N A
Monthly
BusyBox wget's FEATURE_WGET_TIMEOUT handler in networking/wget.c crashes with a null pointer dereference when the -T (timeout) argument is processed, affecting versions 1.30.0 and 1.30.1. Local users who can invoke BusyBox wget can trigger a denial-of-service crash of the wget process by supplying a crafted -T argument value, exploiting an unguarded pointer dereference in the shared getopt32 option-parsing library. No public exploit has confirmed active production exploitation, but a public proof-of-concept is available and the CVE is not listed in CISA KEV.
Secure boot bypass in the Ingenic T31 SoC allows an attacker with physical write access to boot media to forge SPL (Secondary Program Loader) images that pass RSA signature verification without the OEM signing key. The boot ROM's flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest - rather than validating the full cryptographic outputs - yielding a forgery success rate of approximately 2/3 per attempt. End-to-end hardware acceptance of a forged firmware image on a Wyze Video Doorbell v2 (T31X) has been confirmed by external researchers at opensensor.io; no public exploit is confirmed in CISA KEV, but a working proof-of-concept exists per the researcher disclosure.
Secure boot bypass in Ingenic T41, T32, T40, and A1 SoC boot ROMs allows an attacker with physical write access to boot media to permanently disable secure boot enforcement and execute unsigned or modified firmware. The boot ROM's init table parser applies full 32-bit SRAM write operations from the SPL header before evaluating the secure boot state or invoking signature verification - an ordering flaw that permits an attacker-crafted init-table entry to corrupt the SRAM-resident flag that governs the verification decision. No public exploit identified at time of analysis, though the opensensor.io research disclosure constitutes detailed technical findings including hardware-validated proof of concept on a T41 device with secure boot provisioned; because the flaw resides in mask ROM, no firmware patch is possible for hardware already in the field.
Reflected XSS in reportico-web 8.1.0 and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL targeting the run.php endpoint with a malicious payload in the loadTemplate parameter combined with execute_mode=PREPARE. The CVSS vector (PR:N, S:C, UI:R) confirms no authentication is required from the attacker, though user interaction is needed, and the attack scope crosses into the victim's browser context. A public vulnerability research repository exists for this CVE, suggesting exploit code is likely available; no confirmed active exploitation via CISA KEV at time of analysis.
Reflected XSS in Reportico Web (versions up to and including 8.1.0) enables remote unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a payload in the `reportico_criteria` parameter combined with `execute_mode=CRITERIA` on `run.php`. A public proof-of-concept is available per SSVC data, though no active exploitation is confirmed in CISA KEV. Successful exploitation requires social engineering the victim into clicking a crafted link, enabling session hijacking, credential theft, or malicious in-browser actions.
Unauthenticated path traversal in reportico-web <= 8.1.0 allows remote attackers to expose PHP source files or execute existing PHP files on the server by manipulating the target_format parameter of the run.php endpoint combined with the execute_mode=EXECUTE directive. The vulnerability requires no authentication and is reachable over the network, meaning any internet-exposed instance is at risk. Publicly available exploit research exists (kilotel/vulnerability-research); no public exploit identified as confirmed actively exploited (CISA KEV). EPSS stands at 0.37% (30th percentile), suggesting low observed exploitation frequency at time of analysis.
Stored cross-site scripting in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to inject persistent malicious JavaScript into the user documentation field, which then executes in the browsers of any users who view the affected content. The CVSS scope-change indicator (S:C) confirms that impact propagates beyond the injecting session to other authenticated users, enabling session hijacking, credential theft, or UI redressing. No public exploit confirmation or KEV listing is present, but a detailed researcher disclosure on GitHub (cert-rit, January 2026) documents the stored variant specifically.
Persistent ad-blocking bypass in Adblock for Youtube Extension versions up to 7.2.1 on Google Chrome allows remote web content to silently disable the extension's filtering rules by exploiting an improper authorization flaw (CWE-285) in the contentscript.js event listener. The updateDynamicRules function processes the yt-anti-adblock-detected DOM event without verifying the caller's origin or authorization, meaning any adversarial webpage can trigger the function and persistently disable ad blocking. Publicly available exploit code demonstrates this technique; the vulnerability is not listed in the CISA KEV catalog and no vendor patch exists, as the maintainer did not respond to pre-disclosure outreach.
Cross-site scripting in JeecgBoot v3.9.2's AI RAG chat upload endpoint allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in the browsers of users who interact with the malicious content. The CVSS 6.1 (Medium) vector confirms Changed Scope, enabling session hijacking, credential theft, or authenticated action hijacking against victims. No public exploit code has been identified and the EPSS score of 0.21% (11th percentile) indicates negligible current exploitation activity; this is not listed in the CISA KEV catalog.
Cross-site scripting in Squirro Cognitive Search versions prior to 3.14.2 allows remote attackers to inject and execute arbitrary JavaScript in victims' browsers via three distinct application functions: Email Notification, Create Evaluation Sets, and HTML Editor. The CVSS scope change (S:C) indicates the injected script executes outside the originating security context, enabling session hijacking, credential theft, or malicious action on behalf of authenticated users. No public exploit identified at time of analysis, though a researcher-published CVE entry with supporting materials exists on GitHub at Henkel-CyberVM/CVEs, suggesting active investigation of the vulnerability.
LDAP injection in Dolibarr's User Cloning component (htdocs/user/card.php) through version 23.0.3 allows authenticated remote attackers to manipulate LDAP query logic by crafting the user ID argument. Any valid Dolibarr user with access to the User Cloning feature can exploit this without additional privileges or user interaction. A public exploit has been released on Google Drive, substantially lowering the barrier for abuse; no active exploitation is confirmed in CISA KEV at time of analysis.
Improper privilege management in OpenBoxes up to 0.9.7 allows authenticated low-privileged users to escalate their roles by injecting unsanitized role parameters into the UserController's GORM data binding layer. The RoleInterceptor's needManager function additionally failed to enforce manager-level access on the user/show and user/edit endpoints, compounding the access control gap. A public proof-of-concept exploit is available; patched releases 0.9.8-hotfix1 and 0.9.8 are confirmed available from the vendor.
Server-side request forgery in OpenBoxes up to v0.9.7 allows authenticated remote attackers to coerce the application server into issuing HTTP requests to arbitrary internal or external URLs via the unvalidated `params.url` parameter in the Product Upload endpoint. The vulnerable code in `ProductController.groovy` passes the attacker-supplied URL directly to `new URL(params.url).openStream()` with no allowlist, blocklist, or scheme restriction - a textbook CWE-918 implementation flaw. A public proof-of-concept exploit exists on GitHub Gist, and the fix (removing the URL-based upload code path entirely) is available in v0.9.8 and v0.9.8-hotfix1; no CISA KEV listing at time of analysis.
SQL injection in Evergreen's open-ils.fielder OpenSRF Service, exposed via the /osrf-gateway-v1 HTTP gateway endpoint, affects all actively maintained branches through 3.14.11, 3.15.11, 3.16.5, and 3.17-beta1. The CVSS 4.0 vector confirms network-accessible, unauthenticated exploitation with low attack complexity, yielding partial confidentiality, integrity, and availability impact against the underlying database. A public proof-of-concept has been disclosed and patched releases (3.14.12, 3.15.12, 3.16.6, 3.17-beta2) are available, making delayed remediation difficult to justify given the exploit's public availability.
Cross-site request forgery in basecamp/upright's Alertmanager and Prometheus proxy controllers allows unauthenticated attackers to exploit authenticated user sessions by inducing browser-submitted requests that bypass Rails CSRF protection entirely. At the specific commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f, both proxy controllers skip the Rails authenticity token check, exposing upstream monitoring write and management APIs - including Alertmanager silence creation and Prometheus configuration reload - to attacker-controlled actions without the victim's awareness. A public proof-of-concept gist has been published by the reporting researcher, and no patched release has been confirmed at time of analysis.
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer access to crash the Session Management Function (SMF) by sending a malformed Credit-Control-Answer (CCA) message to the smf_gx_cca_cb handler. A publicly available proof-of-concept crash sample (SMF.crashes.zip) confirms exploitability; the absence of a CISA KEV listing indicates no confirmed widespread threat-actor exploitation has been reported. In 5G/4G core network deployments, an SMF crash disrupts session management for all connected user equipment, making this a higher operational risk than the CVSS medium score alone suggests.
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipulating the Session-Id argument processed by the fd_msg_sess_get function, causing the HSS service to fail. Low-privileged network access to the Diameter interface is sufficient to exploit this flaw, and a proof-of-concept packet capture (HSS_ULR_error_poc.pcapng.zip) has been publicly released via GitHub. No active exploitation has been confirmed in CISA KEV, but the public POC materially lowers the barrier for targeted attacks against private LTE/5G deployments running this stack.
Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, allowing low-privileged network-accessible attackers to corrupt memory with limited confidentiality, integrity, and availability impact. The vulnerability falls under CWE-119 and is tagged as a buffer overflow class flaw within the Diameter protocol handling stack used in 5G/4G core network deployments. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the telecom-grade attack surface warrants attention for operators running Open5GS in production.
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER handler, causing a denial of service. The vulnerability exists in diam_log_func within lib/diameter/common/init.c, where a call to ogs_assert_if_reached() could be triggered by a crafted Capabilities Exchange Request message over the Diameter protocol. A public exploit exists and a patched release (v2.7.7) is available; no active exploitation has been confirmed via CISA KEV.
CryptoPro Secure Disk for BitLocker versions before v7.7.4 leaks TPM2.0 unsealing secrets by persisting them in a serialized binary format within unused disk sectors - raw storage areas that survive reboots and are accessible without operating system authentication. An unauthenticated attacker with physical access to the drive can image these sectors, extract the serialized secrets, and reconstruct a compatible TPM environment to unseal the BitLocker volume, effectively defeating the hardware-backed disk encryption the product is designed to enforce. No public exploit code has been identified at time of analysis; CISA SSVC rates exploitation as 'none', but the attack's low complexity once physical access is obtained was detailed publicly in a Black Hat USA 2026 research presentation, materially lowering the skill barrier for motivated actors.
Boot-stage integrity bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker who can present a LUKS-encrypted volume during the pre-boot phase to cause bootxsa.efi to skip all CryptoPro file integrity checks, enabling execution of tampered EFI boot components. Publicly disclosed at Black Hat USA 2026 with an accompanying whitepaper, substantially raising the bar for exploit development. No CISA KEV listing and EPSS at the 1st percentile indicate no observed mass exploitation, but the research-quality disclosure significantly reduces attacker effort for targeted campaigns against affected endpoints.
Protection-mechanism bypass in CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 lets unsigned code run from temporary filesystems because the product fails to enforce its Integrity Measurement Architecture (IMA) policy across those locations. An attacker able to stage a binary in a tmpfs-style path can execute code that the integrity policy was meant to block, undermining the pre-boot/disk-encryption trust model. The flaw was disclosed in Black Hat USA 2026 research ('The Cost of Obscurity', Burch); no public exploit is identified at time of analysis, EPSS is low (0.17%, 6th percentile), and it is not in CISA KEV.
CryptoPro Secure Disk for BitLocker before v7.7.4 stores initramfs contents in plaintext on disk, allowing a physical attacker to recover cryptographic keys and other secrets without defeating the encryption layer. The vulnerability was publicly disclosed at Black Hat USA 2026 by researcher Burch in a presentation titled 'The Cost of Obscurity,' suggesting the vendor's security model relied on implementation obscurity rather than cryptographic assurance. No public exploit identified at time of analysis; EPSS at 0.17% reflects the physical-access prerequisite that limits widespread automated exploitation.
Boot partition authentication bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker who can manipulate disk partition layout to redirect boot-time code execution to a crafted Linux partition. The product fails to cryptographically verify the integrity of the intended boot partition and instead selects the first partition whose type matches a hardcoded value - a logic flaw that allows a spoofed partition to preempt the legitimate boot target and execute arbitrary code at elevated privilege. No public exploit or CISA KEV listing is confirmed at time of analysis, though a Black Hat USA 2026 research presentation by Burch ('The Cost of Obscurity') describes the finding, suggesting detailed technical disclosure has occurred.
Integrity-check bypass in CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 lets an attacker defeat the product's file-integrity verification: when a LUKS-encrypted volume is present, the software fails to validate that encryption correctly and then silently skips ALL CryptoPro integrity checks, so tampered files pass as trusted. This undermines the pre-boot/endpoint trust guarantees the product exists to provide, enabling evil-maid-style tampering. There is no public exploit identified at time of analysis, though the flaw is the subject of a Black Hat USA 2026 disclosure ('The Cost of Obscurity'); EPSS is very low (0.11%, 1st percentile) and it is not on CISA KEV.
Integrity validation failure in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker with local or physical disk access to craft malicious DataStore contents that trigger code execution in a high-privilege context or disrupt service availability on the host. The DataStore - a non-partitioned filesystem holding pre-boot configuration and cryptographic material - is parsed without authenticity verification, making it a viable Evil Maid attack surface. No public exploit identified at time of analysis, and EPSS at 0.18% (8th percentile) indicates very limited real-world exploitation activity; however, research presented at Black Hat USA 2026 details the vulnerability class.
CryptoPro Secure Disk for BitLocker before v7.7.4 silently falls back to plaintext volume mounting when a decryption error occurs, negating the entire confidentiality guarantee that BitLocker is meant to enforce. Disclosed publicly at Black Hat USA 2026 in research titled 'The Cost of Obscurity' (Burch), the flaw demonstrates how improper error handling in encryption middleware can fully undermine the security layer it wraps. No public exploit code has been identified at time of analysis, though the Black Hat presentation and accompanying whitepaper are publicly available, substantially lowering the knowledge barrier for exploitation; EPSS stands at a low 0.17% but may shift as presentation details circulate.
Full-disk-encryption bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 stems from a default TPM PCR sealing policy that ignores the system boot state, letting an attacker with physical access unseal the TPM through an unintended execution path or by relocating the drive/TPM to another hardware platform and recover the BitLocker keys. The flaw was documented in the Black Hat USA 2026 research 'The Cost of Obscurity' by Burch; there is no public exploit identified at time of analysis, it is not on CISA KEV, and EPSS is low at 0.18% (8th percentile), consistent with a physical-access rather than mass-exploitable weakness.
Privilege escalation in Intel(R) Transfer Learning Tool before version v0.7 stems from a protection mechanism failure (CWE-693) within the Ring 3 user application layer, enabling unauthenticated remote attackers to elevate privileges under specific attack conditions. The flaw affects confidentiality, integrity, and availability at a low severity each, with no subsequent system-level impact confirmed. No public exploit code or CISA KEV listing exists at time of analysis, and Intel has published advisory INTEL-SA-01499 addressing this issue.
Intel Software Guard Extensions Data Center Attestation Primitives (SGX DCAP), operating at Ring 0 kernel privilege level, omits security-relevant information during attestation operations, enabling a privileged local attacker under high-complexity conditions to cause denial of service and high-integrity data alteration on downstream systems relying on attestation output. The SI:H subsequent-system integrity impact is the critical concern: systems that consume SGX attestation results - cloud orchestrators, confidential VM managers, or trust brokers - may accept manipulated evidence, undermining the core trust guarantees of confidential computing infrastructure. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H and AC:H prerequisites substantially constrain the realistic attacker pool.
Privilege escalation in Intel Processors operating within Ring 0 environments - kernel, hypervisor, and bare-metal OS - allows an authorized attacker already holding high-privilege access to cross isolation boundaries and achieve high confidentiality and integrity impact on subsequent systems such as hypervisors or co-located virtual machines. The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:H/SC:H/SI:H) confirms the attack is local, high-complexity, and gated behind existing privileged access plus special internal knowledge of processor internals, significantly limiting the exploitable population. No public exploit code and no CISA KEV listing exist at time of analysis, making current real-world risk primarily theoretical but relevant to hardened multi-tenant and virtualized datacenter environments.
Deserialization of untrusted data in Intel Extension for PyTorch (IPEX) versions before 2.8.0 enables local privilege escalation when a victim user opens a maliciously crafted serialized artifact within an IPEX-dependent application. The vulnerability operates at Ring 3 (user-space) and yields low confidentiality, integrity, and availability impact with no subsequent system-level compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in Intel's Hardware-Aware-Automated-MachineLearning (NA) software before commit 45cd723 stems from an uncontrolled search path element (CWE-427) in its Ring 3 user-space application layer. An unprivileged local attacker who can write to a directory within the application's library or executable search path can plant a malicious artifact; when a high-privileged user subsequently runs the AutoML tool, the application loads the attacker-controlled file and executes code at the elevated privilege level. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the CVSS 4.0 score of 5.4 (Medium) reflects the attack requirements and required user interaction that constrain real-world exploitation.
Privilege escalation in Intel Performance Counter Monitor (PCM) before version tag 202604 allows a local authenticated attacker to gain elevated privileges via an untrusted search path (CWE-426) within Ring 3 user-space applications. The attack requires high complexity and passive interaction from a privileged user, producing full high-impact confidentiality, integrity, and availability compromise of the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Local privilege escalation via uncontrolled search path (DLL/binary planting) affects Intel's Approximate Bayesian Inference Framework prior to commit #484c949. An attacker operating at Ring 3 (user application space) with high privileges who can manipulate the search path can cause a co-located privileged user to load a malicious binary, resulting in full compromise of confidentiality, integrity, and availability on the vulnerable system. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Path traversal in Intel's gaudi-container-runtime before version 1.24.0 enables privilege escalation for locally authenticated users running workloads on Intel Gaudi AI accelerator hardware. The CWE-22 path traversal flaw resides in the Ring 3 userspace component of the runtime, allowing a low-privileged attacker to traverse directory boundaries and potentially gain elevated access with full confidentiality, integrity, and availability impact on the vulnerable system. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 5.4 reflects the local attack vector, required attack preconditions (AT:P), and passive user interaction requirement, which substantially reduce real-world exploitability despite the high per-system impact.
Insufficient access control granularity in a subsystem of Intel Xeon 6 Scalable processors with Trust Domain Extensions (TDX) enables cross-domain information disclosure. The flaw, classified under CWE-1220, allows an authenticated local adversary with specialized knowledge of processor internals to leak confidential data belonging to a co-resident trust domain or protected virtual machine, while leaving integrity and availability of all systems untouched. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the CVSS 4.0 scope-change pattern (VC:N/SC:H) signals a meaningful cross-trust-domain confidentiality risk specifically in confidential computing deployments.
Privilege escalation in Intel Xeon 6 processors arises from improper handling of overlapping protected memory ranges when Intel Trust Domain Extensions (TDX) operate within System Management Mode (SMM). An adversary who has already achieved SMM-level access and combines that foothold with a high-complexity, knowledge-intensive attack can break the isolation guarantees that TDX is designed to enforce, achieving unauthorized reads and writes of confidential memory. No public exploit code and no CISA KEV listing are associated with this issue at time of analysis, but the high confidentiality and integrity impact to the vulnerable system makes it significant for confidential-computing deployments.
Insufficient data authenticity verification within Intel Trust Domain Extensions (Intel TDX) at Ring 0 (hypervisor privilege level) enables information disclosure under a high-complexity, locally-mounted attack. A system software adversary already holding hypervisor-level privileges can exploit CWE-345 conditions to expose sensitive Trust Domain memory contents, achieving high confidentiality impact on the vulnerable system with limited integrity effects on both the vulnerable and subsequent systems. No public exploit code exists and this vulnerability has not been listed in CISA KEV, with the vendor-confirmed CVSS 4.0 score of 5.6 (Medium) accurately reflecting the constrained attack profile.
Privilege escalation in Intel Workload Services Framework software affects the Ring 3 user-application layer, where a protection mechanism failure (CWE-693) allows an unprivileged process to gain elevated privileges when a concurrently active privileged user provides passive interaction. The attack is local, requires attack prerequisites to be met (AT:P per CVSS 4.0), and achieves full compromise of the vulnerable system's confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis; this is a vendor-disclosed advisory via INTEL-SA-01467.
Integer overflow in Intel Slim Bootloader UEFI firmware exposes systems to limited information disclosure and denial of service. Exploitation requires local, authenticated access with active user interaction, yielding only low-impact confidentiality and availability consequences with no integrity impact. No active exploitation has been identified; the CVSS 4.0 score of 2.4 reflects the constrained exploitation conditions and limited blast radius.
Privilege escalation in Intel's LLM-on-Ray framework before version 1.0 stems from a protection mechanism failure (CWE-693) within Ring 3 user-space components, allowing an attacker with high-privileged user access to escalate privileges on the local system. The attack requires local access, passive user interaction from a privileged user, and specific attack requirements (AT:P), but results in high confidentiality, integrity, and availability impact on the vulnerable system with no subsequent system scope change. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
Privilege escalation in EquiTriton before commit f5ddbb5 arises from an uncontrolled search path element (CWE-427) within Ring 3 user-mode application components, allowing a local attacker operating under a high-privilege user context to substitute a malicious binary or library in a search path directory that EquiTriton resolves ahead of its legitimate target. Successful exploitation yields full confidentiality, integrity, and availability compromise of the vulnerable system while leaving downstream systems unaffected. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis; Intel disclosed the issue under advisory INTEL-SA-01473.
Improper input validation in the vLLM Hardware Plugin for Intel Gaudi software (versions before 0.16.0) allows a locally authenticated user to cause a denial of service, crashing or degrading availability of the affected system. The vulnerability operates within Ring 3 (user application space) and requires only low-privilege local access with no user interaction, making it viable for insider threat or compromised-account scenarios. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis; Intel has released a fix in version 0.16.0.
Out-of-bounds write (CWE-787) in Intel Slim Bootloader firmware enables a denial of service condition on the local system. Exploitation requires a privileged local account and the presence of specific attack preconditions (AT:P per CVSS 4.0), and impact is confined to low availability on the vulnerable system with no confidentiality or integrity consequences. Intel disclosed this issue through advisory INTEL-SA-01475 with a CVSS 4.0 base score of 1.8; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Privilege escalation in Intel(R) oneCCL Bindings for PyTorch before v2.8.0 stems from a protection mechanism failure (CWE-693) in Ring 3 user application space, enabling a local adversary - operating in conjunction with a high-privilege user through passive interaction - to escalate privileges with full confidentiality, integrity, and availability impact on the vulnerable system. The CVSS 4.0 score of 5.4 reflects meaningful exploitation constraints: specific attack requirements must be present (AT:P), high privileges are already required (PR:H), and passive interaction from a privileged user is needed (UI:P). No public exploit code or CISA KEV active exploitation listing has been identified at time of analysis.
Use-after-free in the kernel-mode (Ring 0) driver component of Intel PROSet/Wireless WiFi Software for Windows enables a local denial-of-service condition by crashing the affected system. The flaw resides in the most privileged execution ring on x86/x64, meaning a successful trigger causes a kernel panic (BSOD) with no containment boundary below the OS. No active exploitation has been confirmed by CISA KEV, no public exploit code has been identified at time of analysis, and the combination of local-only access with high attack complexity substantially constrains real-world risk.
Privilege escalation in Intel AI Reference Models before v3.4.1 stems from a protection mechanism failure (CWE-693) within Ring 3 user-space applications, allowing unprivileged software to gain elevated access when a privileged user is passively present under specific deployment conditions. The vulnerability carries full confidentiality, integrity, and availability impact on the vulnerable system, though scope is contained with no subsequent-system impact. No public exploit has been identified at time of analysis; Intel has issued a fix in version v3.4.1 per advisory INTEL-SA-01432.
Heap-based buffer overflow in Intel Open Volume Kernel Library (Open VKL) before version 2.0.2 allows a local authenticated attacker with low privileges to cause denial of service against applications consuming the library. Operating entirely in Ring 3 (user space), the flaw requires no user interaction and carries low attack complexity, making it straightforward to trigger for any local account on an affected system. No public exploit code and no active exploitation have been identified; Intel has released version 2.0.2 as the corrective fix per advisory INTEL-SA-01459.
Privilege escalation affects Intel's LLM Library for PyTorch operating within Ring 3 (user application space) due to a protection mechanism failure (CWE-693). An adversary with access to an unprivileged software context, combined with the presence of a privileged user and passive user interaction, can exploit this flaw locally to gain elevated privileges with high impact on confidentiality, integrity, and availability. No public exploit code or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 5.4 reflects the restrictive local access and high-privilege prerequisites that limit real-world exploitability.
Privilege escalation in Intel Neural Compressor software before v3.7 stems from improper input validation within Ring 3 (user application space), allowing a locally authenticated low-privileged user to elevate privileges on the affected host. The CVSS 4.0 vector confirms local access with low complexity, no special attack requirements, and no user interaction needed - meaning exploitation is straightforward once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to the vulnerable system with no lateral scope change.
Denial of service via a TOCTOU race condition in the Intel NPU Driver for Windows affects all current versions operating at Ring 1 (device driver layer). An authenticated local attacker with low privileges can exploit a window between the driver's resource state check and its use, resulting in high availability impact and low integrity impact to the vulnerable system. No active exploitation has been confirmed, and the high attack complexity plus specific attack prerequisites substantially limit opportunistic exploitation.
Privilege escalation in Intel Neural Compressor software before v3.6 stems from a protection mechanism failure (CWE-693) within the Ring 3 user-application layer. A local attacker operating with high privileges, in conjunction with specific attack requirements and passive user interaction, can exploit this flaw to elevate privileges with high confidentiality, integrity, and availability impact on the vulnerable system. Intel has issued advisory INTEL-SA-01454 and released v3.6 as the remediated version; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in Intel AI Containers before v0.4.0 exposes a protection mechanism failure (CWE-693) within the Ring 3 user application layer, enabling a local attacker already holding high privileges to further escalate privileges with full confidentiality, integrity, and availability impact on the vulnerable system. Exploitation requires passive user interaction and specific attack conditions (AT:P), substantially limiting the realistic attack population to multi-tenant AI container deployments where privileged users must be constrained. No public exploit code has been identified and this vulnerability does not appear in CISA KEV at time of analysis.
Local privilege escalation in Intel PROSet/Wireless WiFi Software for Windows allows unprivileged local code execution by exploiting improper authentication within the device driver layer. An attacker with only local access and no required privileges can bypass authentication checks in the Ring-2 driver tier, ultimately achieving code execution that results in high confidentiality impact on the broader host system alongside low integrity and availability impacts. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows (Ring 2: Device Drivers) enables a denial-of-service condition exploitable from adjacent network position without authentication. The memory corruption flaw in the Windows WiFi driver stack can be triggered with passive user interaction, causing high availability impact to the vulnerable system and a residual low availability impact to subsequently connected systems. No public exploit code has been identified at time of analysis, and Intel has published advisory INTEL-SA-01422 addressing this issue.
Local privilege escalation in Intel Battery Life Diagnostic Tool Software before version 2.9.0 stems from an untrusted search path (CWE-426), enabling a malicious binary or DLL to be loaded in place of a legitimate dependency when the tool executes. An authenticated local attacker with write access to a directory in the application's search path can achieve full system compromise (confidentiality, integrity, and availability all rated High on the vulnerable system) by waiting for a legitimate user to passively trigger the tool. Intel has released a fix in version 2.9.0 via advisory INTEL-SA-01453; no public exploit or CISA KEV listing is present at time of analysis.
Out-of-bounds read in the Intel Neural Processing Unit (NPU) Driver across all versions exposes systems to local denial of service via a low-privilege authenticated attacker operating in Ring 3 (user application space). The CVSS 4.0 score of 6.9 reflects high availability impact with a local, low-complexity, no-interaction attack path, alongside minor integrity degradation. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Denial of service in the Intel NPU Driver firmware (all versions) is achievable by any local authenticated low-privileged user through an improper conditions check (CWE-754) in the Ring 1 device driver layer. The flaw allows an unprivileged software process operating under an authenticated user context to trigger a high-availability-impact disruption - likely a driver crash or system hang - with no attack requirements and no user interaction beyond the attacker's own actions. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low complexity and minimal privilege bar make it straightforward to exploit on any affected Intel Core Ultra system where the NPU driver is loaded.
Uncontrolled resource consumption in the Intel PROSet/Wireless WiFi Software for Windows device driver (Ring 2) enables a local denial-of-service condition triggerable by an unprivileged process. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) confirms a low-complexity, local-access scenario requiring no authentication and no user interaction, with high availability impact on the vulnerable system and a secondary low availability impact on the subsequent system. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Denial of service in Intel TDX (Trust Domain Extensions) modules at Ring 0 can be triggered by a system software adversary who already holds kernel-level privileges, causing an uncaught exception that crashes Trust Domain availability. Exploitation is constrained to local access with high attack complexity and specific attack prerequisites, meaning only highly privileged, sophisticated actors in TDX-enabled environments are realistic threat actors. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the impact is limited strictly to availability - no confidentiality or integrity compromise is possible through this vector.
Privilege escalation in Intel's Cluster Management Toolkit for Kubernetes (CMK) before v0.8.5 allows a privileged local adversary to fully compromise the confidentiality, integrity, and availability of the affected system by exploiting a protection mechanism failure (CWE-693) within the Ring 3 user-application boundary. Exploitation requires a pre-established privileged local account, specific attack prerequisites (AT:P), and the occurrence of passive user interaction - a combination that substantially limits the exploitable population but results in complete system-level impact when conditions align. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Denial of service in Intel(R) NPU Driver affects all versions via an improper conditions check (CWE-754) reachable from Ring 3 (user applications). A locally authenticated, low-privileged user can trigger the flaw without any special attack prerequisites or user interaction, resulting in high availability impact to the vulnerable system. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the low complexity of exploitation combined with the growing deployment of NPU-equipped Intel platforms warrants prompt patching.
Privilege escalation in Intel TDX Guest software before version 0.3.1 stems from an incorrect comparison (CWE-697) within Ring 3 user application space, exploitable by a local attacker who already holds high system privileges. Impact is limited - low confidentiality, integrity, and availability degradation on the vulnerable guest system with no subsequent system impact - aligning with the CVSS 4.0 score of 4.6. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Intel has released a fix at version 0.3.1 via advisory INTEL-SA-01462.
Privilege escalation in Intel TDX Guest software before version 0.3.1 stems from an incorrect calculation (CWE-682) within Ring 3 user application code, enabling a local, high-privilege adversary to elevate privileges within a Trust Domain. The CVSS 4.0 vector confirms local access with high privileges required and low C/I/A impact on the vulnerable system, with no subsequent-system (host/hypervisor) impact. No public exploit exists and the vulnerability is absent from CISA KEV, placing real-world risk squarely in multi-tenant confidential computing scenarios where intra-guest privilege containment is a security objective.
Privilege escalation in Intel processor microcode stems from improper handling of overlap between protected memory ranges at the Ring 0 hypervisor privilege level, tracked as CVE-2026-20760 and EUVD-2026-56489. Exploitation requires local, low-privilege access to a system running an affected Intel processor, allowing an authorized adversary to escalate privileges or disrupt hypervisor availability without user interaction. Intel has published advisory INTEL-SA-01441 covering this issue; no active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, though the hypervisor-level attack surface warrants priority treatment in virtualized environments.
Privilege escalation in Intel's LLM Scaler software exposes systems to full compromise of confidentiality, integrity, and availability within the affected host. The flaw stems from a protection mechanism failure (CWE-693) operating in Ring 3 (user-space applications), where an unprivileged software component can leverage a co-present privileged user session to bypass access controls and elevate privileges. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the high impact triad (C:H/I:H/A:H) warrants prompt patching on any system running Intel's LLM Scaler where privileged users operate.
Information disclosure in Intel PROSet/Wireless WiFi Software at Ring 0 (kernel level) exposes sensitive system data to privileged local adversaries who bypass improper authentication controls within the kernel driver. Affected systems include any platform running Intel PROSet/Wireless WiFi Software, with the exact version range deferred to Intel Security Advisory INTEL-SA-01468. No active exploitation has been confirmed (not listed in CISA KEV), no public exploit code has been identified, and the CVSS 4.0 base score of 6.7 reflects the significant mitigation offered by the high-privilege local access prerequisite.
Local privilege escalation and code execution in Intel PROSet/Wireless WiFi Software for Windows arises from an information disclosure flaw (CWE-200) within the Ring 2 device driver layer, exploitable by an unprivileged local user without authentication or user interaction. The vulnerable system itself suffers only low confidentiality impact, but a scope change into the driver subsystem produces high subsequent-system confidentiality impact alongside low integrity and availability impacts - consistent with a privilege escalation chain from user space into driver-controlled memory. No public exploit has been identified at time of analysis and the vulnerability has not been listed in the CISA KEV catalog.
Intel Active Management Technology (Intel AMT) and Intel Standard Manageability firmware contain an improper initialization flaw (CWE-665) that enables confidentiality compromise by a locally privileged system software adversary. The vulnerability arises when firmware fails to properly initialize memory or state, allowing residual data to be read by a subsequent privileged operation under specific attack conditions (AT:P per CVSS 4.0). No CISA KEV listing exists and no public proof-of-concept has been identified; Intel reported this through their own security advisory program (INTEL-SA-01427) and the CVSS 4.0 base score of 5.6 reflects the constrained local, high-privilege exploitation prerequisites.
Improper buffer restrictions in the Intel NPU Driver (Ring 3: User Applications) expose all driver versions to a denial-of-service condition triggerable by a local, low-privileged authenticated user. The CVSS 4.0 vector confirms local-only access (AV:L/PR:L) with high availability impact (VA:H) and a minor integrity side-effect (VI:L), but no confidentiality loss. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, which tempers real-world urgency despite the potentially system-disrupting availability impact.
Privilege escalation in Intel Extension for TensorFlow software before version 2.15.0.3 stems from a protection mechanism failure (CWE-693) operating at Ring 3 - the CPU user-application privilege boundary. A system software adversary holding high privileges can exploit this failure under specific local attack conditions with passive user interaction to achieve full confidentiality, integrity, and availability compromise of the vulnerable system. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Privilege escalation in Intel Xeon processor firmware stems from an always-incorrect control flow implementation (CWE-670) that allows a privileged system software adversary to escalate privileges under high-complexity local attack conditions. Exploitation yields subsequent-system impacts - high confidentiality and high integrity compromise - while leaving the vulnerable system itself unimpacted, consistent with a scope change into a higher-privilege domain such as an OS kernel or hypervisor. No active exploitation is confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Sensitive data insertion into log files in Intel Active Management Technology (AMT) and Intel Standard Manageability exposes confidential information to privileged network adversaries. The flaw is classified under CWE-532 and carries a CVSS 4.0 score of 5.9, with high confidentiality impact but no integrity or availability consequences. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the network-accessible attack vector and high confidentiality impact make patching a priority for organizations relying on Intel vPro out-of-band management infrastructure.
Hardware logic race conditions in 3rd Gen Intel Xeon Scalable Processors expose server environments to local denial of service. The flaw resides within Ring 3 (user-space) processor logic, where a low-privileged authenticated local user can exploit the race condition - provided they possess specialized internal knowledge of processor timing - to crash or destabilize the affected system. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS 4.0 score of 6.8 reflects the high availability impact across both the vulnerable system and any subsequent workloads sharing the hardware.
Insecure sensitive data storage in the Intel Trust Domain Extensions (TDX) module exposes confidential memory to privileged local adversaries on affected Intel platforms. The flaw, classified under CWE-922, allows a Ring-0 system software attacker - such as a compromised or malicious hypervisor or host OS kernel - to read data that should be protected within a Trust Domain, breaking TDX's core confidential computing isolation guarantee. No public exploit has been identified at time of analysis, and exploitation demands high privilege, high complexity, and specific attack prerequisites, materially constraining real-world risk despite the high confidentiality impact rating.
File inclusion in DedeCMS up to 5.7.118 UTF8SP2 allows a remote attacker with low privileges and high-complexity conditions to include arbitrary files via the _4_Setup function within the Installation Wizard (install/index.php). Exploitation results in limited confidentiality, integrity, and availability impact. A proof-of-concept has been publicly disclosed via GitHub, though no active exploitation has been confirmed by CISA KEV. The CVSS 4.0 score of 1.3 reflects the constrained real-world impact and significant attack complexity required.
Behavioral workflow enforcement bypass in WonderTrader up to version 0.9.9 allows remote low-privileged attackers to manipulate the getUndoneQty argument within the _undone_qty function of the Pending Order Handler component (src/WtCore/TraderAdapter.h), resulting in unauthorized integrity modification of pending order state. The CVSS 4.0 vector confirms network-accessible exploitation with low privilege requirements and no user interaction. A publicly available proof-of-concept exploit exists (E:P), though no CISA KEV listing is recorded. The vendor was notified prior to disclosure and did not respond, meaning no official patch or advisory has been released.
Use of an uninitialized variable in WonderTrader up to version 0.9.9 allows a remote low-privileged attacker to cause limited availability disruption by manipulating the m_offsetType argument within the TraderATP Cash Trade Conversion component. The flaw resides in src/Includes/WTSTradeDef.hpp and is exploitable remotely, with a public proof-of-concept available via a Feishu document. No patch has been released and the vendor has not responded to disclosure - exploitation conditions are low complexity once authentication is satisfied, making this a persistent unmitigated risk for deployments using the ATP cash trading interface.
Improper behavioral workflow enforcement in WonderTrader up to version 0.9.9 allows remote attackers to manipulate the FID_JYLB argument in the TraderDD::queryTrades function, causing the application to execute trading query operations in an unintended sequence. Per the CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N), exploitation is network-reachable without authentication but requires high attack complexity, limiting opportunistic abuse. A proof-of-concept exploit is publicly available (E:P), and the vendor did not respond to responsible disclosure, leaving no patch available at time of analysis.
Resource exhaustion in the sol MQTT broker (commit 373d848, 2024-12-12) allows unauthenticated remote attackers to cause a denial of service by flooding the service with malformed or duplicate CONNECT packets. The broker's session teardown logic is incomplete: failed or repeated CONNECT attempts silently drop the connection without releasing internal state, leaving memory and file descriptors allocated indefinitely. With no authentication required and the attack confirmed automatable per SSVC, a sustained flood of crafted CONNECT packets can exhaust system resources and trigger the Linux OOM killer. No public exploit code was formally released as a tool, but a POC is referenced in the linked GitHub advisory; the vulnerability has not been added to the CISA KEV catalog.
File inclusion in TinyAGI 0.0.20 exposes server-side files to remote unauthenticated attackers through the buildSystemPrompt function in packages/server/src/routes/agents.ts. Exploitation requires no privileges or user interaction, and a publicly available proof-of-concept exists via GitHub issue #283. No patch has been released - the vendor has not responded to the responsible disclosure despite being notified through the project's issue tracker.
Missing authorization in TinyAGI 0.0.20's Message API Endpoint allows remote unauthenticated attackers to invoke the processMessage function without any access control enforcement, yielding limited but real confidentiality, integrity, and availability impact. A publicly available proof-of-concept exploit is referenced in GitHub issue #284, and the project maintainer has not responded to the responsible disclosure, leaving no patch available at time of analysis. The combination of unauthenticated network exploitability, live POC, and vendor silence makes this a material risk for any deployment exposing the endpoint to untrusted networks.
File inclusion via unsanitized path input in TinyAGI 0.0.20's Message API Endpoint exposes server-side files to remote unauthenticated attackers. The vulnerable surface is the `collectFiles` function in `packages/core/src/response.ts`, which accepts externally controlled file paths without adequate validation (CWE-73). Publicly available exploit code exists via GitHub issue #282, and the project maintainer had not issued a patch or response at time of disclosure - compounding risk for any internet-exposed deployments.
Server-side request forgery (SSRF) in JeecgBoot's AI RAG chat endpoint (/airag/chat/send) exposes unauthenticated remote attackers a direct path to make the application server issue arbitrary HTTP requests to internal or external network resources. All versions up to and including 3.9.2 are affected, with the flaw residing in the Anonymous Chat Attachment Parser component - meaning no login is required to trigger it. Public exploit code exists via a GitHub issue (no public exploit identified as actively exploited per CISA KEV), and no vendor-released patch is available at time of analysis.
Authentication bypass in the My Safetipin Android application version 5.2.1 stems from hardcoded credentials in the authentication module that produce predictable OTP values, letting remote attackers log in as arbitrary users and take over accounts without legitimate credentials. Any personal-safety data stored in a victim's account - location history, safety pins, and profile details - becomes exposed and modifiable. No public exploit has been identified at time of analysis, and the EPSS score of 0.27% (18th percentile) reflects low observed exploitation activity despite the maximal CVSS rating.
Hardcoded RTSP credentials in Zosi C519M IP camera firmware V4.2.8.823C01450BA expose live video feeds to any network-reachable attacker. The built-in credentials embedded in the RTSP authentication mechanism cannot be changed by the device owner, making every affected unit permanently vulnerable to unauthorized stream access. A public proof-of-concept exists on GitHub, and CISA's SSVC framework rates the attack as automatable with no exploitation preconditions beyond network reachability - no public exploit identified as actively exploited in CISA KEV at time of analysis.
Unauthorized access to other users' personal data in SirenGPS Android Application 2.19.44 stems from the backend API failing to verify that a requesting user is authorized to act on the target user identifier supplied in API parameters. An authenticated attacker exploiting this horizontal privilege escalation can read and overwrite arbitrary users' personal information with only low-privilege access. No public exploit identified at time of analysis and EPSS is extremely low (0.15%, 5th percentile), but a detailed researcher advisory is publicly available on GitHub, lowering the bar for replication.
Cross-site request forgery in RackTables through version 0.22.0 enables remote attackers to perform unauthorized state-changing actions against authenticated users' sessions by enticing them to visit attacker-controlled pages. The project maintainer has publicly confirmed the complete absence of any CSRF protection across the entire codebase and has explicitly declined to commit to a timely fix, making this a persistent, unfixed exposure. A public POC exists on GitHub; however, no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects the limited integrity-only impact and mandatory user interaction requirement.
Reflected XSS in O2OA v10's Forum posting function allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by convincing them to click a crafted URL. The Changed scope (S:C) in the CVSS vector confirms the exploit breaks out of the application's origin into the broader browser context, enabling session token theft or unauthorized actions on behalf of the victim. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.22% (12th percentile) alongside SSVC 'Exploitation: none' indicate low real-world exploitation activity at time of analysis.
BusyBox wget's FEATURE_WGET_TIMEOUT handler in networking/wget.c crashes with a null pointer dereference when the -T (timeout) argument is processed, affecting versions 1.30.0 and 1.30.1. Local users who can invoke BusyBox wget can trigger a denial-of-service crash of the wget process by supplying a crafted -T argument value, exploiting an unguarded pointer dereference in the shared getopt32 option-parsing library. No public exploit has confirmed active production exploitation, but a public proof-of-concept is available and the CVE is not listed in CISA KEV.
Secure boot bypass in the Ingenic T31 SoC allows an attacker with physical write access to boot media to forge SPL (Secondary Program Loader) images that pass RSA signature verification without the OEM signing key. The boot ROM's flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest - rather than validating the full cryptographic outputs - yielding a forgery success rate of approximately 2/3 per attempt. End-to-end hardware acceptance of a forged firmware image on a Wyze Video Doorbell v2 (T31X) has been confirmed by external researchers at opensensor.io; no public exploit is confirmed in CISA KEV, but a working proof-of-concept exists per the researcher disclosure.
Secure boot bypass in Ingenic T41, T32, T40, and A1 SoC boot ROMs allows an attacker with physical write access to boot media to permanently disable secure boot enforcement and execute unsigned or modified firmware. The boot ROM's init table parser applies full 32-bit SRAM write operations from the SPL header before evaluating the secure boot state or invoking signature verification - an ordering flaw that permits an attacker-crafted init-table entry to corrupt the SRAM-resident flag that governs the verification decision. No public exploit identified at time of analysis, though the opensensor.io research disclosure constitutes detailed technical findings including hardware-validated proof of concept on a T41 device with secure boot provisioned; because the flaw resides in mask ROM, no firmware patch is possible for hardware already in the field.
Reflected XSS in reportico-web 8.1.0 and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL targeting the run.php endpoint with a malicious payload in the loadTemplate parameter combined with execute_mode=PREPARE. The CVSS vector (PR:N, S:C, UI:R) confirms no authentication is required from the attacker, though user interaction is needed, and the attack scope crosses into the victim's browser context. A public vulnerability research repository exists for this CVE, suggesting exploit code is likely available; no confirmed active exploitation via CISA KEV at time of analysis.
Reflected XSS in Reportico Web (versions up to and including 8.1.0) enables remote unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a payload in the `reportico_criteria` parameter combined with `execute_mode=CRITERIA` on `run.php`. A public proof-of-concept is available per SSVC data, though no active exploitation is confirmed in CISA KEV. Successful exploitation requires social engineering the victim into clicking a crafted link, enabling session hijacking, credential theft, or malicious in-browser actions.
Unauthenticated path traversal in reportico-web <= 8.1.0 allows remote attackers to expose PHP source files or execute existing PHP files on the server by manipulating the target_format parameter of the run.php endpoint combined with the execute_mode=EXECUTE directive. The vulnerability requires no authentication and is reachable over the network, meaning any internet-exposed instance is at risk. Publicly available exploit research exists (kilotel/vulnerability-research); no public exploit identified as confirmed actively exploited (CISA KEV). EPSS stands at 0.37% (30th percentile), suggesting low observed exploitation frequency at time of analysis.
Stored cross-site scripting in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to inject persistent malicious JavaScript into the user documentation field, which then executes in the browsers of any users who view the affected content. The CVSS scope-change indicator (S:C) confirms that impact propagates beyond the injecting session to other authenticated users, enabling session hijacking, credential theft, or UI redressing. No public exploit confirmation or KEV listing is present, but a detailed researcher disclosure on GitHub (cert-rit, January 2026) documents the stored variant specifically.
Persistent ad-blocking bypass in Adblock for Youtube Extension versions up to 7.2.1 on Google Chrome allows remote web content to silently disable the extension's filtering rules by exploiting an improper authorization flaw (CWE-285) in the contentscript.js event listener. The updateDynamicRules function processes the yt-anti-adblock-detected DOM event without verifying the caller's origin or authorization, meaning any adversarial webpage can trigger the function and persistently disable ad blocking. Publicly available exploit code demonstrates this technique; the vulnerability is not listed in the CISA KEV catalog and no vendor patch exists, as the maintainer did not respond to pre-disclosure outreach.
Cross-site scripting in JeecgBoot v3.9.2's AI RAG chat upload endpoint allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in the browsers of users who interact with the malicious content. The CVSS 6.1 (Medium) vector confirms Changed Scope, enabling session hijacking, credential theft, or authenticated action hijacking against victims. No public exploit code has been identified and the EPSS score of 0.21% (11th percentile) indicates negligible current exploitation activity; this is not listed in the CISA KEV catalog.
Cross-site scripting in Squirro Cognitive Search versions prior to 3.14.2 allows remote attackers to inject and execute arbitrary JavaScript in victims' browsers via three distinct application functions: Email Notification, Create Evaluation Sets, and HTML Editor. The CVSS scope change (S:C) indicates the injected script executes outside the originating security context, enabling session hijacking, credential theft, or malicious action on behalf of authenticated users. No public exploit identified at time of analysis, though a researcher-published CVE entry with supporting materials exists on GitHub at Henkel-CyberVM/CVEs, suggesting active investigation of the vulnerability.
LDAP injection in Dolibarr's User Cloning component (htdocs/user/card.php) through version 23.0.3 allows authenticated remote attackers to manipulate LDAP query logic by crafting the user ID argument. Any valid Dolibarr user with access to the User Cloning feature can exploit this without additional privileges or user interaction. A public exploit has been released on Google Drive, substantially lowering the barrier for abuse; no active exploitation is confirmed in CISA KEV at time of analysis.
Improper privilege management in OpenBoxes up to 0.9.7 allows authenticated low-privileged users to escalate their roles by injecting unsanitized role parameters into the UserController's GORM data binding layer. The RoleInterceptor's needManager function additionally failed to enforce manager-level access on the user/show and user/edit endpoints, compounding the access control gap. A public proof-of-concept exploit is available; patched releases 0.9.8-hotfix1 and 0.9.8 are confirmed available from the vendor.
Server-side request forgery in OpenBoxes up to v0.9.7 allows authenticated remote attackers to coerce the application server into issuing HTTP requests to arbitrary internal or external URLs via the unvalidated `params.url` parameter in the Product Upload endpoint. The vulnerable code in `ProductController.groovy` passes the attacker-supplied URL directly to `new URL(params.url).openStream()` with no allowlist, blocklist, or scheme restriction - a textbook CWE-918 implementation flaw. A public proof-of-concept exploit exists on GitHub Gist, and the fix (removing the URL-based upload code path entirely) is available in v0.9.8 and v0.9.8-hotfix1; no CISA KEV listing at time of analysis.
SQL injection in Evergreen's open-ils.fielder OpenSRF Service, exposed via the /osrf-gateway-v1 HTTP gateway endpoint, affects all actively maintained branches through 3.14.11, 3.15.11, 3.16.5, and 3.17-beta1. The CVSS 4.0 vector confirms network-accessible, unauthenticated exploitation with low attack complexity, yielding partial confidentiality, integrity, and availability impact against the underlying database. A public proof-of-concept has been disclosed and patched releases (3.14.12, 3.15.12, 3.16.6, 3.17-beta2) are available, making delayed remediation difficult to justify given the exploit's public availability.
Cross-site request forgery in basecamp/upright's Alertmanager and Prometheus proxy controllers allows unauthenticated attackers to exploit authenticated user sessions by inducing browser-submitted requests that bypass Rails CSRF protection entirely. At the specific commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f, both proxy controllers skip the Rails authenticity token check, exposing upstream monitoring write and management APIs - including Alertmanager silence creation and Prometheus configuration reload - to attacker-controlled actions without the victim's awareness. A public proof-of-concept gist has been published by the reporting researcher, and no patched release has been confirmed at time of analysis.
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer access to crash the Session Management Function (SMF) by sending a malformed Credit-Control-Answer (CCA) message to the smf_gx_cca_cb handler. A publicly available proof-of-concept crash sample (SMF.crashes.zip) confirms exploitability; the absence of a CISA KEV listing indicates no confirmed widespread threat-actor exploitation has been reported. In 5G/4G core network deployments, an SMF crash disrupts session management for all connected user equipment, making this a higher operational risk than the CVSS medium score alone suggests.
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipulating the Session-Id argument processed by the fd_msg_sess_get function, causing the HSS service to fail. Low-privileged network access to the Diameter interface is sufficient to exploit this flaw, and a proof-of-concept packet capture (HSS_ULR_error_poc.pcapng.zip) has been publicly released via GitHub. No active exploitation has been confirmed in CISA KEV, but the public POC materially lowers the barrier for targeted attacks against private LTE/5G deployments running this stack.
Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, allowing low-privileged network-accessible attackers to corrupt memory with limited confidentiality, integrity, and availability impact. The vulnerability falls under CWE-119 and is tagged as a buffer overflow class flaw within the Diameter protocol handling stack used in 5G/4G core network deployments. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the telecom-grade attack surface warrants attention for operators running Open5GS in production.
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER handler, causing a denial of service. The vulnerability exists in diam_log_func within lib/diameter/common/init.c, where a call to ogs_assert_if_reached() could be triggered by a crafted Capabilities Exchange Request message over the Diameter protocol. A public exploit exists and a patched release (v2.7.7) is available; no active exploitation has been confirmed via CISA KEV.
CryptoPro Secure Disk for BitLocker versions before v7.7.4 leaks TPM2.0 unsealing secrets by persisting them in a serialized binary format within unused disk sectors - raw storage areas that survive reboots and are accessible without operating system authentication. An unauthenticated attacker with physical access to the drive can image these sectors, extract the serialized secrets, and reconstruct a compatible TPM environment to unseal the BitLocker volume, effectively defeating the hardware-backed disk encryption the product is designed to enforce. No public exploit code has been identified at time of analysis; CISA SSVC rates exploitation as 'none', but the attack's low complexity once physical access is obtained was detailed publicly in a Black Hat USA 2026 research presentation, materially lowering the skill barrier for motivated actors.
Boot-stage integrity bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker who can present a LUKS-encrypted volume during the pre-boot phase to cause bootxsa.efi to skip all CryptoPro file integrity checks, enabling execution of tampered EFI boot components. Publicly disclosed at Black Hat USA 2026 with an accompanying whitepaper, substantially raising the bar for exploit development. No CISA KEV listing and EPSS at the 1st percentile indicate no observed mass exploitation, but the research-quality disclosure significantly reduces attacker effort for targeted campaigns against affected endpoints.
Protection-mechanism bypass in CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 lets unsigned code run from temporary filesystems because the product fails to enforce its Integrity Measurement Architecture (IMA) policy across those locations. An attacker able to stage a binary in a tmpfs-style path can execute code that the integrity policy was meant to block, undermining the pre-boot/disk-encryption trust model. The flaw was disclosed in Black Hat USA 2026 research ('The Cost of Obscurity', Burch); no public exploit is identified at time of analysis, EPSS is low (0.17%, 6th percentile), and it is not in CISA KEV.
CryptoPro Secure Disk for BitLocker before v7.7.4 stores initramfs contents in plaintext on disk, allowing a physical attacker to recover cryptographic keys and other secrets without defeating the encryption layer. The vulnerability was publicly disclosed at Black Hat USA 2026 by researcher Burch in a presentation titled 'The Cost of Obscurity,' suggesting the vendor's security model relied on implementation obscurity rather than cryptographic assurance. No public exploit identified at time of analysis; EPSS at 0.17% reflects the physical-access prerequisite that limits widespread automated exploitation.
Boot partition authentication bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker who can manipulate disk partition layout to redirect boot-time code execution to a crafted Linux partition. The product fails to cryptographically verify the integrity of the intended boot partition and instead selects the first partition whose type matches a hardcoded value - a logic flaw that allows a spoofed partition to preempt the legitimate boot target and execute arbitrary code at elevated privilege. No public exploit or CISA KEV listing is confirmed at time of analysis, though a Black Hat USA 2026 research presentation by Burch ('The Cost of Obscurity') describes the finding, suggesting detailed technical disclosure has occurred.
Integrity-check bypass in CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 lets an attacker defeat the product's file-integrity verification: when a LUKS-encrypted volume is present, the software fails to validate that encryption correctly and then silently skips ALL CryptoPro integrity checks, so tampered files pass as trusted. This undermines the pre-boot/endpoint trust guarantees the product exists to provide, enabling evil-maid-style tampering. There is no public exploit identified at time of analysis, though the flaw is the subject of a Black Hat USA 2026 disclosure ('The Cost of Obscurity'); EPSS is very low (0.11%, 1st percentile) and it is not on CISA KEV.
Integrity validation failure in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker with local or physical disk access to craft malicious DataStore contents that trigger code execution in a high-privilege context or disrupt service availability on the host. The DataStore - a non-partitioned filesystem holding pre-boot configuration and cryptographic material - is parsed without authenticity verification, making it a viable Evil Maid attack surface. No public exploit identified at time of analysis, and EPSS at 0.18% (8th percentile) indicates very limited real-world exploitation activity; however, research presented at Black Hat USA 2026 details the vulnerability class.
CryptoPro Secure Disk for BitLocker before v7.7.4 silently falls back to plaintext volume mounting when a decryption error occurs, negating the entire confidentiality guarantee that BitLocker is meant to enforce. Disclosed publicly at Black Hat USA 2026 in research titled 'The Cost of Obscurity' (Burch), the flaw demonstrates how improper error handling in encryption middleware can fully undermine the security layer it wraps. No public exploit code has been identified at time of analysis, though the Black Hat presentation and accompanying whitepaper are publicly available, substantially lowering the knowledge barrier for exploitation; EPSS stands at a low 0.17% but may shift as presentation details circulate.
Full-disk-encryption bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 stems from a default TPM PCR sealing policy that ignores the system boot state, letting an attacker with physical access unseal the TPM through an unintended execution path or by relocating the drive/TPM to another hardware platform and recover the BitLocker keys. The flaw was documented in the Black Hat USA 2026 research 'The Cost of Obscurity' by Burch; there is no public exploit identified at time of analysis, it is not on CISA KEV, and EPSS is low at 0.18% (8th percentile), consistent with a physical-access rather than mass-exploitable weakness.
Privilege escalation in Intel(R) Transfer Learning Tool before version v0.7 stems from a protection mechanism failure (CWE-693) within the Ring 3 user application layer, enabling unauthenticated remote attackers to elevate privileges under specific attack conditions. The flaw affects confidentiality, integrity, and availability at a low severity each, with no subsequent system-level impact confirmed. No public exploit code or CISA KEV listing exists at time of analysis, and Intel has published advisory INTEL-SA-01499 addressing this issue.
Intel Software Guard Extensions Data Center Attestation Primitives (SGX DCAP), operating at Ring 0 kernel privilege level, omits security-relevant information during attestation operations, enabling a privileged local attacker under high-complexity conditions to cause denial of service and high-integrity data alteration on downstream systems relying on attestation output. The SI:H subsequent-system integrity impact is the critical concern: systems that consume SGX attestation results - cloud orchestrators, confidential VM managers, or trust brokers - may accept manipulated evidence, undermining the core trust guarantees of confidential computing infrastructure. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H and AC:H prerequisites substantially constrain the realistic attacker pool.
Privilege escalation in Intel Processors operating within Ring 0 environments - kernel, hypervisor, and bare-metal OS - allows an authorized attacker already holding high-privilege access to cross isolation boundaries and achieve high confidentiality and integrity impact on subsequent systems such as hypervisors or co-located virtual machines. The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:H/SC:H/SI:H) confirms the attack is local, high-complexity, and gated behind existing privileged access plus special internal knowledge of processor internals, significantly limiting the exploitable population. No public exploit code and no CISA KEV listing exist at time of analysis, making current real-world risk primarily theoretical but relevant to hardened multi-tenant and virtualized datacenter environments.
Deserialization of untrusted data in Intel Extension for PyTorch (IPEX) versions before 2.8.0 enables local privilege escalation when a victim user opens a maliciously crafted serialized artifact within an IPEX-dependent application. The vulnerability operates at Ring 3 (user-space) and yields low confidentiality, integrity, and availability impact with no subsequent system-level compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in Intel's Hardware-Aware-Automated-MachineLearning (NA) software before commit 45cd723 stems from an uncontrolled search path element (CWE-427) in its Ring 3 user-space application layer. An unprivileged local attacker who can write to a directory within the application's library or executable search path can plant a malicious artifact; when a high-privileged user subsequently runs the AutoML tool, the application loads the attacker-controlled file and executes code at the elevated privilege level. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the CVSS 4.0 score of 5.4 (Medium) reflects the attack requirements and required user interaction that constrain real-world exploitation.
Privilege escalation in Intel Performance Counter Monitor (PCM) before version tag 202604 allows a local authenticated attacker to gain elevated privileges via an untrusted search path (CWE-426) within Ring 3 user-space applications. The attack requires high complexity and passive interaction from a privileged user, producing full high-impact confidentiality, integrity, and availability compromise of the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Local privilege escalation via uncontrolled search path (DLL/binary planting) affects Intel's Approximate Bayesian Inference Framework prior to commit #484c949. An attacker operating at Ring 3 (user application space) with high privileges who can manipulate the search path can cause a co-located privileged user to load a malicious binary, resulting in full compromise of confidentiality, integrity, and availability on the vulnerable system. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Path traversal in Intel's gaudi-container-runtime before version 1.24.0 enables privilege escalation for locally authenticated users running workloads on Intel Gaudi AI accelerator hardware. The CWE-22 path traversal flaw resides in the Ring 3 userspace component of the runtime, allowing a low-privileged attacker to traverse directory boundaries and potentially gain elevated access with full confidentiality, integrity, and availability impact on the vulnerable system. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 5.4 reflects the local attack vector, required attack preconditions (AT:P), and passive user interaction requirement, which substantially reduce real-world exploitability despite the high per-system impact.
Insufficient access control granularity in a subsystem of Intel Xeon 6 Scalable processors with Trust Domain Extensions (TDX) enables cross-domain information disclosure. The flaw, classified under CWE-1220, allows an authenticated local adversary with specialized knowledge of processor internals to leak confidential data belonging to a co-resident trust domain or protected virtual machine, while leaving integrity and availability of all systems untouched. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the CVSS 4.0 scope-change pattern (VC:N/SC:H) signals a meaningful cross-trust-domain confidentiality risk specifically in confidential computing deployments.
Privilege escalation in Intel Xeon 6 processors arises from improper handling of overlapping protected memory ranges when Intel Trust Domain Extensions (TDX) operate within System Management Mode (SMM). An adversary who has already achieved SMM-level access and combines that foothold with a high-complexity, knowledge-intensive attack can break the isolation guarantees that TDX is designed to enforce, achieving unauthorized reads and writes of confidential memory. No public exploit code and no CISA KEV listing are associated with this issue at time of analysis, but the high confidentiality and integrity impact to the vulnerable system makes it significant for confidential-computing deployments.
Insufficient data authenticity verification within Intel Trust Domain Extensions (Intel TDX) at Ring 0 (hypervisor privilege level) enables information disclosure under a high-complexity, locally-mounted attack. A system software adversary already holding hypervisor-level privileges can exploit CWE-345 conditions to expose sensitive Trust Domain memory contents, achieving high confidentiality impact on the vulnerable system with limited integrity effects on both the vulnerable and subsequent systems. No public exploit code exists and this vulnerability has not been listed in CISA KEV, with the vendor-confirmed CVSS 4.0 score of 5.6 (Medium) accurately reflecting the constrained attack profile.
Privilege escalation in Intel Workload Services Framework software affects the Ring 3 user-application layer, where a protection mechanism failure (CWE-693) allows an unprivileged process to gain elevated privileges when a concurrently active privileged user provides passive interaction. The attack is local, requires attack prerequisites to be met (AT:P per CVSS 4.0), and achieves full compromise of the vulnerable system's confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis; this is a vendor-disclosed advisory via INTEL-SA-01467.
Integer overflow in Intel Slim Bootloader UEFI firmware exposes systems to limited information disclosure and denial of service. Exploitation requires local, authenticated access with active user interaction, yielding only low-impact confidentiality and availability consequences with no integrity impact. No active exploitation has been identified; the CVSS 4.0 score of 2.4 reflects the constrained exploitation conditions and limited blast radius.
Privilege escalation in Intel's LLM-on-Ray framework before version 1.0 stems from a protection mechanism failure (CWE-693) within Ring 3 user-space components, allowing an attacker with high-privileged user access to escalate privileges on the local system. The attack requires local access, passive user interaction from a privileged user, and specific attack requirements (AT:P), but results in high confidentiality, integrity, and availability impact on the vulnerable system with no subsequent system scope change. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
Privilege escalation in EquiTriton before commit f5ddbb5 arises from an uncontrolled search path element (CWE-427) within Ring 3 user-mode application components, allowing a local attacker operating under a high-privilege user context to substitute a malicious binary or library in a search path directory that EquiTriton resolves ahead of its legitimate target. Successful exploitation yields full confidentiality, integrity, and availability compromise of the vulnerable system while leaving downstream systems unaffected. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis; Intel disclosed the issue under advisory INTEL-SA-01473.
Improper input validation in the vLLM Hardware Plugin for Intel Gaudi software (versions before 0.16.0) allows a locally authenticated user to cause a denial of service, crashing or degrading availability of the affected system. The vulnerability operates within Ring 3 (user application space) and requires only low-privilege local access with no user interaction, making it viable for insider threat or compromised-account scenarios. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis; Intel has released a fix in version 0.16.0.
Out-of-bounds write (CWE-787) in Intel Slim Bootloader firmware enables a denial of service condition on the local system. Exploitation requires a privileged local account and the presence of specific attack preconditions (AT:P per CVSS 4.0), and impact is confined to low availability on the vulnerable system with no confidentiality or integrity consequences. Intel disclosed this issue through advisory INTEL-SA-01475 with a CVSS 4.0 base score of 1.8; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Privilege escalation in Intel(R) oneCCL Bindings for PyTorch before v2.8.0 stems from a protection mechanism failure (CWE-693) in Ring 3 user application space, enabling a local adversary - operating in conjunction with a high-privilege user through passive interaction - to escalate privileges with full confidentiality, integrity, and availability impact on the vulnerable system. The CVSS 4.0 score of 5.4 reflects meaningful exploitation constraints: specific attack requirements must be present (AT:P), high privileges are already required (PR:H), and passive interaction from a privileged user is needed (UI:P). No public exploit code or CISA KEV active exploitation listing has been identified at time of analysis.
Use-after-free in the kernel-mode (Ring 0) driver component of Intel PROSet/Wireless WiFi Software for Windows enables a local denial-of-service condition by crashing the affected system. The flaw resides in the most privileged execution ring on x86/x64, meaning a successful trigger causes a kernel panic (BSOD) with no containment boundary below the OS. No active exploitation has been confirmed by CISA KEV, no public exploit code has been identified at time of analysis, and the combination of local-only access with high attack complexity substantially constrains real-world risk.
Privilege escalation in Intel AI Reference Models before v3.4.1 stems from a protection mechanism failure (CWE-693) within Ring 3 user-space applications, allowing unprivileged software to gain elevated access when a privileged user is passively present under specific deployment conditions. The vulnerability carries full confidentiality, integrity, and availability impact on the vulnerable system, though scope is contained with no subsequent-system impact. No public exploit has been identified at time of analysis; Intel has issued a fix in version v3.4.1 per advisory INTEL-SA-01432.
Heap-based buffer overflow in Intel Open Volume Kernel Library (Open VKL) before version 2.0.2 allows a local authenticated attacker with low privileges to cause denial of service against applications consuming the library. Operating entirely in Ring 3 (user space), the flaw requires no user interaction and carries low attack complexity, making it straightforward to trigger for any local account on an affected system. No public exploit code and no active exploitation have been identified; Intel has released version 2.0.2 as the corrective fix per advisory INTEL-SA-01459.
Privilege escalation affects Intel's LLM Library for PyTorch operating within Ring 3 (user application space) due to a protection mechanism failure (CWE-693). An adversary with access to an unprivileged software context, combined with the presence of a privileged user and passive user interaction, can exploit this flaw locally to gain elevated privileges with high impact on confidentiality, integrity, and availability. No public exploit code or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 5.4 reflects the restrictive local access and high-privilege prerequisites that limit real-world exploitability.
Privilege escalation in Intel Neural Compressor software before v3.7 stems from improper input validation within Ring 3 (user application space), allowing a locally authenticated low-privileged user to elevate privileges on the affected host. The CVSS 4.0 vector confirms local access with low complexity, no special attack requirements, and no user interaction needed - meaning exploitation is straightforward once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to the vulnerable system with no lateral scope change.
Denial of service via a TOCTOU race condition in the Intel NPU Driver for Windows affects all current versions operating at Ring 1 (device driver layer). An authenticated local attacker with low privileges can exploit a window between the driver's resource state check and its use, resulting in high availability impact and low integrity impact to the vulnerable system. No active exploitation has been confirmed, and the high attack complexity plus specific attack prerequisites substantially limit opportunistic exploitation.
Privilege escalation in Intel Neural Compressor software before v3.6 stems from a protection mechanism failure (CWE-693) within the Ring 3 user-application layer. A local attacker operating with high privileges, in conjunction with specific attack requirements and passive user interaction, can exploit this flaw to elevate privileges with high confidentiality, integrity, and availability impact on the vulnerable system. Intel has issued advisory INTEL-SA-01454 and released v3.6 as the remediated version; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in Intel AI Containers before v0.4.0 exposes a protection mechanism failure (CWE-693) within the Ring 3 user application layer, enabling a local attacker already holding high privileges to further escalate privileges with full confidentiality, integrity, and availability impact on the vulnerable system. Exploitation requires passive user interaction and specific attack conditions (AT:P), substantially limiting the realistic attack population to multi-tenant AI container deployments where privileged users must be constrained. No public exploit code has been identified and this vulnerability does not appear in CISA KEV at time of analysis.
Local privilege escalation in Intel PROSet/Wireless WiFi Software for Windows allows unprivileged local code execution by exploiting improper authentication within the device driver layer. An attacker with only local access and no required privileges can bypass authentication checks in the Ring-2 driver tier, ultimately achieving code execution that results in high confidentiality impact on the broader host system alongside low integrity and availability impacts. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows (Ring 2: Device Drivers) enables a denial-of-service condition exploitable from adjacent network position without authentication. The memory corruption flaw in the Windows WiFi driver stack can be triggered with passive user interaction, causing high availability impact to the vulnerable system and a residual low availability impact to subsequently connected systems. No public exploit code has been identified at time of analysis, and Intel has published advisory INTEL-SA-01422 addressing this issue.
Local privilege escalation in Intel Battery Life Diagnostic Tool Software before version 2.9.0 stems from an untrusted search path (CWE-426), enabling a malicious binary or DLL to be loaded in place of a legitimate dependency when the tool executes. An authenticated local attacker with write access to a directory in the application's search path can achieve full system compromise (confidentiality, integrity, and availability all rated High on the vulnerable system) by waiting for a legitimate user to passively trigger the tool. Intel has released a fix in version 2.9.0 via advisory INTEL-SA-01453; no public exploit or CISA KEV listing is present at time of analysis.
Out-of-bounds read in the Intel Neural Processing Unit (NPU) Driver across all versions exposes systems to local denial of service via a low-privilege authenticated attacker operating in Ring 3 (user application space). The CVSS 4.0 score of 6.9 reflects high availability impact with a local, low-complexity, no-interaction attack path, alongside minor integrity degradation. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Denial of service in the Intel NPU Driver firmware (all versions) is achievable by any local authenticated low-privileged user through an improper conditions check (CWE-754) in the Ring 1 device driver layer. The flaw allows an unprivileged software process operating under an authenticated user context to trigger a high-availability-impact disruption - likely a driver crash or system hang - with no attack requirements and no user interaction beyond the attacker's own actions. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low complexity and minimal privilege bar make it straightforward to exploit on any affected Intel Core Ultra system where the NPU driver is loaded.
Uncontrolled resource consumption in the Intel PROSet/Wireless WiFi Software for Windows device driver (Ring 2) enables a local denial-of-service condition triggerable by an unprivileged process. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) confirms a low-complexity, local-access scenario requiring no authentication and no user interaction, with high availability impact on the vulnerable system and a secondary low availability impact on the subsequent system. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Denial of service in Intel TDX (Trust Domain Extensions) modules at Ring 0 can be triggered by a system software adversary who already holds kernel-level privileges, causing an uncaught exception that crashes Trust Domain availability. Exploitation is constrained to local access with high attack complexity and specific attack prerequisites, meaning only highly privileged, sophisticated actors in TDX-enabled environments are realistic threat actors. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the impact is limited strictly to availability - no confidentiality or integrity compromise is possible through this vector.
Privilege escalation in Intel's Cluster Management Toolkit for Kubernetes (CMK) before v0.8.5 allows a privileged local adversary to fully compromise the confidentiality, integrity, and availability of the affected system by exploiting a protection mechanism failure (CWE-693) within the Ring 3 user-application boundary. Exploitation requires a pre-established privileged local account, specific attack prerequisites (AT:P), and the occurrence of passive user interaction - a combination that substantially limits the exploitable population but results in complete system-level impact when conditions align. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Denial of service in Intel(R) NPU Driver affects all versions via an improper conditions check (CWE-754) reachable from Ring 3 (user applications). A locally authenticated, low-privileged user can trigger the flaw without any special attack prerequisites or user interaction, resulting in high availability impact to the vulnerable system. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the low complexity of exploitation combined with the growing deployment of NPU-equipped Intel platforms warrants prompt patching.
Privilege escalation in Intel TDX Guest software before version 0.3.1 stems from an incorrect comparison (CWE-697) within Ring 3 user application space, exploitable by a local attacker who already holds high system privileges. Impact is limited - low confidentiality, integrity, and availability degradation on the vulnerable guest system with no subsequent system impact - aligning with the CVSS 4.0 score of 4.6. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Intel has released a fix at version 0.3.1 via advisory INTEL-SA-01462.
Privilege escalation in Intel TDX Guest software before version 0.3.1 stems from an incorrect calculation (CWE-682) within Ring 3 user application code, enabling a local, high-privilege adversary to elevate privileges within a Trust Domain. The CVSS 4.0 vector confirms local access with high privileges required and low C/I/A impact on the vulnerable system, with no subsequent-system (host/hypervisor) impact. No public exploit exists and the vulnerability is absent from CISA KEV, placing real-world risk squarely in multi-tenant confidential computing scenarios where intra-guest privilege containment is a security objective.
Privilege escalation in Intel processor microcode stems from improper handling of overlap between protected memory ranges at the Ring 0 hypervisor privilege level, tracked as CVE-2026-20760 and EUVD-2026-56489. Exploitation requires local, low-privilege access to a system running an affected Intel processor, allowing an authorized adversary to escalate privileges or disrupt hypervisor availability without user interaction. Intel has published advisory INTEL-SA-01441 covering this issue; no active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, though the hypervisor-level attack surface warrants priority treatment in virtualized environments.
Privilege escalation in Intel's LLM Scaler software exposes systems to full compromise of confidentiality, integrity, and availability within the affected host. The flaw stems from a protection mechanism failure (CWE-693) operating in Ring 3 (user-space applications), where an unprivileged software component can leverage a co-present privileged user session to bypass access controls and elevate privileges. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the high impact triad (C:H/I:H/A:H) warrants prompt patching on any system running Intel's LLM Scaler where privileged users operate.
Information disclosure in Intel PROSet/Wireless WiFi Software at Ring 0 (kernel level) exposes sensitive system data to privileged local adversaries who bypass improper authentication controls within the kernel driver. Affected systems include any platform running Intel PROSet/Wireless WiFi Software, with the exact version range deferred to Intel Security Advisory INTEL-SA-01468. No active exploitation has been confirmed (not listed in CISA KEV), no public exploit code has been identified, and the CVSS 4.0 base score of 6.7 reflects the significant mitigation offered by the high-privilege local access prerequisite.
Local privilege escalation and code execution in Intel PROSet/Wireless WiFi Software for Windows arises from an information disclosure flaw (CWE-200) within the Ring 2 device driver layer, exploitable by an unprivileged local user without authentication or user interaction. The vulnerable system itself suffers only low confidentiality impact, but a scope change into the driver subsystem produces high subsequent-system confidentiality impact alongside low integrity and availability impacts - consistent with a privilege escalation chain from user space into driver-controlled memory. No public exploit has been identified at time of analysis and the vulnerability has not been listed in the CISA KEV catalog.
Intel Active Management Technology (Intel AMT) and Intel Standard Manageability firmware contain an improper initialization flaw (CWE-665) that enables confidentiality compromise by a locally privileged system software adversary. The vulnerability arises when firmware fails to properly initialize memory or state, allowing residual data to be read by a subsequent privileged operation under specific attack conditions (AT:P per CVSS 4.0). No CISA KEV listing exists and no public proof-of-concept has been identified; Intel reported this through their own security advisory program (INTEL-SA-01427) and the CVSS 4.0 base score of 5.6 reflects the constrained local, high-privilege exploitation prerequisites.
Improper buffer restrictions in the Intel NPU Driver (Ring 3: User Applications) expose all driver versions to a denial-of-service condition triggerable by a local, low-privileged authenticated user. The CVSS 4.0 vector confirms local-only access (AV:L/PR:L) with high availability impact (VA:H) and a minor integrity side-effect (VI:L), but no confidentiality loss. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, which tempers real-world urgency despite the potentially system-disrupting availability impact.
Privilege escalation in Intel Extension for TensorFlow software before version 2.15.0.3 stems from a protection mechanism failure (CWE-693) operating at Ring 3 - the CPU user-application privilege boundary. A system software adversary holding high privileges can exploit this failure under specific local attack conditions with passive user interaction to achieve full confidentiality, integrity, and availability compromise of the vulnerable system. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Privilege escalation in Intel Xeon processor firmware stems from an always-incorrect control flow implementation (CWE-670) that allows a privileged system software adversary to escalate privileges under high-complexity local attack conditions. Exploitation yields subsequent-system impacts - high confidentiality and high integrity compromise - while leaving the vulnerable system itself unimpacted, consistent with a scope change into a higher-privilege domain such as an OS kernel or hypervisor. No active exploitation is confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Sensitive data insertion into log files in Intel Active Management Technology (AMT) and Intel Standard Manageability exposes confidential information to privileged network adversaries. The flaw is classified under CWE-532 and carries a CVSS 4.0 score of 5.9, with high confidentiality impact but no integrity or availability consequences. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the network-accessible attack vector and high confidentiality impact make patching a priority for organizations relying on Intel vPro out-of-band management infrastructure.
Hardware logic race conditions in 3rd Gen Intel Xeon Scalable Processors expose server environments to local denial of service. The flaw resides within Ring 3 (user-space) processor logic, where a low-privileged authenticated local user can exploit the race condition - provided they possess specialized internal knowledge of processor timing - to crash or destabilize the affected system. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS 4.0 score of 6.8 reflects the high availability impact across both the vulnerable system and any subsequent workloads sharing the hardware.
Insecure sensitive data storage in the Intel Trust Domain Extensions (TDX) module exposes confidential memory to privileged local adversaries on affected Intel platforms. The flaw, classified under CWE-922, allows a Ring-0 system software attacker - such as a compromised or malicious hypervisor or host OS kernel - to read data that should be protected within a Trust Domain, breaking TDX's core confidential computing isolation guarantee. No public exploit has been identified at time of analysis, and exploitation demands high privilege, high complexity, and specific attack prerequisites, materially constraining real-world risk despite the high confidentiality impact rating.
File inclusion in DedeCMS up to 5.7.118 UTF8SP2 allows a remote attacker with low privileges and high-complexity conditions to include arbitrary files via the _4_Setup function within the Installation Wizard (install/index.php). Exploitation results in limited confidentiality, integrity, and availability impact. A proof-of-concept has been publicly disclosed via GitHub, though no active exploitation has been confirmed by CISA KEV. The CVSS 4.0 score of 1.3 reflects the constrained real-world impact and significant attack complexity required.
Behavioral workflow enforcement bypass in WonderTrader up to version 0.9.9 allows remote low-privileged attackers to manipulate the getUndoneQty argument within the _undone_qty function of the Pending Order Handler component (src/WtCore/TraderAdapter.h), resulting in unauthorized integrity modification of pending order state. The CVSS 4.0 vector confirms network-accessible exploitation with low privilege requirements and no user interaction. A publicly available proof-of-concept exploit exists (E:P), though no CISA KEV listing is recorded. The vendor was notified prior to disclosure and did not respond, meaning no official patch or advisory has been released.
Use of an uninitialized variable in WonderTrader up to version 0.9.9 allows a remote low-privileged attacker to cause limited availability disruption by manipulating the m_offsetType argument within the TraderATP Cash Trade Conversion component. The flaw resides in src/Includes/WTSTradeDef.hpp and is exploitable remotely, with a public proof-of-concept available via a Feishu document. No patch has been released and the vendor has not responded to disclosure - exploitation conditions are low complexity once authentication is satisfied, making this a persistent unmitigated risk for deployments using the ATP cash trading interface.
Improper behavioral workflow enforcement in WonderTrader up to version 0.9.9 allows remote attackers to manipulate the FID_JYLB argument in the TraderDD::queryTrades function, causing the application to execute trading query operations in an unintended sequence. Per the CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N), exploitation is network-reachable without authentication but requires high attack complexity, limiting opportunistic abuse. A proof-of-concept exploit is publicly available (E:P), and the vendor did not respond to responsible disclosure, leaving no patch available at time of analysis.
Resource exhaustion in the sol MQTT broker (commit 373d848, 2024-12-12) allows unauthenticated remote attackers to cause a denial of service by flooding the service with malformed or duplicate CONNECT packets. The broker's session teardown logic is incomplete: failed or repeated CONNECT attempts silently drop the connection without releasing internal state, leaving memory and file descriptors allocated indefinitely. With no authentication required and the attack confirmed automatable per SSVC, a sustained flood of crafted CONNECT packets can exhaust system resources and trigger the Linux OOM killer. No public exploit code was formally released as a tool, but a POC is referenced in the linked GitHub advisory; the vulnerability has not been added to the CISA KEV catalog.
File inclusion in TinyAGI 0.0.20 exposes server-side files to remote unauthenticated attackers through the buildSystemPrompt function in packages/server/src/routes/agents.ts. Exploitation requires no privileges or user interaction, and a publicly available proof-of-concept exists via GitHub issue #283. No patch has been released - the vendor has not responded to the responsible disclosure despite being notified through the project's issue tracker.
Missing authorization in TinyAGI 0.0.20's Message API Endpoint allows remote unauthenticated attackers to invoke the processMessage function without any access control enforcement, yielding limited but real confidentiality, integrity, and availability impact. A publicly available proof-of-concept exploit is referenced in GitHub issue #284, and the project maintainer has not responded to the responsible disclosure, leaving no patch available at time of analysis. The combination of unauthenticated network exploitability, live POC, and vendor silence makes this a material risk for any deployment exposing the endpoint to untrusted networks.
File inclusion via unsanitized path input in TinyAGI 0.0.20's Message API Endpoint exposes server-side files to remote unauthenticated attackers. The vulnerable surface is the `collectFiles` function in `packages/core/src/response.ts`, which accepts externally controlled file paths without adequate validation (CWE-73). Publicly available exploit code exists via GitHub issue #282, and the project maintainer had not issued a patch or response at time of disclosure - compounding risk for any internet-exposed deployments.
Server-side request forgery (SSRF) in JeecgBoot's AI RAG chat endpoint (/airag/chat/send) exposes unauthenticated remote attackers a direct path to make the application server issue arbitrary HTTP requests to internal or external network resources. All versions up to and including 3.9.2 are affected, with the flaw residing in the Anonymous Chat Attachment Parser component - meaning no login is required to trigger it. Public exploit code exists via a GitHub issue (no public exploit identified as actively exploited per CISA KEV), and no vendor-released patch is available at time of analysis.
Authentication bypass in the My Safetipin Android application version 5.2.1 stems from hardcoded credentials in the authentication module that produce predictable OTP values, letting remote attackers log in as arbitrary users and take over accounts without legitimate credentials. Any personal-safety data stored in a victim's account - location history, safety pins, and profile details - becomes exposed and modifiable. No public exploit has been identified at time of analysis, and the EPSS score of 0.27% (18th percentile) reflects low observed exploitation activity despite the maximal CVSS rating.
Hardcoded RTSP credentials in Zosi C519M IP camera firmware V4.2.8.823C01450BA expose live video feeds to any network-reachable attacker. The built-in credentials embedded in the RTSP authentication mechanism cannot be changed by the device owner, making every affected unit permanently vulnerable to unauthorized stream access. A public proof-of-concept exists on GitHub, and CISA's SSVC framework rates the attack as automatable with no exploitation preconditions beyond network reachability - no public exploit identified as actively exploited in CISA KEV at time of analysis.
Unauthorized access to other users' personal data in SirenGPS Android Application 2.19.44 stems from the backend API failing to verify that a requesting user is authorized to act on the target user identifier supplied in API parameters. An authenticated attacker exploiting this horizontal privilege escalation can read and overwrite arbitrary users' personal information with only low-privilege access. No public exploit identified at time of analysis and EPSS is extremely low (0.15%, 5th percentile), but a detailed researcher advisory is publicly available on GitHub, lowering the bar for replication.
Cross-site request forgery in RackTables through version 0.22.0 enables remote attackers to perform unauthorized state-changing actions against authenticated users' sessions by enticing them to visit attacker-controlled pages. The project maintainer has publicly confirmed the complete absence of any CSRF protection across the entire codebase and has explicitly declined to commit to a timely fix, making this a persistent, unfixed exposure. A public POC exists on GitHub; however, no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects the limited integrity-only impact and mandatory user interaction requirement.
Reflected XSS in O2OA v10's Forum posting function allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by convincing them to click a crafted URL. The Changed scope (S:C) in the CVSS vector confirms the exploit breaks out of the application's origin into the broader browser context, enabling session token theft or unauthorized actions on behalf of the victim. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.22% (12th percentile) alongside SSVC 'Exploitation: none' indicate low real-world exploitation activity at time of analysis.