Red Hat
Monthly
Spoofing and identity impersonation in Microsoft Active Directory Federation Services (AD FS) let an unauthenticated network attacker get forged or intercepted certificates accepted as trusted, undermining the integrity of federated authentication. Affected deployments are AD FS running on Windows Server 2012 R2 through Windows Server 2025, along with the underlying .NET Framework certificate-validation components (3.5, 4.6.2 through 4.8.1) and System.Security.Cryptography.Xml, plus Visual Studio 2022 17.14 and Visual Studio 2026 18.10. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (7.4), meaning no credentials or user interaction are needed but the attacker must first obtain a privileged network/intercept position or craft a certificate that slips past validation; impact is limited to confidentiality and integrity, with no availability effect. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue, but a vendor patch is available and should be applied promptly given the authentication-bypass potential in default, network-exposed AD FS deployments.
Request smuggling in the ASP.NET Core Kestrel HTTP/1 server lets a remote, unauthenticated attacker desynchronize HTTP request parsing and tamper with how requests are interpreted by the server and any shared front-end proxy, load balancer, or connection pool. The flaw is triggered when a Kestrel HTTP/1 connection carrying unread request-body bytes is aborted and Kestrel reparses that leftover data as a new request; the vendor rates it Critical at CVSS 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), while the independent assessment applies the same impact but rates attack complexity as High because the abort/timing prerequisite must be met, and the practical blast radius is greatest where connections are reused across tenants. Affected runtimes are ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2, plus Microsoft Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4; a vendor patch is available and there is no public exploit identified at time of analysis.
Remote code execution affects Windows desktop applications built on the Microsoft.WindowsDesktop.App.Runtime (WPF) component of .NET, specifically runtimes 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1, as well as Visual Studio 2022 17.14 and Visual Studio 2026 18.10 installations that carry the vulnerable runtime. An unauthenticated attacker can deliver crafted content that, when a victim interacts with an XPS document whose synthetic hyperlinks are exposed through UI Automation, bypasses the application's restrictive navigation checks and reaches attacker-controlled content, leading to code execution in the context of the running application; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) confirms high confidentiality, integrity, and availability impact but explicitly requires user interaction. Vendor patches are available (runtime fixes 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2), and no public exploit code was identified at time of analysis despite the network-reachable attack path.
Plugin installation in Claude Code and Claude Desktop before 2.1.179 can install attacker-controlled code: the installer pins a plugin to a 40-character commit SHA from a marketplace but then runs git checkout on that string without confirming that the resulting HEAD actually equals the pinned SHA, so an attacker who controls the plugin repository on a Git host that allows branch names shaped like a 40-hex SHA can create a branch named after the 'reviewed' commit and have its tip checked out instead. Exploitation is unauthenticated from the attacker's side (CVSS 4.0 vector PR:N) but requires considerable user interaction - the victim must choose to install the malicious plugin and deliberately pin it to the ostensibly safe hash - which is why our independent assessment rates it a HIGH-impact, LOW-likelihood issue that is a moderate, conditional priority rather than an emergency. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and there is no KEV listing.
Memory corruption in Microsoft's WPF desktop stack (Microsoft.WindowsDesktop.App.Runtime, shared by .NET and .NET Framework) allows an unauthenticated, network-positioned attacker to cause an out-of-bounds write by delivering an XPS document whose glyph coordinates overflow pointer arithmetic in CD3DGlyphBank::RectFillAlpha. Exploitation requires user interaction - the victim must open or render the malicious XPS file in an affected WPF application - and prerequisites are otherwise limited to the Windows platform and to applications that actually process untrusted XPS/glyph content, so server services that never render such documents are not exposed. CVSS 3.1 scores it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with high confidentiality, integrity and availability impact; note that signals conflict and should be weighed carefully, since the CVE description frames the outcome as privilege elevation while the vendor advisory frames it as remote code execution with process termination. No public exploit code and no confirmed active exploitation have been identified at time of analysis (SSVC exploitation: none), and vendor patches are available across .NET 8/9/10/11 RC, .NET Framework 3.5 and 4.x, and Visual Studio.
Remote code execution in .NET WPF (Microsoft.WindowsDesktop.App.Runtime) allows an unauthenticated attacker to execute code on a victim's Windows system by crafting a malicious XAML/XPS document or serialized payload and convincing the user to open or load it. The vulnerability is a CWE-502 deserialization of untrusted data issue rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); exploitation requires user interaction and is not automatable (SSVC Automatable=no, Exploitation=none). No public exploit code or active exploitation has been identified at time of analysis, though vendor patches are available for all affected .NET and .NET Framework versions.
Memory corruption in Microsoft .NET's System.Net.Sockets component allows an unauthorized attacker to execute code over a network on Windows hosts, but only against applications that reuse a single SocketAsyncEventArgs instance across both IPv4 and IPv6 UDP datagram sockets. The flaw (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) manifests as an out-of-bounds write in the ReceiveFromAsync path once an undersized cached native address buffer is retained; no authentication or user interaction is required, though the high attack complexity reflects the non-default coding pattern required to reach the vulnerable state. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as none and non-automatable, and no KEV listing applies; Microsoft has shipped fixed runtime builds, making this a meaningful but non-emergency patching priority.
Improper link resolution before file access in Microsoft .NET (CWE-59, 'link following') allows an authorized local attacker to elevate privileges, rated CVSS 7.3 with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. Affected components include .NET 9.0 before 9.0.319/9.0.122, .NET 10.0 before 10.0.113, .NET 11.0 before 11.0.100-rc.2, Visual Studio 2022 version 17.14 before 17.14.42, and Visual Studio 2026 version 18.10 before 18.10.4. Exploitation requires a pre-existing low-privileged local account, the ability to plant symbolic links or junctions, and required user/process interaction to trigger a privileged file operation, so the SSVC decision is Exploitation: none, Automatable: no, Technical Impact: total; no public exploit identified at time of analysis, and the EPSS/KEV signals in the provided data give no indication of active exploitation.
HTTP request smuggling in ASP.NET Core's Kestrel web server allows unauthenticated remote attackers to desynchronize request parsing and bypass security features by having Kestrel accept newline characters in HTTP/2 request trailers and in values drawn from the dynamic HPACK table rather than rejecting them as malformed. All supported ASP.NET Core release trains are exposed - 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2 - along with bundled Visual Studio 2022 17.14 (<17.14.42) and Visual Studio 2026 18.10 (<18.10.4); realistic impact is highest where a proxy, load balancer, or chained server sits in front of Kestrel and performs its own HTTP/2 parsing. The flaw carries a critical CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is rated with total technical impact under CISA SSVC, but exploitation has not been observed (SSVC Exploitation: none) and no public exploit code has been identified at time of analysis.
Denial of service in ASP.NET Core's Kestrel web server allows an unauthenticated remote attacker to deadlock connection handling by sending crafted HTTP/3 reset or abort sequences, causing excessive blocked-thread creation and eventual server resource exhaustion. The flaw affects applications built on Microsoft.AspNetCore.App.Runtime 8.0.x before 8.0.32, 9.0.x before 9.0.21, and 10.0.x before 10.0.13 on Windows, Linux, and macOS, but only when Kestrel is running with HTTP/3 support enabled - servers limited to HTTP/1.1 or HTTP/2 are not exposed. Publicly available exploit code exists (a public gist demonstrates the issue), and the CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), an availability-only impact with no confidentiality or integrity loss; there is no confirmed active exploitation at time of analysis.
Privilege escalation and security-feature bypass in Microsoft ASP.NET Core's Blazor authorization stack lets an authenticated remote user defeat an application's [Authorize] decision and reach content or operations their role should not permit. The flaw is a race condition in the Microsoft.AspNetCore.Components.Authorization AuthorizeRouteView component, where a stale asynchronous authorization result can be applied after a navigation or an authorization-state change, so the current authorization decision is silently overwritten by an earlier one. Only Blazor applications that use AuthorizeRouteView for route-level authorization are in scope; ASP.NET Core deployments that do not use Blazor component-level authorization are unaffected. Exploitation is non-deterministic (CVSS AC:H) and requires the attacker to already hold a valid authenticated session (PR:L), and publicly available exploit code exists as a published proof-of-concept gist, but CISA SSVC rates exploitation as none and the issue is not automatable. Vendor patches are available across all supported ASP.NET Core release trains.
Denial of service in ASP.NET Core 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaust server memory by sending crafted multipart requests that trigger unbounded buffer allocation in Microsoft.AspNetCore.WebUtilities.FileBufferingReadStream, ultimately degrading or halting the application (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). Affected deployments are those running unpatched runtimes (8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13) and the bundled Visual Studio toolchains, specifically applications that expose endpoints consuming buffered or multipart/form-data request bodies; no authentication or special non-default configuration is required beyond such a route existing. Microsoft has published patched runtime packages, and no public exploit code has been identified at time of analysis - CISA SSVC records exploitation as 'none' and the issue is not listed in KEV, though the attack is rated automatable, making rapid patching advisable for internet-facing upload endpoints.
Authentication bypass by spoofing in the Microsoft.AspNetCore.Authentication.Negotiate package for ASP.NET Core lets an authenticated remote attacker (PR:L) have their Kerberos-authenticated identity associated with an unintended LDAP principal, yielding high confidentiality, integrity, and availability impact (CVSS 7.5) after the attacker reaches the application over the network. Exposure is conditional: the application must use an affected package version - 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, or 10.0.0 through 10.0.12 - and must have LDAP claim resolution enabled, an opt-in and non-default configuration, on Windows, Linux, or macOS. CISA's SSVC assessment records no exploitation, and no public exploit code was identified at time of analysis; the AC:H metric reflects that a specific spoofing/timing condition outside the attacker's full control must be satisfied, making this a genuine but conditional privilege-escalation issue rather than a mass-exploitation emergency.
Account takeover is possible in applications built on ASP.NET Core Identity because the framework's password-reset and email-confirmation flows can dispatch mail to the unvalidated address supplied in the incoming request rather than the user's stored canonical address, allowing a remote unauthenticated attacker who can influence that request address to intercept recovery tokens and reset victim credentials. The issue affects Microsoft.AspNetCore.Identity and Microsoft.AspNetCore.Identity.UI deployments running on ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, and 10.0 before 10.0.13, as well as certain Visual Studio 2022 and Visual Studio 2026 builds that bundle the affected runtime; it carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) under CWE-640. No public exploit code was identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this should be treated as a high-priority patching item rather than an active-exploitation emergency.
Path traversal in .NET (CWE-22) allows an authenticated local attacker to escape an intended restricted directory and elevate privileges on the host, with the same flaw reaching users through the Visual Studio 2022 17.14 and Visual Studio 2026 18.10 toolchains. Successful exploitation requires a local, already-authenticated foothold (PR:L) plus user interaction (UI:R), meaning a higher-privileged user or process must be induced to act on an attacker-influenced pathname; it is therefore not remotely triggerable, and CISA's SSVC assessment records Exploitation: none, Automatable: no, with total technical impact if it does succeed. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this rates as a moderate-priority local privilege-escalation issue rather than an urgent, widely exploitable threat. Vendor patches are available.
Denial of service in ASP.NET Core SignalR affects applications that have stateful reconnect enabled and that reference vulnerable versions of Microsoft.AspNetCore.SignalR.Common (8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.5 through 11.0.0-rc.1) or Microsoft.AspNetCore.SignalR.Core (1.0.0 through 1.2.13). An unauthenticated remote attacker can repeatedly trigger stateful reconnect handling so that MessageBuffer.ResendAsync backpressure blocks broadcasts indefinitely while retaining associated server resources, degrading or halting hub messaging for all connected clients; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms a pure availability impact with no confidentiality or integrity loss. CISA's SSVC evaluation rates exploitation as 'none' with automatable attack steps and partial technical impact, and no public exploit code has been identified at time of analysis - patch status is vendor-released, with fixed package versions published by Microsoft, so remediation is straightforward but the exposure is limited to non-default stateful-reconnect configurations.
Remote code execution in Microsoft's Windows Presentation Foundation (WPF) component of .NET allows an unauthenticated remote attacker to run arbitrary code on a Windows host, but only when a WPF-based application loads or renders attacker-supplied XAML or XPS content and the victim opens or processes that malicious document (CVSS PR:N/UI:R). The vulnerable component is Microsoft.WindowsDesktop.App.Runtime, affecting .NET 8.0 (<8.0.32), 9.0 (<9.0.21), 10.0 (<10.0.13), 11.0 (<11.0.0-rc.2), .NET Framework 3.5/4.6.2-4.8.1, Visual Studio 2022 17.14 (<17.14.42) and Visual Studio 2026 18.10 (<18.10.4) on Windows only. Publicly available exploit code exists (a public gist is referenced), though CISA SSVC records Exploitation as none and CISA KEV does not list this CVE; CISA's SSVC decision also rates the issue as not automatable, so mass opportunistic scanning is unlikely and practical risk concentrates on environments whose WPF applications consume untrusted markup. Signals are moderately strong but not uniformly alarming: high technical impact (total via SSVC) is tempered by the required user interaction and the absence of a server-side, zero-click remote path in default configurations.
Denial of service in Microsoft .NET lets an unauthenticated remote attacker force the runtime into disproportionately expensive computation, driving CPU or memory consumption high enough to degrade or halt a service. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms remote, low-complexity, unauthenticated exploitation with no user interaction and a high availability-only impact, requiring only that the vulnerable .NET code path be reachable by attacker-supplied network input - no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. Exposure is limited to reachable, .NET-based services; internal-only or non-.NET-facing deployments are not affected, and the exact affected runtime versions must be confirmed against the MSRC advisory.
Denial of service in Microsoft .NET and .NET Framework stems from uncontrolled recursion (CWE-674) in the System.Security.Cryptography.Xml and System.Private.Xml libraries, which an unauthenticated remote attacker can trigger by supplying crafted signed or encrypted XML that the target application parses. Affected runtimes include .NET 8.0 before 8.0.32, .NET 9.0 before 9.0.21, .NET 10.0 before 10.0.13, .NET 11.0 before 11.0.0-rc.2, and multiple .NET Framework builds (3.5 through 4.8.1) shipped on Windows, Linux and macOS, plus Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4. Impact is limited to availability (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 7.5) - process crash or hang, with no data exposure or code execution; CISA's SSVC assessment rates exploitation as 'none' meaning no public exploit identified at time of analysis, and exploitation is only practical against services that actually invoke XML signature or encryption validation on untrusted input.
Kubeflow Model Registry through 0.3.17 allows an authenticated namespace user with permission to create InferenceService resources to steal the InferenceService controller's ServiceAccount bearer token. The attacker creates an InferenceService with the modelregistry.kubeflow.org/url annotation pointing to an attacker-controlled server; the controller follows the annotation and attaches its token, which the attacker captures and then uses to modify other tenants' InferenceServices cluster-wide. This is a server-side request forgery (CWE-918) requiring low privileges (PR:L) and no user interaction; no public exploit code was identified at time of analysis, and no CISA KEV entry exists.
Remote code execution in ASP.NET Core via a code-injection flaw (CWE-94) allows an unauthenticated, network-based attacker to execute arbitrary code when a victim user interacts with crafted content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation requires an ASP.NET Core application that routes attacker-controlled input through a dynamic code-generation or evaluation path; the user interaction requirement (UI:R) is a significant limiting factor, preventing fully autonomous or wormable exploitation. No public exploit code was identified at the time of analysis, and the specific framework API or configuration exposing the injectable path is not described in the available data and should be confirmed against the Microsoft MSRC advisory.
Path traversal in NLTK's WekaClassifier integration (all versions through 3.10.3) lets attackers who control the model_filename or model argument escape nltk.pathsec containment and drive the Weka JVM to write files outside permitted data roots via the -d option, or probe for file existence via -l. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), but exploitation requires an application that wires attacker-controllable values into WekaClassifier and has a working Weka Java/JVM toolchain installed - a non-default, niche integration that most NLTK deployments never invoke. Under those preconditions, the CVSS 4.0 base score of 8.3 is driven by a network vector with high integrity impact (VI:H), while the AT:P metric reflects the required application-wiring precondition.
Denial of service in GNOME Remote Desktop (gnome-remote-desktop) as shipped in Red Hat Enterprise Linux 8, 9, and 10 allows an unauthenticated remote attacker to pin the daemon's event-loop thread at high CPU by sending traffic to a TLS-enabled VNC listener, causing the service to stop making forward progress. The defect is in the VNC TLS I/O handlers, which treat retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) with an unbounded busy loop instead of returning control to the event loop, so the thread spins indefinitely rather than waiting for socket readiness. No public exploit code exists and there is no confirmed active exploitation, and practical exposure is bounded: the VNC backend must be running with a TLS listener reachable over the network, a configuration that is not enabled by default on typical RHEL installs and is far more common on desktops than on servers.
Out-of-bounds access in libwebsockets' LEJP incremental JSON parser allows unauthenticated remote attackers to crash the process via crafted JSON that exceeds the parser's fixed-size path index or stack arrays. Affected are applications that call lejp_parse on untrusted input; publicly available exploit code exists, though exploitation is deployment-dependent and impact is limited to denial of service (no code execution or data disclosure). The root cause is an off-by-one error in lib/misc/lejp.c, where boundary checks are performed after incrementing the index.
Memory exhaustion in modern-tar versions 0.3.5 through 0.8.5 lets remote, unauthenticated attackers crash or stall any process that unpacks an attacker-supplied tar archive, because a size field containing a non-octal byte (such as '/', '8', '9' or ':') is parsed by readOctal() into a negative entry size that the unpacker then buffers against indefinitely - the malicious archive may also be gzip-compressed. The impact is availability only (CVSS 4.0 8.7, assessed CVSS 3.1 8.1 with VC:N/VI:N/VA:H): no code execution or data disclosure is demonstrated, and the upstream 'Information Disclosure' tag is not supported by either vector. No public exploit code and no CISA KEV entry were identified at time of analysis; the practical limiting factor is exposure and configuration, since deployments that enable the library's strict parsing mode, or that only unpack trusted archives, throw on the malformed header instead of buffering and are not realistically exploitable.
Privilege escalation in containerd's CRI checkpoint-restore path allows an authenticated local attacker who can submit an attacker-controlled checkpoint archive via CRI CreateContainer to have the restored process run with restored credentials (including root), full capabilities, and restored no_new_privs and seccomp state, while CRI status continues to report the requested ContainerConfig. The flaw affects containerd 2.1.0 through 2.2.6 and 2.3.0 through 2.3.3, and only where CRI checkpoint restore via CreateContainer is actually used; systems that never use this experimental feature are not affected. Rated CVSS 7.8 (High) with a local, low-complexity, authenticated (PR:L) vector, and no public exploit identified at time of analysis. Fixed in 2.2.7 and 2.3.4, where the restore-via-CreateContainer behavior is additionally disabled by default.
openstack-network-exporter can be made to silently skip basic authentication when an operator enables user authentication but forgets or misconfigures TLS, letting an adjacent-network attacker pull OVS/OVN dataplane metrics without credentials. Only deployments in that specific non-default, inconsistent configuration are exposed; correct TLS deployments and deployments without authentication enabled are unaffected. The published CVSS is 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), but our assessment narrows this to AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - adjacency-limited, read-only information disclosure, with no integrity or availability impact and no public exploit identified at time of analysis.
Unauthenticated attackers can bypass security controls on REST endpoints generated by Quarkus REST Data Panache when a developer uses @MethodProperties to customize an operation without re-declaring class-level security roles, causing the generator to silently drop the security requirement and expose the endpoint. This results in potential unauthorized information disclosure or data modification, with a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and CWE-425. No public exploit code has been identified at the time of analysis.
Denial of service in the Gitoxide gix-pack crate before 0.75.0 allows a remote attacker operating a malicious Git remote to crash a victim's clone or fetch operation by advertising an absurd pack-header object count, forcing the client to reserve hundreds of gigabytes of memory. Exploitation requires the victim to initiate the clone or fetch against the untrusted remote (user interaction), and no authentication is required of the attacker; the flaw sits in the default pack-header parsing path, so unmodified configurations are affected. The impact is limited to killing the client process with no code execution or data exposure, and no public exploit code was identified at time of analysis.
A denial-of-service condition in the Rust gitoxide `gix-pack` crate (all versions before 0.75.0) lets a malicious or compromised remote abort a client's fetch or clone by serving a malformed thin pack. The crafted pack combines a REF_DELTA that points at an already-known object with a following OFS_DELTA whose base_distance exceeds the current pack_offset, which drives the LookupRefDeltaObjectsIter into an arithmetic boundary it cannot satisfy and causes a panic that terminates the fetch process. The attack is unauthenticated from the attacker's side (PR:N) but requires user interaction (UI:P/UI:R): the victim must voluntarily fetch from or clone the attacker's repository, so it cannot be triggered against a passive listener. Impact is limited to availability of the fetch operation - no code execution, data disclosure, or integrity impact - and no public exploit code has been identified at time of analysis.
Denial of service in gitoxide gix-pack before 0.75.0 allows a malicious remote to panic and abort a client's git clone or fetch by responding with a crafted 12-byte pack header declaring version 3, which trips a release-enabled assert_eq! in BytesToEntriesIter::new_from_header that expects version 2. The attack requires the victim to initiate the fetch from an attacker-controlled or compromised remote (UI:R), but no authentication is needed (PR:N); automated CI, dependency resolution, or mirror synchronization that pulls from untrusted sources is the primary exposure. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 4.0 score is 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H per independent assessment).
A malicious RDP client can crash a FreeRDP-based RDP server running versions before 3.32.0 by negotiating the NSCodec and requesting an oversized desktop geometry, which forces a buffer-growth allocation failure inside nsc_context_initialize_encode() and leaves dangling plane pointers that are later double-freed during context teardown. The impact is availability-only - no code execution, data exposure, or persistence - and the attack is unauthenticated (CVSS PR:N), but success depends on actually inducing the allocation failure, so the trigger is not perfectly deterministic and the vulnerable server-mode deployment is less common than FreeRDP's client-side use. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a moderate-priority crash issue rather than the more alarming 8.2 CVSS 4.0 base score suggests.
Heap buffer overflow in FreeRDP 3.0.0 through 3.31.x allows an attacker who controls a physical smartcard token to corrupt heap memory during PKCS#11 smartcard logon, potentially achieving code execution with the privileges of the FreeRDP client. The flaw is in collect_keys(), which enumerates public key objects across PKCS#11 slots into a fixed 64-entry array without bounds checking; a token exposing more than 64 keys with attacker-controlled CKA_ID and CKA_LABEL values overflows the array. Exploitation requires PKCS#11 smartcard authentication to be configured, physical presentation of the malicious token, and user-initiated logon, and no public exploit code or active exploitation is known at time of analysis; this is a constrained, physically proximate issue rather than a mass-exploitation priority.
FreeRDP 3.0.0 through 3.31.x allows an on-path attacker to capture OAuth authorization codes and substitute the OpenID discovery document during Azure AD authentication because freerdp_http_request() completes TLS handshakes without validating the server certificate chain. Exploitation requires the victim to use the Azure AD/AAD-brokered RDP path (plain RDP is unaffected) and to actively perform the login while the attacker holds a man-in-the-middle network position, making this a conditional risk rather than a broadly exploitable flaw. No public exploit code has been identified at time of analysis, and the issue is patched in FreeRDP 3.32.0.
FreeRDP clients before 3.0.0 and in the 3.6.0-before-3.32.0 range can be coerced by a malicious RDP server into painting uninitialized heap memory onscreen or into aborting the client process via crafted WBT_TILE_FIRST and WBT_TILE_UPGRADE progressive codec messages. This client-side uninitialized heap read (CWE-908) occurs because the tile->current buffer is allocated without zeroing, and exploitation requires the victim to connect to an attacker-controlled or man-in-the-middle RDP server while the session negotiates the RemoteFX/progressive codec. No public exploit identified at time of analysis, and confirmed active exploitation has not been reported; the CVSS 4.0 score is 7.1 (High), driven primarily by availability impact (client abort) with a low, opportunistic confidentiality impact.
Path traversal in the Hex package manager for the Elixir/Erlang (Mix) ecosystem, versions 0.6.0 through 2.5.1, lets a malicious package publisher delete a directory outside the project's deps/ folder and write the package's files into that location when a developer runs mix deps.get or mix deps.update. The attacker abuses a dependency's OTP application label, which Hex copies from the signed registry without validation and Mix joins onto deps/ as the checkout path, so a crafted label such as '../../target' escapes the project tree through File.rm_rf!/1 before any dependency code is compiled. Exploitation requires the victim project to depend directly or transitively on the attacker-controlled release and the developer to explicitly fetch dependencies, so no victim-side authentication is needed (PR:N) but user interaction is required; no public exploit identified at time of analysis, and the vendor rates it CVSS 7.5.
Use-after-free in GNOME Mutter's Wayland color-management (wp_image_description_v1) path allows a local, authenticated attacker who can run a malicious Wayland client to destroy the image-description resource while an asynchronous ICC file read is still in flight, after which the compositor writes into freed memory and frees a pointer derived from it - typically crashing the GNOME session and potentially enabling code execution inside the compositor process. The flaw is local-only and timing-dependent (it requires winning a race window), only applies to Wayland sessions where the color-management/ICC path is exposed (not X11-only sessions or builds without that code path), and no public exploit code or CISA KEV entry has been identified at time of analysis; in practice the more likely outcome is a session crash rather than reliable code execution. This is a credible local privilege/code-execution risk but not an urgent internet-facing emergency.
Remote code execution in ManageIQ (and its downstream Red Hat CloudForms) is possible because the YamlLoadAliases module overrides YAML.safe_load so that in production a Psych::DisallowedClass error silently falls back to YAML.unsafe_load, deserializing arbitrary Ruby objects. An authenticated attacker holding dialog import privileges (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) can upload a crafted YAML dialog payload containing a disallowed class to trigger an unsafe deserialization path with full confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but Red Hat CloudForms has reached End of Life and no errata will be issued, so CloudForms operators cannot patch and must depend on restricting the dialog import role.
OS command injection in GNU Emacs's TRAMP remote-file library (Emacs releases before 31.2, TRAMP through 2.8.2) lets an attacker who can get a crafted filename in front of a user execute arbitrary shell commands with that user's privileges, because tramp-user-regexp relies on an incomplete denylist of dangerous shell characters. This is a follow-on defect to CVE-2026-79992, whose fix did not cover all dangerous inputs. Exploitation is local, requires user interaction (the victim must open, complete, or otherwise have Emacs/TRAMP evaluate the malicious path), and only affects installations that use TRAMP remote-file functionality; no public exploit code and no confirmed active exploitation were identified at time of analysis.
ImageMagick on Windows (versions through 7.1.2-33 and the legacy 6.x line through 6.9.13-58) can be induced to execute an attacker-supplied gswin64c.exe when it converts a PDF, PostScript, or EPS file while Ghostscript is left unregistered. The flaw is an uncontrolled search path (CWE-427) in NTGhostscriptEXE(): instead of resolving the Ghostscript binary through the registry, ImageMagick falls back to launching 'gswin64c.exe' by bare filename, so a malicious binary dropped in ImageMagick's current working directory is executed with ImageMagick's privileges. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and exploitation is conditional: it requires a Windows host with unregistered Ghostscript, attacker write access to the working directory, and a victim-triggered conversion - making this a genuine but situational, non-urgent issue rather than a mass-exploitation priority.
Privilege escalation in MariaDB Server affects releases from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, where the view FRM parser fails to safely encode embedded newline characters in an account name. An authenticated attacker who already holds both CREATE USER and CREATE VIEW WITH GRANT OPTION (CVSS vector PR:H, so not an anonymous path) can create a username containing forged view metadata and then create a view, causing the parser to read part of the username as security fields such as definer_host and suid and thereby escalates database privileges. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the 7.2 High base score reflects a conditional, insider-style privilege-boundary bypass rather than a remote unauthenticated attack, and environments that restrict these administrative grants to trusted administrators have substantially reduced exposure.
Out-of-bounds reads and writes in MariaDB Server's binary FRM (table-definition) parser allow an attacker who can drop a crafted .frm file into the server's data directory and then cause that table to be opened to crash mysqld or potentially execute code in the server process. Affected releases are MariaDB Server from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The published CVSS of 8.0 is driven by high confidentiality, integrity and availability impact once the parser is reached, but the independent assessment rates the practical path as local (AV:L/AC:L) with high privileges required (PR:H), since file placement in the data directory is a host/local operation rather than a remote unauthenticated one; no public exploit identified at time of analysis.
Privilege escalation in MariaDB Server (10.6.1 up to 10.6.28, 10.11.x before 10.11.19, 11.4.x before 11.4.13, 11.8.x before 11.8.9, 12.3.x before 12.3.3, and 13.0.x before 13.0.2) allows an authenticated database user holding the FILE privilege to plant a /run/mysqld/wsrep-new-cluster file when secure-file-priv permits writes into that runtime directory, which the packaged mariadb.service systemd unit subsequently consumes as an EnvironmentFile. On the next administrator-triggered restart of mariadb.service, attacker-controlled environment values are injected into the mariadbd process, escalating from the database user context onto the host/systemd layer (scope change) with full confidentiality, integrity, and availability impact. The vendor rates this 8.4 while our independent assessment uses CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H, reflecting that exploitation requires a high, non-default privilege and a restart gate; no public exploit code has been identified at time of analysis, and patched releases are already available.
An out-of-bounds stack write in the MariaDB CONNECT storage engine's DOS table type lets an authenticated user crash the server and potentially achieve code execution by supplying a crafted column definition and value. The flaw is an incorrect boundary check in the CONNECT value conversion routine that permits a one-byte null write past a stack buffer at an attacker-controlled offset (CWE-787), and it affects MariaDB from 10.6.1 up to the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. Exploitation requires the non-default CONNECT engine to be installed and enabled plus privileges to create CONNECT tables of table_type 'dos' with a crafted numeric definition such as double(255,30); the vendor rates it CVSS 8.5 while the independent assessment is slightly lower (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because authentication, a non-default engine, and high attack complexity are needed, and no public exploit code was identified at time of analysis.
RPM-based MariaDB Server packages up to the fixed releases can create the mysql service account with the database data directory as its home, allowing a database user that holds the FILE privilege to write shell startup files such as .bash_profile there. Those files only execute if an administrator later opens an interactive login shell as the mysql account, overriding its usual /sbin/nologin shell, so real-world exploitation requires both a highly privileged database account and a non-default administrator action. No public exploit has been identified at the time of analysis, Debian/Ubuntu packages are not affected because they already use /nonexistent as the account home, and the CVSS base score of 8.4 overstates the realistic likelihood given the required preconditions.
Denial of service in Google Guava 4.0 through 33.7.1 can be triggered by remote unauthenticated attackers who can supply crafted Java serialization streams containing CompactHashMap, CompactHashSet, or MapMakerInternalMap objects, causing Guava to allocate an attacker-controlled backing array without throttling and exhaust memory with OutOfMemoryError. This is a genuine but conditional availability-only risk: exploitation requires the target application to perform Java native deserialization (ObjectInputStream.readObject) on attacker-influenced input, and any authentication or authorization in front of the deserializing endpoint further limits reach; no code execution or data disclosure results. A vendor fix is available in Guava 33.7.2, and no public exploit identified at time of analysis.
Code execution inside the gVisor sentry process is achievable by a local attacker holding standard container privileges on any platform running a gVisor build prior to release 20260831.0, due to a use-after-free/double-free of the MemoryFile backing an in-sandbox overlay filesystem in the virtual filesystem (VFS) mount layer. The issue is local-only and requires authenticated in-sandbox access (CVSS 4.0 vector AV:L/PR:L), and the resulting code execution lands in the sentry, which remains confined by host-level Linux seccomp and namespace boundaries rather than directly in the host kernel, so a single exploitation does not automatically yield host-kernel compromise or cross-tenant escape. No public exploit code was identified at time of analysis, but the trigger path is documented in the upstream fix's regression tests.
Unbounded memory allocation in Xerial snappy-java before 1.1.10.9 lets unauthenticated remote attackers exhaust the JVM heap by declaring an oversized uncompressed length in a compressed stream header, triggering OutOfMemoryError and denial of service. Any application that passes externally supplied bytes to Snappy.uncompress, Snappy.uncompressString, SnappyInputStream or SnappyFramedInputStream - for example Kafka, Hadoop/Spark or other services using snappy-java transitively - is in scope, and a handful of crafted bytes can force allocations of up to 2 GB before decompression validates the data. Impact is limited to availability (CVSS:4.0 base 8.7; assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no data disclosure or modification, and no public exploit was identified at time of analysis; the practical constraint is reachability, since applications that only decompress trusted internal data are not meaningfully exposed.
Apache CXF versions prior to 4.2.4, 4.1.9, and 3.6.13 allow remote, unauthenticated attackers to cause a denial of service by submitting a very large XML document that exhausts memory and CPU during parsing. The flaw lies in StaxUtils, which by default imposes no limit on the total number of elements or characters, and is most impactful when CXF builds a DOM from the input, such as in SAAJ or WS-Security processing. No public exploit code has been identified, and deployments that enforce a request size limit are largely protected.
Unbounded memory allocation in Apache CXF's multipart/MTOM attachment part-header parser lets a remote, unauthenticated attacker exhaust server memory and cause a denial of service by sending a single crafted multipart request. The parser applies attachment-max-header-size (default 300 characters) only per physical line and enforces attachment-headers-max-count (default 500) against distinct header names rather than total header lines, so folded continuation lines or a repeated header name slip past both limits and inflate the parsed value without bound. Affected are CXF 4.2.0 through 4.2.3, 4.0.0 through 4.1.8, and all releases before 3.6.13 that expose a multipart/MTOM-accepting endpoint; fixed releases are 4.2.4, 4.1.9 and 3.6.13. Exploitation requires no authentication (CVSS PR:N/UI:N) and no non-default configuration, but it is limited to availability impact only; EPSS is low at 0.24% (14th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis.
Keystream reuse in the native one-shot CTR packet cipher of Bouncy Castle for Java LTS before 2.73.13 allows remote attackers to recover plaintext from ciphertext alone, without knowledge of the key. Exploitation is unauthenticated but conditional: the application must use the native one-shot CTR path with a 13-, 14-, or 15-byte IV, leaving only a 1-, 2-, or 3-byte block counter (256, 65,536, or 16,777,216 blocks), and must pass a single input longer than that counter space so the counter wraps and the keystream restarts within the packet. The call returns the full input length with no exception, so the caller receives no signal that some bytes were transformed under a repeated keystream; the resulting two-time-pad condition permits plaintext recovery. No public exploit code has been identified at time of analysis, and the non-default short-IV native deployment requirement keeps realistic exposure narrow, which is why this is assessed as AC:H rather than trivially exploitable.
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman Desktop, Red Hat OpenShift/CRC tooling and related Red Hat products), lets an attacker who can reach the /services/forwarder/expose control endpoint supply an arbitrary socket path that is passed unsanitised to os.Remove, resulting in deletion of arbitrary files on the host. The defect is reachable without credentials (PR:N) but requires adjacent/guest-side network access to the forwarder API (AV:A), which is normally bound to the virtual network rather than exposed as a routed internet service; impact is limited to integrity and availability (no data disclosure). No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); an upstream fix exists in gvisor-tap-vsock PR #718. The vendor score of 9.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) reflects low-complexity, unauthenticated access combined with a scope change and High integrity/availability impact, and the actual risk depends heavily on whether the forwarder control API is reachable by an untrusted guest or adjacent host.
Memory-exhaustion denial of service in the elixir-protobuf library (protobuf) from 0.8.0 onward allows an unauthenticated remote attacker to crash an Elixir decoding process by supplying a deeply nested JSON document through Protobuf.JSON.decode/3, decode!/3, or from_decoded/3 when the target schema contains a self-referential or cyclic message type. Because the embedded-message clause of decode_singular/3 recurses once per nesting level without touching the decoder's depth counter, the recursion_limit option offers no protection and each level consumes a stack frame plus heap objects until the process runs out of memory; confidentiality and integrity are unaffected, only availability. Exploitation is unauthenticated and requires no user interaction, but is limited to applications that decode untrusted JSON into recursive message definitions, and no public exploit code has been identified at time of analysis (EPSS data not provided).
Request smuggling in the Go net/http standard library occurs when an application handler answers an HTTP/1 CONNECT request with a 2xx status and then returns without hijacking the connection, causing the server to keep parsing HTTP requests on a connection that an intermediate proxy now treats as an opaque tunnel. Affected builds are net/http before 1.26.9 and the 1.27.x line before 1.27.2 (CWE-444, parser disagreement between proxy and origin server). Exploitation requires a non-default handler pattern plus a fronting proxy, so despite the published CVSS base of 7.5 the assessed real-world priority is moderate-to-low; no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none with Technical Impact: partial.
Signals conflict: the original CVSS rates integrity and availability impact as high (9.1), but independent assessment determines only low availability impact. A logic error in Go's HTTP/2 server allows unauthenticated remote attackers to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection) by resetting streams to trigger a double refund of flow control credit. The practical impact is limited because total buffered data remains bounded by concurrent stream limits and stream-level flow control; no public exploit identified at time of analysis, and patches are available as upstream commits.
CPU exhaustion in the Go standard library's net/http file-serving handlers (FileServer, ServeContent, and ServeFile(FS)) lets remote unauthenticated attackers degrade or deny service by sending a single HTTP request whose Range header enumerates a large number of small ranges. The flaw affects net/http in Go releases before 1.26.9 and 1.27.0-0 before 1.27.2, but only on servers that actually expose those file-serving handlers; default configurations that use them are affected with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Impact is availability-only, exploitation is not confirmed and no public exploit has been identified at time of analysis, EPSS is low at 0.17% (6th percentile), and patched releases are available from the vendor.
Go's os.Root API on Windows can be tricked into creating a directory outside the sandboxed root when the final path component passed to Root.Mkdir or Root.MkdirAll is a junction that resolves to an empty location, allowing an attacker who can influence filesystem layout or path input to escape the intended root boundary. Only Windows applications built with a vulnerable Go toolchain (os and internal/syscall/windows before 1.26.9, or the 1.27.0 pre-release line before 1.27.2) that actually use os.Root are affected; non-Windows builds and applications not using os.Root are not impacted. The headline CVSS 9.8 overstates real-world risk: our independent assessment scores it AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N because the primitive is confined to directory creation outside the root, with no arbitrary file read, content write, or code execution described. EPSS is 0.21% (10th percentile), no public exploit has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Strawberry GraphQL versions 0.217.0 through 0.326.0 contain an authorization bypass in which a custom permission class whose has_permission() is declared as a synchronous def but returns an awaitable (for example a coroutine) can grant access to fields that should be denied. Because only async def methods are detected as asynchronous, the returned awaitable is evaluated for truthiness on the synchronous resolve path and is always truthy, so the protected resolver runs even when the awaitable would resolve to False. The flaw affects synchronous field resolvers under both execute_sync() and execute(); permissions declared with async def or returning a plain boolean are unaffected, and no public exploit code or confirmed active exploitation was identified at time of analysis, though the patch is a single small commit (PR #4605) that is easy to reverse-engineer.
Arbitrary memory disclosure and denial of service in Hazelcast allow a client that can reach a cluster member's listening port to read arbitrary data from that member's Java heap, off-heap storage and JVM process address space, to crash members, and - in some Hazelcast Enterprise Edition configurations - to corrupt memory with possible remote code execution. All editions prior to 5.4.5, 5.5.10, 5.6.1 and 5.7.0 are affected in both the slim and full distributions, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a low-privileged client credential where client authorization is enforced, while in default deployments with Hazelcast Security disabled any reachable client can connect without credentials; the vendor's CVSS 4.0 score of 9.3 assumes PR:N. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but vendor-released patches exist (5.4.5, 5.5.10, 5.6.1, 5.7.0) and the vendor's own hardening guidance - enabling security, enforcing client authorization and defining an explicit zero-config Compact serialization allowlist - directly addresses the exposure, making this a genuine high-priority vulnerability rather than an inflated score.
Authorization bypass in the Hazelcast IMap Predicates API allows a client holding only limited cluster credentials to execute arbitrary code on a Hazelcast cluster member in versions prior to 5.4.5, 5.5.10, 5.6.1 and 5.7.0. Because the missing check sits inside the map permission model itself, a partially trusted client - for instance one granted read or put rights on a single map - can invoke the aggregation and projection query paths that were never gated by a permission bit, yielding full compromise of confidentiality, integrity and availability on the member (CVSS 4.0 base 8.7 High; vendor-assessed CVSS 3.1 8.7 with PR:L). Exploitation requires an authenticated client connection to the cluster, so it is not reachable by fully unauthenticated attackers; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor states no workaround exists other than upgrading.
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galaxy collection install` against a crafted collection tarball, because the archive extractor validates member paths with lexical normalization (os.path.abspath) instead of resolving symlinks (os.path.realpath) and performs no containment check on symlink-typed directory members before creating them, letting chained symlink entries redirect a subsequent file member outside the destination directory. The flaw (CWE-59, CVSS 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is a bypass of the fix for CVE-2020-10691 and requires the victim to actively install the malicious collection, so an attacker can write arbitrary files with the privileges of the ansible-galaxy user and potentially achieve code execution on the control node. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; affected deployments include ansible-core 2.x as shipped in Red Hat Ansible Automation Platform 2 and numerous other Red Hat products, and no patched version is identified in the supplied intelligence, which currently cites only the Red Hat CVE page and Bugzilla 2531646.
Banks, a Python library for generating LLM prompts from a simple template language, ships a DirectoryPromptRegistry that prior to version 2.5.1 fails to reject symbolic links for its index.json file and for discovered or existing .jinja prompt files. An attacker who can influence the contents of the registry directory - for example by planting a symlink or by controlling files extracted from an untrusted archive into that directory - can cause _scan() and get() to follow a link outside the registry root and disclose arbitrary files, while set(), _save() and _load() can read or overwrite an external link target, giving high confidentiality and integrity impact with limited availability impact. Exploitation requires local placement influence over the prompt directory and applies only to deployments that use DirectoryPromptRegistry and expose that directory to untrusted input, which is why the vendor CVSS 4.0 base score is 7.3 (AV:L/AC:L/AT:P/PR:L/UI:N) and the assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. The issue is fixed in version 2.5.1.
Authenticated Kerberos clients can cause a NULL pointer dereference in MIT Kerberos 5 through 1.22.2 by sending a forwarded KRB-CRED message with more tickets than ticket_info entries to a GSS-API acceptor service, resulting in a service crash (denial of service). The vulnerability requires the attacker to hold a valid Kerberos principal and the target to process forwarded credentials via gss_accept_sec_context(); impact is limited to availability with no confidentiality or integrity effect. No public exploit code identified at time of analysis, and a patch is available via upstream commits.
Stack-based buffer overflow in Poppler's Decrypt::revision6Hash() allows a caller-supplied password longer than 127 bytes for an AESV3/R6 (AES-256 revision 6) encrypted PDF to overwrite the K1 and E stack buffers, crashing the process and corrupting nearby memory. Poppler 0.42.0 through 26.10.0 is affected across libpoppler, libpoppler-glib and the C++ API, and the flaw is remotely reachable and unauthenticated per the assessed vector (CVSS:4.0 PR:N) but carries an explicit attack requirement - the attacker must control the password string passed to the decrypt routine - so realistic exposure is automated or server-side PDF pipelines that decrypt files with externally supplied passwords rather than interactive viewers where the user types the password. Impact is primarily availability (A:H) with a limited integrity effect (I:L); no public exploit identified at time of analysis, no CISA KEV confirmation of active exploitation, and an upstream fix is tracked via freedesktop GitLab merge request 2398 with a vendor advisory noted.
Denial of service through CPU exhaustion in Go's HTTP/2 implementation (net/http and golang.org/x/net) lets an unauthenticated remote HTTP/2 peer open many streams and then repeatedly send small SETTINGS frames carrying SETTINGS_INITIAL_WINDOW_SIZE, forcing the victim to recompute per-stream flow-control window state at O(number of streams) for each frame (assessed CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Impact is confined to availability - there is no confidentiality or integrity loss - and exposure is limited to Go programs with HTTP/2 active: servers over TLS (the Go default) and Go HTTP/2 clients connecting to an attacker-controlled peer, in versions predating the O(1) initial-window-size fix tracked in Go issue 81742. No public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV); HTTP/1-only deployments are unaffected.
HTTP/1 connection desynchronization in Go's net/http Transport allows response poisoning for other users of a shared, pooled connection pool. When an outbound HTTP/1 CONNECT request carries a non-empty Request.Body, Transport writes those bytes to the wire unframed after the request headers; if the upstream server rejects the CONNECT with a non-2xx but connection-reusing (keep-alive) response, Transport returns the still-contaminated socket to the idle pool, and the backend may parse the trailing bytes as a pipelined follow-up request. The primary exposure is reverse proxies (including httputil.ReverseProxy) that forward CONNECT through a shared Transport, where the next caller to reuse the desynchronized connection reads the response to the injected request - an unauthenticated remote scenario per the CVSS vector (PR:N), though exploitation requires a specific chain rather than a default single request. No public exploit identified at time of analysis; EPSS is low at 0.17% (5th percentile).
Concurrent mutation of the shared HPACK encoder in Go's HTTP/2 server stack (net/http, also reachable via golang.org/x/net/http2, tracked as GO-2026-6617) allows remote, unauthenticated attackers to crash the process by repeatedly issuing requests while sending SETTINGS frames that change SETTINGS_HEADER_TABLE_SIZE. One goroutine encodes a HEADERS frame for an outgoing response while another resizes the encoder's dynamic table with no synchronization, producing a data race (CWE-362) that can terminate the server. The impact is availability only (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H); exploitation is timing-dependent and requires HTTP/2 to be enabled, but publicly available exploit code exists and EPSS is low at roughly 0.18% (7th percentile). There is no confirmed active exploitation (CISA KEV does not list this CVE), and a vendor patch is available per vendor advisory.
Go toolchain (cmd/go) releases before 1.26.9 and 1.27.0 through 1.27.1 can be induced to substitute an attacker-controlled module in place of the bundled golang.org/fips140 dependency when a developer builds a project that ships a bogus golang.org/fips140 definition and connects the build to an attacker-operated GOMODPROXY. Successful abuse yields high confidentiality, integrity, and availability impact within the build environment because the toolchain fails to properly validate the module's integrity check value (CWE-354), so untrusted module content is accepted in place of the trusted bundled copy. Exploitation is conditional rather than widespread: it requires both an attacker-crafted project and explicit developer action to use a non-default, attacker-chosen proxy (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), and no public exploit code or confirmed active exploitation has been identified at time of analysis, with EPSS at roughly 0.11% (1st percentile). Vendor patches are available in Go 1.26.9 and 1.27.2.
Checksum verification bypass in the Go toolchain (cmd/go) versions 1.27.0 before 1.27.2 and before 1.26.9 allows a malicious Go project with a forged golang.org/toolchain go.sum entry, combined with a user-selected attacker-controlled GOMODPROXY, to substitute a tampered toolchain that cmd/go would otherwise reject. Exploitation requires local access and user interaction (CVSS 7.8, AV:L/UI:R) and two attacker-controlled preconditions the victim must opt into: operating inside the crafted project and using the malicious proxy. No public exploit code identified at time of analysis, and EPSS is 0.13% (2nd percentile), indicating low predicted exploitation likelihood.
Remote memory exhaustion in the Go standard library's crypto/tls package lets a client that sends a crafted ClientHello containing multiple ECH outer extension references - a construction prohibited by RFC 9849 - force disproportionate memory allocation in TLS servers with Encrypted Client Hello enabled. Only Go releases before 1.27.2 and before 1.26.9 are affected, and the flaw is fixed in those two releases; no public exploit code exists and there is no CISA KEV listing at time of analysis. The practical attack surface is narrow because ECH is opt-in and not active in a default Go TLS server configuration, but where enabled the attacker needs no authentication or user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5).
Cross-project resource manipulation in OpenStack Mistral through 23.0.0 allows an authenticated project member to rewrite and un-publish another project's public action definitions and environments via the v2 API, while a project administrator can relocate another project's resource by creating a workbook with a colliding embedded action or workflow name. This incorrect authorization vulnerability (CWE-863) has a CVSS 4.0 base score of 7.2 (High) and requires a valid account on a multi-tenant cloud that exposes the Mistral v2 API; no public exploit code was identified at time of analysis, and the impact is primarily integrity (VI:H) with limited confidentiality and availability effects. Deployments without the Mistral API exposed are not affected.
Cluster-wide denial of service in OpenStack Mistral (all versions through 23.0.0) lets any authenticated holder of a valid Mistral token - regardless of role or tenant - read and alter the service's global maintenance state through the /v2/maintenance API, because the controller clears the request context and calls the maintenance service without any policy enforcement. Setting the state to PAUSED halts processing of new workflow and execution objects for every tenant project until an operator intervenes, giving a lowest-privileged tenant member a persistent, cross-tenant availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 7.1 High; NVD's CVSS 4.0 vector scores identically at 7.1 High). Exploit path is reachable against default configurations with no feature flag or non-default setting required, but it is not anonymously exploitable - a valid Mistral API token is the single prerequisite. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis; patch availability is not confirmed in the provided data.
FFmpeg through 9.0.2 contains an infinite loop in ff_rtsp_connect() (libavformat/rtsp.c) because the RTSP client follows 3xx redirects without a redirect limit, allowing a malicious RTSP server to cause endless reconnects that saturate a CPU core. Exploitation is remote and unauthenticated (CVSS PR:N) but requires passive user interaction (UI:P/UI:R): the victim must open an RTSP stream that resolves to the attacker-controlled server, which then answers every request with a 302 redirect to itself or another server. Publicly available exploit code exists (a gist PoC), but no CISA KEV entry confirms active exploitation; the independent assessment rates this as a genuine but bounded availability threat, with the highest exposure in services that accept and open user-supplied RTSP URLs automatically.
Infinite loop in FFmpeg's HLS demuxer (libavformat/hls.c) lets remote attackers pin CPU and I/O indefinitely on any host that feeds a crafted playlist to FFmpeg before version 8.1.3. A malicious Media Playlist that embeds Master Playlist tags causes parse_playlist()/hls_read_header() to keep registering self-referencing variants that never terminate. Exploitation is unauthenticated (PR:N) but requires a victim or automated pipeline to open the playlist (UI:P), impact is availability-only with no data disclosure or code execution, and publicly available exploit code exists; there is no confirmed active exploitation (CISA KEV) at time of analysis.
OpenStack Mistral through 23.0.0 exposes an authenticated command-injection path in its std.ssh_proxied action: the caller-supplied proxy_command string is handed to paramiko.ProxyCommand() and executed as a local subprocess on the executor host under the Mistral service account, before any SSH connection to the gateway or target host is even attempted. Any authenticated project member who can reach the standard action-execution API can therefore run arbitrary OS commands on the Mistral executor, with the default configuration affected because std.ssh_proxied is permitted out of the box; deployments that explicitly disable or restrict that action are not impacted. Exploitation requires valid project credentials (PR:L, not anonymous), so the practical risk is privilege escalation and lateral movement from a low-privileged tenant account rather than unauthenticated compromise, and no public exploit code was identified at time of analysis.
Cross-site request forgery in Pydantic AI's development web chat UI allows any website a developer happens to visit while `Agent.to_web()` or `clai web` is running to fire forged chat requests at the loopback-hosted server, causing the served agent to start a run and execute its tools with the privileges and credentials of the local process. The pre-patch `/api/chat` endpoint performed no Content-Type validation, so a malicious page can deliver a JSON body cross-origin using a CORS-safelisted content type (text/plain, multipart/form-data, application/x-www-form-urlencoded, or none at all) without triggering a preflight; binding the server to localhost - the default - provides no protection because a browser page can reach 127.0.0.1. Realized damage is bounded by the tools the agent exposes, and `requires_approval=True` does not help because the endpoint trusts approval decisions relayed by the client; exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L, 7.6) but requires the developer to browse an attacker-controlled page while the dev UI is running, and there is no public exploit code identified at time of analysis. Vendor-released patches are available in 1.107.4 and 2.28.0.
Concurrency slot exhaustion in Pydantic AI 2.10.0 through 2.52.x lets streamed model requests permanently occupy slots in a shared ConcurrencyLimiter, progressively starving later requests until a service that reuses one long-lived limiter can no longer make model calls - an availability-only denial of service (C:N/I:N/A:H) with no confidentiality or integrity impact. The issue is remotely reachable and unauthenticated (PR:N), but our independent assessment rates it AC:H rather than GitHub's AC:L because exploitation requires a specific deployment pattern: model requests wrapped in ConcurrencyLimitedModel (or covered by limit_model_concurrency) that share a single long-lived limiter across streamed responses; agent-level max_concurrency and all non-streaming model requests are explicitly unaffected, and a short-lived or per-request limiter never accumulates enough leaked slots to deadlock. Slots are leaked by early stream termination, cancellation, consumer exceptions, or even full stream_text() consumption with debounce_by=0.1, and the vendor-released fix in 2.53.0 is available; no public exploit code identified at time of analysis.
Unauthenticated path traversal in the Ollama `/api/pull` endpoint lets a remote attacker write an arbitrary file outside the model store by submitting a crafted path-traversal sequence in the layer digest field, because the `digestToPath` function does not adequately validate digests before constructing a filesystem path. When the Ollama process can write to `/usr/lib/ollama` (described as the default in most Ollama Docker images) and the server or container is subsequently restarted, the planted binary is loaded and executed, yielding remote code execution as root; the same file-write primitive is available without authentication to anyone who can reach the API. The issue is fixed in Ollama 0.35.0, no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none', and no EPSS score was supplied in the source data. Real-world risk is high but conditional: exploitation of the full RCE chain depends on write access to `/usr/lib/ollama` and a restart, so deployments not using the default Docker image, running Ollama as a non-privileged user without write access to that directory, or not exposing the API to untrusted networks face substantially reduced exposure.
Arbitrary code execution on the Vault host is achievable in HashiCorp Vault and Vault Enterprise when a privileged operator restores a crafted Integrated Storage (Raft) snapshot in a deployment configured with Shamir seals and an external plugin directory, because stored plugin catalog entries are not consistently verified to reference binaries inside that configured directory (CWE-22 path traversal). The attacker must already hold the high privileges needed to restore a Raft snapshot (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), and exploitation also depends on the non-default Shamir-seal-plus-external-plugin-directory configuration, so this is a genuinely serious but condition-gated vulnerability rather than a mass-exploitation threat; clusters using auto-unseal or without an external plugin directory are not affected by this path. No public exploit identified at time of analysis, and vendor-released fixes are available in Vault Community Edition 2.1.2 and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
Cross-host request replay in AsyncHttpClient (AHC) before 3.0.13 and 2.16.1 can disclose the original origin's request path, Host header, Authorization credentials, or even a plaintext request to a completely different destination when an application's ResponseFilter fails over or retries a request onto a different base origin (host, scheme, or port) or downgrades HTTPS to HTTP. The assessed vector is unauthenticated from the network perspective (PR:N, AV:N), but exploitation hinges on a concrete application-side prerequisite: a ResponseFilter (or equivalent retry/failover code path) that replays requests across origins - default AHC usage with same-host retries is unaffected, and AC:H/AT:P reflect the specific sequencing that must occur. No public exploit code and no confirmed active exploitation were identified at time of analysis, and because the impact depends on configuration rather than an attacker-reachable endpoint, the CVSS 4.0 score of 9.4 and the independent CVSS 3.1 assessment point in different directions; prioritization should be driven by whether a cross-host replaying filter is deployed.
Digest mutual-authentication bypass in AsyncHttpClient (AHC) 3.0.12 allows a rogue or on-path peer to be accepted as the authenticated server: when a Digest challenge advertises qop="auth-int" as the only supported quality-of-protection, the client negotiates it but cannot compute the expected rspauth, treats that as unverifiable-but-nonfatal, and accepts a response whose rspauth value is invalid. The flaw is network-reachable, unauthenticated and requires no user interaction (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, 8.8), with the primary impact on integrity (VI:H) consistent with server impersonation rather than the data theft implied by the 'Information Disclosure' tag. It only affects applications that use AHC's Digest Realm with mutual authentication and connect to a peer offering an auth-int-only challenge; deployments where the server offers 'auth' or 'auth,auth-int' are unaffected because AHC prefers and verifies 'auth'. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor-released patch is version 3.0.13.
Cleartext credential disclosure in AsyncHttpClient (AHC) before 3.0.12 on the 3.x line and before 2.16.1 on the 2.x line causes a client configured to use an HTTP proxy to write the origin request and its Authorization credentials onto a still-plaintext proxy connection when the proxy rejects the CONNECT with anything other than 200, because the client infers an established tunnel from the last request method rather than the CONNECT result. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 HIGH), this is an unauthenticated, confidentiality-only issue: Basic credentials can be recovered directly, while NTLM responses may be cracked or relayed. Exploitation is limited to environments where the victim application routes through an HTTP proxy and the attacker controls or can man-in-the-middle the client-to-proxy hop; no public exploit identified at time of analysis.
Credential disclosure in the AsyncHttpClient (AHC) Java library allows a malicious or compromised origin server or proxy to capture plaintext-recoverable usernames and passwords from applications that configure HTTP credentials via Realm.Builder. When the attacker returns a WWW-Authenticate or Proxy-Authenticate challenge labeled 'Digest' but with the nonce parameter omitted or empty, versions prior to 3.0.13 (3.x) and 2.16.1 (2.x) silently fall back to Basic authentication and resend the credentials in reversible Base64, defeating the entire purpose of Digest. Exploitation is unauthenticated from the network (CVSS v4.0 8.7, AV:N/PR:N, independent assessment CVSS v3.1 C:H/I:N/A:N), but requires the attacker to control or tamper with the authentication challenge, so it is not exploitable against arbitrary endpoints; no public exploit code or CISA KEV entry was identified at time of analysis.
Connection-pool key scoping in AsyncHttpClient (AHC) 2.0.0 through 3.0.13 omits identity-defining fields for Kerberos, SPNEGO, NTLM, authenticated proxy and SOCKS/CONNECT login paths, so a request can be handed a pooled keep-alive socket that was already authenticated as an entirely different identity and then execute under that first identity's credentials, exposing the other identity's data or authority. Reachability is conditional: the application must use Kerberos/SPNEGO/NTLM, an authenticated proxy realm, or SOCKS/CONNECT proxy logins, and specifically the ambiguous cases where login has no configured principal, where realms are proxy realms, where distinct identities share a user name, or where proxy logins are used - clients using only HTTP Basic/Digest or a single identity/principal are not affected. Rated CVSS 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, CWE-346 Origin Validation Error); exploitation depends on timing the reuse of an already-authenticated socket across multiplexed callers, and there is no public exploit identified at time of analysis and no CISA KEV listing. Vendor-released patch: 3.0.14.
Unbounded WebSocket permessage-deflate decompression in the AsyncHttpClient (AHC) Java library versions 2.2.0 through 3.0.13 allows a malicious or compromised WebSocket peer to exhaust the JVM heap of the connecting application by sending a small compressed message that inflates into a very large Netty buffer. The flaw is remote, requires no authentication or user interaction from the peer side (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), but it only triggers when the client application itself opens an outbound WebSocket connection with permessage-deflate compression negotiated - meaning the victim must connect to an attacker-controlled endpoint or be exposed to a man-in-the-middle. Impact is availability-only: no confidentiality or integrity loss, and no public exploit code has been identified at time of analysis. The issue is fixed in version 3.0.14.
Cyrus SASL clients that use the DIGEST-MD5 authentication mechanism can be crashed by a malicious or on-path server that supplies a crafted challenge field (such as realm or nonce), because the add_to_challenge() function computes a buffer size before DIGEST-MD5 quoting and fails to account for escaping that lengthens the value, resulting in a heap-based out-of-bounds write. This is a client-side denial-of-service flaw affecting Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4; the assessed CVSS vector is AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H, meaning unauthenticated remote attackers must control or intercept the server endpoint and the victim must initiate authentication. No public exploit code or confirmed active exploitation is identified at time of analysis.
Command injection in Backstage's TechDocs build pipeline allows an authenticated user who can register or modify a documentation source to run arbitrary commands inside the TechDocs backend or its build container by supplying a crafted mkdocs.yml. Exploitation requires write access to a catalog entity or docs source that is processed by local or docker-based TechDocs generation, and the impact is confined to resources reachable by the backend or its build container; deployments that only publish externally pre-built documentation are not exposed. The issue is fixed in @backstage/plugin-techdocs-node 1.14.6 and 1.15.4, is rated CVSS 7.7 with high attack complexity, low privileges, and scope change, and there is no public exploit identified at time of analysis.
Remote code execution on TechDocs build hosts affects Backstage deployments running the @backstage/plugin-techdocs-node mkdocs generator prior to 1.14.6 (and 1.15.x prior to 1.15.4). An authenticated user holding the privilege to register or update catalog entities can commit a crafted mkdocs.yml whose markdown_extensions entries point at dangerous Python callables such as subprocess:Popen, os:system, or plantuml_markdown's plantuml_cmd, which mkdocs instantiates and executes while building the docs; the flaw requires authentication and an entity-registration permission rather than anonymous access, and deployments that publish pre-built docs or build in isolated disposable runners have a much smaller blast radius. The upstream fix, which extends MkDocs configuration sanitization to cover nested configuration keys, hyphenated extension names, and theme options, is available in vendor-released versions 1.14.6 and 1.15.4, and no public exploit code tied to this CVE was identified at time of analysis beyond the payload fixtures included in the upstream fix commit.
Heap memory corruption in llama.cpp's chat/tool parser lets unauthenticated remote attackers crash llama-server and potentially shape a controlled heap write primitive by sending a crafted POST /completion request containing a chat_parser that emits a tool-id token after a tool-close tag. Versions prior to build b11393 are affected; the trigger leaves the mapper's current_tool pointer dangling, producing a use-after-free and double-free in common_chat_peg_mapper::map. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, but the CVSS 4.0 score of 9.2 reflects high confidentiality, integrity and availability impact, and the independent assessment confirms high severity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) - reliable denial of service is straightforward, while converting the bug into a controlled heap write requires heap grooming. A vendor patch exists as upstream PR/commit and as build b11393.
A time-of-check to time-of-use (TOCTOU) race condition in Anthropic's Claude Code CLI allows an attacker who already has write access to a shared project workspace to atomically replace a project file with a symlink after the agent has validated the path but before it writes, causing Claude Code to follow the link and write to an arbitrary file outside the sandbox - for example a shell configuration file that will later be sourced by a higher-privileged session. Exploitation is bounded: it requires local write access to a workspace shared with a more privileged Claude Code session, requires winning a narrow timing race rather than triggering deterministically, and requires the privileged session to actually perform a write to the targeted path; single-user installations with no shared workspace are not exposed. There is no indication of active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, though Anthropic has already shipped the fix through the standard auto-update channel, leaving only manual-update holdouts at risk.
Spoofing and identity impersonation in Microsoft Active Directory Federation Services (AD FS) let an unauthenticated network attacker get forged or intercepted certificates accepted as trusted, undermining the integrity of federated authentication. Affected deployments are AD FS running on Windows Server 2012 R2 through Windows Server 2025, along with the underlying .NET Framework certificate-validation components (3.5, 4.6.2 through 4.8.1) and System.Security.Cryptography.Xml, plus Visual Studio 2022 17.14 and Visual Studio 2026 18.10. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (7.4), meaning no credentials or user interaction are needed but the attacker must first obtain a privileged network/intercept position or craft a certificate that slips past validation; impact is limited to confidentiality and integrity, with no availability effect. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue, but a vendor patch is available and should be applied promptly given the authentication-bypass potential in default, network-exposed AD FS deployments.
Request smuggling in the ASP.NET Core Kestrel HTTP/1 server lets a remote, unauthenticated attacker desynchronize HTTP request parsing and tamper with how requests are interpreted by the server and any shared front-end proxy, load balancer, or connection pool. The flaw is triggered when a Kestrel HTTP/1 connection carrying unread request-body bytes is aborted and Kestrel reparses that leftover data as a new request; the vendor rates it Critical at CVSS 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), while the independent assessment applies the same impact but rates attack complexity as High because the abort/timing prerequisite must be met, and the practical blast radius is greatest where connections are reused across tenants. Affected runtimes are ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2, plus Microsoft Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4; a vendor patch is available and there is no public exploit identified at time of analysis.
Remote code execution affects Windows desktop applications built on the Microsoft.WindowsDesktop.App.Runtime (WPF) component of .NET, specifically runtimes 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1, as well as Visual Studio 2022 17.14 and Visual Studio 2026 18.10 installations that carry the vulnerable runtime. An unauthenticated attacker can deliver crafted content that, when a victim interacts with an XPS document whose synthetic hyperlinks are exposed through UI Automation, bypasses the application's restrictive navigation checks and reaches attacker-controlled content, leading to code execution in the context of the running application; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) confirms high confidentiality, integrity, and availability impact but explicitly requires user interaction. Vendor patches are available (runtime fixes 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2), and no public exploit code was identified at time of analysis despite the network-reachable attack path.
Plugin installation in Claude Code and Claude Desktop before 2.1.179 can install attacker-controlled code: the installer pins a plugin to a 40-character commit SHA from a marketplace but then runs git checkout on that string without confirming that the resulting HEAD actually equals the pinned SHA, so an attacker who controls the plugin repository on a Git host that allows branch names shaped like a 40-hex SHA can create a branch named after the 'reviewed' commit and have its tip checked out instead. Exploitation is unauthenticated from the attacker's side (CVSS 4.0 vector PR:N) but requires considerable user interaction - the victim must choose to install the malicious plugin and deliberately pin it to the ostensibly safe hash - which is why our independent assessment rates it a HIGH-impact, LOW-likelihood issue that is a moderate, conditional priority rather than an emergency. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and there is no KEV listing.
Memory corruption in Microsoft's WPF desktop stack (Microsoft.WindowsDesktop.App.Runtime, shared by .NET and .NET Framework) allows an unauthenticated, network-positioned attacker to cause an out-of-bounds write by delivering an XPS document whose glyph coordinates overflow pointer arithmetic in CD3DGlyphBank::RectFillAlpha. Exploitation requires user interaction - the victim must open or render the malicious XPS file in an affected WPF application - and prerequisites are otherwise limited to the Windows platform and to applications that actually process untrusted XPS/glyph content, so server services that never render such documents are not exposed. CVSS 3.1 scores it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with high confidentiality, integrity and availability impact; note that signals conflict and should be weighed carefully, since the CVE description frames the outcome as privilege elevation while the vendor advisory frames it as remote code execution with process termination. No public exploit code and no confirmed active exploitation have been identified at time of analysis (SSVC exploitation: none), and vendor patches are available across .NET 8/9/10/11 RC, .NET Framework 3.5 and 4.x, and Visual Studio.
Remote code execution in .NET WPF (Microsoft.WindowsDesktop.App.Runtime) allows an unauthenticated attacker to execute code on a victim's Windows system by crafting a malicious XAML/XPS document or serialized payload and convincing the user to open or load it. The vulnerability is a CWE-502 deserialization of untrusted data issue rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); exploitation requires user interaction and is not automatable (SSVC Automatable=no, Exploitation=none). No public exploit code or active exploitation has been identified at time of analysis, though vendor patches are available for all affected .NET and .NET Framework versions.
Memory corruption in Microsoft .NET's System.Net.Sockets component allows an unauthorized attacker to execute code over a network on Windows hosts, but only against applications that reuse a single SocketAsyncEventArgs instance across both IPv4 and IPv6 UDP datagram sockets. The flaw (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) manifests as an out-of-bounds write in the ReceiveFromAsync path once an undersized cached native address buffer is retained; no authentication or user interaction is required, though the high attack complexity reflects the non-default coding pattern required to reach the vulnerable state. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as none and non-automatable, and no KEV listing applies; Microsoft has shipped fixed runtime builds, making this a meaningful but non-emergency patching priority.
Improper link resolution before file access in Microsoft .NET (CWE-59, 'link following') allows an authorized local attacker to elevate privileges, rated CVSS 7.3 with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. Affected components include .NET 9.0 before 9.0.319/9.0.122, .NET 10.0 before 10.0.113, .NET 11.0 before 11.0.100-rc.2, Visual Studio 2022 version 17.14 before 17.14.42, and Visual Studio 2026 version 18.10 before 18.10.4. Exploitation requires a pre-existing low-privileged local account, the ability to plant symbolic links or junctions, and required user/process interaction to trigger a privileged file operation, so the SSVC decision is Exploitation: none, Automatable: no, Technical Impact: total; no public exploit identified at time of analysis, and the EPSS/KEV signals in the provided data give no indication of active exploitation.
HTTP request smuggling in ASP.NET Core's Kestrel web server allows unauthenticated remote attackers to desynchronize request parsing and bypass security features by having Kestrel accept newline characters in HTTP/2 request trailers and in values drawn from the dynamic HPACK table rather than rejecting them as malformed. All supported ASP.NET Core release trains are exposed - 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2 - along with bundled Visual Studio 2022 17.14 (<17.14.42) and Visual Studio 2026 18.10 (<18.10.4); realistic impact is highest where a proxy, load balancer, or chained server sits in front of Kestrel and performs its own HTTP/2 parsing. The flaw carries a critical CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is rated with total technical impact under CISA SSVC, but exploitation has not been observed (SSVC Exploitation: none) and no public exploit code has been identified at time of analysis.
Denial of service in ASP.NET Core's Kestrel web server allows an unauthenticated remote attacker to deadlock connection handling by sending crafted HTTP/3 reset or abort sequences, causing excessive blocked-thread creation and eventual server resource exhaustion. The flaw affects applications built on Microsoft.AspNetCore.App.Runtime 8.0.x before 8.0.32, 9.0.x before 9.0.21, and 10.0.x before 10.0.13 on Windows, Linux, and macOS, but only when Kestrel is running with HTTP/3 support enabled - servers limited to HTTP/1.1 or HTTP/2 are not exposed. Publicly available exploit code exists (a public gist demonstrates the issue), and the CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), an availability-only impact with no confidentiality or integrity loss; there is no confirmed active exploitation at time of analysis.
Privilege escalation and security-feature bypass in Microsoft ASP.NET Core's Blazor authorization stack lets an authenticated remote user defeat an application's [Authorize] decision and reach content or operations their role should not permit. The flaw is a race condition in the Microsoft.AspNetCore.Components.Authorization AuthorizeRouteView component, where a stale asynchronous authorization result can be applied after a navigation or an authorization-state change, so the current authorization decision is silently overwritten by an earlier one. Only Blazor applications that use AuthorizeRouteView for route-level authorization are in scope; ASP.NET Core deployments that do not use Blazor component-level authorization are unaffected. Exploitation is non-deterministic (CVSS AC:H) and requires the attacker to already hold a valid authenticated session (PR:L), and publicly available exploit code exists as a published proof-of-concept gist, but CISA SSVC rates exploitation as none and the issue is not automatable. Vendor patches are available across all supported ASP.NET Core release trains.
Denial of service in ASP.NET Core 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaust server memory by sending crafted multipart requests that trigger unbounded buffer allocation in Microsoft.AspNetCore.WebUtilities.FileBufferingReadStream, ultimately degrading or halting the application (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). Affected deployments are those running unpatched runtimes (8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13) and the bundled Visual Studio toolchains, specifically applications that expose endpoints consuming buffered or multipart/form-data request bodies; no authentication or special non-default configuration is required beyond such a route existing. Microsoft has published patched runtime packages, and no public exploit code has been identified at time of analysis - CISA SSVC records exploitation as 'none' and the issue is not listed in KEV, though the attack is rated automatable, making rapid patching advisable for internet-facing upload endpoints.
Authentication bypass by spoofing in the Microsoft.AspNetCore.Authentication.Negotiate package for ASP.NET Core lets an authenticated remote attacker (PR:L) have their Kerberos-authenticated identity associated with an unintended LDAP principal, yielding high confidentiality, integrity, and availability impact (CVSS 7.5) after the attacker reaches the application over the network. Exposure is conditional: the application must use an affected package version - 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, or 10.0.0 through 10.0.12 - and must have LDAP claim resolution enabled, an opt-in and non-default configuration, on Windows, Linux, or macOS. CISA's SSVC assessment records no exploitation, and no public exploit code was identified at time of analysis; the AC:H metric reflects that a specific spoofing/timing condition outside the attacker's full control must be satisfied, making this a genuine but conditional privilege-escalation issue rather than a mass-exploitation emergency.
Account takeover is possible in applications built on ASP.NET Core Identity because the framework's password-reset and email-confirmation flows can dispatch mail to the unvalidated address supplied in the incoming request rather than the user's stored canonical address, allowing a remote unauthenticated attacker who can influence that request address to intercept recovery tokens and reset victim credentials. The issue affects Microsoft.AspNetCore.Identity and Microsoft.AspNetCore.Identity.UI deployments running on ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, and 10.0 before 10.0.13, as well as certain Visual Studio 2022 and Visual Studio 2026 builds that bundle the affected runtime; it carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) under CWE-640. No public exploit code was identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this should be treated as a high-priority patching item rather than an active-exploitation emergency.
Path traversal in .NET (CWE-22) allows an authenticated local attacker to escape an intended restricted directory and elevate privileges on the host, with the same flaw reaching users through the Visual Studio 2022 17.14 and Visual Studio 2026 18.10 toolchains. Successful exploitation requires a local, already-authenticated foothold (PR:L) plus user interaction (UI:R), meaning a higher-privileged user or process must be induced to act on an attacker-influenced pathname; it is therefore not remotely triggerable, and CISA's SSVC assessment records Exploitation: none, Automatable: no, with total technical impact if it does succeed. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this rates as a moderate-priority local privilege-escalation issue rather than an urgent, widely exploitable threat. Vendor patches are available.
Denial of service in ASP.NET Core SignalR affects applications that have stateful reconnect enabled and that reference vulnerable versions of Microsoft.AspNetCore.SignalR.Common (8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.5 through 11.0.0-rc.1) or Microsoft.AspNetCore.SignalR.Core (1.0.0 through 1.2.13). An unauthenticated remote attacker can repeatedly trigger stateful reconnect handling so that MessageBuffer.ResendAsync backpressure blocks broadcasts indefinitely while retaining associated server resources, degrading or halting hub messaging for all connected clients; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms a pure availability impact with no confidentiality or integrity loss. CISA's SSVC evaluation rates exploitation as 'none' with automatable attack steps and partial technical impact, and no public exploit code has been identified at time of analysis - patch status is vendor-released, with fixed package versions published by Microsoft, so remediation is straightforward but the exposure is limited to non-default stateful-reconnect configurations.
Remote code execution in Microsoft's Windows Presentation Foundation (WPF) component of .NET allows an unauthenticated remote attacker to run arbitrary code on a Windows host, but only when a WPF-based application loads or renders attacker-supplied XAML or XPS content and the victim opens or processes that malicious document (CVSS PR:N/UI:R). The vulnerable component is Microsoft.WindowsDesktop.App.Runtime, affecting .NET 8.0 (<8.0.32), 9.0 (<9.0.21), 10.0 (<10.0.13), 11.0 (<11.0.0-rc.2), .NET Framework 3.5/4.6.2-4.8.1, Visual Studio 2022 17.14 (<17.14.42) and Visual Studio 2026 18.10 (<18.10.4) on Windows only. Publicly available exploit code exists (a public gist is referenced), though CISA SSVC records Exploitation as none and CISA KEV does not list this CVE; CISA's SSVC decision also rates the issue as not automatable, so mass opportunistic scanning is unlikely and practical risk concentrates on environments whose WPF applications consume untrusted markup. Signals are moderately strong but not uniformly alarming: high technical impact (total via SSVC) is tempered by the required user interaction and the absence of a server-side, zero-click remote path in default configurations.
Denial of service in Microsoft .NET lets an unauthenticated remote attacker force the runtime into disproportionately expensive computation, driving CPU or memory consumption high enough to degrade or halt a service. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms remote, low-complexity, unauthenticated exploitation with no user interaction and a high availability-only impact, requiring only that the vulnerable .NET code path be reachable by attacker-supplied network input - no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. Exposure is limited to reachable, .NET-based services; internal-only or non-.NET-facing deployments are not affected, and the exact affected runtime versions must be confirmed against the MSRC advisory.
Denial of service in Microsoft .NET and .NET Framework stems from uncontrolled recursion (CWE-674) in the System.Security.Cryptography.Xml and System.Private.Xml libraries, which an unauthenticated remote attacker can trigger by supplying crafted signed or encrypted XML that the target application parses. Affected runtimes include .NET 8.0 before 8.0.32, .NET 9.0 before 9.0.21, .NET 10.0 before 10.0.13, .NET 11.0 before 11.0.0-rc.2, and multiple .NET Framework builds (3.5 through 4.8.1) shipped on Windows, Linux and macOS, plus Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4. Impact is limited to availability (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 7.5) - process crash or hang, with no data exposure or code execution; CISA's SSVC assessment rates exploitation as 'none' meaning no public exploit identified at time of analysis, and exploitation is only practical against services that actually invoke XML signature or encryption validation on untrusted input.
Kubeflow Model Registry through 0.3.17 allows an authenticated namespace user with permission to create InferenceService resources to steal the InferenceService controller's ServiceAccount bearer token. The attacker creates an InferenceService with the modelregistry.kubeflow.org/url annotation pointing to an attacker-controlled server; the controller follows the annotation and attaches its token, which the attacker captures and then uses to modify other tenants' InferenceServices cluster-wide. This is a server-side request forgery (CWE-918) requiring low privileges (PR:L) and no user interaction; no public exploit code was identified at time of analysis, and no CISA KEV entry exists.
Remote code execution in ASP.NET Core via a code-injection flaw (CWE-94) allows an unauthenticated, network-based attacker to execute arbitrary code when a victim user interacts with crafted content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation requires an ASP.NET Core application that routes attacker-controlled input through a dynamic code-generation or evaluation path; the user interaction requirement (UI:R) is a significant limiting factor, preventing fully autonomous or wormable exploitation. No public exploit code was identified at the time of analysis, and the specific framework API or configuration exposing the injectable path is not described in the available data and should be confirmed against the Microsoft MSRC advisory.
Path traversal in NLTK's WekaClassifier integration (all versions through 3.10.3) lets attackers who control the model_filename or model argument escape nltk.pathsec containment and drive the Weka JVM to write files outside permitted data roots via the -d option, or probe for file existence via -l. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), but exploitation requires an application that wires attacker-controllable values into WekaClassifier and has a working Weka Java/JVM toolchain installed - a non-default, niche integration that most NLTK deployments never invoke. Under those preconditions, the CVSS 4.0 base score of 8.3 is driven by a network vector with high integrity impact (VI:H), while the AT:P metric reflects the required application-wiring precondition.
Denial of service in GNOME Remote Desktop (gnome-remote-desktop) as shipped in Red Hat Enterprise Linux 8, 9, and 10 allows an unauthenticated remote attacker to pin the daemon's event-loop thread at high CPU by sending traffic to a TLS-enabled VNC listener, causing the service to stop making forward progress. The defect is in the VNC TLS I/O handlers, which treat retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) with an unbounded busy loop instead of returning control to the event loop, so the thread spins indefinitely rather than waiting for socket readiness. No public exploit code exists and there is no confirmed active exploitation, and practical exposure is bounded: the VNC backend must be running with a TLS listener reachable over the network, a configuration that is not enabled by default on typical RHEL installs and is far more common on desktops than on servers.
Out-of-bounds access in libwebsockets' LEJP incremental JSON parser allows unauthenticated remote attackers to crash the process via crafted JSON that exceeds the parser's fixed-size path index or stack arrays. Affected are applications that call lejp_parse on untrusted input; publicly available exploit code exists, though exploitation is deployment-dependent and impact is limited to denial of service (no code execution or data disclosure). The root cause is an off-by-one error in lib/misc/lejp.c, where boundary checks are performed after incrementing the index.
Memory exhaustion in modern-tar versions 0.3.5 through 0.8.5 lets remote, unauthenticated attackers crash or stall any process that unpacks an attacker-supplied tar archive, because a size field containing a non-octal byte (such as '/', '8', '9' or ':') is parsed by readOctal() into a negative entry size that the unpacker then buffers against indefinitely - the malicious archive may also be gzip-compressed. The impact is availability only (CVSS 4.0 8.7, assessed CVSS 3.1 8.1 with VC:N/VI:N/VA:H): no code execution or data disclosure is demonstrated, and the upstream 'Information Disclosure' tag is not supported by either vector. No public exploit code and no CISA KEV entry were identified at time of analysis; the practical limiting factor is exposure and configuration, since deployments that enable the library's strict parsing mode, or that only unpack trusted archives, throw on the malformed header instead of buffering and are not realistically exploitable.
Privilege escalation in containerd's CRI checkpoint-restore path allows an authenticated local attacker who can submit an attacker-controlled checkpoint archive via CRI CreateContainer to have the restored process run with restored credentials (including root), full capabilities, and restored no_new_privs and seccomp state, while CRI status continues to report the requested ContainerConfig. The flaw affects containerd 2.1.0 through 2.2.6 and 2.3.0 through 2.3.3, and only where CRI checkpoint restore via CreateContainer is actually used; systems that never use this experimental feature are not affected. Rated CVSS 7.8 (High) with a local, low-complexity, authenticated (PR:L) vector, and no public exploit identified at time of analysis. Fixed in 2.2.7 and 2.3.4, where the restore-via-CreateContainer behavior is additionally disabled by default.
openstack-network-exporter can be made to silently skip basic authentication when an operator enables user authentication but forgets or misconfigures TLS, letting an adjacent-network attacker pull OVS/OVN dataplane metrics without credentials. Only deployments in that specific non-default, inconsistent configuration are exposed; correct TLS deployments and deployments without authentication enabled are unaffected. The published CVSS is 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), but our assessment narrows this to AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - adjacency-limited, read-only information disclosure, with no integrity or availability impact and no public exploit identified at time of analysis.
Unauthenticated attackers can bypass security controls on REST endpoints generated by Quarkus REST Data Panache when a developer uses @MethodProperties to customize an operation without re-declaring class-level security roles, causing the generator to silently drop the security requirement and expose the endpoint. This results in potential unauthorized information disclosure or data modification, with a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and CWE-425. No public exploit code has been identified at the time of analysis.
Denial of service in the Gitoxide gix-pack crate before 0.75.0 allows a remote attacker operating a malicious Git remote to crash a victim's clone or fetch operation by advertising an absurd pack-header object count, forcing the client to reserve hundreds of gigabytes of memory. Exploitation requires the victim to initiate the clone or fetch against the untrusted remote (user interaction), and no authentication is required of the attacker; the flaw sits in the default pack-header parsing path, so unmodified configurations are affected. The impact is limited to killing the client process with no code execution or data exposure, and no public exploit code was identified at time of analysis.
A denial-of-service condition in the Rust gitoxide `gix-pack` crate (all versions before 0.75.0) lets a malicious or compromised remote abort a client's fetch or clone by serving a malformed thin pack. The crafted pack combines a REF_DELTA that points at an already-known object with a following OFS_DELTA whose base_distance exceeds the current pack_offset, which drives the LookupRefDeltaObjectsIter into an arithmetic boundary it cannot satisfy and causes a panic that terminates the fetch process. The attack is unauthenticated from the attacker's side (PR:N) but requires user interaction (UI:P/UI:R): the victim must voluntarily fetch from or clone the attacker's repository, so it cannot be triggered against a passive listener. Impact is limited to availability of the fetch operation - no code execution, data disclosure, or integrity impact - and no public exploit code has been identified at time of analysis.
Denial of service in gitoxide gix-pack before 0.75.0 allows a malicious remote to panic and abort a client's git clone or fetch by responding with a crafted 12-byte pack header declaring version 3, which trips a release-enabled assert_eq! in BytesToEntriesIter::new_from_header that expects version 2. The attack requires the victim to initiate the fetch from an attacker-controlled or compromised remote (UI:R), but no authentication is needed (PR:N); automated CI, dependency resolution, or mirror synchronization that pulls from untrusted sources is the primary exposure. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 4.0 score is 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H per independent assessment).
A malicious RDP client can crash a FreeRDP-based RDP server running versions before 3.32.0 by negotiating the NSCodec and requesting an oversized desktop geometry, which forces a buffer-growth allocation failure inside nsc_context_initialize_encode() and leaves dangling plane pointers that are later double-freed during context teardown. The impact is availability-only - no code execution, data exposure, or persistence - and the attack is unauthenticated (CVSS PR:N), but success depends on actually inducing the allocation failure, so the trigger is not perfectly deterministic and the vulnerable server-mode deployment is less common than FreeRDP's client-side use. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a moderate-priority crash issue rather than the more alarming 8.2 CVSS 4.0 base score suggests.
Heap buffer overflow in FreeRDP 3.0.0 through 3.31.x allows an attacker who controls a physical smartcard token to corrupt heap memory during PKCS#11 smartcard logon, potentially achieving code execution with the privileges of the FreeRDP client. The flaw is in collect_keys(), which enumerates public key objects across PKCS#11 slots into a fixed 64-entry array without bounds checking; a token exposing more than 64 keys with attacker-controlled CKA_ID and CKA_LABEL values overflows the array. Exploitation requires PKCS#11 smartcard authentication to be configured, physical presentation of the malicious token, and user-initiated logon, and no public exploit code or active exploitation is known at time of analysis; this is a constrained, physically proximate issue rather than a mass-exploitation priority.
FreeRDP 3.0.0 through 3.31.x allows an on-path attacker to capture OAuth authorization codes and substitute the OpenID discovery document during Azure AD authentication because freerdp_http_request() completes TLS handshakes without validating the server certificate chain. Exploitation requires the victim to use the Azure AD/AAD-brokered RDP path (plain RDP is unaffected) and to actively perform the login while the attacker holds a man-in-the-middle network position, making this a conditional risk rather than a broadly exploitable flaw. No public exploit code has been identified at time of analysis, and the issue is patched in FreeRDP 3.32.0.
FreeRDP clients before 3.0.0 and in the 3.6.0-before-3.32.0 range can be coerced by a malicious RDP server into painting uninitialized heap memory onscreen or into aborting the client process via crafted WBT_TILE_FIRST and WBT_TILE_UPGRADE progressive codec messages. This client-side uninitialized heap read (CWE-908) occurs because the tile->current buffer is allocated without zeroing, and exploitation requires the victim to connect to an attacker-controlled or man-in-the-middle RDP server while the session negotiates the RemoteFX/progressive codec. No public exploit identified at time of analysis, and confirmed active exploitation has not been reported; the CVSS 4.0 score is 7.1 (High), driven primarily by availability impact (client abort) with a low, opportunistic confidentiality impact.
Path traversal in the Hex package manager for the Elixir/Erlang (Mix) ecosystem, versions 0.6.0 through 2.5.1, lets a malicious package publisher delete a directory outside the project's deps/ folder and write the package's files into that location when a developer runs mix deps.get or mix deps.update. The attacker abuses a dependency's OTP application label, which Hex copies from the signed registry without validation and Mix joins onto deps/ as the checkout path, so a crafted label such as '../../target' escapes the project tree through File.rm_rf!/1 before any dependency code is compiled. Exploitation requires the victim project to depend directly or transitively on the attacker-controlled release and the developer to explicitly fetch dependencies, so no victim-side authentication is needed (PR:N) but user interaction is required; no public exploit identified at time of analysis, and the vendor rates it CVSS 7.5.
Use-after-free in GNOME Mutter's Wayland color-management (wp_image_description_v1) path allows a local, authenticated attacker who can run a malicious Wayland client to destroy the image-description resource while an asynchronous ICC file read is still in flight, after which the compositor writes into freed memory and frees a pointer derived from it - typically crashing the GNOME session and potentially enabling code execution inside the compositor process. The flaw is local-only and timing-dependent (it requires winning a race window), only applies to Wayland sessions where the color-management/ICC path is exposed (not X11-only sessions or builds without that code path), and no public exploit code or CISA KEV entry has been identified at time of analysis; in practice the more likely outcome is a session crash rather than reliable code execution. This is a credible local privilege/code-execution risk but not an urgent internet-facing emergency.
Remote code execution in ManageIQ (and its downstream Red Hat CloudForms) is possible because the YamlLoadAliases module overrides YAML.safe_load so that in production a Psych::DisallowedClass error silently falls back to YAML.unsafe_load, deserializing arbitrary Ruby objects. An authenticated attacker holding dialog import privileges (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) can upload a crafted YAML dialog payload containing a disallowed class to trigger an unsafe deserialization path with full confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but Red Hat CloudForms has reached End of Life and no errata will be issued, so CloudForms operators cannot patch and must depend on restricting the dialog import role.
OS command injection in GNU Emacs's TRAMP remote-file library (Emacs releases before 31.2, TRAMP through 2.8.2) lets an attacker who can get a crafted filename in front of a user execute arbitrary shell commands with that user's privileges, because tramp-user-regexp relies on an incomplete denylist of dangerous shell characters. This is a follow-on defect to CVE-2026-79992, whose fix did not cover all dangerous inputs. Exploitation is local, requires user interaction (the victim must open, complete, or otherwise have Emacs/TRAMP evaluate the malicious path), and only affects installations that use TRAMP remote-file functionality; no public exploit code and no confirmed active exploitation were identified at time of analysis.
ImageMagick on Windows (versions through 7.1.2-33 and the legacy 6.x line through 6.9.13-58) can be induced to execute an attacker-supplied gswin64c.exe when it converts a PDF, PostScript, or EPS file while Ghostscript is left unregistered. The flaw is an uncontrolled search path (CWE-427) in NTGhostscriptEXE(): instead of resolving the Ghostscript binary through the registry, ImageMagick falls back to launching 'gswin64c.exe' by bare filename, so a malicious binary dropped in ImageMagick's current working directory is executed with ImageMagick's privileges. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and exploitation is conditional: it requires a Windows host with unregistered Ghostscript, attacker write access to the working directory, and a victim-triggered conversion - making this a genuine but situational, non-urgent issue rather than a mass-exploitation priority.
Privilege escalation in MariaDB Server affects releases from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, where the view FRM parser fails to safely encode embedded newline characters in an account name. An authenticated attacker who already holds both CREATE USER and CREATE VIEW WITH GRANT OPTION (CVSS vector PR:H, so not an anonymous path) can create a username containing forged view metadata and then create a view, causing the parser to read part of the username as security fields such as definer_host and suid and thereby escalates database privileges. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the 7.2 High base score reflects a conditional, insider-style privilege-boundary bypass rather than a remote unauthenticated attack, and environments that restrict these administrative grants to trusted administrators have substantially reduced exposure.
Out-of-bounds reads and writes in MariaDB Server's binary FRM (table-definition) parser allow an attacker who can drop a crafted .frm file into the server's data directory and then cause that table to be opened to crash mysqld or potentially execute code in the server process. Affected releases are MariaDB Server from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The published CVSS of 8.0 is driven by high confidentiality, integrity and availability impact once the parser is reached, but the independent assessment rates the practical path as local (AV:L/AC:L) with high privileges required (PR:H), since file placement in the data directory is a host/local operation rather than a remote unauthenticated one; no public exploit identified at time of analysis.
Privilege escalation in MariaDB Server (10.6.1 up to 10.6.28, 10.11.x before 10.11.19, 11.4.x before 11.4.13, 11.8.x before 11.8.9, 12.3.x before 12.3.3, and 13.0.x before 13.0.2) allows an authenticated database user holding the FILE privilege to plant a /run/mysqld/wsrep-new-cluster file when secure-file-priv permits writes into that runtime directory, which the packaged mariadb.service systemd unit subsequently consumes as an EnvironmentFile. On the next administrator-triggered restart of mariadb.service, attacker-controlled environment values are injected into the mariadbd process, escalating from the database user context onto the host/systemd layer (scope change) with full confidentiality, integrity, and availability impact. The vendor rates this 8.4 while our independent assessment uses CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H, reflecting that exploitation requires a high, non-default privilege and a restart gate; no public exploit code has been identified at time of analysis, and patched releases are already available.
An out-of-bounds stack write in the MariaDB CONNECT storage engine's DOS table type lets an authenticated user crash the server and potentially achieve code execution by supplying a crafted column definition and value. The flaw is an incorrect boundary check in the CONNECT value conversion routine that permits a one-byte null write past a stack buffer at an attacker-controlled offset (CWE-787), and it affects MariaDB from 10.6.1 up to the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. Exploitation requires the non-default CONNECT engine to be installed and enabled plus privileges to create CONNECT tables of table_type 'dos' with a crafted numeric definition such as double(255,30); the vendor rates it CVSS 8.5 while the independent assessment is slightly lower (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because authentication, a non-default engine, and high attack complexity are needed, and no public exploit code was identified at time of analysis.
RPM-based MariaDB Server packages up to the fixed releases can create the mysql service account with the database data directory as its home, allowing a database user that holds the FILE privilege to write shell startup files such as .bash_profile there. Those files only execute if an administrator later opens an interactive login shell as the mysql account, overriding its usual /sbin/nologin shell, so real-world exploitation requires both a highly privileged database account and a non-default administrator action. No public exploit has been identified at the time of analysis, Debian/Ubuntu packages are not affected because they already use /nonexistent as the account home, and the CVSS base score of 8.4 overstates the realistic likelihood given the required preconditions.
Denial of service in Google Guava 4.0 through 33.7.1 can be triggered by remote unauthenticated attackers who can supply crafted Java serialization streams containing CompactHashMap, CompactHashSet, or MapMakerInternalMap objects, causing Guava to allocate an attacker-controlled backing array without throttling and exhaust memory with OutOfMemoryError. This is a genuine but conditional availability-only risk: exploitation requires the target application to perform Java native deserialization (ObjectInputStream.readObject) on attacker-influenced input, and any authentication or authorization in front of the deserializing endpoint further limits reach; no code execution or data disclosure results. A vendor fix is available in Guava 33.7.2, and no public exploit identified at time of analysis.
Code execution inside the gVisor sentry process is achievable by a local attacker holding standard container privileges on any platform running a gVisor build prior to release 20260831.0, due to a use-after-free/double-free of the MemoryFile backing an in-sandbox overlay filesystem in the virtual filesystem (VFS) mount layer. The issue is local-only and requires authenticated in-sandbox access (CVSS 4.0 vector AV:L/PR:L), and the resulting code execution lands in the sentry, which remains confined by host-level Linux seccomp and namespace boundaries rather than directly in the host kernel, so a single exploitation does not automatically yield host-kernel compromise or cross-tenant escape. No public exploit code was identified at time of analysis, but the trigger path is documented in the upstream fix's regression tests.
Unbounded memory allocation in Xerial snappy-java before 1.1.10.9 lets unauthenticated remote attackers exhaust the JVM heap by declaring an oversized uncompressed length in a compressed stream header, triggering OutOfMemoryError and denial of service. Any application that passes externally supplied bytes to Snappy.uncompress, Snappy.uncompressString, SnappyInputStream or SnappyFramedInputStream - for example Kafka, Hadoop/Spark or other services using snappy-java transitively - is in scope, and a handful of crafted bytes can force allocations of up to 2 GB before decompression validates the data. Impact is limited to availability (CVSS:4.0 base 8.7; assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no data disclosure or modification, and no public exploit was identified at time of analysis; the practical constraint is reachability, since applications that only decompress trusted internal data are not meaningfully exposed.
Apache CXF versions prior to 4.2.4, 4.1.9, and 3.6.13 allow remote, unauthenticated attackers to cause a denial of service by submitting a very large XML document that exhausts memory and CPU during parsing. The flaw lies in StaxUtils, which by default imposes no limit on the total number of elements or characters, and is most impactful when CXF builds a DOM from the input, such as in SAAJ or WS-Security processing. No public exploit code has been identified, and deployments that enforce a request size limit are largely protected.
Unbounded memory allocation in Apache CXF's multipart/MTOM attachment part-header parser lets a remote, unauthenticated attacker exhaust server memory and cause a denial of service by sending a single crafted multipart request. The parser applies attachment-max-header-size (default 300 characters) only per physical line and enforces attachment-headers-max-count (default 500) against distinct header names rather than total header lines, so folded continuation lines or a repeated header name slip past both limits and inflate the parsed value without bound. Affected are CXF 4.2.0 through 4.2.3, 4.0.0 through 4.1.8, and all releases before 3.6.13 that expose a multipart/MTOM-accepting endpoint; fixed releases are 4.2.4, 4.1.9 and 3.6.13. Exploitation requires no authentication (CVSS PR:N/UI:N) and no non-default configuration, but it is limited to availability impact only; EPSS is low at 0.24% (14th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis.
Keystream reuse in the native one-shot CTR packet cipher of Bouncy Castle for Java LTS before 2.73.13 allows remote attackers to recover plaintext from ciphertext alone, without knowledge of the key. Exploitation is unauthenticated but conditional: the application must use the native one-shot CTR path with a 13-, 14-, or 15-byte IV, leaving only a 1-, 2-, or 3-byte block counter (256, 65,536, or 16,777,216 blocks), and must pass a single input longer than that counter space so the counter wraps and the keystream restarts within the packet. The call returns the full input length with no exception, so the caller receives no signal that some bytes were transformed under a repeated keystream; the resulting two-time-pad condition permits plaintext recovery. No public exploit code has been identified at time of analysis, and the non-default short-IV native deployment requirement keeps realistic exposure narrow, which is why this is assessed as AC:H rather than trivially exploitable.
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman Desktop, Red Hat OpenShift/CRC tooling and related Red Hat products), lets an attacker who can reach the /services/forwarder/expose control endpoint supply an arbitrary socket path that is passed unsanitised to os.Remove, resulting in deletion of arbitrary files on the host. The defect is reachable without credentials (PR:N) but requires adjacent/guest-side network access to the forwarder API (AV:A), which is normally bound to the virtual network rather than exposed as a routed internet service; impact is limited to integrity and availability (no data disclosure). No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); an upstream fix exists in gvisor-tap-vsock PR #718. The vendor score of 9.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) reflects low-complexity, unauthenticated access combined with a scope change and High integrity/availability impact, and the actual risk depends heavily on whether the forwarder control API is reachable by an untrusted guest or adjacent host.
Memory-exhaustion denial of service in the elixir-protobuf library (protobuf) from 0.8.0 onward allows an unauthenticated remote attacker to crash an Elixir decoding process by supplying a deeply nested JSON document through Protobuf.JSON.decode/3, decode!/3, or from_decoded/3 when the target schema contains a self-referential or cyclic message type. Because the embedded-message clause of decode_singular/3 recurses once per nesting level without touching the decoder's depth counter, the recursion_limit option offers no protection and each level consumes a stack frame plus heap objects until the process runs out of memory; confidentiality and integrity are unaffected, only availability. Exploitation is unauthenticated and requires no user interaction, but is limited to applications that decode untrusted JSON into recursive message definitions, and no public exploit code has been identified at time of analysis (EPSS data not provided).
Request smuggling in the Go net/http standard library occurs when an application handler answers an HTTP/1 CONNECT request with a 2xx status and then returns without hijacking the connection, causing the server to keep parsing HTTP requests on a connection that an intermediate proxy now treats as an opaque tunnel. Affected builds are net/http before 1.26.9 and the 1.27.x line before 1.27.2 (CWE-444, parser disagreement between proxy and origin server). Exploitation requires a non-default handler pattern plus a fronting proxy, so despite the published CVSS base of 7.5 the assessed real-world priority is moderate-to-low; no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none with Technical Impact: partial.
Signals conflict: the original CVSS rates integrity and availability impact as high (9.1), but independent assessment determines only low availability impact. A logic error in Go's HTTP/2 server allows unauthenticated remote attackers to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection) by resetting streams to trigger a double refund of flow control credit. The practical impact is limited because total buffered data remains bounded by concurrent stream limits and stream-level flow control; no public exploit identified at time of analysis, and patches are available as upstream commits.
CPU exhaustion in the Go standard library's net/http file-serving handlers (FileServer, ServeContent, and ServeFile(FS)) lets remote unauthenticated attackers degrade or deny service by sending a single HTTP request whose Range header enumerates a large number of small ranges. The flaw affects net/http in Go releases before 1.26.9 and 1.27.0-0 before 1.27.2, but only on servers that actually expose those file-serving handlers; default configurations that use them are affected with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Impact is availability-only, exploitation is not confirmed and no public exploit has been identified at time of analysis, EPSS is low at 0.17% (6th percentile), and patched releases are available from the vendor.
Go's os.Root API on Windows can be tricked into creating a directory outside the sandboxed root when the final path component passed to Root.Mkdir or Root.MkdirAll is a junction that resolves to an empty location, allowing an attacker who can influence filesystem layout or path input to escape the intended root boundary. Only Windows applications built with a vulnerable Go toolchain (os and internal/syscall/windows before 1.26.9, or the 1.27.0 pre-release line before 1.27.2) that actually use os.Root are affected; non-Windows builds and applications not using os.Root are not impacted. The headline CVSS 9.8 overstates real-world risk: our independent assessment scores it AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N because the primitive is confined to directory creation outside the root, with no arbitrary file read, content write, or code execution described. EPSS is 0.21% (10th percentile), no public exploit has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Strawberry GraphQL versions 0.217.0 through 0.326.0 contain an authorization bypass in which a custom permission class whose has_permission() is declared as a synchronous def but returns an awaitable (for example a coroutine) can grant access to fields that should be denied. Because only async def methods are detected as asynchronous, the returned awaitable is evaluated for truthiness on the synchronous resolve path and is always truthy, so the protected resolver runs even when the awaitable would resolve to False. The flaw affects synchronous field resolvers under both execute_sync() and execute(); permissions declared with async def or returning a plain boolean are unaffected, and no public exploit code or confirmed active exploitation was identified at time of analysis, though the patch is a single small commit (PR #4605) that is easy to reverse-engineer.
Arbitrary memory disclosure and denial of service in Hazelcast allow a client that can reach a cluster member's listening port to read arbitrary data from that member's Java heap, off-heap storage and JVM process address space, to crash members, and - in some Hazelcast Enterprise Edition configurations - to corrupt memory with possible remote code execution. All editions prior to 5.4.5, 5.5.10, 5.6.1 and 5.7.0 are affected in both the slim and full distributions, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a low-privileged client credential where client authorization is enforced, while in default deployments with Hazelcast Security disabled any reachable client can connect without credentials; the vendor's CVSS 4.0 score of 9.3 assumes PR:N. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but vendor-released patches exist (5.4.5, 5.5.10, 5.6.1, 5.7.0) and the vendor's own hardening guidance - enabling security, enforcing client authorization and defining an explicit zero-config Compact serialization allowlist - directly addresses the exposure, making this a genuine high-priority vulnerability rather than an inflated score.
Authorization bypass in the Hazelcast IMap Predicates API allows a client holding only limited cluster credentials to execute arbitrary code on a Hazelcast cluster member in versions prior to 5.4.5, 5.5.10, 5.6.1 and 5.7.0. Because the missing check sits inside the map permission model itself, a partially trusted client - for instance one granted read or put rights on a single map - can invoke the aggregation and projection query paths that were never gated by a permission bit, yielding full compromise of confidentiality, integrity and availability on the member (CVSS 4.0 base 8.7 High; vendor-assessed CVSS 3.1 8.7 with PR:L). Exploitation requires an authenticated client connection to the cluster, so it is not reachable by fully unauthenticated attackers; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor states no workaround exists other than upgrading.
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galaxy collection install` against a crafted collection tarball, because the archive extractor validates member paths with lexical normalization (os.path.abspath) instead of resolving symlinks (os.path.realpath) and performs no containment check on symlink-typed directory members before creating them, letting chained symlink entries redirect a subsequent file member outside the destination directory. The flaw (CWE-59, CVSS 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is a bypass of the fix for CVE-2020-10691 and requires the victim to actively install the malicious collection, so an attacker can write arbitrary files with the privileges of the ansible-galaxy user and potentially achieve code execution on the control node. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; affected deployments include ansible-core 2.x as shipped in Red Hat Ansible Automation Platform 2 and numerous other Red Hat products, and no patched version is identified in the supplied intelligence, which currently cites only the Red Hat CVE page and Bugzilla 2531646.
Banks, a Python library for generating LLM prompts from a simple template language, ships a DirectoryPromptRegistry that prior to version 2.5.1 fails to reject symbolic links for its index.json file and for discovered or existing .jinja prompt files. An attacker who can influence the contents of the registry directory - for example by planting a symlink or by controlling files extracted from an untrusted archive into that directory - can cause _scan() and get() to follow a link outside the registry root and disclose arbitrary files, while set(), _save() and _load() can read or overwrite an external link target, giving high confidentiality and integrity impact with limited availability impact. Exploitation requires local placement influence over the prompt directory and applies only to deployments that use DirectoryPromptRegistry and expose that directory to untrusted input, which is why the vendor CVSS 4.0 base score is 7.3 (AV:L/AC:L/AT:P/PR:L/UI:N) and the assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. The issue is fixed in version 2.5.1.
Authenticated Kerberos clients can cause a NULL pointer dereference in MIT Kerberos 5 through 1.22.2 by sending a forwarded KRB-CRED message with more tickets than ticket_info entries to a GSS-API acceptor service, resulting in a service crash (denial of service). The vulnerability requires the attacker to hold a valid Kerberos principal and the target to process forwarded credentials via gss_accept_sec_context(); impact is limited to availability with no confidentiality or integrity effect. No public exploit code identified at time of analysis, and a patch is available via upstream commits.
Stack-based buffer overflow in Poppler's Decrypt::revision6Hash() allows a caller-supplied password longer than 127 bytes for an AESV3/R6 (AES-256 revision 6) encrypted PDF to overwrite the K1 and E stack buffers, crashing the process and corrupting nearby memory. Poppler 0.42.0 through 26.10.0 is affected across libpoppler, libpoppler-glib and the C++ API, and the flaw is remotely reachable and unauthenticated per the assessed vector (CVSS:4.0 PR:N) but carries an explicit attack requirement - the attacker must control the password string passed to the decrypt routine - so realistic exposure is automated or server-side PDF pipelines that decrypt files with externally supplied passwords rather than interactive viewers where the user types the password. Impact is primarily availability (A:H) with a limited integrity effect (I:L); no public exploit identified at time of analysis, no CISA KEV confirmation of active exploitation, and an upstream fix is tracked via freedesktop GitLab merge request 2398 with a vendor advisory noted.
Denial of service through CPU exhaustion in Go's HTTP/2 implementation (net/http and golang.org/x/net) lets an unauthenticated remote HTTP/2 peer open many streams and then repeatedly send small SETTINGS frames carrying SETTINGS_INITIAL_WINDOW_SIZE, forcing the victim to recompute per-stream flow-control window state at O(number of streams) for each frame (assessed CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Impact is confined to availability - there is no confidentiality or integrity loss - and exposure is limited to Go programs with HTTP/2 active: servers over TLS (the Go default) and Go HTTP/2 clients connecting to an attacker-controlled peer, in versions predating the O(1) initial-window-size fix tracked in Go issue 81742. No public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV); HTTP/1-only deployments are unaffected.
HTTP/1 connection desynchronization in Go's net/http Transport allows response poisoning for other users of a shared, pooled connection pool. When an outbound HTTP/1 CONNECT request carries a non-empty Request.Body, Transport writes those bytes to the wire unframed after the request headers; if the upstream server rejects the CONNECT with a non-2xx but connection-reusing (keep-alive) response, Transport returns the still-contaminated socket to the idle pool, and the backend may parse the trailing bytes as a pipelined follow-up request. The primary exposure is reverse proxies (including httputil.ReverseProxy) that forward CONNECT through a shared Transport, where the next caller to reuse the desynchronized connection reads the response to the injected request - an unauthenticated remote scenario per the CVSS vector (PR:N), though exploitation requires a specific chain rather than a default single request. No public exploit identified at time of analysis; EPSS is low at 0.17% (5th percentile).
Concurrent mutation of the shared HPACK encoder in Go's HTTP/2 server stack (net/http, also reachable via golang.org/x/net/http2, tracked as GO-2026-6617) allows remote, unauthenticated attackers to crash the process by repeatedly issuing requests while sending SETTINGS frames that change SETTINGS_HEADER_TABLE_SIZE. One goroutine encodes a HEADERS frame for an outgoing response while another resizes the encoder's dynamic table with no synchronization, producing a data race (CWE-362) that can terminate the server. The impact is availability only (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H); exploitation is timing-dependent and requires HTTP/2 to be enabled, but publicly available exploit code exists and EPSS is low at roughly 0.18% (7th percentile). There is no confirmed active exploitation (CISA KEV does not list this CVE), and a vendor patch is available per vendor advisory.
Go toolchain (cmd/go) releases before 1.26.9 and 1.27.0 through 1.27.1 can be induced to substitute an attacker-controlled module in place of the bundled golang.org/fips140 dependency when a developer builds a project that ships a bogus golang.org/fips140 definition and connects the build to an attacker-operated GOMODPROXY. Successful abuse yields high confidentiality, integrity, and availability impact within the build environment because the toolchain fails to properly validate the module's integrity check value (CWE-354), so untrusted module content is accepted in place of the trusted bundled copy. Exploitation is conditional rather than widespread: it requires both an attacker-crafted project and explicit developer action to use a non-default, attacker-chosen proxy (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), and no public exploit code or confirmed active exploitation has been identified at time of analysis, with EPSS at roughly 0.11% (1st percentile). Vendor patches are available in Go 1.26.9 and 1.27.2.
Checksum verification bypass in the Go toolchain (cmd/go) versions 1.27.0 before 1.27.2 and before 1.26.9 allows a malicious Go project with a forged golang.org/toolchain go.sum entry, combined with a user-selected attacker-controlled GOMODPROXY, to substitute a tampered toolchain that cmd/go would otherwise reject. Exploitation requires local access and user interaction (CVSS 7.8, AV:L/UI:R) and two attacker-controlled preconditions the victim must opt into: operating inside the crafted project and using the malicious proxy. No public exploit code identified at time of analysis, and EPSS is 0.13% (2nd percentile), indicating low predicted exploitation likelihood.
Remote memory exhaustion in the Go standard library's crypto/tls package lets a client that sends a crafted ClientHello containing multiple ECH outer extension references - a construction prohibited by RFC 9849 - force disproportionate memory allocation in TLS servers with Encrypted Client Hello enabled. Only Go releases before 1.27.2 and before 1.26.9 are affected, and the flaw is fixed in those two releases; no public exploit code exists and there is no CISA KEV listing at time of analysis. The practical attack surface is narrow because ECH is opt-in and not active in a default Go TLS server configuration, but where enabled the attacker needs no authentication or user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5).
Cross-project resource manipulation in OpenStack Mistral through 23.0.0 allows an authenticated project member to rewrite and un-publish another project's public action definitions and environments via the v2 API, while a project administrator can relocate another project's resource by creating a workbook with a colliding embedded action or workflow name. This incorrect authorization vulnerability (CWE-863) has a CVSS 4.0 base score of 7.2 (High) and requires a valid account on a multi-tenant cloud that exposes the Mistral v2 API; no public exploit code was identified at time of analysis, and the impact is primarily integrity (VI:H) with limited confidentiality and availability effects. Deployments without the Mistral API exposed are not affected.
Cluster-wide denial of service in OpenStack Mistral (all versions through 23.0.0) lets any authenticated holder of a valid Mistral token - regardless of role or tenant - read and alter the service's global maintenance state through the /v2/maintenance API, because the controller clears the request context and calls the maintenance service without any policy enforcement. Setting the state to PAUSED halts processing of new workflow and execution objects for every tenant project until an operator intervenes, giving a lowest-privileged tenant member a persistent, cross-tenant availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 7.1 High; NVD's CVSS 4.0 vector scores identically at 7.1 High). Exploit path is reachable against default configurations with no feature flag or non-default setting required, but it is not anonymously exploitable - a valid Mistral API token is the single prerequisite. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis; patch availability is not confirmed in the provided data.
FFmpeg through 9.0.2 contains an infinite loop in ff_rtsp_connect() (libavformat/rtsp.c) because the RTSP client follows 3xx redirects without a redirect limit, allowing a malicious RTSP server to cause endless reconnects that saturate a CPU core. Exploitation is remote and unauthenticated (CVSS PR:N) but requires passive user interaction (UI:P/UI:R): the victim must open an RTSP stream that resolves to the attacker-controlled server, which then answers every request with a 302 redirect to itself or another server. Publicly available exploit code exists (a gist PoC), but no CISA KEV entry confirms active exploitation; the independent assessment rates this as a genuine but bounded availability threat, with the highest exposure in services that accept and open user-supplied RTSP URLs automatically.
Infinite loop in FFmpeg's HLS demuxer (libavformat/hls.c) lets remote attackers pin CPU and I/O indefinitely on any host that feeds a crafted playlist to FFmpeg before version 8.1.3. A malicious Media Playlist that embeds Master Playlist tags causes parse_playlist()/hls_read_header() to keep registering self-referencing variants that never terminate. Exploitation is unauthenticated (PR:N) but requires a victim or automated pipeline to open the playlist (UI:P), impact is availability-only with no data disclosure or code execution, and publicly available exploit code exists; there is no confirmed active exploitation (CISA KEV) at time of analysis.
OpenStack Mistral through 23.0.0 exposes an authenticated command-injection path in its std.ssh_proxied action: the caller-supplied proxy_command string is handed to paramiko.ProxyCommand() and executed as a local subprocess on the executor host under the Mistral service account, before any SSH connection to the gateway or target host is even attempted. Any authenticated project member who can reach the standard action-execution API can therefore run arbitrary OS commands on the Mistral executor, with the default configuration affected because std.ssh_proxied is permitted out of the box; deployments that explicitly disable or restrict that action are not impacted. Exploitation requires valid project credentials (PR:L, not anonymous), so the practical risk is privilege escalation and lateral movement from a low-privileged tenant account rather than unauthenticated compromise, and no public exploit code was identified at time of analysis.
Cross-site request forgery in Pydantic AI's development web chat UI allows any website a developer happens to visit while `Agent.to_web()` or `clai web` is running to fire forged chat requests at the loopback-hosted server, causing the served agent to start a run and execute its tools with the privileges and credentials of the local process. The pre-patch `/api/chat` endpoint performed no Content-Type validation, so a malicious page can deliver a JSON body cross-origin using a CORS-safelisted content type (text/plain, multipart/form-data, application/x-www-form-urlencoded, or none at all) without triggering a preflight; binding the server to localhost - the default - provides no protection because a browser page can reach 127.0.0.1. Realized damage is bounded by the tools the agent exposes, and `requires_approval=True` does not help because the endpoint trusts approval decisions relayed by the client; exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L, 7.6) but requires the developer to browse an attacker-controlled page while the dev UI is running, and there is no public exploit code identified at time of analysis. Vendor-released patches are available in 1.107.4 and 2.28.0.
Concurrency slot exhaustion in Pydantic AI 2.10.0 through 2.52.x lets streamed model requests permanently occupy slots in a shared ConcurrencyLimiter, progressively starving later requests until a service that reuses one long-lived limiter can no longer make model calls - an availability-only denial of service (C:N/I:N/A:H) with no confidentiality or integrity impact. The issue is remotely reachable and unauthenticated (PR:N), but our independent assessment rates it AC:H rather than GitHub's AC:L because exploitation requires a specific deployment pattern: model requests wrapped in ConcurrencyLimitedModel (or covered by limit_model_concurrency) that share a single long-lived limiter across streamed responses; agent-level max_concurrency and all non-streaming model requests are explicitly unaffected, and a short-lived or per-request limiter never accumulates enough leaked slots to deadlock. Slots are leaked by early stream termination, cancellation, consumer exceptions, or even full stream_text() consumption with debounce_by=0.1, and the vendor-released fix in 2.53.0 is available; no public exploit code identified at time of analysis.
Unauthenticated path traversal in the Ollama `/api/pull` endpoint lets a remote attacker write an arbitrary file outside the model store by submitting a crafted path-traversal sequence in the layer digest field, because the `digestToPath` function does not adequately validate digests before constructing a filesystem path. When the Ollama process can write to `/usr/lib/ollama` (described as the default in most Ollama Docker images) and the server or container is subsequently restarted, the planted binary is loaded and executed, yielding remote code execution as root; the same file-write primitive is available without authentication to anyone who can reach the API. The issue is fixed in Ollama 0.35.0, no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none', and no EPSS score was supplied in the source data. Real-world risk is high but conditional: exploitation of the full RCE chain depends on write access to `/usr/lib/ollama` and a restart, so deployments not using the default Docker image, running Ollama as a non-privileged user without write access to that directory, or not exposing the API to untrusted networks face substantially reduced exposure.
Arbitrary code execution on the Vault host is achievable in HashiCorp Vault and Vault Enterprise when a privileged operator restores a crafted Integrated Storage (Raft) snapshot in a deployment configured with Shamir seals and an external plugin directory, because stored plugin catalog entries are not consistently verified to reference binaries inside that configured directory (CWE-22 path traversal). The attacker must already hold the high privileges needed to restore a Raft snapshot (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), and exploitation also depends on the non-default Shamir-seal-plus-external-plugin-directory configuration, so this is a genuinely serious but condition-gated vulnerability rather than a mass-exploitation threat; clusters using auto-unseal or without an external plugin directory are not affected by this path. No public exploit identified at time of analysis, and vendor-released fixes are available in Vault Community Edition 2.1.2 and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
Cross-host request replay in AsyncHttpClient (AHC) before 3.0.13 and 2.16.1 can disclose the original origin's request path, Host header, Authorization credentials, or even a plaintext request to a completely different destination when an application's ResponseFilter fails over or retries a request onto a different base origin (host, scheme, or port) or downgrades HTTPS to HTTP. The assessed vector is unauthenticated from the network perspective (PR:N, AV:N), but exploitation hinges on a concrete application-side prerequisite: a ResponseFilter (or equivalent retry/failover code path) that replays requests across origins - default AHC usage with same-host retries is unaffected, and AC:H/AT:P reflect the specific sequencing that must occur. No public exploit code and no confirmed active exploitation were identified at time of analysis, and because the impact depends on configuration rather than an attacker-reachable endpoint, the CVSS 4.0 score of 9.4 and the independent CVSS 3.1 assessment point in different directions; prioritization should be driven by whether a cross-host replaying filter is deployed.
Digest mutual-authentication bypass in AsyncHttpClient (AHC) 3.0.12 allows a rogue or on-path peer to be accepted as the authenticated server: when a Digest challenge advertises qop="auth-int" as the only supported quality-of-protection, the client negotiates it but cannot compute the expected rspauth, treats that as unverifiable-but-nonfatal, and accepts a response whose rspauth value is invalid. The flaw is network-reachable, unauthenticated and requires no user interaction (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, 8.8), with the primary impact on integrity (VI:H) consistent with server impersonation rather than the data theft implied by the 'Information Disclosure' tag. It only affects applications that use AHC's Digest Realm with mutual authentication and connect to a peer offering an auth-int-only challenge; deployments where the server offers 'auth' or 'auth,auth-int' are unaffected because AHC prefers and verifies 'auth'. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor-released patch is version 3.0.13.
Cleartext credential disclosure in AsyncHttpClient (AHC) before 3.0.12 on the 3.x line and before 2.16.1 on the 2.x line causes a client configured to use an HTTP proxy to write the origin request and its Authorization credentials onto a still-plaintext proxy connection when the proxy rejects the CONNECT with anything other than 200, because the client infers an established tunnel from the last request method rather than the CONNECT result. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 HIGH), this is an unauthenticated, confidentiality-only issue: Basic credentials can be recovered directly, while NTLM responses may be cracked or relayed. Exploitation is limited to environments where the victim application routes through an HTTP proxy and the attacker controls or can man-in-the-middle the client-to-proxy hop; no public exploit identified at time of analysis.
Credential disclosure in the AsyncHttpClient (AHC) Java library allows a malicious or compromised origin server or proxy to capture plaintext-recoverable usernames and passwords from applications that configure HTTP credentials via Realm.Builder. When the attacker returns a WWW-Authenticate or Proxy-Authenticate challenge labeled 'Digest' but with the nonce parameter omitted or empty, versions prior to 3.0.13 (3.x) and 2.16.1 (2.x) silently fall back to Basic authentication and resend the credentials in reversible Base64, defeating the entire purpose of Digest. Exploitation is unauthenticated from the network (CVSS v4.0 8.7, AV:N/PR:N, independent assessment CVSS v3.1 C:H/I:N/A:N), but requires the attacker to control or tamper with the authentication challenge, so it is not exploitable against arbitrary endpoints; no public exploit code or CISA KEV entry was identified at time of analysis.
Connection-pool key scoping in AsyncHttpClient (AHC) 2.0.0 through 3.0.13 omits identity-defining fields for Kerberos, SPNEGO, NTLM, authenticated proxy and SOCKS/CONNECT login paths, so a request can be handed a pooled keep-alive socket that was already authenticated as an entirely different identity and then execute under that first identity's credentials, exposing the other identity's data or authority. Reachability is conditional: the application must use Kerberos/SPNEGO/NTLM, an authenticated proxy realm, or SOCKS/CONNECT proxy logins, and specifically the ambiguous cases where login has no configured principal, where realms are proxy realms, where distinct identities share a user name, or where proxy logins are used - clients using only HTTP Basic/Digest or a single identity/principal are not affected. Rated CVSS 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, CWE-346 Origin Validation Error); exploitation depends on timing the reuse of an already-authenticated socket across multiplexed callers, and there is no public exploit identified at time of analysis and no CISA KEV listing. Vendor-released patch: 3.0.14.
Unbounded WebSocket permessage-deflate decompression in the AsyncHttpClient (AHC) Java library versions 2.2.0 through 3.0.13 allows a malicious or compromised WebSocket peer to exhaust the JVM heap of the connecting application by sending a small compressed message that inflates into a very large Netty buffer. The flaw is remote, requires no authentication or user interaction from the peer side (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), but it only triggers when the client application itself opens an outbound WebSocket connection with permessage-deflate compression negotiated - meaning the victim must connect to an attacker-controlled endpoint or be exposed to a man-in-the-middle. Impact is availability-only: no confidentiality or integrity loss, and no public exploit code has been identified at time of analysis. The issue is fixed in version 3.0.14.
Cyrus SASL clients that use the DIGEST-MD5 authentication mechanism can be crashed by a malicious or on-path server that supplies a crafted challenge field (such as realm or nonce), because the add_to_challenge() function computes a buffer size before DIGEST-MD5 quoting and fails to account for escaping that lengthens the value, resulting in a heap-based out-of-bounds write. This is a client-side denial-of-service flaw affecting Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4; the assessed CVSS vector is AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H, meaning unauthenticated remote attackers must control or intercept the server endpoint and the victim must initiate authentication. No public exploit code or confirmed active exploitation is identified at time of analysis.
Command injection in Backstage's TechDocs build pipeline allows an authenticated user who can register or modify a documentation source to run arbitrary commands inside the TechDocs backend or its build container by supplying a crafted mkdocs.yml. Exploitation requires write access to a catalog entity or docs source that is processed by local or docker-based TechDocs generation, and the impact is confined to resources reachable by the backend or its build container; deployments that only publish externally pre-built documentation are not exposed. The issue is fixed in @backstage/plugin-techdocs-node 1.14.6 and 1.15.4, is rated CVSS 7.7 with high attack complexity, low privileges, and scope change, and there is no public exploit identified at time of analysis.
Remote code execution on TechDocs build hosts affects Backstage deployments running the @backstage/plugin-techdocs-node mkdocs generator prior to 1.14.6 (and 1.15.x prior to 1.15.4). An authenticated user holding the privilege to register or update catalog entities can commit a crafted mkdocs.yml whose markdown_extensions entries point at dangerous Python callables such as subprocess:Popen, os:system, or plantuml_markdown's plantuml_cmd, which mkdocs instantiates and executes while building the docs; the flaw requires authentication and an entity-registration permission rather than anonymous access, and deployments that publish pre-built docs or build in isolated disposable runners have a much smaller blast radius. The upstream fix, which extends MkDocs configuration sanitization to cover nested configuration keys, hyphenated extension names, and theme options, is available in vendor-released versions 1.14.6 and 1.15.4, and no public exploit code tied to this CVE was identified at time of analysis beyond the payload fixtures included in the upstream fix commit.
Heap memory corruption in llama.cpp's chat/tool parser lets unauthenticated remote attackers crash llama-server and potentially shape a controlled heap write primitive by sending a crafted POST /completion request containing a chat_parser that emits a tool-id token after a tool-close tag. Versions prior to build b11393 are affected; the trigger leaves the mapper's current_tool pointer dangling, producing a use-after-free and double-free in common_chat_peg_mapper::map. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, but the CVSS 4.0 score of 9.2 reflects high confidentiality, integrity and availability impact, and the independent assessment confirms high severity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) - reliable denial of service is straightforward, while converting the bug into a controlled heap write requires heap grooming. A vendor patch exists as upstream PR/commit and as build b11393.
A time-of-check to time-of-use (TOCTOU) race condition in Anthropic's Claude Code CLI allows an attacker who already has write access to a shared project workspace to atomically replace a project file with a symlink after the agent has validated the path but before it writes, causing Claude Code to follow the link and write to an arbitrary file outside the sandbox - for example a shell configuration file that will later be sourced by a higher-privileged session. Exploitation is bounded: it requires local write access to a workspace shared with a more privileged Claude Code session, requires winning a narrow timing race rather than triggering deterministically, and requires the privileged session to actually perform a write to the targeted path; single-user installations with no shared workspace are not exposed. There is no indication of active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, though Anthropic has already shipped the fix through the standard auto-update channel, leaving only manual-update holdouts at risk.