Microsoft
Monthly
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to gain SYSTEM-level access via a race condition in kernel-level socket processing. The CVSS vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation requires an existing low-privilege foothold, precise timing to win the race window, but no user interaction. Microsoft has released patches across a wide range of supported Windows versions. No public exploit or CISA KEV listing has been identified at time of analysis, though race-condition LPE bugs in Windows kernel drivers are a favored post-exploitation technique.
Privilege elevation in Microsoft Azure Active Directory B2C lets an unauthenticated remote attacker abuse a user-controlled key (CWE-639) to bypass authorization checks and gain elevated privileges across a network. The flaw carries a maximum CVSS 10.0 with a changed scope, reflecting that a successful attack against the shared identity platform can compromise the confidentiality and integrity of resources belonging to other principals or tenants. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege elevation in Microsoft Copilot Studio lets a network-based, unauthenticated attacker bypass cryptographic signature verification (CWE-347) to gain elevated privileges across a scope boundary, per CVSS:3.1 AV:N/PR:N/S:C rated 10.0. The flaw appears to involve forged or improperly validated JWT tokens, per the 'Jwt Attack' tagging, and because Copilot Studio is a multi-tenant cloud service the scope-change vector implies impact beyond the initially compromised authority. No public exploit identified at time of analysis, and EPSS is low at 0.29% (22nd percentile), but SSVC rates technical impact as total and automatable as yes.
Privilege elevation in Microsoft's Azure AI Language cloud service lets a remote, unauthenticated attacker reach a critical function that lacks authentication (CWE-306), gaining elevated privileges over the network. Rated CVSS 10.0 with a scope change (S:C), the flaw is disclosed and fixed by Microsoft via MSRC; no public exploit code or CISA KEV listing is indicated, so this is no public exploit identified at time of analysis.
Privilege escalation in Microsoft Fabric allows an authenticated low-privileged attacker to elevate their access level over the network, gaining full control over confidentiality, integrity, and availability of affected resources. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-friction network exploitation requiring only a valid user account and no additional interaction. No public exploit code has been identified and CISA has not listed this in KEV, though SSVC rates the technical impact as total.
Authorization bypass via user-controlled key in Azure Cosmos DB enables an authenticated attacker to perform cross-account spoofing over the network, potentially accessing or manipulating data belonging to other accounts or tenants. Exploiting CWE-639 (IDOR-class flaw), an attacker with a valid Cosmos DB account can supply a crafted key to circumvent per-resource authorization checks, yielding full confidentiality, integrity, and availability impact per the CVSS vector. No public exploit code has been identified and SSVC confirms no active exploitation, though CVSS impact metrics indicate total technical impact if successfully triggered.
Privilege elevation in Microsoft Power Automate (Power Platform cloud service) lets an authenticated, low-privileged attacker abuse a server-side request forgery flaw (CWE-918) to make the service issue requests to internal/backend endpoints, resulting in a scope-changing escalation with total confidentiality, integrity, and availability impact. The CVSS 3.1 base score is 9.9 with a changed scope, reflecting that the SSRF crosses a trust boundary into resources beyond the vulnerable component. No public exploit identified at time of analysis, and EPSS is low (0.33%, 26th percentile), consistent with CISA SSVC marking exploitation as 'none'.
Privilege escalation in Microsoft Entra ID (formerly Azure Active Directory) lets a remote, unauthenticated attacker bypass authentication through an alternate path or channel and gain elevated privileges over the network. The flaw affects Microsoft's cloud identity-and-access-management service, which underpins sign-in and authorization for Microsoft 365, Azure, and countless federated third-party applications. No public exploit identified at time of analysis and SSVC records exploitation status as none, but the CISA SSVC framework rates the attack as automatable with total technical impact.
NoSQL injection in Microsoft Discovery Studio enables unauthenticated, network-based attackers to extract confidential data from the application's backend data store. The CWE-943 flaw allows specially crafted query inputs to bypass intended data-access boundaries, with the CVSS scope-change (S:C) indicating that leakage can extend beyond the directly targeted component - potentially exposing data belonging to other users or system contexts. Exploitation requires user interaction (UI:R), constraining opportunistic mass attacks; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-origin RCE in Windows ML CLI (winml-cli < 0.4.0) is reachable when a developer runs the `serve` command, which exposes a localhost HTTP API with a wildcard CORS policy and no authentication gate. Any malicious webpage visited by the user while the server is running can send cross-origin requests to `/v1/cli/build` or `/v1/cli/config`, inject `trust_remote_code=true`, and cause the server to call `AutoConfig.from_pretrained(trust_remote_code=True)` - downloading and executing attacker-controlled Python code from a remote model repository as the server user. The vendor has released a fix in version 0.4.0; no public exploit is identified at time of analysis.
Privilege escalation in Jenkins Microsoft Entra ID Plugin (≤710.v0b_ff8e9cc2d2) allows any Entra tenant member with group-creation rights to inherit Jenkins permissions configured for a privileged group by creating a new Entra group whose display name collides with a privileged group's display name. The plugin incorrectly resolves group identity using both the immutable object ID and the mutable, user-controllable display name, so the collision satisfies the authorization check without the attacker belonging to the legitimate privileged group. No public exploit has been identified and CISA has not listed this in KEV, but exploitation requires only a valid Entra account, making it a meaningful insider or tenant-level escalation path into CI/CD infrastructure.
Path traversal in wcurl for Windows allows a crafted URL containing percent-encoded backslashes to redirect a downloaded file to an attacker-controlled directory outside the user's intended destination. Affecting wcurl shipped with curl 8.14.0 through 8.21.0 and standalone wcurl 2024.12.08 through 2026.01.05, the flaw exploits Windows path-separator semantics: wcurl decodes %5C to a backslash, which Windows treats as a directory separator, causing file placement at an unintended filesystem path. No public exploit code and no active exploitation have been identified at time of analysis; vendor-released patches are available as of September 2, 2026.
Arbitrary code execution in OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) allows an attacker who can deliver a crafted repository archive to run code with the victim user's full privileges when Codex automatically collects Git repository metadata. The root cause is that Codex's Git metadata collection path did not suppress the repository-local core.fsmonitor configuration, enabling a malicious .git/config to direct Git to invoke an attacker-supplied filesystem-monitor helper outside Codex's command sandbox and without any user-approval prompt. OpenAI has issued a source-level fix via PR #22652 adding -c core.fsmonitor=false to the relevant Git invocations; no public exploit code has been identified at time of analysis.
Arbitrary code execution in OpenAI Codex Desktop (Windows and macOS, including the Microsoft Store package) occurs when a user opens a workspace containing an attacker-prepared Git repository whose local .git/config is intact. Because Codex automatically inspects Git metadata and working-tree status on open, a malicious attr.tree setting combined with a clean/process filter causes Git to launch an attacker-controlled program outside Codex's command sandbox, with the signed-in user's privileges and no trust prompt, approval, or model interaction. No public exploit is identified at time of analysis and EPSS is low (0.14%), but the outcome is full local compromise of the user's files and credentials.
OpenAI Codex CLI and Codex Desktop's PowerShell command-safety parser failed to recognize PowerShell's stop-parsing token (--%), misclassifying file-writing Git commands embedded after that token as safe and executing them without user approval. An attacker who tricks a developer into opening a crafted repository can cause Codex to silently write an attacker-controlled configuration; when Codex subsequently loads that configuration, it launches an attacker-designated MCP server and executes arbitrary code under the user's account. No public exploit has been identified at time of analysis (EPSS 0.16%, 6th percentile), and the default filesystem sandbox on macOS and Linux can limit the damage radius by preventing writes outside permitted directories.
Arbitrary code execution in OpenAI Codex Desktop for Windows and macOS allows an attacker's Git hooks to run outside the application's command sandbox when a user opens a specially prepared repository. Codex's automated Git operations honored the repository-local `core.hooksPath` setting in `.git/config` without sanitizing or overriding it, enabling a malicious hook script to execute with the user's full OS privileges - reading, modifying, or deleting files and accessing other resources. No active exploitation has been identified (EPSS 0.13%, not in CISA KEV); a code-level fix exists in GitHub PR #22843 but a versioned patch release is not independently confirmed at time of analysis.
Out-of-bounds read in Exiv2's CrwMap::decodeBasic() function affects versions prior to 0.28.9, impacting applications that use the library to parse Canon CRW image metadata. Classified as low severity by the Exiv2 maintainers, this flaw has only been reproduced using a dedicated fuzz target - the standard exiv2 command-line tool cannot trigger it under normal operation. No public exploit exists and no active exploitation has been identified, making real-world impact minimal despite the memory safety class of defect.
Out-of-bounds write in Exiv2's RemoteIo::Impl::populateBlocks() affects all versions prior to 0.28.9, exploitable only when Exiv2 is invoked with a remote URL as input rather than a local file path. Memory corruption from the write could theoretically enable code execution in the Exiv2 process context if a user or automated pipeline fetches a specially crafted image from an attacker-controlled server. Fixed in the 0.28.9 release; no public exploit or KEV listing identified at time of analysis.
Local privilege escalation in SiYuan's Windows NSIS installer affects versions 2.0.14 through 3.8.0, allowing a local attacker with write access to a directory to execute arbitrary code with elevated privileges by planting a malicious binary that the NSIS installer resolves ahead of System32 during an all-users installation. The root cause is electron-builder's preInit hook invoking system utilities such as TASKKILL by short name via nsExec::Exec, causing the installer's launch directory to take search-path precedence over System32 before the license page is even displayed. No public exploit code has been identified at time of analysis, though the binary-planting technique is well-documented in Windows installer security research.
Path traversal in Pake before 3.13.1 allows a malicious or compromised web page loaded inside any Pake-generated desktop app to write attacker-fetched content to arbitrary user-writable filesystem locations, including persistence directories. The `download_file` Tauri command accepted a JavaScript-supplied filename and joined it directly to the Downloads directory without stripping path separators or sanitizing sequences such as `../`, enabling writes to locations such as `~/Library/LaunchAgents/` on macOS, `~/.config/autostart/` on Linux, or the Windows Startup folder. Because the HTTP fetch is performed by the Rust backend rather than the sandboxed browser renderer, browser-level download restrictions do not apply. No public exploit is identified at time of analysis, though the attack primitive is straightforward given JFrog's public disclosure.
Unauthenticated connection exhaustion in MongoDB Connector for BI allows any network-reachable client to hold authentication sessions open indefinitely by initiating a SASL login exchange and then withholding further data. The absence of a wall-clock timeout on the negotiation loop and no read deadline on the client socket means each such session permanently occupies a worker thread, a connection slot, and associated backend MongoDB handles until the process is restarted. Sustained repetition of this pattern can exhaust the configured connection pool capacity entirely, denying service to all legitimate BI tool users; no public exploit has been identified at time of analysis.
Credential disclosure in the MariaDB Connector for Node.js (npm: mariadb) exposes plaintext database passwords to active network attackers when SSL/TLS is configured without a CA or server certificate. Fingerprint-based server identity validation is sequenced after the authentication exchange, so a man-in-the-middle presenting any certificate receives the password before the connection is ultimately rejected and closed. Affected branches span all releases below 3.2.4, 3.3.3, 3.4.6, and 3.5.3; no CISA KEV entry or public proof-of-concept exists at time of analysis, though the flaw is structurally exploitable by any on-path attacker against the specific misconfiguration.
OS command injection in PowSyBl Core's AbstractLocalCommandExecutor implementations allows authenticated callers who forward untrusted data to the vulnerable public APIs to execute arbitrary shell commands as the JVM process user on both Unix and Windows hosts. Affected versions are com.powsybl:powsybl-computation-local up to and including 7.2.1; the flaw is a library-level sink, meaning any REST front-end, pypowsybl integration, or multi-tenant grid analysis platform embedding powsybl-core that passes external parameters to LocalComputationManager.execute(), ActionSimulatorTool.run(), or AmplModelRunner.run() inherits the vulnerability without modifying powsybl code. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the advisory documents multiple injection vectors with bypass paths for the previously weak escaping.
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can be triggered when a user visits attacker-controlled web content. All versions of Edge (Chromium-based) are affected per the wildcard CPE, with full confidentiality, integrity, and availability impact at a CVSS 8.8. A vendor patch is available via the Microsoft Security Response Center; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who controls a monitored log source to inject arbitrary arguments into firewall and account-management commands executing as root. Five scripts handling the srcip alert field (route-null.c, netsh.c, pf.c, npf.c, ipfw.c) omit IP format validation, and disable-account.c passes the dstuser field to passwd/chuser with only a root-name check, enabling injection into pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted CreateProcess concatenation in wpopenv() amplifies the impact by allowing space-delimited srcip values to append additional process arguments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Improper access control on the Synergis Softwire installation folder exposes sensitive files to any low-privileged local user on Windows Server deployments and Genetec Streamvault SV-100E and SV-300E all-in-one appliances. The CVSS scope change (S:C) is particularly consequential in this context: Synergis Softwire is a physical access control server, meaning credentials or configuration material extracted from the installation directory could allow an attacker to manipulate physical security decisions or pivot into backend systems. No public exploit has been identified at time of analysis, and Genetec has released remediated versions in the 12.0.2 and 12.2.0 branches.
Unauthenticated remote process termination in MongoDB Connector for BI (mongosqld) affects deployments explicitly configured with Kerberos authentication. An attacker with network access to the mongosqld listener can send a crafted GSSAPI authentication exchange that triggers a double-free condition in error-handling code, crashing the process and interrupting BI availability until restarted. No public exploit code has been identified at time of analysis, and the attack is constrained to the subset of deployments running Kerberos - a non-default configuration.
Remote code execution via log path traversal in Flowintel 3.3.0 and later is achievable by an authenticated administrator who redirects the LOG_FILE configuration setting to an arbitrary filesystem path and injects server-side template syntax through attacker-controlled logged content. The upstream commit explicitly documents this multi-step exploitation chain - redirecting log output to a template file and triggering application rendering to execute injected code - making weaponization technically straightforward for any attacker holding admin credentials. No public exploit or CISA KEV listing is identified at time of analysis; upstream fix is available as a GitHub commit from the Flowintel maintainer CIRCL.
WibuKey64.sys kernel-mode driver in Wibu-Systems WibuKey up to version 6.70 for Windows allows a local, low-privileged attacker to trigger memory boundary violations by supplying out-of-scope pointer values, with outcomes ranging from denial of service (BSOD) to full SYSTEM-level privilege escalation via kernel code execution. The CVSS Scope:Changed metric reflects the critical boundary crossing from user-space into the driver's SYSTEM-privileged kernel context, meaning successful exploitation yields complete machine control from an unprivileged account. No public exploit has been identified at time of analysis and WibuKey has not been listed in the CISA KEV catalog, but the low attack complexity makes this a high-value local privilege escalation primitive for post-compromise chains.
Local privilege escalation in WibuKey for Windows before 6.71 allows any low-privileged local user to gain full SYSTEM-level control by exploiting a write-what-where primitive in the WibuKey2_64.sys kernel driver. The root cause is an untrusted pointer dereference (CWE-123) in the 64-bit kernel driver, meaning attacker-controlled data is used directly as a kernel-space pointer, enabling arbitrary writes into kernel memory - a classic and highly reliable LPE primitive. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Path traversal in Lektor's built-in preview and development HTTP server on Windows exposes arbitrary files to unauthenticated network attackers in all versions prior to 3.3.14. Crafted HTTP requests containing path traversal sequences exploit Windows-specific path separator handling to escape the configured web root and read any file accessible to the Lektor process, including system files and deployment configuration files that may contain credentials. A public proof-of-concept exploit is available; no confirmed active exploitation via CISA KEV has been recorded.
Remote code execution in Time4Popcorn - a Popcorn Time media-streaming fork - affects the Windows client (<= 6.2.1.18), macOS client (<= 6.2.1.17), and Android client (<= 3.5.0.173) through the application's auto-update mechanism (updater.exe on Windows, the PT.updd component on macOS). Because the updater fetches and executes update payloads without verifying their integrity (CWE-494), an attacker able to influence the update channel can deliver and run arbitrary code on the victim host. No CISA KEV listing, no public exploit is identified at time of analysis, and EPSS is low at 0.26% (18th percentile).
OAuth authorization code hijacking in Stalwart Mail Server through v0.16.19 enables full email account takeover when a victim authenticates via a crafted phishing link. The validation routine for OAuth redirect URIs in the default shipped configuration - where client authentication is disabled - returns success immediately without comparing the supplied redirect_uri against any registered client destination, allowing any attacker-controlled URI to receive a valid authorization code. The CVSS 4.0 score of 8.5 with high confidentiality and integrity impact reflects the severity of resulting mailbox compromise; no public exploit code has been identified at time of analysis, though the vulnerability is fully described in a public GitHub issue with source-level detail.
Race conditions in the s390/vfio_ccw subsystem of the Linux kernel arise from an insufficiently scoped io_mutex that serialized io_regions but left other I/O operations unserialized, creating exploitable synchronization windows. Local low-privilege users inside guest VMs on IBM s390/zSeries hosts running vfio_ccw can exploit these races to achieve scope-changed privilege escalation into the host kernel, with full confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified; vendor patches are confirmed across stable branches 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2.
Data corruption in the Linux kernel's XFS exchange-range subsystem allows a low-privileged local attacker to trigger incorrect reflink inode flag clearing, causing subsequent writes to bypass Copy-on-Write protection on shared extents. Affected are Linux kernel versions prior to 6.12.105, 7.1.10, and 7.2 on systems using XFS volumes with reflink support enabled. No public exploit or CISA KEV listing exists at time of analysis, but the low-complexity local vector and high integrity/confidentiality impact make this a meaningful priority for XFS-heavy enterprise deployments such as RHEL-based systems where XFS is the default filesystem.
Path traversal in IzPack's UnpackerBase.unpack() enables arbitrary file writes under victim privileges when a user executes a trojanized installer JAR. The unpacking pipeline calls IoHelper.translatePath(), which performs only file-separator substitution with no canonical-path check, no startsWith(installDir) containment guard, and no normalization of '../' sequences, allowing attacker-controlled PackFile entries to escape the install directory entirely. Because IzPack JARs are standard unsigned ZIPs with no integrity protection, any legitimate IzPack installer can be silently repackaged with malicious entries; a publicly available proof-of-concept confirms the escape. The CVE is not listed in CISA KEV, but the trivial repacking method and social-engineering distribution vector make this a credible supply-chain threat to organizations consuming IzPack-packaged software from untrusted sources.
Race condition in Google Chrome Enterprise on Windows prior to version 152.0.7977.65 enables an adjacent network attacker to potentially escape the browser sandbox and execute arbitrary code on the host system via crafted network traffic. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog. Despite a CVSS base score of 7.5, Google's Chromium team assigned an internal severity of Low, and SSVC analysis independently rates exploitation as none with non-automatable attack conditions - together suggesting constrained real-world impact relative to raw score.
Sandbox escape in Google Chrome's Media component on Windows allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside Chrome's sandbox via a crafted HTML page. Affected versions are all Chrome releases on Windows prior to 152.0.7977.65. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment confirms exploitation status as none, and EPSS probability is low at 0.26% (17th percentile), though SSVC technical impact is rated total given full sandbox bypass capability.
Out-of-bounds read in Google Chrome's ANGLE graphics engine on Windows prior to version 152.0.7977.65 enables remote attackers to potentially execute arbitrary code outside the browser sandbox. Exploitation requires no authentication and only that a victim navigate to a crafted HTML page, yielding a CVSS 8.8 score with high impact across confidentiality, integrity, and availability. A vendor-released patch is available; no public exploit or confirmed active exploitation has been identified at time of analysis.
Incorrect authorization in the Chromoting component of Google Chrome on Windows prior to version 152.0.7977.65 enables a local attacker with standard user privileges to bypass system access restrictions by executing a crafted local program. The flaw (CWE-863) undermines Chrome Remote Desktop's authorization enforcement on Windows, allowing unauthorized access to protected system resources with both high confidentiality and integrity impact. No public exploit has been identified at time of analysis, and the EPSS score of 0.11% places this in the 1st percentile, indicating very low current exploitation probability despite the 7.1 CVSS base score.
Out-of-bounds write in Chrome's Crashpad crash-reporting library on Windows, versions prior to 152.0.7977.65, enables sandbox escape and arbitrary code execution when chained with a separate renderer compromise. The flaw (CWE-787) is the second stage of a two-stage exploit: an attacker who has already gained code execution inside the sandboxed renderer can trigger the memory corruption in Crashpad to break the sandbox boundary and execute arbitrary code at Chrome process privilege on the host. No public exploit has been identified at time of analysis and SSVC rates current exploitation as none, though the total technical impact and Windows-wide scope make this a high-priority patch item.
Sandbox-escaping remote code execution in Google Chrome on Windows (versions before 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer. A remote attacker who lures a victim to a crafted HTML page can potentially corrupt memory and execute arbitrary code outside the renderer sandbox. Rated High by Chromium with a CVSS of 9.6; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.25%, 16th percentile).
Out-of-bounds write in Chrome's ANGLE graphics layer on Windows allows remote attackers to execute arbitrary code inside the browser's renderer sandbox by directing a user to a crafted HTML page. All Google Chrome releases on Windows prior to 152.0.7977.65 are affected. No public exploit code has been identified at time of analysis, and the EPSS probability of 0.25% (16th percentile) indicates limited current exploitation activity despite the high CVSS score of 8.8.
Out-of-bounds write in ANGLE, Chrome's GPU abstraction layer, affects Google Chrome on Windows prior to 152.0.7977.65 and can be triggered by a remote, unauthenticated attacker via a crafted HTML page, potentially achieving arbitrary code execution within the Chrome sandbox. The CVSS score of 8.8 reflects high theoretical severity, though sandbox containment (S:U) limits immediate blast radius to the GPU process. No public exploit code or CISA KEV listing exists at time of analysis, and the low EPSS of 0.42% (35th percentile) signals limited near-term exploitation probability despite the high CVSS rating.
Remote code execution in Google Chrome on Windows (versions prior to 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES abstraction layer used for GPU rendering. A remote attacker who lures a victim to a crafted HTML page can corrupt memory in the GPU process and potentially execute arbitrary code outside the browser sandbox, giving control of the underlying host. Rated High by Chromium and CVSS 9.6 due to the scope-changing sandbox escape; there is no public exploit identified and EPSS is low (0.30%), indicating no confirmed active exploitation yet.
Use-after-free in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows enables a remote attacker who has already compromised the renderer process to escape Chrome's sandbox and execute arbitrary code at the browser or OS level via crafted network traffic. All Chrome versions prior to 152.0.7977.65 on Windows are affected. No public exploit code or CISA KEV listing exists; EPSS is low at 0.28% (20th percentile), but the scope-changing, full-CIA-impact sandbox escape warrants rapid deployment of the available patch.
Use-after-free in the Chromoting (Chrome Remote Desktop) component of Google Chrome on Windows prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code outside Chrome's sandbox via crafted network traffic. The sandbox-escape outcome is the most critical aspect, elevating the real-world impact beyond a typical renderer flaw to full host-level code execution. No public exploit code has been identified at time of analysis; EPSS places exploitation probability at 0.28% (20th percentile), though the network vector and no-auth-required CVSS signal warrant prompt patching.
Sandbox escape via type confusion in Google Chrome's Accessibility component on Windows enables arbitrary code execution outside the browser sandbox. Affecting all Chrome versions prior to 152.0.7977.65 on Windows, the flaw requires an attacker to have already compromised the renderer process - making this a critical second-stage exploit in a multi-step attack chain. No public exploit identified at time of analysis, and EPSS sits at 0.27% (19th percentile), consistent with the high technical bar required for exploitation despite the 8.3 CVSS score.
Out-of-bounds read in Chrome's ANGLE graphics component (Windows builds prior to 152.0.7977.65) lets a remote attacker escape the renderer sandbox and potentially run arbitrary code after a victim opens a crafted HTML page. Google rates the Chromium severity High, and the CVSS is 9.6 driven by the sandbox-escape scope change; there is no public exploit identified at time of analysis and EPSS is low (0.42%).
Arbitrary file write in sublinear-time-solver's MCP export_state and import_state tools allows any caller able to invoke the MCP interface to overwrite files accessible to the server process - including sensitive targets such as ~/.ssh/authorized_keys or application binaries - by supplying a path-traversal filepath argument. Affected packages are consciousness-explorer (npm) < 1.1.2, sublinear-time-solver (npm) < 1.6.0, and the Rust crate sublinear < 0.2.0. No public exploit or CISA KEV listing has been identified at time of analysis, but the write-anywhere primitive carries inherent high-impact potential against deployments that expose the MCP server to untrusted callers.
Unauthenticated OAuth redirect URI hijacking in Coroot versions 1.20.2 through 1.24.5 allows attackers to register malicious MCP OAuth clients without any credentials, then capture authorization codes from signed-in users who follow crafted authorization URLs and approve a consent dialog. The captured codes can be exchanged for valid access tokens, enabling full MCP session hijacking. No public exploit has been identified at time of analysis and no CISA KEV listing is present, but the registration step requires no authentication, materially lowering attacker prerequisites.
OAuth redirect URI validation in Ech0 through 4.5.6 allows session hijacking via exchange-code theft by exploiting incomplete allowlist enforcement. The `parseAndValidateClientRedirect` function at `internal/service/auth/auth.go:448` compares only scheme and host of the client-supplied `redirect_uri` against the admin allowlist, ignoring path, query, and fragment in violation of RFC 6749 §3.1.2. An attacker who induces a victim to follow a crafted OAuth login link can redirect the post-authentication browser to any path on an allowlisted host, exposing the one-time exchange code via Referer headers or analytics, then redeem it at `POST /api/auth/exchange` for the victim's access and refresh tokens. No public exploit or CISA KEV listing is confirmed at time of analysis; a detailed public advisory (GHSA-p64j-f4x9-wq66) with source code evidence lowers the bar for independent exploitation. Fixed in 4.7.3.
JWT token replay in AshAuthentication exposes any application using the stateless bearer-token path to full account takeover using purpose-scoped tokens. The `retrieve_from_bearer/3` helper in versions 3.10.5-4.14.2 and 5.0.0-rc.0-5.0.0-rc.13 verifies JWT signatures and rejects tokens with an `act` claim, but never validates that the token's `purpose` claim equals "user", allowing sign-in, remember-me, and TOTP-setup tokens to be silently accepted as full bearer credentials. No public exploit has been identified at time of analysis, but the attack requires only obtaining a still-valid, not-yet-exchanged sign-in token - a realistic threat surface via log leakage, referrer exposure, or intercepted magic-link delivery.
Local privilege escalation to SYSTEM in SKYSEA Client View and SKYMEC IT Manager allows any authenticated Windows user to execute arbitrary code with SYSTEM-level privileges. The root cause is a missing authorization check (CWE-862) within one or more privileged components of these IT asset management products. No public exploit identified at time of analysis, and this vulnerability has not been listed in the CISA KEV catalog, but the low-privilege local exploitation path and full SYSTEM compromise make it a significant risk in multi-user or shared Windows environments where these products are deployed.
Privilege escalation to SYSTEM in SKYSEA Client View and SKYMEC IT Manager (Sky Co., Ltd.) affects any Windows host where these IT management agents are installed. The root cause is CWE-276 - incorrect default permissions set on installation artifacts - allowing any authenticated local Windows user to plant or replace code that a SYSTEM-level service component subsequently executes. No public exploit code and no CISA KEV listing are confirmed at time of analysis, but the CVSS 4.0 score of 8.5 and zero attack complexity barriers make this a credible priority for organizations running these products in multi-user or shared-workstation environments.
Untrusted search path execution in NLTK before 3.10.3 allows a local attacker with write access to the current working directory or the ability to insert relative entries into PATH to substitute a malicious executable named 'dot' for the legitimate Graphviz binary, achieving arbitrary code execution under the invoking process's privileges. The affected code paths are dependencygraph.dot2img and AlignedSent._repr_svg_, both of which invoke the Graphviz dot binary by bare name without validating an absolute path. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 8.5 reflects the high-impact code execution potential.
Header-filter bypass in the Apache Camel Undertow component (4.11.0-4.14.8, 4.15.0-4.18.3, and 4.19.0-4.21.x) lets remote senders smuggle legacy 'websocket.' dispatch headers across the undertow transport boundary. Because UndertowEndpoint overwrote the UndertowHeaderFilterStrategy with the base HttpHeaderFilterStrategy, undertow-specific filtering never ran on endpoint-configured routes, so an undertow HTTP consumer maps attacker-controlled 'websocket.*' wire headers onto the Exchange and a downstream undertow WebSocket producer can be steered to deliver to a peer other than the one the route selected. No public exploit identified at time of analysis, EPSS is low (0.16%, 5th percentile), and the fix is available from Apache.
Header-injection in the Apache Camel camel-atmosphere-websocket producer lets an external sender hijack WebSocket message dispatch in routes that bridge an HTTP consumer into the producer. Because the dispatch headers (websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, websocket.eventType, websocket.errorType) use dotted names outside the filtered Camel namespace, the inherited HttpHeaderFilterStrategy admits them in both directions, so an attacker-supplied header overrides the recipient the route selected - suppressing a notification meant for one client or redirecting it to another client whose connection key the sender knows. No public exploit identified at time of analysis; EPSS is low (0.23%, 13th percentile) and it is not in CISA KEV, though the vendor rates it CVSS 9.8.
Arbitrary file write via path traversal in the Apache Camel Google Cloud Storage consumer component affects versions 4.0.0 through 4.21.x, allowing anyone who can influence GCS bucket object names to cause the Camel process to create or overwrite files outside the configured download directory. The consumer appends blob names verbatim to the local path using the unsanitized ${file:name} token without directory containment checks, and the filter option that could restrict object names is disabled by default. No public exploit is identified at time of analysis; SSVC rates the flaw automatable once malicious object names are present in the consumed bucket, and vendor-released patches are available at 4.14.9, 4.18.4, and 4.22.0.
Arbitrary file write via path traversal in the Apache Camel camel-azure-storage-blob component lets an attacker who can influence blob names in a consumed Azure Storage container force Camel to create or overwrite files outside the configured download directory, with the privileges of the Camel process. It affects Apache Camel 4.0.0 before 4.14.9, 4.15.0 before 4.18.4, and 4.19.0 before 4.22.0, where BlobOperations.downloadBlobToFile joined the fileDir option with the raw remote blob name without normalization or containment checks. No public exploit has been identified at time of analysis and the CVSS is 9.1, but EPSS is low (0.18%, 7th percentile), indicating no observed exploitation activity yet.
Cross-site scripting in the Network Optix Nx Witness VMS Web Administration interface (all versions before 6.1.3 on Linux, Windows, and macOS) enables an adjacent-network attacker who controls a rogue Nx server to inject arbitrary JavaScript into an authenticated administrator's browser session by setting the rogue server's site name to a script payload. The injected script executes when the administrator opens the 'Merge with Another Site' dialog, triggering session token theft and full administrator account takeover. No public exploit code or CISA KEV listing was identified at time of analysis; the vendor has released a patch at version 6.1.3.
Remote buffer overflow in Zscaler Client Connector on Windows enables a network-accessible attacker with low privileges to crash the local system at the kernel level, producing a denial-of-service condition. The provided CVSS vector (C:H/I:H/A:H) signals potential confidentiality and integrity impact beyond what the vendor description explicitly states, a discrepancy that warrants verification - kernel-level buffer overflows frequently allow code execution, not merely DoS. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap buffer overflow in RustDesk's Windows clipboard redirection (wf_cliprdr.c) allows a malicious or compromised remote peer to overwrite heap memory in the local paste consumer process (typically explorer.exe) when the local user pastes clipboard file contents offered by the remote side. The OLE paste consumer calls IStream::Read with a buffer of cb bytes, but CliprdrStream_Read blindly copies req_fsize bytes - taken verbatim from the peer's CLIPRDR FileContentsResponse - before the only bounds check (req_fsize < cb) is ever evaluated, meaning an oversized peer response writes attacker-controlled data past the end of the caller's heap allocation. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed; however, an upstream fix PR (#15515) exists and the root cause is precisely documented, lowering the bar for exploit development. The identical defect was fixed in the upstream FreeRDP library as CVE-2026-68579 in FreeRDP 3.30.0, providing a public reference implementation of the fix.
Local privilege escalation in Entevo HMI V2 R5 P0 M4 enables a low-privileged local user to break out of Kiosk Mode and gain administrative command execution on Windows. The escape path exploits the application's built-in PDF manual viewer: opening the manual triggers an external PDF reader, whose Print dialog exposes Windows Explorer shell access, ultimately permitting arbitrary command execution as an administrator. A proof-of-concept demonstration is publicly available via GitHub gist; EPSS is low at 0.17% and CISA SSVC indicates no confirmed active exploitation, though the public POC meaningfully lowers the skill bar for any attacker with local session access.
DNS rebinding against Microsoft UFO's Linux MCP server (all versions prior to 3.0.8) enables an attacker-controlled web page to bypass localhost binding protections and reach the local /mcp endpoint via the victim's browser. Because the FastMCP streamable HTTP server bound to localhost:8010 performed no Host, Origin, or Sec-Fetch-Site header validation, a browser performing a DNS rebind could enumerate available tool schemas via tools/list and invoke execute_command with a valid UFO_MCP_API_KEY, resulting in arbitrary file reads or OS command execution as the victim's local user. No public exploit code has been identified at time of analysis, though the DNS rebinding technique is well-documented and the commit-confirmed patch validates the described attack path.
NTLM credential exposure in Git for Windows before 2.55.0.windows.4 allows a malicious remote Git server to capture Windows authentication material by advertising a crafted bundle URI during clone or fetch operations. When transfer.bundleuri is enabled, non-HTTP(S) URIs including bare UNC paths are treated as local filesystem paths, causing Windows to initiate an outbound SMB connection to an attacker-controlled host and expose NTLM hashes. No public exploit code has been identified at time of analysis and no CISA KEV listing is present, but the technique maps directly onto well-documented NTLM capture and relay attack patterns.
Server-side request forgery in Microsoft's Azure SQL Database cloud service lets an unauthorized network attacker coerce the service into making backend requests that result in privilege elevation, with a maximum CVSS base score of 10.0 driven by a scope change (S:C). The CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required, and the CWE-918 classification confirms the root cause is unvalidated server-issued requests. No public exploit identified at time of analysis, and the flaw is not currently listed in CISA KEV.
DLL hijacking in Remote Utilities Host ≤7.7.3.0 allows any local, unprivileged Windows user to achieve NT AUTHORITY\SYSTEM-level code execution by replacing service DLLs during a race window. The installer incorrectly grants BUILTIN\Everyone FULL CONTROL over all DLL files in the installation directory - including libasset32.dll and seven additional codec and multimedia libraries - enabling overwrite by any local account. No public exploit is identified at time of analysis, but the technique is well-established and the race window reliably materializes during software updates, service crashes, or manual restarts.
Command injection in Cloud Foundry's BOSH CLI on Windows enables an adjacent-network attacker to execute arbitrary shell commands - specifically via PowerShell injection - without requiring authentication. The vulnerability affects all tracked versions of the BOSH CLI (cpe:2.3:a:cloud_foundry_foundation:bosh_cli) when deployed on Windows hosts, resulting in full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-impact CVSS vector (7.5) and the specificity of the PowerShell injection vector indicate meaningful risk for Cloud Foundry operators running BOSH on Windows.
Server-side request forgery in Microsoft Azure Virtual Machines enables a low-privileged authenticated attacker to forge internal network requests, ultimately achieving privilege escalation with full confidentiality, integrity, and availability impact across a changed scope. The CVSS vector (AV:N/AC:H/PR:L/S:C/C:H/I:H/A:H) confirms the vulnerability reaches beyond the Azure VM component itself, potentially compromising adjacent Azure services or internal metadata infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft has released a patch via MSRC.
Microsoft Partner Center exposes cross-tenant information to unauthenticated network attackers via an authorization bypass rooted in user-controlled key manipulation (CWE-639). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H) indicates low-complexity, scopechanging exploitation that can reach confidential partner or customer data beyond the attacker's own organizational boundary. A vendor-released patch is available through the Microsoft Security Response Center; no public exploit has been identified at time of analysis.
Privilege escalation in Microsoft Azure Arc allows an unauthorized, network-based attacker to bypass authorization checks (CWE-863) and gain elevated privileges over managed hybrid/multicloud resources, with a maximal CVSS 3.1 score of 10.0 driven by a changed scope and high confidentiality/integrity impact. The flaw is reachable remotely without authentication or user interaction (AV:N/AC:L/PR:N/UI:N), and because scope is changed, exploitation can affect resources beyond the initially vulnerable component. Microsoft has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege elevation in Microsoft Azure Logic Apps allows an unauthenticated, remote attacker to escalate privileges by abusing a path-traversal flaw (CWE-22) that fails to restrict a supplied pathname to its intended directory, provided a victim is lured into interacting (UI:R). Rated CVSS 9.6 with a changed scope, indicating impact beyond the initially vulnerable component. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Microsoft Azure Data Manager for Energy arises from an integer overflow or wraparound condition (CWE-190) reachable over the network by any authenticated low-privilege user. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only standard credentials, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though CISA SSVC rates the technical impact as total; Microsoft has released a patch via MSRC.
Privilege elevation via SQL injection (CWE-89) affects Microsoft Azure SQL Database, where an already-authorized attacker can inject unneutralized special elements into SQL commands over the network to gain higher privileges than granted. The 9.9 CVSS score reflects a scope change (S:C) with high confidentiality, integrity, and availability impact, meaning a low-privileged database principal could break out of its authorization boundary. Microsoft has released a fix, and there is no public exploit identified at time of analysis.
Server-side request forgery in Microsoft Azure Data Factory exposes sensitive internal information to unauthenticated remote attackers over a network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special network positioning - any internet-reachable instance is in scope. No active exploitation has been confirmed by CISA KEV or public POC at time of analysis; SSVC rates exploitation as 'none' and EPSS at 0.99%, indicating limited real-world uptake despite the high CVSS base score.
Privilege elevation in Microsoft Azure SQL Database lets an already-authenticated, high-privileged principal escalate its permissions over the network through an improper access-control check (CWE-284). The CVSS scope change (S:C) indicates the abuse crosses an intended trust boundary within the managed service, threatening confidentiality, integrity, and availability. No public exploit identified at time of analysis and the flaw is not in CISA KEV; Microsoft has addressed it server-side per its MSRC advisory.
Privilege elevation in Microsoft Azure Arc allows a remote, unauthenticated attacker to gain elevated privileges over a network by exploiting an incorrectly-resolved name or reference (CWE-706), rated the maximum CVSS 10.0 with a scope change. Reported by Microsoft with a fix available through the MSRC update guide; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Note a source conflict: the CVE description cites Azure Arc while the CPE and tags cite Azure Web Apps, so the exact affected surface should be confirmed with Microsoft.
Privilege escalation in Microsoft Fabric exploits a relative path traversal flaw (CWE-23) to allow a low-privileged authenticated attacker to gain elevated permissions over the network. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack requires only a valid low-privilege account and no user interaction, making it accessible to any tenant user or compromised credential. Microsoft has released a patch via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft's Azure Managed Instance for Apache Cassandra allows an unauthenticated network attacker to inject additional command-line arguments (CWE-88) into a backend process and execute arbitrary code, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) that indicates no authentication or user interaction and a scope change beyond the vulnerable component. Microsoft reported the issue and has released a fix through MSRC. No public exploit is identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Information disclosure via improper input validation in Microsoft Office Word enables unauthenticated remote attackers to extract sensitive data across a broad product surface spanning Word 2016, Office 2019, multiple LTSC releases, and Microsoft 365 Apps for Enterprise on both Windows and macOS. The vendor-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no user interaction is required, though SSVC's 'Automatable: no' designation creates measurable tension with that assessment. No public exploit has been identified at time of analysis, and EPSS at 0.54% (43rd percentile) reflects low near-term exploitation probability despite the CVSS 7.5 rating.
Windows Remote Help versions 5.0.0.0 through below 5.2.1040.0 is vulnerable to an uncontrolled search path element (CWE-427), enabling a locally authenticated attacker to conduct spoofing attacks with high confidentiality and integrity impact. The flaw stems from the application resolving executables or libraries from attacker-controllable directory paths, a class of vulnerability commonly manifesting as DLL or binary planting on Windows. No public exploit has been identified at time of analysis, and Microsoft has released a patch as of the advisory publication.
Remote code execution in Microsoft Entra ID lets an unauthenticated network attacker run arbitrary code by submitting maliciously crafted serialized data that the service deserializes without validation (CWE-502). The CVSS 3.1 base score is a maximum 10.0 with a scope change, reflecting unauthenticated network reach and full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the combination of a cloud identity platform and PR:N/UI:N makes this an urgent-patch candidate.
Privilege elevation in Microsoft Entra ID (formerly Azure Active Directory) allows an authenticated, low-privileged attacker to abuse a server-side request forgery flaw (CWE-918) to reach protected internal endpoints and escalate privileges across a security scope over the network. The flaw carries a critical CVSS 9.9 with a scope change, meaning a foothold in one context can be leveraged to compromise resources beyond the attacker's original authorization. Microsoft has issued a service-side fix; there is no public exploit identified at time of analysis and no CISA KEV listing.
Azure Stack HCI exposes sensitive information to unauthenticated remote attackers via observable response discrepancy (CWE-204), where the system returns distinguishably different responses to distinct inputs, enabling enumeration or inference of confidential data without credentials. The CVSS 3.1 vector's Changed scope (S:C/C:H) signals that the disclosed information extends beyond the vulnerable component - significant in a hyperconverged platform managing compute, storage, and networking workloads with Azure integration. No public exploit code has been identified at time of analysis, but a vendor patch is available through the Microsoft Security Response Center.
Privilege escalation in Microsoft Azure SQL Database allows an already-authenticated, low-privileged attacker to inject crafted SQL over the network and gain elevated database privileges. Rated CVSS 9.9 with a scope-changing vector, the flaw stems from improper neutralization of special elements in SQL commands (CWE-89); Microsoft has issued a service-side fix. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Elevation of privilege in Microsoft Exchange Online lets an unauthorized network attacker abuse a server-side request forgery (CWE-918) flaw to make the service issue attacker-controlled internal requests, crossing a privilege/trust boundary (CVSS scope change) to reach backend resources. The CVSS 10.0 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects unauthenticated, low-complexity network exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV; Microsoft, the reporter, has already remediated the cloud service per its MSRC advisory.
Privilege elevation in Microsoft Azure Data Factory allows a remote, unauthenticated attacker to gain elevated privileges by exploiting improper verification of a cryptographic signature. Tagged as a JWT/authentication-bypass issue, the flaw lets an attacker forge or tamper with signed tokens that the service fails to validate correctly, defeating access controls over the network. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.28%), but the CVSS 9.8 rating reflects total technical impact if exploited.
Heap out-of-bounds read in NanaZip's SquashFS LZ4 decompression handler exposes adjacent heap memory contents when a user opens a crafted archive, affecting all stable releases from 1.0.88.0 through 6.0.1697.x and all preview releases through 6.5.1741.x on Windows. The flaw stems from a sign-conversion bug that causes the decompressor to trust an attacker-inflated block size, allowing a controlled memcpy to read beyond the allocated heap buffer and place internal heap data into the extracted file output, or crash the process entirely. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the memory disclosure primitive is meaningful for targeted attacks.
Splunk Enterprise for Windows exposes a startup race condition on the management port that allows a low-privileged local user to intercept authentication tokens from Splunk child processes. By pre-binding the management port before the Splunk service initializes - exploiting the absence of exclusive address binding protections on Windows - an attacker captures session tokens that can be replayed to compromise all data and system integrity accessible to the Splunk service account. No public exploit code has been identified and EPSS is 0.12% (3rd percentile), indicating low current exploitation activity; however, the vulnerability is Windows-specific and patch is available from Splunk.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to gain SYSTEM-level access via a race condition in kernel-level socket processing. The CVSS vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation requires an existing low-privilege foothold, precise timing to win the race window, but no user interaction. Microsoft has released patches across a wide range of supported Windows versions. No public exploit or CISA KEV listing has been identified at time of analysis, though race-condition LPE bugs in Windows kernel drivers are a favored post-exploitation technique.
Privilege elevation in Microsoft Azure Active Directory B2C lets an unauthenticated remote attacker abuse a user-controlled key (CWE-639) to bypass authorization checks and gain elevated privileges across a network. The flaw carries a maximum CVSS 10.0 with a changed scope, reflecting that a successful attack against the shared identity platform can compromise the confidentiality and integrity of resources belonging to other principals or tenants. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege elevation in Microsoft Copilot Studio lets a network-based, unauthenticated attacker bypass cryptographic signature verification (CWE-347) to gain elevated privileges across a scope boundary, per CVSS:3.1 AV:N/PR:N/S:C rated 10.0. The flaw appears to involve forged or improperly validated JWT tokens, per the 'Jwt Attack' tagging, and because Copilot Studio is a multi-tenant cloud service the scope-change vector implies impact beyond the initially compromised authority. No public exploit identified at time of analysis, and EPSS is low at 0.29% (22nd percentile), but SSVC rates technical impact as total and automatable as yes.
Privilege elevation in Microsoft's Azure AI Language cloud service lets a remote, unauthenticated attacker reach a critical function that lacks authentication (CWE-306), gaining elevated privileges over the network. Rated CVSS 10.0 with a scope change (S:C), the flaw is disclosed and fixed by Microsoft via MSRC; no public exploit code or CISA KEV listing is indicated, so this is no public exploit identified at time of analysis.
Privilege escalation in Microsoft Fabric allows an authenticated low-privileged attacker to elevate their access level over the network, gaining full control over confidentiality, integrity, and availability of affected resources. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-friction network exploitation requiring only a valid user account and no additional interaction. No public exploit code has been identified and CISA has not listed this in KEV, though SSVC rates the technical impact as total.
Authorization bypass via user-controlled key in Azure Cosmos DB enables an authenticated attacker to perform cross-account spoofing over the network, potentially accessing or manipulating data belonging to other accounts or tenants. Exploiting CWE-639 (IDOR-class flaw), an attacker with a valid Cosmos DB account can supply a crafted key to circumvent per-resource authorization checks, yielding full confidentiality, integrity, and availability impact per the CVSS vector. No public exploit code has been identified and SSVC confirms no active exploitation, though CVSS impact metrics indicate total technical impact if successfully triggered.
Privilege elevation in Microsoft Power Automate (Power Platform cloud service) lets an authenticated, low-privileged attacker abuse a server-side request forgery flaw (CWE-918) to make the service issue requests to internal/backend endpoints, resulting in a scope-changing escalation with total confidentiality, integrity, and availability impact. The CVSS 3.1 base score is 9.9 with a changed scope, reflecting that the SSRF crosses a trust boundary into resources beyond the vulnerable component. No public exploit identified at time of analysis, and EPSS is low (0.33%, 26th percentile), consistent with CISA SSVC marking exploitation as 'none'.
Privilege escalation in Microsoft Entra ID (formerly Azure Active Directory) lets a remote, unauthenticated attacker bypass authentication through an alternate path or channel and gain elevated privileges over the network. The flaw affects Microsoft's cloud identity-and-access-management service, which underpins sign-in and authorization for Microsoft 365, Azure, and countless federated third-party applications. No public exploit identified at time of analysis and SSVC records exploitation status as none, but the CISA SSVC framework rates the attack as automatable with total technical impact.
NoSQL injection in Microsoft Discovery Studio enables unauthenticated, network-based attackers to extract confidential data from the application's backend data store. The CWE-943 flaw allows specially crafted query inputs to bypass intended data-access boundaries, with the CVSS scope-change (S:C) indicating that leakage can extend beyond the directly targeted component - potentially exposing data belonging to other users or system contexts. Exploitation requires user interaction (UI:R), constraining opportunistic mass attacks; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-origin RCE in Windows ML CLI (winml-cli < 0.4.0) is reachable when a developer runs the `serve` command, which exposes a localhost HTTP API with a wildcard CORS policy and no authentication gate. Any malicious webpage visited by the user while the server is running can send cross-origin requests to `/v1/cli/build` or `/v1/cli/config`, inject `trust_remote_code=true`, and cause the server to call `AutoConfig.from_pretrained(trust_remote_code=True)` - downloading and executing attacker-controlled Python code from a remote model repository as the server user. The vendor has released a fix in version 0.4.0; no public exploit is identified at time of analysis.
Privilege escalation in Jenkins Microsoft Entra ID Plugin (≤710.v0b_ff8e9cc2d2) allows any Entra tenant member with group-creation rights to inherit Jenkins permissions configured for a privileged group by creating a new Entra group whose display name collides with a privileged group's display name. The plugin incorrectly resolves group identity using both the immutable object ID and the mutable, user-controllable display name, so the collision satisfies the authorization check without the attacker belonging to the legitimate privileged group. No public exploit has been identified and CISA has not listed this in KEV, but exploitation requires only a valid Entra account, making it a meaningful insider or tenant-level escalation path into CI/CD infrastructure.
Path traversal in wcurl for Windows allows a crafted URL containing percent-encoded backslashes to redirect a downloaded file to an attacker-controlled directory outside the user's intended destination. Affecting wcurl shipped with curl 8.14.0 through 8.21.0 and standalone wcurl 2024.12.08 through 2026.01.05, the flaw exploits Windows path-separator semantics: wcurl decodes %5C to a backslash, which Windows treats as a directory separator, causing file placement at an unintended filesystem path. No public exploit code and no active exploitation have been identified at time of analysis; vendor-released patches are available as of September 2, 2026.
Arbitrary code execution in OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) allows an attacker who can deliver a crafted repository archive to run code with the victim user's full privileges when Codex automatically collects Git repository metadata. The root cause is that Codex's Git metadata collection path did not suppress the repository-local core.fsmonitor configuration, enabling a malicious .git/config to direct Git to invoke an attacker-supplied filesystem-monitor helper outside Codex's command sandbox and without any user-approval prompt. OpenAI has issued a source-level fix via PR #22652 adding -c core.fsmonitor=false to the relevant Git invocations; no public exploit code has been identified at time of analysis.
Arbitrary code execution in OpenAI Codex Desktop (Windows and macOS, including the Microsoft Store package) occurs when a user opens a workspace containing an attacker-prepared Git repository whose local .git/config is intact. Because Codex automatically inspects Git metadata and working-tree status on open, a malicious attr.tree setting combined with a clean/process filter causes Git to launch an attacker-controlled program outside Codex's command sandbox, with the signed-in user's privileges and no trust prompt, approval, or model interaction. No public exploit is identified at time of analysis and EPSS is low (0.14%), but the outcome is full local compromise of the user's files and credentials.
OpenAI Codex CLI and Codex Desktop's PowerShell command-safety parser failed to recognize PowerShell's stop-parsing token (--%), misclassifying file-writing Git commands embedded after that token as safe and executing them without user approval. An attacker who tricks a developer into opening a crafted repository can cause Codex to silently write an attacker-controlled configuration; when Codex subsequently loads that configuration, it launches an attacker-designated MCP server and executes arbitrary code under the user's account. No public exploit has been identified at time of analysis (EPSS 0.16%, 6th percentile), and the default filesystem sandbox on macOS and Linux can limit the damage radius by preventing writes outside permitted directories.
Arbitrary code execution in OpenAI Codex Desktop for Windows and macOS allows an attacker's Git hooks to run outside the application's command sandbox when a user opens a specially prepared repository. Codex's automated Git operations honored the repository-local `core.hooksPath` setting in `.git/config` without sanitizing or overriding it, enabling a malicious hook script to execute with the user's full OS privileges - reading, modifying, or deleting files and accessing other resources. No active exploitation has been identified (EPSS 0.13%, not in CISA KEV); a code-level fix exists in GitHub PR #22843 but a versioned patch release is not independently confirmed at time of analysis.
Out-of-bounds read in Exiv2's CrwMap::decodeBasic() function affects versions prior to 0.28.9, impacting applications that use the library to parse Canon CRW image metadata. Classified as low severity by the Exiv2 maintainers, this flaw has only been reproduced using a dedicated fuzz target - the standard exiv2 command-line tool cannot trigger it under normal operation. No public exploit exists and no active exploitation has been identified, making real-world impact minimal despite the memory safety class of defect.
Out-of-bounds write in Exiv2's RemoteIo::Impl::populateBlocks() affects all versions prior to 0.28.9, exploitable only when Exiv2 is invoked with a remote URL as input rather than a local file path. Memory corruption from the write could theoretically enable code execution in the Exiv2 process context if a user or automated pipeline fetches a specially crafted image from an attacker-controlled server. Fixed in the 0.28.9 release; no public exploit or KEV listing identified at time of analysis.
Local privilege escalation in SiYuan's Windows NSIS installer affects versions 2.0.14 through 3.8.0, allowing a local attacker with write access to a directory to execute arbitrary code with elevated privileges by planting a malicious binary that the NSIS installer resolves ahead of System32 during an all-users installation. The root cause is electron-builder's preInit hook invoking system utilities such as TASKKILL by short name via nsExec::Exec, causing the installer's launch directory to take search-path precedence over System32 before the license page is even displayed. No public exploit code has been identified at time of analysis, though the binary-planting technique is well-documented in Windows installer security research.
Path traversal in Pake before 3.13.1 allows a malicious or compromised web page loaded inside any Pake-generated desktop app to write attacker-fetched content to arbitrary user-writable filesystem locations, including persistence directories. The `download_file` Tauri command accepted a JavaScript-supplied filename and joined it directly to the Downloads directory without stripping path separators or sanitizing sequences such as `../`, enabling writes to locations such as `~/Library/LaunchAgents/` on macOS, `~/.config/autostart/` on Linux, or the Windows Startup folder. Because the HTTP fetch is performed by the Rust backend rather than the sandboxed browser renderer, browser-level download restrictions do not apply. No public exploit is identified at time of analysis, though the attack primitive is straightforward given JFrog's public disclosure.
Unauthenticated connection exhaustion in MongoDB Connector for BI allows any network-reachable client to hold authentication sessions open indefinitely by initiating a SASL login exchange and then withholding further data. The absence of a wall-clock timeout on the negotiation loop and no read deadline on the client socket means each such session permanently occupies a worker thread, a connection slot, and associated backend MongoDB handles until the process is restarted. Sustained repetition of this pattern can exhaust the configured connection pool capacity entirely, denying service to all legitimate BI tool users; no public exploit has been identified at time of analysis.
Credential disclosure in the MariaDB Connector for Node.js (npm: mariadb) exposes plaintext database passwords to active network attackers when SSL/TLS is configured without a CA or server certificate. Fingerprint-based server identity validation is sequenced after the authentication exchange, so a man-in-the-middle presenting any certificate receives the password before the connection is ultimately rejected and closed. Affected branches span all releases below 3.2.4, 3.3.3, 3.4.6, and 3.5.3; no CISA KEV entry or public proof-of-concept exists at time of analysis, though the flaw is structurally exploitable by any on-path attacker against the specific misconfiguration.
OS command injection in PowSyBl Core's AbstractLocalCommandExecutor implementations allows authenticated callers who forward untrusted data to the vulnerable public APIs to execute arbitrary shell commands as the JVM process user on both Unix and Windows hosts. Affected versions are com.powsybl:powsybl-computation-local up to and including 7.2.1; the flaw is a library-level sink, meaning any REST front-end, pypowsybl integration, or multi-tenant grid analysis platform embedding powsybl-core that passes external parameters to LocalComputationManager.execute(), ActionSimulatorTool.run(), or AmplModelRunner.run() inherits the vulnerability without modifying powsybl code. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the advisory documents multiple injection vectors with bypass paths for the previously weak escaping.
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can be triggered when a user visits attacker-controlled web content. All versions of Edge (Chromium-based) are affected per the wildcard CPE, with full confidentiality, integrity, and availability impact at a CVSS 8.8. A vendor patch is available via the Microsoft Security Response Center; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who controls a monitored log source to inject arbitrary arguments into firewall and account-management commands executing as root. Five scripts handling the srcip alert field (route-null.c, netsh.c, pf.c, npf.c, ipfw.c) omit IP format validation, and disable-account.c passes the dstuser field to passwd/chuser with only a root-name check, enabling injection into pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted CreateProcess concatenation in wpopenv() amplifies the impact by allowing space-delimited srcip values to append additional process arguments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Improper access control on the Synergis Softwire installation folder exposes sensitive files to any low-privileged local user on Windows Server deployments and Genetec Streamvault SV-100E and SV-300E all-in-one appliances. The CVSS scope change (S:C) is particularly consequential in this context: Synergis Softwire is a physical access control server, meaning credentials or configuration material extracted from the installation directory could allow an attacker to manipulate physical security decisions or pivot into backend systems. No public exploit has been identified at time of analysis, and Genetec has released remediated versions in the 12.0.2 and 12.2.0 branches.
Unauthenticated remote process termination in MongoDB Connector for BI (mongosqld) affects deployments explicitly configured with Kerberos authentication. An attacker with network access to the mongosqld listener can send a crafted GSSAPI authentication exchange that triggers a double-free condition in error-handling code, crashing the process and interrupting BI availability until restarted. No public exploit code has been identified at time of analysis, and the attack is constrained to the subset of deployments running Kerberos - a non-default configuration.
Remote code execution via log path traversal in Flowintel 3.3.0 and later is achievable by an authenticated administrator who redirects the LOG_FILE configuration setting to an arbitrary filesystem path and injects server-side template syntax through attacker-controlled logged content. The upstream commit explicitly documents this multi-step exploitation chain - redirecting log output to a template file and triggering application rendering to execute injected code - making weaponization technically straightforward for any attacker holding admin credentials. No public exploit or CISA KEV listing is identified at time of analysis; upstream fix is available as a GitHub commit from the Flowintel maintainer CIRCL.
WibuKey64.sys kernel-mode driver in Wibu-Systems WibuKey up to version 6.70 for Windows allows a local, low-privileged attacker to trigger memory boundary violations by supplying out-of-scope pointer values, with outcomes ranging from denial of service (BSOD) to full SYSTEM-level privilege escalation via kernel code execution. The CVSS Scope:Changed metric reflects the critical boundary crossing from user-space into the driver's SYSTEM-privileged kernel context, meaning successful exploitation yields complete machine control from an unprivileged account. No public exploit has been identified at time of analysis and WibuKey has not been listed in the CISA KEV catalog, but the low attack complexity makes this a high-value local privilege escalation primitive for post-compromise chains.
Local privilege escalation in WibuKey for Windows before 6.71 allows any low-privileged local user to gain full SYSTEM-level control by exploiting a write-what-where primitive in the WibuKey2_64.sys kernel driver. The root cause is an untrusted pointer dereference (CWE-123) in the 64-bit kernel driver, meaning attacker-controlled data is used directly as a kernel-space pointer, enabling arbitrary writes into kernel memory - a classic and highly reliable LPE primitive. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Path traversal in Lektor's built-in preview and development HTTP server on Windows exposes arbitrary files to unauthenticated network attackers in all versions prior to 3.3.14. Crafted HTTP requests containing path traversal sequences exploit Windows-specific path separator handling to escape the configured web root and read any file accessible to the Lektor process, including system files and deployment configuration files that may contain credentials. A public proof-of-concept exploit is available; no confirmed active exploitation via CISA KEV has been recorded.
Remote code execution in Time4Popcorn - a Popcorn Time media-streaming fork - affects the Windows client (<= 6.2.1.18), macOS client (<= 6.2.1.17), and Android client (<= 3.5.0.173) through the application's auto-update mechanism (updater.exe on Windows, the PT.updd component on macOS). Because the updater fetches and executes update payloads without verifying their integrity (CWE-494), an attacker able to influence the update channel can deliver and run arbitrary code on the victim host. No CISA KEV listing, no public exploit is identified at time of analysis, and EPSS is low at 0.26% (18th percentile).
OAuth authorization code hijacking in Stalwart Mail Server through v0.16.19 enables full email account takeover when a victim authenticates via a crafted phishing link. The validation routine for OAuth redirect URIs in the default shipped configuration - where client authentication is disabled - returns success immediately without comparing the supplied redirect_uri against any registered client destination, allowing any attacker-controlled URI to receive a valid authorization code. The CVSS 4.0 score of 8.5 with high confidentiality and integrity impact reflects the severity of resulting mailbox compromise; no public exploit code has been identified at time of analysis, though the vulnerability is fully described in a public GitHub issue with source-level detail.
Race conditions in the s390/vfio_ccw subsystem of the Linux kernel arise from an insufficiently scoped io_mutex that serialized io_regions but left other I/O operations unserialized, creating exploitable synchronization windows. Local low-privilege users inside guest VMs on IBM s390/zSeries hosts running vfio_ccw can exploit these races to achieve scope-changed privilege escalation into the host kernel, with full confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified; vendor patches are confirmed across stable branches 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2.
Data corruption in the Linux kernel's XFS exchange-range subsystem allows a low-privileged local attacker to trigger incorrect reflink inode flag clearing, causing subsequent writes to bypass Copy-on-Write protection on shared extents. Affected are Linux kernel versions prior to 6.12.105, 7.1.10, and 7.2 on systems using XFS volumes with reflink support enabled. No public exploit or CISA KEV listing exists at time of analysis, but the low-complexity local vector and high integrity/confidentiality impact make this a meaningful priority for XFS-heavy enterprise deployments such as RHEL-based systems where XFS is the default filesystem.
Path traversal in IzPack's UnpackerBase.unpack() enables arbitrary file writes under victim privileges when a user executes a trojanized installer JAR. The unpacking pipeline calls IoHelper.translatePath(), which performs only file-separator substitution with no canonical-path check, no startsWith(installDir) containment guard, and no normalization of '../' sequences, allowing attacker-controlled PackFile entries to escape the install directory entirely. Because IzPack JARs are standard unsigned ZIPs with no integrity protection, any legitimate IzPack installer can be silently repackaged with malicious entries; a publicly available proof-of-concept confirms the escape. The CVE is not listed in CISA KEV, but the trivial repacking method and social-engineering distribution vector make this a credible supply-chain threat to organizations consuming IzPack-packaged software from untrusted sources.
Race condition in Google Chrome Enterprise on Windows prior to version 152.0.7977.65 enables an adjacent network attacker to potentially escape the browser sandbox and execute arbitrary code on the host system via crafted network traffic. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog. Despite a CVSS base score of 7.5, Google's Chromium team assigned an internal severity of Low, and SSVC analysis independently rates exploitation as none with non-automatable attack conditions - together suggesting constrained real-world impact relative to raw score.
Sandbox escape in Google Chrome's Media component on Windows allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside Chrome's sandbox via a crafted HTML page. Affected versions are all Chrome releases on Windows prior to 152.0.7977.65. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment confirms exploitation status as none, and EPSS probability is low at 0.26% (17th percentile), though SSVC technical impact is rated total given full sandbox bypass capability.
Out-of-bounds read in Google Chrome's ANGLE graphics engine on Windows prior to version 152.0.7977.65 enables remote attackers to potentially execute arbitrary code outside the browser sandbox. Exploitation requires no authentication and only that a victim navigate to a crafted HTML page, yielding a CVSS 8.8 score with high impact across confidentiality, integrity, and availability. A vendor-released patch is available; no public exploit or confirmed active exploitation has been identified at time of analysis.
Incorrect authorization in the Chromoting component of Google Chrome on Windows prior to version 152.0.7977.65 enables a local attacker with standard user privileges to bypass system access restrictions by executing a crafted local program. The flaw (CWE-863) undermines Chrome Remote Desktop's authorization enforcement on Windows, allowing unauthorized access to protected system resources with both high confidentiality and integrity impact. No public exploit has been identified at time of analysis, and the EPSS score of 0.11% places this in the 1st percentile, indicating very low current exploitation probability despite the 7.1 CVSS base score.
Out-of-bounds write in Chrome's Crashpad crash-reporting library on Windows, versions prior to 152.0.7977.65, enables sandbox escape and arbitrary code execution when chained with a separate renderer compromise. The flaw (CWE-787) is the second stage of a two-stage exploit: an attacker who has already gained code execution inside the sandboxed renderer can trigger the memory corruption in Crashpad to break the sandbox boundary and execute arbitrary code at Chrome process privilege on the host. No public exploit has been identified at time of analysis and SSVC rates current exploitation as none, though the total technical impact and Windows-wide scope make this a high-priority patch item.
Sandbox-escaping remote code execution in Google Chrome on Windows (versions before 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer. A remote attacker who lures a victim to a crafted HTML page can potentially corrupt memory and execute arbitrary code outside the renderer sandbox. Rated High by Chromium with a CVSS of 9.6; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.25%, 16th percentile).
Out-of-bounds write in Chrome's ANGLE graphics layer on Windows allows remote attackers to execute arbitrary code inside the browser's renderer sandbox by directing a user to a crafted HTML page. All Google Chrome releases on Windows prior to 152.0.7977.65 are affected. No public exploit code has been identified at time of analysis, and the EPSS probability of 0.25% (16th percentile) indicates limited current exploitation activity despite the high CVSS score of 8.8.
Out-of-bounds write in ANGLE, Chrome's GPU abstraction layer, affects Google Chrome on Windows prior to 152.0.7977.65 and can be triggered by a remote, unauthenticated attacker via a crafted HTML page, potentially achieving arbitrary code execution within the Chrome sandbox. The CVSS score of 8.8 reflects high theoretical severity, though sandbox containment (S:U) limits immediate blast radius to the GPU process. No public exploit code or CISA KEV listing exists at time of analysis, and the low EPSS of 0.42% (35th percentile) signals limited near-term exploitation probability despite the high CVSS rating.
Remote code execution in Google Chrome on Windows (versions prior to 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES abstraction layer used for GPU rendering. A remote attacker who lures a victim to a crafted HTML page can corrupt memory in the GPU process and potentially execute arbitrary code outside the browser sandbox, giving control of the underlying host. Rated High by Chromium and CVSS 9.6 due to the scope-changing sandbox escape; there is no public exploit identified and EPSS is low (0.30%), indicating no confirmed active exploitation yet.
Use-after-free in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows enables a remote attacker who has already compromised the renderer process to escape Chrome's sandbox and execute arbitrary code at the browser or OS level via crafted network traffic. All Chrome versions prior to 152.0.7977.65 on Windows are affected. No public exploit code or CISA KEV listing exists; EPSS is low at 0.28% (20th percentile), but the scope-changing, full-CIA-impact sandbox escape warrants rapid deployment of the available patch.
Use-after-free in the Chromoting (Chrome Remote Desktop) component of Google Chrome on Windows prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code outside Chrome's sandbox via crafted network traffic. The sandbox-escape outcome is the most critical aspect, elevating the real-world impact beyond a typical renderer flaw to full host-level code execution. No public exploit code has been identified at time of analysis; EPSS places exploitation probability at 0.28% (20th percentile), though the network vector and no-auth-required CVSS signal warrant prompt patching.
Sandbox escape via type confusion in Google Chrome's Accessibility component on Windows enables arbitrary code execution outside the browser sandbox. Affecting all Chrome versions prior to 152.0.7977.65 on Windows, the flaw requires an attacker to have already compromised the renderer process - making this a critical second-stage exploit in a multi-step attack chain. No public exploit identified at time of analysis, and EPSS sits at 0.27% (19th percentile), consistent with the high technical bar required for exploitation despite the 8.3 CVSS score.
Out-of-bounds read in Chrome's ANGLE graphics component (Windows builds prior to 152.0.7977.65) lets a remote attacker escape the renderer sandbox and potentially run arbitrary code after a victim opens a crafted HTML page. Google rates the Chromium severity High, and the CVSS is 9.6 driven by the sandbox-escape scope change; there is no public exploit identified at time of analysis and EPSS is low (0.42%).
Arbitrary file write in sublinear-time-solver's MCP export_state and import_state tools allows any caller able to invoke the MCP interface to overwrite files accessible to the server process - including sensitive targets such as ~/.ssh/authorized_keys or application binaries - by supplying a path-traversal filepath argument. Affected packages are consciousness-explorer (npm) < 1.1.2, sublinear-time-solver (npm) < 1.6.0, and the Rust crate sublinear < 0.2.0. No public exploit or CISA KEV listing has been identified at time of analysis, but the write-anywhere primitive carries inherent high-impact potential against deployments that expose the MCP server to untrusted callers.
Unauthenticated OAuth redirect URI hijacking in Coroot versions 1.20.2 through 1.24.5 allows attackers to register malicious MCP OAuth clients without any credentials, then capture authorization codes from signed-in users who follow crafted authorization URLs and approve a consent dialog. The captured codes can be exchanged for valid access tokens, enabling full MCP session hijacking. No public exploit has been identified at time of analysis and no CISA KEV listing is present, but the registration step requires no authentication, materially lowering attacker prerequisites.
OAuth redirect URI validation in Ech0 through 4.5.6 allows session hijacking via exchange-code theft by exploiting incomplete allowlist enforcement. The `parseAndValidateClientRedirect` function at `internal/service/auth/auth.go:448` compares only scheme and host of the client-supplied `redirect_uri` against the admin allowlist, ignoring path, query, and fragment in violation of RFC 6749 §3.1.2. An attacker who induces a victim to follow a crafted OAuth login link can redirect the post-authentication browser to any path on an allowlisted host, exposing the one-time exchange code via Referer headers or analytics, then redeem it at `POST /api/auth/exchange` for the victim's access and refresh tokens. No public exploit or CISA KEV listing is confirmed at time of analysis; a detailed public advisory (GHSA-p64j-f4x9-wq66) with source code evidence lowers the bar for independent exploitation. Fixed in 4.7.3.
JWT token replay in AshAuthentication exposes any application using the stateless bearer-token path to full account takeover using purpose-scoped tokens. The `retrieve_from_bearer/3` helper in versions 3.10.5-4.14.2 and 5.0.0-rc.0-5.0.0-rc.13 verifies JWT signatures and rejects tokens with an `act` claim, but never validates that the token's `purpose` claim equals "user", allowing sign-in, remember-me, and TOTP-setup tokens to be silently accepted as full bearer credentials. No public exploit has been identified at time of analysis, but the attack requires only obtaining a still-valid, not-yet-exchanged sign-in token - a realistic threat surface via log leakage, referrer exposure, or intercepted magic-link delivery.
Local privilege escalation to SYSTEM in SKYSEA Client View and SKYMEC IT Manager allows any authenticated Windows user to execute arbitrary code with SYSTEM-level privileges. The root cause is a missing authorization check (CWE-862) within one or more privileged components of these IT asset management products. No public exploit identified at time of analysis, and this vulnerability has not been listed in the CISA KEV catalog, but the low-privilege local exploitation path and full SYSTEM compromise make it a significant risk in multi-user or shared Windows environments where these products are deployed.
Privilege escalation to SYSTEM in SKYSEA Client View and SKYMEC IT Manager (Sky Co., Ltd.) affects any Windows host where these IT management agents are installed. The root cause is CWE-276 - incorrect default permissions set on installation artifacts - allowing any authenticated local Windows user to plant or replace code that a SYSTEM-level service component subsequently executes. No public exploit code and no CISA KEV listing are confirmed at time of analysis, but the CVSS 4.0 score of 8.5 and zero attack complexity barriers make this a credible priority for organizations running these products in multi-user or shared-workstation environments.
Untrusted search path execution in NLTK before 3.10.3 allows a local attacker with write access to the current working directory or the ability to insert relative entries into PATH to substitute a malicious executable named 'dot' for the legitimate Graphviz binary, achieving arbitrary code execution under the invoking process's privileges. The affected code paths are dependencygraph.dot2img and AlignedSent._repr_svg_, both of which invoke the Graphviz dot binary by bare name without validating an absolute path. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 8.5 reflects the high-impact code execution potential.
Header-filter bypass in the Apache Camel Undertow component (4.11.0-4.14.8, 4.15.0-4.18.3, and 4.19.0-4.21.x) lets remote senders smuggle legacy 'websocket.' dispatch headers across the undertow transport boundary. Because UndertowEndpoint overwrote the UndertowHeaderFilterStrategy with the base HttpHeaderFilterStrategy, undertow-specific filtering never ran on endpoint-configured routes, so an undertow HTTP consumer maps attacker-controlled 'websocket.*' wire headers onto the Exchange and a downstream undertow WebSocket producer can be steered to deliver to a peer other than the one the route selected. No public exploit identified at time of analysis, EPSS is low (0.16%, 5th percentile), and the fix is available from Apache.
Header-injection in the Apache Camel camel-atmosphere-websocket producer lets an external sender hijack WebSocket message dispatch in routes that bridge an HTTP consumer into the producer. Because the dispatch headers (websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, websocket.eventType, websocket.errorType) use dotted names outside the filtered Camel namespace, the inherited HttpHeaderFilterStrategy admits them in both directions, so an attacker-supplied header overrides the recipient the route selected - suppressing a notification meant for one client or redirecting it to another client whose connection key the sender knows. No public exploit identified at time of analysis; EPSS is low (0.23%, 13th percentile) and it is not in CISA KEV, though the vendor rates it CVSS 9.8.
Arbitrary file write via path traversal in the Apache Camel Google Cloud Storage consumer component affects versions 4.0.0 through 4.21.x, allowing anyone who can influence GCS bucket object names to cause the Camel process to create or overwrite files outside the configured download directory. The consumer appends blob names verbatim to the local path using the unsanitized ${file:name} token without directory containment checks, and the filter option that could restrict object names is disabled by default. No public exploit is identified at time of analysis; SSVC rates the flaw automatable once malicious object names are present in the consumed bucket, and vendor-released patches are available at 4.14.9, 4.18.4, and 4.22.0.
Arbitrary file write via path traversal in the Apache Camel camel-azure-storage-blob component lets an attacker who can influence blob names in a consumed Azure Storage container force Camel to create or overwrite files outside the configured download directory, with the privileges of the Camel process. It affects Apache Camel 4.0.0 before 4.14.9, 4.15.0 before 4.18.4, and 4.19.0 before 4.22.0, where BlobOperations.downloadBlobToFile joined the fileDir option with the raw remote blob name without normalization or containment checks. No public exploit has been identified at time of analysis and the CVSS is 9.1, but EPSS is low (0.18%, 7th percentile), indicating no observed exploitation activity yet.
Cross-site scripting in the Network Optix Nx Witness VMS Web Administration interface (all versions before 6.1.3 on Linux, Windows, and macOS) enables an adjacent-network attacker who controls a rogue Nx server to inject arbitrary JavaScript into an authenticated administrator's browser session by setting the rogue server's site name to a script payload. The injected script executes when the administrator opens the 'Merge with Another Site' dialog, triggering session token theft and full administrator account takeover. No public exploit code or CISA KEV listing was identified at time of analysis; the vendor has released a patch at version 6.1.3.
Remote buffer overflow in Zscaler Client Connector on Windows enables a network-accessible attacker with low privileges to crash the local system at the kernel level, producing a denial-of-service condition. The provided CVSS vector (C:H/I:H/A:H) signals potential confidentiality and integrity impact beyond what the vendor description explicitly states, a discrepancy that warrants verification - kernel-level buffer overflows frequently allow code execution, not merely DoS. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap buffer overflow in RustDesk's Windows clipboard redirection (wf_cliprdr.c) allows a malicious or compromised remote peer to overwrite heap memory in the local paste consumer process (typically explorer.exe) when the local user pastes clipboard file contents offered by the remote side. The OLE paste consumer calls IStream::Read with a buffer of cb bytes, but CliprdrStream_Read blindly copies req_fsize bytes - taken verbatim from the peer's CLIPRDR FileContentsResponse - before the only bounds check (req_fsize < cb) is ever evaluated, meaning an oversized peer response writes attacker-controlled data past the end of the caller's heap allocation. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed; however, an upstream fix PR (#15515) exists and the root cause is precisely documented, lowering the bar for exploit development. The identical defect was fixed in the upstream FreeRDP library as CVE-2026-68579 in FreeRDP 3.30.0, providing a public reference implementation of the fix.
Local privilege escalation in Entevo HMI V2 R5 P0 M4 enables a low-privileged local user to break out of Kiosk Mode and gain administrative command execution on Windows. The escape path exploits the application's built-in PDF manual viewer: opening the manual triggers an external PDF reader, whose Print dialog exposes Windows Explorer shell access, ultimately permitting arbitrary command execution as an administrator. A proof-of-concept demonstration is publicly available via GitHub gist; EPSS is low at 0.17% and CISA SSVC indicates no confirmed active exploitation, though the public POC meaningfully lowers the skill bar for any attacker with local session access.
DNS rebinding against Microsoft UFO's Linux MCP server (all versions prior to 3.0.8) enables an attacker-controlled web page to bypass localhost binding protections and reach the local /mcp endpoint via the victim's browser. Because the FastMCP streamable HTTP server bound to localhost:8010 performed no Host, Origin, or Sec-Fetch-Site header validation, a browser performing a DNS rebind could enumerate available tool schemas via tools/list and invoke execute_command with a valid UFO_MCP_API_KEY, resulting in arbitrary file reads or OS command execution as the victim's local user. No public exploit code has been identified at time of analysis, though the DNS rebinding technique is well-documented and the commit-confirmed patch validates the described attack path.
NTLM credential exposure in Git for Windows before 2.55.0.windows.4 allows a malicious remote Git server to capture Windows authentication material by advertising a crafted bundle URI during clone or fetch operations. When transfer.bundleuri is enabled, non-HTTP(S) URIs including bare UNC paths are treated as local filesystem paths, causing Windows to initiate an outbound SMB connection to an attacker-controlled host and expose NTLM hashes. No public exploit code has been identified at time of analysis and no CISA KEV listing is present, but the technique maps directly onto well-documented NTLM capture and relay attack patterns.
Server-side request forgery in Microsoft's Azure SQL Database cloud service lets an unauthorized network attacker coerce the service into making backend requests that result in privilege elevation, with a maximum CVSS base score of 10.0 driven by a scope change (S:C). The CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required, and the CWE-918 classification confirms the root cause is unvalidated server-issued requests. No public exploit identified at time of analysis, and the flaw is not currently listed in CISA KEV.
DLL hijacking in Remote Utilities Host ≤7.7.3.0 allows any local, unprivileged Windows user to achieve NT AUTHORITY\SYSTEM-level code execution by replacing service DLLs during a race window. The installer incorrectly grants BUILTIN\Everyone FULL CONTROL over all DLL files in the installation directory - including libasset32.dll and seven additional codec and multimedia libraries - enabling overwrite by any local account. No public exploit is identified at time of analysis, but the technique is well-established and the race window reliably materializes during software updates, service crashes, or manual restarts.
Command injection in Cloud Foundry's BOSH CLI on Windows enables an adjacent-network attacker to execute arbitrary shell commands - specifically via PowerShell injection - without requiring authentication. The vulnerability affects all tracked versions of the BOSH CLI (cpe:2.3:a:cloud_foundry_foundation:bosh_cli) when deployed on Windows hosts, resulting in full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-impact CVSS vector (7.5) and the specificity of the PowerShell injection vector indicate meaningful risk for Cloud Foundry operators running BOSH on Windows.
Server-side request forgery in Microsoft Azure Virtual Machines enables a low-privileged authenticated attacker to forge internal network requests, ultimately achieving privilege escalation with full confidentiality, integrity, and availability impact across a changed scope. The CVSS vector (AV:N/AC:H/PR:L/S:C/C:H/I:H/A:H) confirms the vulnerability reaches beyond the Azure VM component itself, potentially compromising adjacent Azure services or internal metadata infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft has released a patch via MSRC.
Microsoft Partner Center exposes cross-tenant information to unauthenticated network attackers via an authorization bypass rooted in user-controlled key manipulation (CWE-639). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H) indicates low-complexity, scopechanging exploitation that can reach confidential partner or customer data beyond the attacker's own organizational boundary. A vendor-released patch is available through the Microsoft Security Response Center; no public exploit has been identified at time of analysis.
Privilege escalation in Microsoft Azure Arc allows an unauthorized, network-based attacker to bypass authorization checks (CWE-863) and gain elevated privileges over managed hybrid/multicloud resources, with a maximal CVSS 3.1 score of 10.0 driven by a changed scope and high confidentiality/integrity impact. The flaw is reachable remotely without authentication or user interaction (AV:N/AC:L/PR:N/UI:N), and because scope is changed, exploitation can affect resources beyond the initially vulnerable component. Microsoft has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege elevation in Microsoft Azure Logic Apps allows an unauthenticated, remote attacker to escalate privileges by abusing a path-traversal flaw (CWE-22) that fails to restrict a supplied pathname to its intended directory, provided a victim is lured into interacting (UI:R). Rated CVSS 9.6 with a changed scope, indicating impact beyond the initially vulnerable component. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Microsoft Azure Data Manager for Energy arises from an integer overflow or wraparound condition (CWE-190) reachable over the network by any authenticated low-privilege user. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only standard credentials, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though CISA SSVC rates the technical impact as total; Microsoft has released a patch via MSRC.
Privilege elevation via SQL injection (CWE-89) affects Microsoft Azure SQL Database, where an already-authorized attacker can inject unneutralized special elements into SQL commands over the network to gain higher privileges than granted. The 9.9 CVSS score reflects a scope change (S:C) with high confidentiality, integrity, and availability impact, meaning a low-privileged database principal could break out of its authorization boundary. Microsoft has released a fix, and there is no public exploit identified at time of analysis.
Server-side request forgery in Microsoft Azure Data Factory exposes sensitive internal information to unauthenticated remote attackers over a network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special network positioning - any internet-reachable instance is in scope. No active exploitation has been confirmed by CISA KEV or public POC at time of analysis; SSVC rates exploitation as 'none' and EPSS at 0.99%, indicating limited real-world uptake despite the high CVSS base score.
Privilege elevation in Microsoft Azure SQL Database lets an already-authenticated, high-privileged principal escalate its permissions over the network through an improper access-control check (CWE-284). The CVSS scope change (S:C) indicates the abuse crosses an intended trust boundary within the managed service, threatening confidentiality, integrity, and availability. No public exploit identified at time of analysis and the flaw is not in CISA KEV; Microsoft has addressed it server-side per its MSRC advisory.
Privilege elevation in Microsoft Azure Arc allows a remote, unauthenticated attacker to gain elevated privileges over a network by exploiting an incorrectly-resolved name or reference (CWE-706), rated the maximum CVSS 10.0 with a scope change. Reported by Microsoft with a fix available through the MSRC update guide; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Note a source conflict: the CVE description cites Azure Arc while the CPE and tags cite Azure Web Apps, so the exact affected surface should be confirmed with Microsoft.
Privilege escalation in Microsoft Fabric exploits a relative path traversal flaw (CWE-23) to allow a low-privileged authenticated attacker to gain elevated permissions over the network. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack requires only a valid low-privilege account and no user interaction, making it accessible to any tenant user or compromised credential. Microsoft has released a patch via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft's Azure Managed Instance for Apache Cassandra allows an unauthenticated network attacker to inject additional command-line arguments (CWE-88) into a backend process and execute arbitrary code, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) that indicates no authentication or user interaction and a scope change beyond the vulnerable component. Microsoft reported the issue and has released a fix through MSRC. No public exploit is identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Information disclosure via improper input validation in Microsoft Office Word enables unauthenticated remote attackers to extract sensitive data across a broad product surface spanning Word 2016, Office 2019, multiple LTSC releases, and Microsoft 365 Apps for Enterprise on both Windows and macOS. The vendor-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no user interaction is required, though SSVC's 'Automatable: no' designation creates measurable tension with that assessment. No public exploit has been identified at time of analysis, and EPSS at 0.54% (43rd percentile) reflects low near-term exploitation probability despite the CVSS 7.5 rating.
Windows Remote Help versions 5.0.0.0 through below 5.2.1040.0 is vulnerable to an uncontrolled search path element (CWE-427), enabling a locally authenticated attacker to conduct spoofing attacks with high confidentiality and integrity impact. The flaw stems from the application resolving executables or libraries from attacker-controllable directory paths, a class of vulnerability commonly manifesting as DLL or binary planting on Windows. No public exploit has been identified at time of analysis, and Microsoft has released a patch as of the advisory publication.
Remote code execution in Microsoft Entra ID lets an unauthenticated network attacker run arbitrary code by submitting maliciously crafted serialized data that the service deserializes without validation (CWE-502). The CVSS 3.1 base score is a maximum 10.0 with a scope change, reflecting unauthenticated network reach and full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the combination of a cloud identity platform and PR:N/UI:N makes this an urgent-patch candidate.
Privilege elevation in Microsoft Entra ID (formerly Azure Active Directory) allows an authenticated, low-privileged attacker to abuse a server-side request forgery flaw (CWE-918) to reach protected internal endpoints and escalate privileges across a security scope over the network. The flaw carries a critical CVSS 9.9 with a scope change, meaning a foothold in one context can be leveraged to compromise resources beyond the attacker's original authorization. Microsoft has issued a service-side fix; there is no public exploit identified at time of analysis and no CISA KEV listing.
Azure Stack HCI exposes sensitive information to unauthenticated remote attackers via observable response discrepancy (CWE-204), where the system returns distinguishably different responses to distinct inputs, enabling enumeration or inference of confidential data without credentials. The CVSS 3.1 vector's Changed scope (S:C/C:H) signals that the disclosed information extends beyond the vulnerable component - significant in a hyperconverged platform managing compute, storage, and networking workloads with Azure integration. No public exploit code has been identified at time of analysis, but a vendor patch is available through the Microsoft Security Response Center.
Privilege escalation in Microsoft Azure SQL Database allows an already-authenticated, low-privileged attacker to inject crafted SQL over the network and gain elevated database privileges. Rated CVSS 9.9 with a scope-changing vector, the flaw stems from improper neutralization of special elements in SQL commands (CWE-89); Microsoft has issued a service-side fix. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Elevation of privilege in Microsoft Exchange Online lets an unauthorized network attacker abuse a server-side request forgery (CWE-918) flaw to make the service issue attacker-controlled internal requests, crossing a privilege/trust boundary (CVSS scope change) to reach backend resources. The CVSS 10.0 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects unauthenticated, low-complexity network exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV; Microsoft, the reporter, has already remediated the cloud service per its MSRC advisory.
Privilege elevation in Microsoft Azure Data Factory allows a remote, unauthenticated attacker to gain elevated privileges by exploiting improper verification of a cryptographic signature. Tagged as a JWT/authentication-bypass issue, the flaw lets an attacker forge or tamper with signed tokens that the service fails to validate correctly, defeating access controls over the network. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.28%), but the CVSS 9.8 rating reflects total technical impact if exploited.
Heap out-of-bounds read in NanaZip's SquashFS LZ4 decompression handler exposes adjacent heap memory contents when a user opens a crafted archive, affecting all stable releases from 1.0.88.0 through 6.0.1697.x and all preview releases through 6.5.1741.x on Windows. The flaw stems from a sign-conversion bug that causes the decompressor to trust an attacker-inflated block size, allowing a controlled memcpy to read beyond the allocated heap buffer and place internal heap data into the extracted file output, or crash the process entirely. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the memory disclosure primitive is meaningful for targeted attacks.
Splunk Enterprise for Windows exposes a startup race condition on the management port that allows a low-privileged local user to intercept authentication tokens from Splunk child processes. By pre-binding the management port before the Splunk service initializes - exploiting the absence of exclusive address binding protections on Windows - an attacker captures session tokens that can be replayed to compromise all data and system integrity accessible to the Splunk service account. No public exploit code has been identified and EPSS is 0.12% (3rd percentile), indicating low current exploitation activity; however, the vulnerability is Windows-specific and patch is available from Splunk.