nearly the entire supported Windows family - Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025. Reported by Microsoft with a fix available; there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Windows Win32K information disclosure on multiple Windows 10, Windows 11, and Windows Server releases allows a locally authenticated low-privilege user to read sensitive kernel-level data that should be inaccessible to user-space processes. Rooted in CWE-200 (improper exposure of sensitive information), the flaw exposes confidentiality-impacting data via the Win32K graphical subsystem without requiring elevated rights or user interaction from another party. No public exploit code has been identified, CISA SSVC rates exploitation status as 'none,' and the EPSS score of 0.47% (38th percentile) confirms low near-term exploitation probability.
Null pointer dereference in the Windows SMB Server component allows an authenticated network attacker to crash the service across multiple Windows 10, 11, and Server editions. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms network exploitability with low-privilege credentials and complete availability impact, though confidentiality and integrity are unaffected. No public exploit identified at time of analysis; SSVC exploitation status is 'none' and EPSS sits at 0.79%, indicating low active exploitation pressure despite the broad product footprint.
Spoofing vulnerability in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition allows an authenticated network attacker to impersonate identities or forge content due to improper access control (CWE-284). Exploitation requires valid credentials (CVSS PR:L), limiting opportunistic attack surface. SSVC assessment confirms no active exploitation, and EPSS sits at just 0.28% (20th percentile), consistent with a targeted rather than broadly exploited vulnerability. Vendor-released patches are available for all three affected product lines.
Type confusion (CWE-843) in Microsoft SQL Server 2025 enables authenticated, low-privileged network attackers to disclose sensitive server-side information. The CVSS vector (AV:N/PR:L/C:H) confirms that any authorized database user - regardless of their data access permissions - can potentially trigger the flaw remotely with no user interaction required. No public exploit code or CISA KEV listing exists at time of analysis, but the high confidentiality impact and low access complexity make patching a meaningful priority for organizations running SQL Server 2025.
Buffer over-read in Microsoft SQL Server 2025 exposes server memory contents to low-privileged authenticated attackers over the network, resulting in high confidentiality impact with no integrity or availability consequences. Both the Cumulative Update 6 (CU 6) and General Distribution Release (GDR) servicing tracks on x64-based systems are confirmed affected per vendor CPE data. No public exploit has been identified and CISA has not listed this in KEV; SSVC assessment corroborates no active exploitation at time of analysis, placing this in a measured but real priority category for environments handling sensitive SQL data.
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, Server 2019, and Server Subscription Edition enables authenticated network attackers to inject malicious scripts that execute in victims' browsers, enabling spoofing, session hijacking, or unauthorized actions on behalf of targeted users. The CWE-79 flaw requires victim interaction (UI:R) and low-privilege attacker credentials (PR:L), but the changed scope (S:C) means impact extends beyond the SharePoint server into the victim's browser session. No public exploit identified at time of analysis; EPSS of 0.28% (20th percentile) and SSVC exploitation rating of 'none' indicate low immediate threat despite broad enterprise deployment.
Out-of-bounds read in Microsoft Office exposes a limited portion of process memory to a local attacker when a user opens a specially crafted document. Affected products span Office 2016 through LTSC 2024 on both Windows and macOS, with impact confined to low-severity information disclosure and no integrity or availability consequence. No public exploit code exists and CISA has not listed this in KEV; SSVC confirms exploitation status as none and the vulnerability is assessed as non-automatable, collectively placing this in the lowest real-world risk tier despite broad product coverage.
Uninitialized memory disclosure in Microsoft Office exposes sensitive data locally when a user interacts with a crafted document. The vulnerability, rooted in CWE-908 (Use of Uninitialized Resource), affects the full breadth of current Office deployments across Windows and macOS, including Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise. No public exploit code has been identified at time of analysis, and SSVC signals confirm no observed exploitation; however, the High confidentiality impact warrants prompt patching given Office's ubiquitous deployment footprint.
Numeric truncation error (CWE-197) in Microsoft Office Word triggers local information disclosure when a user opens a maliciously crafted document, exposing potentially sensitive memory contents with high confidentiality impact (C:H). The vulnerability spans a broad range of Microsoft Office and SharePoint products - including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Word 2016, Office 2019, Office 365 for Mac, and multiple SharePoint Server versions. No public exploit identified at time of analysis; CISA SSVC rates exploitation as none, EPSS stands at 0.39% (31st percentile), and a vendor-released patch is available from Microsoft.
Server-side request forgery in Microsoft SharePoint Server enables authenticated, low-privileged users to force the server to issue outbound network requests, exposing internal resources and sensitive data not directly accessible to the attacker. All three actively supported SharePoint server editions are affected: Enterprise Server 2016, Server 2019, and Subscription Edition. No public exploit code or CISA KEV listing exists at time of analysis; EPSS sits at 0.59% (44th percentile) and SSVC rates exploitation as none, indicating limited real-world exploitation activity despite the medium-high CVSS score.
Stored/reflected cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Edition) lets an authenticated attacker inject script that executes in another user's browser session to spoof content over the network. Although Microsoft classifies the impact as 'spoofing,' the CVSS 3.1 vector rates confidentiality and integrity as High (C:H/I:H), indicating the injected script can access or alter sensitive session data. There is no public exploit identified at time of analysis, and a vendor patch is available.
Microsoft Office information disclosure via integer overflow (CWE-190) exposes high-confidentiality data to a local attacker who can induce a victim to open a crafted document. The flaw affects a broad range of Microsoft Office versions on both Windows and macOS - including Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise - confirmed by Microsoft via MSRC. No public exploit code exists and CISA SSVC rates exploitation as none, placing this in low urgency despite the High confidentiality impact in the CVSS vector; however, the extensive product footprint means patching remains advisable.
Out-of-bounds read in Microsoft Excel's file parser discloses sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC for Mac 2021/2024, and Office Online Server. The CVSS vector (AV:N/PR:N/UI:R/C:H) indicates unauthenticated network delivery with mandatory user interaction and high confidentiality impact. No public exploit identified at time of analysis; SSVC confirms no known active exploitation and EPSS at 0.64% (46th percentile) reflects below-average exploitation probability, positioning this as a targeted phishing risk rather than an opportunistic threat.
Out-of-bounds read in Microsoft Office (including 365 Apps for Enterprise, Office 2016/2019, LTSC 2021/2024 on Windows and macOS, and SharePoint Server 2016/2019/Subscription Edition) allows a local attacker to disclose limited memory contents when a victim opens a specially crafted document. The CVSS 3.3 Low score, EPSS of 0.51% (40th percentile), SSVC exploitation status of 'none,' and absence from CISA KEV collectively place this vulnerability at low real-world priority despite its broad product footprint. No public exploit or proof-of-concept code has been identified at time of analysis.
Information disclosure in Microsoft Office Word and related Microsoft 365/SharePoint products exposes sensitive memory contents when a user opens a specially crafted document. Affecting a broad suite of products spanning Word 2016 through Office LTSC 2024 and SharePoint Server versions, the flaw stems from improper input type validation (CWE-1287) in the document parsing subsystem. No public exploit has been identified at time of analysis; EPSS at 0.39% and CISA SSVC exploitation status of 'none' confirm this remains a theoretical rather than actively targeted risk, though Microsoft has released patches.
Untrusted pointer dereference (CWE-822) in Microsoft Excel allows a local attacker to disclose sensitive memory contents when a victim opens a specially crafted workbook. The flaw affects a broad swath of Microsoft Office product lines - from Excel 2016 through Office LTSC 2024 and their Mac counterparts - as confirmed by CPE enumeration. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as none and technical impact as partial, placing this in the moderate real-world priority tier despite the C:H CVSS rating.
Out-of-bounds read in Microsoft Office Word and associated Microsoft 365 products allows local information disclosure when a user opens a specially crafted document. Affecting a broad range of Microsoft Office versions across Windows and macOS - including Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and SharePoint Server 2016/2019/Subscription Edition - an attacker with no prior system privileges must socially engineer a victim into opening a malicious file to trigger memory disclosure. No public exploit identified at time of analysis; EPSS is 0.39% (31st percentile) and SSVC confirms exploitation status as none and the attack as non-automatable.
Out-of-bounds read in Microsoft Office exposes high-confidentiality memory contents to a local, unauthenticated attacker who can induce a user to open a crafted document. The flaw affects a wide swath of Office and SharePoint products across Windows and Mac platforms, including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, Office 365 for Mac, and SharePoint Server 2016 through the Subscription Edition. No public exploit has been identified at time of analysis, EPSS is low at 0.50% (39th percentile), and CISA SSVC rates exploitation as none and the flaw as non-automatable, placing this firmly in a patch-and-monitor risk tier rather than an emergency-response tier.
Out-of-bounds memory read in Microsoft Office and SharePoint exposes sensitive in-process data when a user opens a specially crafted document on a local machine. Affecting Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024 (Windows and macOS), and SharePoint Server 2016 through Subscription Edition, the CWE-125 flaw allows an unauthorized attacker to read beyond allocated buffer boundaries, achieving High confidentiality impact with no integrity or availability consequence. No public exploit exists and no active exploitation is confirmed at time of analysis - CISA SSVC rates exploitation status as none - making this a routine-priority patch despite the broad product coverage.
Out-of-bounds read in Microsoft Office and SharePoint Server exposes local memory contents to an unauthorized attacker, resulting in information disclosure. The vulnerability (CWE-125) is triggered when a user opens a specially crafted Office document, making exploitation dependent on user interaction rather than remote network access. No active exploitation has been confirmed - CISA KEV does not list this CVE, SSVC rates exploitation as none, and EPSS probability sits at 0.51% (40th percentile), collectively indicating low real-world threat activity despite the wide deployment footprint of affected products.
Local information disclosure in Microsoft Office and SharePoint via an integer overflow (CWE-190) exposes sensitive data to low-privileged local attackers across a broad range of Office versions on both Windows and Mac platforms. The CVSS vector (AV:L/PR:L) confirms exploitation requires an existing foothold on the target machine, limiting real-world impact to post-compromise scenarios or insider threats. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.40% (32nd percentile) combined with SSVC exploitation status of 'none' indicates this is not currently being weaponized in the wild.
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables an authenticated network attacker to inject malicious scripts into SharePoint pages, causing spoofing against users who view the affected content. The vulnerability carries a CVSS 5.4 (Medium) score with an EPSS of 0.38% (30th percentile), indicating low current exploitation probability. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read (CWE-125) in Microsoft Office's file parsing logic exposes potentially sensitive in-memory data to a local attacker when a victim opens a specially crafted document, affecting Windows and macOS Office editions as well as Microsoft SharePoint Server. The CVSS 5.5 Medium score reflects a local-only attack vector with mandatory user interaction, confining impact to information disclosure with no integrity or availability consequence. No public exploit code exists, CISA SSVC classifies exploitation as 'none' with no automation potential, and the EPSS of 0.51% (40th percentile) confirms low current exploitation probability.
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables an authenticated attacker with low-privilege network access to inject malicious scripts into SharePoint pages, resulting in spoofing impacts when a victim user interacts with the crafted content. The CVSS vector (PR:L/UI:R) confirms exploitation requires both an existing authenticated account and victim interaction, constraining real-world risk relative to unauthenticated XSS variants. No public exploit identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog. Vendor patch is available via the Microsoft Security Response Center.
Missing authorization controls in Microsoft Edge (Chromium-based) allow a local attacker without any system privileges to bypass authorization and perform tampering actions against the browser. The flaw (CWE-862) results in high confidentiality impact per the CVSS vector, though the description characterizes the effect as tampering - a discrepancy addressed in confidence notes below. No public exploit code has been identified and Microsoft has released an official patch through the MSRC advisory portal.
Code injection (CWE-94) in Microsoft Edge (Chromium-based) enables network-based spoofing attacks against users who interact with attacker-controlled content. An unauthorized remote attacker can exploit improper code generation controls to inject and execute code within the browser's execution context, crossing security scope boundaries (S:C) to spoof content or interfaces presented to the victim. No public exploit has been identified at time of analysis (E:U temporal metric), and Microsoft has released an official fix via the MSRC update guide.
Spoofing via origin validation failure in Microsoft Edge (Chromium-based) allows a network-adjacent unauthenticated attacker to deceive users or systems about the true origin of web content or requests. All Chromium-based Edge versions are affected per the wildcard CPE, and a vendor-released patch is confirmed via the Microsoft Security Response Center. No public exploit code exists and active exploitation is not confirmed - the CVSS temporal metric E:U (exploit unproven) and absence of CISA KEV listing reinforce a currently theoretical risk level.
Microsoft Edge (Chromium-based) is affected by a Time-of-Check Time-of-Use (TOCTOU) race condition that allows a remote, unauthenticated attacker to disclose sensitive information over the network, contingent on user interaction. The flaw exploits the timing gap between a security check and subsequent resource use within the Chromium-based browser engine, potentially exposing cross-origin data or internal browser state. No active exploitation has been confirmed by CISA KEV, and the temporal CVSS metrics (E:U) confirm no proven exploit code exists at time of analysis; a vendor patch is available via MSRC.
Origin validation error in Microsoft Edge (Chromium-based) enables a local, unauthenticated attacker to bypass cross-origin restrictions and perform data tampering. The CVSS vector (AV:L/PR:N) indicates that any unprivileged local user - including guest or kiosk session users - can trigger this flaw without requiring prior authentication or user interaction. With a high confidentiality impact (C:H) and low integrity impact (I:L), exploitation could expose sensitive browser-held data while also permitting limited content manipulation. No public exploit code has been identified and CISA KEV does not list this CVE; the temporal metric E:U corroborates no known active exploitation at time of analysis.
Man-in-the-middle interception of SSH sessions and file transfers is possible through the EMR SSH helper commands in Amazon AWS CLI v1 before 1.45.28 and v2 before 2.35.3 due to missing entity authentication during the SSH key exchange. Network-positioned attackers - requiring no privileges or user interaction - can substitute their own key material during the handshake and silently relay or inspect the session. No active exploitation is confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the impact on downstream EMR cluster confidentiality is rated high (SC:H in the CVSS 4.0 vector).
UI spoofing in the Google Chrome Updater component on Windows (prior to 151.0.7922.72) enables a local attacker to present a falsified interface to users by placing a malicious file in a location the Updater processes. Chromium's own team rates this 'Low' severity, consistent with the 4.0 CVSS score, EPSS of 0.10% (1st percentile), and SSVC exploitation status of 'none'. No public exploit exists at time of analysis, and a vendor-confirmed patch is available in Chrome 151.0.7922.72.
Uninitialized memory use in Skia, Chrome's 2D graphics rendering engine, exposes process memory contents to remote attackers on Windows via crafted HTML pages in Google Chrome versions prior to 151.0.7922.72. The flaw is strictly an information disclosure issue (CWE-457), with no integrity or availability impact, affecting only the Windows platform per the vulnerability description. No public exploit code has been identified, EPSS places exploitation probability at 0.19% (9th percentile), and SSVC classifies exploitation as none with partial technical impact - collectively suggesting limited real-world risk despite the CVSS C:H rating.
Use-after-free in Chrome's DataTransfer component on Windows exposes process memory to local attackers who can deliver a crafted HTML page to a victim. The flaw affects all Chrome versions on Windows prior to 151.0.7922.72 and results in high-confidence confidentiality loss with no integrity or availability impact. No public exploit code has been identified and EPSS sits at 0.11% (2nd percentile), consistent with CISA SSVC classifying exploitation as 'none' and technical impact as 'partial' - making this a low operational priority despite the High confidentiality CVSS sub-score.
Sandbox escape in Google Chrome's Printing component on Windows enables a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on Windows. No public exploit has been identified, EPSS sits at the 7th percentile (0.17%), CISA SSVC rates exploitation as none and the attack as non-automatable, making this a low-urgency patching item despite the sandbox-escape classification.
Cross-origin data leakage in the Enterprise policy implementation of Google Chrome on Windows (versions prior to 151.0.7922.72) enables a remote attacker to extract data across origin boundaries by delivering a malicious file to a victim user. The CWE-346 (Origin Validation Error) root cause indicates Chrome's Enterprise component fails to enforce same-origin boundaries in this specific code path, exposing data that should be restricted. No public exploit has been identified and EPSS sits at the 6th percentile, with CISA SSVC confirming no current exploitation; this is a low-urgency but real information disclosure risk for enterprise Chrome deployments on Windows.
Cross-origin data leak in Google Chrome on Windows (prior to 151.0.7922.72) stems from uninitialized memory use in the WebNN subsystem, exposing fragments of memory that may contain data from other origins. A remote attacker can trigger this flaw by luring a victim to a crafted HTML page, requiring no authentication but necessitating user interaction. No public exploit identified at time of analysis; EPSS sits at just 0.20% (10th percentile), consistent with a medium-severity information disclosure with no code execution potential.
Same-origin policy bypass in Google Chrome for Windows (prior to 151.0.7922.72) allows a remote attacker who has already compromised the Chrome renderer process to circumvent cross-origin isolation controls via a crafted HTML page exploiting an origin validation flaw (CWE-346) in the Media component. This is a second-stage, chained exploitation capability - not a standalone entry point - requiring a prior renderer compromise to weaponize, which substantially constrains its independent risk. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile); the vendor patch is available in Chrome 151.0.7922.72.
Uninitialized memory read in ANGLE (Chrome's graphics abstraction layer) on Windows exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. Affected are all Google Chrome releases on Windows prior to 151.0.7922.72. An attacker who persuades a user to visit a malicious page can trigger the ANGLE component to read and potentially leak uninitialized memory, risking disclosure of in-process data. No public exploit code has been identified and EPSS stands at 0.23% (14th percentile), indicating low observed exploitation probability despite the broad deployment footprint of Chrome.
Uninitialized memory disclosure in Google Chrome's Media component on Windows exposes process memory to attackers who have already achieved renderer process compromise. Versions prior to 151.0.7922.72 are affected. A renderer-compromised attacker delivers a crafted HTML page to trigger a CWE-457 uninitialized variable read, potentially leaking sensitive in-memory data such as credentials, tokens, or cryptographic material. No public exploit has been identified at time of analysis, SSVC rates exploitation as none, and EPSS sits at 0.31% - indicating low observed exploitation pressure despite the High CVSS confidentiality impact.
Cross-origin data leakage in Google Chrome's Media component on Windows (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a crafted HTML page. The flaw is rooted in insufficient input validation (CWE-20) in the Media subsystem, exploitable only on Windows and only as a second-stage primitive following a prior renderer compromise. No public exploit code has been identified and EPSS is low at 0.29% (21st percentile), placing this firmly in the targeted-attacker rather than mass-exploitation threat category.
Cross-Site Request Forgery in the Facturación Electrónica Costa Rica WordPress plugin (all versions through 2.0.2) allows unauthenticated attackers to overwrite critical plugin configuration - including API tokens, Hacienda environment mode, and invoice emission flags - by tricking a logged-in site administrator into clicking a malicious link. The flaw stems from missing nonce validation in the admin configuration handler exposed via fvcr_admin_page_html, confirmed by Wordfence with direct source references to admin/configuration.php and functions.php. No public exploit or active exploitation has been identified at time of analysis, though the financial-system integration amplifies the business impact of a successful attack.
SQL injection in the Advocate Office Management System 1.0 (a SourceCodester PHP application) lets remote unauthenticated attackers inject arbitrary SQL through the 'id' GET parameter of control/activate_case.php. Publicly available exploit code exists (SSVC exploitation status: poc), with confirmed error-based and time-based blind techniques enabling full database extraction; the 'remote code execution' framing in the report is not substantiated by the provided sqlmap payloads. EPSS is low (0.16%, 6th percentile) and the flaw is not on CISA KEV, so no active exploitation is confirmed.
Improper input validation in Edge for Android allows a remote attacker to tamper with data over a network by convincing a user to interact with malicious content. Exploitation requires user interaction and results in low confidentiality and integrity impact, with no availability loss. No public exploit or active exploitation is known; an official vendor patch is available.
A spoofing vulnerability in Microsoft Edge (Chromium-based) allows remote attackers to bypass origin validation, enabling them to trick users into believing they are interacting with a trusted website. The flaw, tracked as CVE-2026-57978, affects all pre-patch versions of Edge and can be exploited via a malicious site with user interaction. No active exploitation or public exploit code has been identified, and Microsoft has released a patch.
Microsoft Graph exposes sensitive information to authenticated network attackers through an information disclosure flaw classified under CWE-200. Any attacker holding a valid low-privilege credential can query the Microsoft Graph API over the network to retrieve data they should not have access to, without requiring additional user interaction or elevated rights. No active exploitation is confirmed (not in CISA KEV), and Microsoft has released an official fix; however, the high confidentiality impact and low attack complexity make this a meaningful risk for any organization relying on Microsoft 365 services.
Privilege abuse in Tridium Niagara Framework and Niagara Enterprise Security allows an authenticated high-privileged user on an adjacent network to improperly access confidential data and perform limited unauthorized modifications beyond their sanctioned scope. Affected platforms span Windows, Linux, and QNX, and versions prior to 4.14.6 and 4.15.5 are vulnerable. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Uncontrolled resource consumption in dompdf's BMP image processing pipeline allows any unauthenticated attacker who can submit HTML to a dompdf-powered endpoint to exhaust server memory and stall PHP-FPM worker pools with a 169-byte HTTP request. The library trusts attacker-controlled BMP header dimensions without bounding width × height, causing PHP's GD extension to allocate a full native pixel canvas - bypassing PHP's memory_limit entirely because GD allocates through its own native allocator. A publicly available, verified proof-of-concept demonstrates ~12× memory amplification (34 MB control vs ~412 MB attack peak RSS) from identically-sized requests, making this a high-impact, low-effort denial-of-service primitive. No active exploitation confirmed in CISA KEV at time of analysis.
Server-side request forgery in Progress Telerik UI for ASP.NET AJAX's RadEditor PDF export feature enables authenticated attackers to force the web server to issue outbound HTTP requests to arbitrary attacker-controlled hosts. Because the affected product runs on Windows, those outbound connections can carry Windows NTLM authentication material, exposing credentials for potential relay or offline cracking attacks. The vulnerability affects all versions prior to v2026.2.708 and carries a vendor-confirmed CVSS 6.5 (High confidentiality impact) with no public exploit identified at time of analysis.
Shell sandbox bypass in the optional @n8n/computer-use package for n8n exposes the full host filesystem and network to any privileged user who can invoke a computer-use workflow on Linux or Windows, because sandboxing was only implemented for macOS. Affected are n8n versions before 2.29.8 and 2.30.x before 2.30.1; standard n8n installations without the @n8n/computer-use package are entirely unaffected. No public exploit has been identified at time of analysis, but the subsequent-system impact is rated High across confidentiality, integrity, and availability in the vendor-sourced CVSS 4.0 vector.
Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) exposes a network-exploitable flaw in its Outlook Sync Win 32 component that allows low-privileged authenticated users to perform unauthorized data reads, writes, and cause a partial denial of service via HTTP. Oracle classified this as easily exploitable, with low attack complexity and no user interaction required beyond holding a valid low-level account. No public exploit identified at time of analysis and it does not appear in the CISA KEV catalog, but the low barrier to exploitation makes it a credible insider or compromised-credential threat for affected EBS deployments.
Unauthorized data manipulation via authentication bypass in Oracle Siebel CRM Integration's Siebel Server Sync for Exchange component allows unauthenticated remote attackers to insert, update, or delete a subset of CRM-accessible data over HTTP. All versions from 17.0 through 26.5 are affected, with exploitation constrained by high attack complexity that substantially reduces real-world risk. No public exploit code or active exploitation has been identified at time of analysis, consistent with the low CVSS score of 3.7 reflecting limited, integrity-only impact.
Public-only personal access token scope enforcement in Gitea's REST API is inconsistently applied across two organization endpoints, allowing a token holder to enumerate private organization memberships and retrieve detailed permission data (ownership, admin status, write access, repository-creation capability) that the public-only restriction was explicitly designed to block. All Gitea versions prior to 1.27.0 are affected via GET /api/v1/user/orgs and GET /api/v1/users/{username}/orgs/{org}/permissions. Publicly available exploit code with full HTTP request/response traces is confirmed in the GHSA advisory; no CISA KEV listing exists, indicating no confirmed opportunistic mass exploitation at time of analysis.
Cross-repository information disclosure in Gitea's org-level Actions API exposes workflow run and job metadata from private repositories to any authenticated organization member, regardless of per-repository access rights. The endpoints GET /api/v1/orgs/{org}/actions/runs and GET /api/v1/orgs/{org}/actions/jobs bypass per-repo ACL checks entirely, allowing low-privileged org members with no team or repository assignments to enumerate private repo names, commit SHAs, branch names, workflow file paths, contributor identities, CI timing, and commit messages across the entire organization. No CISA KEV listing or separately published exploit tool has been identified, but the detailed advisory with curl reproduction commands substantially lowers the exploitation barrier.
Draft release attachment disclosure in Gitea exposes files uploaded to draft releases to unauthenticated network callers via UUID-based web endpoints, bypassing access controls that correctly gate the parallel API handlers. This is an incomplete fix for CVE-2026-27660: that advisory's PR #36659 added `canAccessReleaseDraft` checks to every API code path but left the web-side `ServeAttachment` handler ungated, allowing anyone who obtains an attachment UUID to download its contents with no authentication. A working proof-of-concept is documented in the advisory and confirmed against Gitea v1.27.0+dev; no public exploit identified at time of analysis beyond the advisory PoC, and the vulnerability does not appear in CISA KEV.
Out-of-bounds heap read in libssh exposes small amounts of server memory during GSSAPI key exchange, exploitable by remote unauthenticated attackers. When a client submits a Curve25519 public key shorter than the expected 32 bytes during server-side GSSAPI key exchange, libssh copies the key without validating its length, triggering a read beyond the intended buffer boundary. No public exploit has been identified at time of analysis; exploitation is constrained to servers with GSSAPI key exchange explicitly enabled, which is a non-default configuration.
Cross-tenant self-service signup bypass in Microsoft Azure API Management (through 2025-10-17) lets remote unauthenticated actors register developer-portal accounts against a tenant where signup was disabled in the UI, by swapping the Host header or tenant identifier to reuse another tenant's still-live registration endpoint. Publicly available proof-of-concept exploit code exists (GHSA-vcwf-73jp-r7mv), but Microsoft evaluated the report and determined the behavior did not cross a security boundary, calling it a configuration/state issue rather than a product vulnerability affecting tenant isolation. No public in-the-wild exploitation has been identified, and the EPSS probability is low (0.18%, 7th percentile).
Arbitrary host file disclosure in BuildKit's WCOW (Windows Container on Windows) worker mode allows an untrusted build author to read any file reachable by the BuildKit daemon process. By placing NTFS directory junctions inside the cache mount root - a technique the `source=` selector fails to detect on Windows - a malicious Dockerfile can redirect cache access to traverse outside the container's expected filesystem boundary. This affects any multi-tenant or shared CI/CD environment running a WCOW-configured BuildKit daemon where untrusted users can submit builds; no active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() A DIRECTORY entry's value field is used as the dir_offset for a recursive call into __tb_property_parse_dir() with no depth counter. A crafted peer that chains DIRECTORY entries into a back-reference loop drives the parser until the kernel stack is exhausted and the guard page fires. Any untrusted XDomain peer (cable, dock, in-line inspector, adjacent host) that reaches the PROPERTIES_REQUEST control-plane exchange can trigger this without authentication. Thread a depth counter through tb_property_parse() and __tb_property_parse_dir(), and reject blocks that exceed TB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any observed legitimate XDomain layout. Operators who do not need XDomain host-to-host discovery can disable the path entirely with thunderbolt.xdomain=0 on the kernel command line.
Authentication bypass in Microsoft Edge (Chromium-based) allows an unauthenticated remote attacker to perform network-based tampering through an alternate path or channel that circumvents access controls (CWE-288). Affected users must interact with attacker-controlled content for exploitation to succeed (UI:R per CVSS), limiting opportunistic automation but keeping phishing-based delivery viable. No public exploit identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.
SQL injection in the Azure Synapse connector of Amazon aws-athena-query-federation allows authenticated remote users to exfiltrate unintended data from connected Azure Synapse databases by supplying crafted table names that are improperly neutralized before inclusion in SQL commands. Affected versions span v2022.20.1 through v2026.19.1, and the scope of data exposure extends beyond Athena itself into the downstream Synapse database. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires valid Athena credentials with sufficient privilege to invoke the Synapse connector.
DLL hijacking in HCL Traveler for Microsoft Outlook (HTMO) permits a local, high-privileged attacker to replace or plant a malicious DLL in a directory searched by the application at load time, enabling arbitrary code execution within the HTMO process context. The CVSS vector (AV:L/AC:L/PR:H/UI:R) confirms the attack is constrained to local access with elevated privileges and requires a user to trigger application load, substantially limiting real-world exploitability despite the full C/I/A:H impact ratings. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds memory read in YAML::Syck's bundled libsyck C library for Perl exposes any application calling Load() or LoadFile() on untrusted YAML to a one-byte heap over-read. The root flaw (CVE-2025-11683) resided in the libsyck block-scalar lexer's newline scanning logic; the patch issued for that CVE was incomplete, leaving a second lexer path uncovered - subsequently disclosed as CVE-2026-57077. Both are resolved in YAML-Syck 1.47 (released July 13, 2026). No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog.
Stored or reflected cross-site scripting in Microsoft SharePoint Server allows an authenticated low-privileged attacker to inject malicious script content that executes in a victim's browser, enabling spoofing attacks over a network. Affected deployments span SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. No public exploit code or active CISA KEV listing has been identified; the CVSS 4.6 Medium rating reflects the dual prerequisites of authentication and victim interaction, which materially constrain real-world exploitability.
Cross-site scripting in Microsoft Windows Admin Center enables network-based spoofing attacks against users who interact with attacker-controlled content. The CVSS vector (AV:N/PR:N/UI:R/S:C) confirms that an unauthenticated remote attacker can deliver a crafted payload that executes in the victim's browser context once user interaction occurs, enabling session hijacking or administrative action spoofing within the management interface. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.
Lenovo Smart Connect for Windows exposes an improper access control flaw that permits a local authenticated user to read files belonging to other users on the same machine. Discovered through Lenovo's own internal security assessment and documented under advisory LEN-218281, the flaw carries a CVSS 4.0 score of 6.8 with a local, low-privilege attack vector and high confidentiality impact. No public exploit code and no CISA KEV listing exist at time of analysis, limiting immediate risk to multi-user Windows environments where Lenovo Smart Connect is installed.
Session-squatting and memory exhaustion in Microsoft UFO's WebSocket server allow any authenticated client to permanently deny legitimate task owners access to their sessions or flood the shared session store with phantom entries. The COMMAND_RESULTS handler in ufo/server/ws/handler.py invoked get_or_create_session with a caller-supplied session_id but omitted the owner_client_id binding, and the message type carried no role gate - meaning any authenticated peer could pre-register arbitrary session IDs before their intended owners. This issue is not in CISA KEV and no public exploit has been identified, though the fix commit's regression tests provide a near-complete exploitation blueprint.
Cross-device system_info disclosure in Microsoft UFO's WebSocket server allows any authenticated DEVICE-role client to retrieve another enrolled device's server-side system_info - including hostname, IP address, and metadata tags - by supplying an arbitrary target_id in a DEVICE_INFO_REQUEST message. Affected versions 3.0.0 through 3.0.5 authenticate the caller's role but omit object-level authorization in handle_device_info_request and get_device_info (ufo/server/ws/handler.py), meaning DEVICE clients can enumerate peers that only CONSTELLATION controllers should be able to query. No public exploit identified at time of analysis; vendor-released patch is version 3.0.6.
Insecure Direct Object Reference (IDOR) in Microsoft SimpleChat exposes any authenticated user's profile data to other authenticated users without authorization checks. The GET /api/user/info/<user_id> and GET /api/user/profile-image/<user_id> endpoints in route_backend_users.py accept a caller-supplied user_id and query the Cosmos DB user-settings document directly, bypassing object-level authorization - enabling enumeration of email addresses, display names, and profile images across the entire user base. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog; the vendor-released fix is version 0.241.203.
ToolHive's hand-maintained SSRF guard (`networking.IsPrivateIP`) omits IPv6 NAT64 prefixes `64:ff9b::/96` (RFC 6052) and `64:ff9b:1::/48` (RFC 8215), allowing addresses like `64:ff9b:1::a9fe:a9fe` - the NAT64 encoding of the cloud metadata endpoint `169.254.169.254` - to be misclassified as globally routable and pass unchecked. On ToolHive deployments behind a NAT64/DNS64 gateway (the default in IPv6-only Kubernetes clusters and several IPv6-only cloud environments), an unauthenticated attacker can submit a crafted OAuth `client_id` URL that causes ToolHive's CIMD fetcher to dial internal or link-local addresses the guard is intended to block, achieving a blind internal-reachability oracle. Practical impact is limited to TCP/TLS connection probing rather than credential exfiltration due to HTTPS-only enforcement and TLS verification on the attacker-controlled path; a complete proof-of-concept is publicly available in the vendor advisory, and no public exploit identified at time of analysis as a KEV-listed active campaign.
Full-read SSRF in Koel's podcast subscription feature allows any authenticated user to coerce the server into fetching internal HTTP endpoints - including cloud instance metadata services - and receive the full response. The vulnerability exists because PHP's `filter_var` with `FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE` does not unwrap NAT64 (`64:ff9b::/96`) or 6to4 (`2002::/16`) IPv6 transition addresses, both of which deterministically embed a private IPv4 that the OS kernel routes internally. This affects all Koel deployments through v9.7.0 on NAT64 or dual-stack networks (the default for IPv6-only AWS and GCP subnets); a detailed proof-of-concept with verbatim server output is published in the advisory. No public exploit code is in KEV at time of analysis, but the PoC substantially lowers the exploitation barrier.
Process memory disclosure in Google Chrome's Media component on Windows (prior to 150.0.7871.125) enables an attacker who has already compromised the renderer process to read sensitive data from Chrome's memory via a crafted HTML page. This is a chained vulnerability - it is a second-stage exploit requiring a pre-compromised renderer, making it a useful component in multi-stage browser attack chains rather than a standalone threat. No public exploit identified at time of analysis, EPSS is 0.30% (22nd percentile), and SSVC exploitation status is 'none,' confirming no current active exploitation.
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to manipulate encoded output, enabling content or identity spoofing with high integrity impact. Affected products span three active .NET generations plus Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7), creating a broad enterprise attack surface. A publicly available proof-of-concept exploit exists on GitHub; however, CISA SSVC reports exploitation status as none and EPSS sits at 0.41% (34th percentile), suggesting opportunistic rather than widespread active threat activity at time of analysis.
Local tampering via symbolic-link following in Microsoft .NET (versions 8.0, 9.0, and 10.0) and the bundled toolchain in Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7) allows an authorized local attacker to redirect a privileged file operation to an unintended target, corrupting or replacing files outside their normal permissions. Microsoft (the reporter) has released a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. The high CVSS 3.1 base score of 7.0 is tempered by high attack complexity and the requirement for existing low-level local access.
Devolutions Server 2026.1.22.0 and 2026.2.11.0 exposes Azure Key Vault client secrets in cleartext within Recovery Kit response files, defeating an explicit 'exclude sensitive data' option that administrators rely on. Any party who obtains a copy of the generated response file can trivially read the credential without any decryption or tooling. No public exploit code exists and the vulnerability is not in CISA KEV; however, because successful exploitation yields a reusable cloud credential, the downstream blast radius in Azure environments substantially exceeds what the 3.3 CVSS base score suggests. A vendor-released patch is available.
Memory parsing across Microsoft Office and SharePoint Server products is susceptible to a CWE-125 out-of-bounds read that, when triggered by opening a specially crafted Office document, produces local information disclosure or application availability loss. The affected surface is broad - spanning Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024 on both Windows and macOS, and SharePoint Enterprise Server 2016, 2019, and Subscription Edition - but real-world exploitation pressure is low: EPSS sits at 0.36% (28th percentile), CISA SSVC rates exploitation as none and the attack as non-automatable, and no public exploit has been identified at time of analysis. Vendor-released patches are available for all affected product lines.
Windows Boot Loader across Windows 10, Windows 11, and Windows Server 2012 through 2025 omits a required cryptographic integrity step (CWE-325), enabling a locally authenticated attacker to bypass boot-time security features. The CVSS vector (AV:L/PR:L) confirms exploitation requires an existing local foothold - remote unauthenticated attacks are not possible. No active exploitation is recorded (SSVC: none, EPSS 0.23%), but SSVC rates technical impact as total, reflecting that a successful boot-level security bypass can undermine the entire trusted boot chain and enable persistent pre-OS compromise.
Privilege escalation in the Windows USB Print Driver affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025, exploitable by a physically-present attacker with low-privilege credentials via a race condition in the driver's shared resource handling. The flaw requires both physical device access and precise timing to win the synchronization window, making exploitation non-trivial. No public exploit identified at time of analysis; EPSS stands at 0.17% (7th percentile), and SSVC rates exploitation as none - consistent with high attack complexity and the physical access prerequisite.
Windows Kernel security feature bypass across Windows 10, 11, and Server 2012 through 2025 allows a local authenticated attacker to circumvent kernel-enforced access controls, resulting in high-confidence disclosure of sensitive information (C:H). Rooted in CWE-284 (Improper Access Control), the flaw enables a privilege-constrained local user to read protected data beyond their authorization boundary. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.25% (16th percentile) and SSVC assigns exploitation status 'none,' consistently characterizing this as a standard patch-cycle priority rather than an emergency response item.
Windows Remote Desktop Protocol (RDP) across a broad range of Windows 10, 11, and Server editions discloses potentially sensitive memory contents over the network due to an uninitialized resource flaw (CWE-908), exploitable by remote unauthenticated attackers when a user interacts with an RDP session. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates network-wide reachability with no attacker privilege requirement, though mandatory user interaction (UI:R) prevents automated mass exploitation. No public exploit has been identified at time of analysis; EPSS at 0.51% (40th percentile) and SSVC exploitation status of 'none' confirm low current threat activity despite Windows RDP's ubiquitous enterprise attack surface.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) exposes kernel memory contents to an attacker who physically connects a crafted USB audio device to an unpatched system. Affected systems span Windows 10 (1809 through 22H2), Windows 11 (24H2 through 26H1), and Windows Server 2019/2022/2025, as confirmed by EUVD-2026-44284 and the MSRC advisory. No public exploit code has been identified at time of analysis, and EPSS at 0.42% (34th percentile) reflects low automated exploitation probability consistent with the mandatory physical access requirement.
Information disclosure via uninitialized resource use in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to authenticated remote attackers across a wide range of Microsoft Windows desktop and server editions. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms this is exploitable over the network by any low-privileged authenticated user with no complexity or interaction requirements, yielding high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation and the ubiquitous deployment of Windows RDP make this a meaningful patching priority.
Tampering via a time-of-check time-of-use (TOCTOU) race condition in Windows Subsystem for Linux 2 (WSL2) enables a locally authorized, low-privileged attacker to manipulate file system or resource state between the moment a security check is performed and the moment the resource is actually used. Affected versions run below 2.7.10, and Microsoft has released a fix. No public exploit code has been identified and CISA has not added this to the KEV catalog, but the SSVC framework assesses technical impact as total if the race is won, making the integrity risk significant despite a medium CVSS score.
Cross-site scripting in Microsoft Visual Studio Code lets an attacker who tricks a local user into opening crafted content bypass a built-in security feature and gain high-impact code execution within the editor context. The flaw (CWE-79) carries a CVSS 3.1 base score of 7.1 with a local attack vector requiring user interaction, and Microsoft has published an advisory with a fix. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Information disclosure in Windows Print Spooler Components exposes memory contents to locally authenticated attackers via an out-of-bounds read (CWE-125). The flaw affects a sweeping range of Windows releases from Server 2012 through Windows 11 26H1 and Server 2025, making the affected surface extremely broad. Microsoft has released patched builds and the SSVC assessment confirms no observed exploitation, with EPSS at 0.31% (22nd percentile) corroborating a low immediate threat posture; however, Print Spooler's historical exploitation history (PrintNightmare family) warrants prompt patching given attacker familiarity with the component.
Information disclosure in Windows File Explorer exposes sensitive memory contents to local attackers due to CWE-908 use of an uninitialized resource. Triggered when a local user interacts with File Explorer, the flaw allows memory contents - potentially including sensitive data from other processes or the OS - to be read without elevated privileges. No public exploit code has been identified and CISA has not listed this in KEV, but the breadth of affected platforms (Windows 10 through 11 and Windows Server 2012 through 2025) makes patching broadly applicable.
Uninitialized memory exposure in the Microsoft Windows Codecs Library enables a local attacker to disclose sensitive process memory contents on affected Windows systems. The flaw (CWE-908) requires user interaction - specifically opening or processing a specially crafted media file - but demands no elevated privileges. No public exploit code exists and no active exploitation is confirmed; EPSS sits at 0.51% (40th percentile), consistent with SSVC's 'Exploitation: none' assessment, making this a medium-severity, low-urgency issue relative to the breadth of affected platforms.
Out-of-bounds read in Microsoft Office exposes sensitive memory contents to a local, unauthenticated attacker who can induce a user to open a malicious document. Affected products span the full current Office portfolio - Office 2016 through LTSC 2024 on both Windows and macOS - making the blast radius broad despite the local attack vector. No public exploit identified at time of analysis and SSVC classifies exploitation as none and not automatable, though the high confidentiality impact (C:H) and near-universal deployment of Office keep this a meaningful patching priority.
Out-of-bounds read in Microsoft Office and SharePoint exposes process memory contents locally when a user opens a specially crafted document. Affected products span the full Office suite - Office 2016, 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise (Windows and Mac), and SharePoint Server 2016, 2019, and Subscription Edition - covering virtually the entire active Office install base. No public exploit code exists and CISA SSVC rates exploitation as none, making this a patch-and-monitor priority rather than an emergency response.
Information disclosure in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) arises from an out-of-bounds read (CWE-125) that lets an attacker who convinces a victim to open a crafted file read memory beyond an intended buffer boundary. Exploitation is local and requires user interaction, and there is no public exploit identified at time of analysis and no CISA KEV listing. Disclosed memory can leak sensitive data such as heap contents or pointer addresses useful for defeating ASLR in a follow-on exploit chain.
Information disclosure in Microsoft Windows Schannel (the Secure Channel TLS/SSL provider) lets an authenticated, network-adjacent attacker read memory beyond an allocated buffer and leak sensitive data across a network connection. The flaw spans nearly the entire supported Windows family - Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025. Reported by Microsoft with a fix available; there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Windows Win32K information disclosure on multiple Windows 10, Windows 11, and Windows Server releases allows a locally authenticated low-privilege user to read sensitive kernel-level data that should be inaccessible to user-space processes. Rooted in CWE-200 (improper exposure of sensitive information), the flaw exposes confidentiality-impacting data via the Win32K graphical subsystem without requiring elevated rights or user interaction from another party. No public exploit code has been identified, CISA SSVC rates exploitation status as 'none,' and the EPSS score of 0.47% (38th percentile) confirms low near-term exploitation probability.
Null pointer dereference in the Windows SMB Server component allows an authenticated network attacker to crash the service across multiple Windows 10, 11, and Server editions. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms network exploitability with low-privilege credentials and complete availability impact, though confidentiality and integrity are unaffected. No public exploit identified at time of analysis; SSVC exploitation status is 'none' and EPSS sits at 0.79%, indicating low active exploitation pressure despite the broad product footprint.
Spoofing vulnerability in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition allows an authenticated network attacker to impersonate identities or forge content due to improper access control (CWE-284). Exploitation requires valid credentials (CVSS PR:L), limiting opportunistic attack surface. SSVC assessment confirms no active exploitation, and EPSS sits at just 0.28% (20th percentile), consistent with a targeted rather than broadly exploited vulnerability. Vendor-released patches are available for all three affected product lines.
Type confusion (CWE-843) in Microsoft SQL Server 2025 enables authenticated, low-privileged network attackers to disclose sensitive server-side information. The CVSS vector (AV:N/PR:L/C:H) confirms that any authorized database user - regardless of their data access permissions - can potentially trigger the flaw remotely with no user interaction required. No public exploit code or CISA KEV listing exists at time of analysis, but the high confidentiality impact and low access complexity make patching a meaningful priority for organizations running SQL Server 2025.
Buffer over-read in Microsoft SQL Server 2025 exposes server memory contents to low-privileged authenticated attackers over the network, resulting in high confidentiality impact with no integrity or availability consequences. Both the Cumulative Update 6 (CU 6) and General Distribution Release (GDR) servicing tracks on x64-based systems are confirmed affected per vendor CPE data. No public exploit has been identified and CISA has not listed this in KEV; SSVC assessment corroborates no active exploitation at time of analysis, placing this in a measured but real priority category for environments handling sensitive SQL data.
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, Server 2019, and Server Subscription Edition enables authenticated network attackers to inject malicious scripts that execute in victims' browsers, enabling spoofing, session hijacking, or unauthorized actions on behalf of targeted users. The CWE-79 flaw requires victim interaction (UI:R) and low-privilege attacker credentials (PR:L), but the changed scope (S:C) means impact extends beyond the SharePoint server into the victim's browser session. No public exploit identified at time of analysis; EPSS of 0.28% (20th percentile) and SSVC exploitation rating of 'none' indicate low immediate threat despite broad enterprise deployment.
Out-of-bounds read in Microsoft Office exposes a limited portion of process memory to a local attacker when a user opens a specially crafted document. Affected products span Office 2016 through LTSC 2024 on both Windows and macOS, with impact confined to low-severity information disclosure and no integrity or availability consequence. No public exploit code exists and CISA has not listed this in KEV; SSVC confirms exploitation status as none and the vulnerability is assessed as non-automatable, collectively placing this in the lowest real-world risk tier despite broad product coverage.
Uninitialized memory disclosure in Microsoft Office exposes sensitive data locally when a user interacts with a crafted document. The vulnerability, rooted in CWE-908 (Use of Uninitialized Resource), affects the full breadth of current Office deployments across Windows and macOS, including Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise. No public exploit code has been identified at time of analysis, and SSVC signals confirm no observed exploitation; however, the High confidentiality impact warrants prompt patching given Office's ubiquitous deployment footprint.
Numeric truncation error (CWE-197) in Microsoft Office Word triggers local information disclosure when a user opens a maliciously crafted document, exposing potentially sensitive memory contents with high confidentiality impact (C:H). The vulnerability spans a broad range of Microsoft Office and SharePoint products - including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Word 2016, Office 2019, Office 365 for Mac, and multiple SharePoint Server versions. No public exploit identified at time of analysis; CISA SSVC rates exploitation as none, EPSS stands at 0.39% (31st percentile), and a vendor-released patch is available from Microsoft.
Server-side request forgery in Microsoft SharePoint Server enables authenticated, low-privileged users to force the server to issue outbound network requests, exposing internal resources and sensitive data not directly accessible to the attacker. All three actively supported SharePoint server editions are affected: Enterprise Server 2016, Server 2019, and Subscription Edition. No public exploit code or CISA KEV listing exists at time of analysis; EPSS sits at 0.59% (44th percentile) and SSVC rates exploitation as none, indicating limited real-world exploitation activity despite the medium-high CVSS score.
Stored/reflected cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Edition) lets an authenticated attacker inject script that executes in another user's browser session to spoof content over the network. Although Microsoft classifies the impact as 'spoofing,' the CVSS 3.1 vector rates confidentiality and integrity as High (C:H/I:H), indicating the injected script can access or alter sensitive session data. There is no public exploit identified at time of analysis, and a vendor patch is available.
Microsoft Office information disclosure via integer overflow (CWE-190) exposes high-confidentiality data to a local attacker who can induce a victim to open a crafted document. The flaw affects a broad range of Microsoft Office versions on both Windows and macOS - including Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise - confirmed by Microsoft via MSRC. No public exploit code exists and CISA SSVC rates exploitation as none, placing this in low urgency despite the High confidentiality impact in the CVSS vector; however, the extensive product footprint means patching remains advisable.
Out-of-bounds read in Microsoft Excel's file parser discloses sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC for Mac 2021/2024, and Office Online Server. The CVSS vector (AV:N/PR:N/UI:R/C:H) indicates unauthenticated network delivery with mandatory user interaction and high confidentiality impact. No public exploit identified at time of analysis; SSVC confirms no known active exploitation and EPSS at 0.64% (46th percentile) reflects below-average exploitation probability, positioning this as a targeted phishing risk rather than an opportunistic threat.
Out-of-bounds read in Microsoft Office (including 365 Apps for Enterprise, Office 2016/2019, LTSC 2021/2024 on Windows and macOS, and SharePoint Server 2016/2019/Subscription Edition) allows a local attacker to disclose limited memory contents when a victim opens a specially crafted document. The CVSS 3.3 Low score, EPSS of 0.51% (40th percentile), SSVC exploitation status of 'none,' and absence from CISA KEV collectively place this vulnerability at low real-world priority despite its broad product footprint. No public exploit or proof-of-concept code has been identified at time of analysis.
Information disclosure in Microsoft Office Word and related Microsoft 365/SharePoint products exposes sensitive memory contents when a user opens a specially crafted document. Affecting a broad suite of products spanning Word 2016 through Office LTSC 2024 and SharePoint Server versions, the flaw stems from improper input type validation (CWE-1287) in the document parsing subsystem. No public exploit has been identified at time of analysis; EPSS at 0.39% and CISA SSVC exploitation status of 'none' confirm this remains a theoretical rather than actively targeted risk, though Microsoft has released patches.
Untrusted pointer dereference (CWE-822) in Microsoft Excel allows a local attacker to disclose sensitive memory contents when a victim opens a specially crafted workbook. The flaw affects a broad swath of Microsoft Office product lines - from Excel 2016 through Office LTSC 2024 and their Mac counterparts - as confirmed by CPE enumeration. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as none and technical impact as partial, placing this in the moderate real-world priority tier despite the C:H CVSS rating.
Out-of-bounds read in Microsoft Office Word and associated Microsoft 365 products allows local information disclosure when a user opens a specially crafted document. Affecting a broad range of Microsoft Office versions across Windows and macOS - including Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and SharePoint Server 2016/2019/Subscription Edition - an attacker with no prior system privileges must socially engineer a victim into opening a malicious file to trigger memory disclosure. No public exploit identified at time of analysis; EPSS is 0.39% (31st percentile) and SSVC confirms exploitation status as none and the attack as non-automatable.
Out-of-bounds read in Microsoft Office exposes high-confidentiality memory contents to a local, unauthenticated attacker who can induce a user to open a crafted document. The flaw affects a wide swath of Office and SharePoint products across Windows and Mac platforms, including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, Office 365 for Mac, and SharePoint Server 2016 through the Subscription Edition. No public exploit has been identified at time of analysis, EPSS is low at 0.50% (39th percentile), and CISA SSVC rates exploitation as none and the flaw as non-automatable, placing this firmly in a patch-and-monitor risk tier rather than an emergency-response tier.
Out-of-bounds memory read in Microsoft Office and SharePoint exposes sensitive in-process data when a user opens a specially crafted document on a local machine. Affecting Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024 (Windows and macOS), and SharePoint Server 2016 through Subscription Edition, the CWE-125 flaw allows an unauthorized attacker to read beyond allocated buffer boundaries, achieving High confidentiality impact with no integrity or availability consequence. No public exploit exists and no active exploitation is confirmed at time of analysis - CISA SSVC rates exploitation status as none - making this a routine-priority patch despite the broad product coverage.
Out-of-bounds read in Microsoft Office and SharePoint Server exposes local memory contents to an unauthorized attacker, resulting in information disclosure. The vulnerability (CWE-125) is triggered when a user opens a specially crafted Office document, making exploitation dependent on user interaction rather than remote network access. No active exploitation has been confirmed - CISA KEV does not list this CVE, SSVC rates exploitation as none, and EPSS probability sits at 0.51% (40th percentile), collectively indicating low real-world threat activity despite the wide deployment footprint of affected products.
Local information disclosure in Microsoft Office and SharePoint via an integer overflow (CWE-190) exposes sensitive data to low-privileged local attackers across a broad range of Office versions on both Windows and Mac platforms. The CVSS vector (AV:L/PR:L) confirms exploitation requires an existing foothold on the target machine, limiting real-world impact to post-compromise scenarios or insider threats. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.40% (32nd percentile) combined with SSVC exploitation status of 'none' indicates this is not currently being weaponized in the wild.
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables an authenticated network attacker to inject malicious scripts into SharePoint pages, causing spoofing against users who view the affected content. The vulnerability carries a CVSS 5.4 (Medium) score with an EPSS of 0.38% (30th percentile), indicating low current exploitation probability. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read (CWE-125) in Microsoft Office's file parsing logic exposes potentially sensitive in-memory data to a local attacker when a victim opens a specially crafted document, affecting Windows and macOS Office editions as well as Microsoft SharePoint Server. The CVSS 5.5 Medium score reflects a local-only attack vector with mandatory user interaction, confining impact to information disclosure with no integrity or availability consequence. No public exploit code exists, CISA SSVC classifies exploitation as 'none' with no automation potential, and the EPSS of 0.51% (40th percentile) confirms low current exploitation probability.
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables an authenticated attacker with low-privilege network access to inject malicious scripts into SharePoint pages, resulting in spoofing impacts when a victim user interacts with the crafted content. The CVSS vector (PR:L/UI:R) confirms exploitation requires both an existing authenticated account and victim interaction, constraining real-world risk relative to unauthenticated XSS variants. No public exploit identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog. Vendor patch is available via the Microsoft Security Response Center.