Suse
Monthly
OpenBlocks firmware versions before 5.0.8 contain an authentication bypass vulnerability that allows unauthenticated attackers on adjacent networks to gain administrator access and reset passwords without valid credentials. This high-severity flaw affects all OpenBlocks series devices and requires no user interaction to exploit, though no patch is currently available.
Cpp-Httplib versions up to 0.30.0 contains a vulnerability that allows attackers to add extra headers, modify request body unexpectedly & trigger an SSRF attack (CVSS 7.5).
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
WinRAR for Windows contains a path traversal vulnerability allowing crafted archives to execute arbitrary code, discovered by ESET and exploited in the wild for targeted attacks.
Chrome's V8 engine contains a type confusion vulnerability (CVE-2025-6554, CVSS 8.1) enabling arbitrary read/write operations through crafted HTML pages. KEV-listed with public PoC, type confusion in V8 is the most reliable class of browser exploitation primitives, providing full memory read/write capability for code execution within the renderer sandbox.
Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot option, which loads /etc/nsswitch.conf from the user-controlled chroot directory instead of the host system. KEV-listed with EPSS 26.5% and public PoC, this vulnerability allows any user with sudo --chroot access to achieve root privileges by placing a malicious nsswitch configuration and library in their chroot.
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attackers to escalate privileges over the network. KEV-listed with EPSS 57.6% and public PoC, this vulnerability in the core Windows file sharing protocol affects every Windows system on the network, enabling lateral movement from any compromised domain account to SYSTEM-level access on SMB-accessible systems.
Chrome's V8 JavaScript engine contains an out-of-bounds read and write vulnerability (CVE-2025-5419, CVSS 8.8) enabling remote heap corruption through crafted HTML pages. KEV-listed with EPSS 3.0% and public PoC, this vulnerability provides both read and write primitives in V8's heap, making it highly reliable for exploitation.
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows authenticated users to achieve remote code execution through a crafted upload URL. With EPSS 90.4% and KEV listing, this vulnerability in one of the most widely deployed open-source webmail platforms enables any email user to compromise the mail server, accessing all hosted mailboxes.
Erlang/OTP SSH server allows unauthenticated remote code execution by exploiting a flaw in SSH protocol message handling, enabling unauthorized system access with CVSS 10.0.
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoints. The query_commited and high_availability parameters are passed directly to Python's eval() function, allowing authenticated users to execute arbitrary Python code on the pgAdmin server.
Google Chrome on Windows contains a Mojo IPC handle validation flaw enabling sandbox escape through a malicious file, exploited in targeted attacks against Russian organizations in March 2025.
A critical path equivalence vulnerability in Apache Tomcat's Default Servlet allows unauthenticated remote code execution through specially crafted PUT requests using internal dot notation in filenames. With EPSS of 94% and active exploitation in the wild, this represents one of the most dangerous Tomcat vulnerabilities in recent years, affecting versions 9.0.0-9.0.98, 10.1.0-10.1.34, and 11.0.0-11.0.2.
PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperly neutralize quoting syntax, enabling SQL injection when function results are used to construct psql input. This vulnerability was used as the initial access vector in the BeyondTrust RS compromise chain.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI that allows remote code execution on Wazuh management servers.
Cacti monitoring platform prior to version 1.2.29 allows authenticated users to achieve remote code execution through the graph creation and template functionality. Attackers abuse the graphing engine to create arbitrary PHP scripts in the web root, escalating from monitoring access to full server control.
7-Zip contains a Mark-of-the-Web bypass vulnerability allowing attackers to circumvent Windows security warnings when extracting files from malicious archives, exploited in campaigns targeting Ukrainian organizations.
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 56.5%.
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute arbitrary code without user interaction. Confirmed actively exploited (CISA KEV) in May 2016 with public exploit code available. EPSS score of 92.76% (100th percentile) reflects the extreme likelihood of exploitation. This was a critical zero-day vulnerability used in targeted attacks before Adobe released emergency patches in APSA16-02 and APSB16-15.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 94.0%.
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in Adobe Flash Player allows network attackers to execute arbitrary code via integer overflow exploitation. Confirmed actively exploited (CISA KEV) with 88.97% EPSS score indicating extremely high real-world exploitation probability. Affects Flash Player before 18.0.0.324/20.0.0.267, Adobe AIR before 20.0.0.233, and associated SDKs across Windows, OS X, and Linux platforms. Vendor-released patches available since December 2015.
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 63.0%.
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 47.6%.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitrary code via crafted Flash content exploiting a use-after-free flaw in the ByteArray class. Confirmed actively exploited (CISA KEV) in July 2015 following the Hacking Team data breach, which exposed weaponized exploit code targeting this vulnerability. With EPSS score of 93.21% (100th percentile) and publicly available proof-of-concept, this represents critical risk to unpatched Flash installations across Windows, OS X, and Linux platforms. Vendor-released patches available via Adobe APSB15-16.
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in June 2015 by APT3 (a Chinese cyber espionage group) in phishing campaigns targeting aerospace and defense organizations.
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 89.0%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 70.5%.
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 71.1%.
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthenticated attackers to execute arbitrary code and escape security restrictions. Affects Oracle JRE 5.0 through Update 45, 6 through Update 45, 7 through Update 21, and OpenJDK 7. Confirmed actively exploited (CISA KEV) with 93.22% EPSS probability and publicly available exploit code. Oracle released patches in June 2013 CPU addressing the vulnerability through image channel verification corrections.
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 54.7%.
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 57.9%.
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 88.0%.
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.4%.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 74.6%.
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 84.0%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.7%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise through malicious Java Web Start applications and untrusted applets exploiting the Scripting component. CISA KEV confirms active exploitation in the wild. EPSS score of 92.59% (100th percentile) indicates extremely high probability of mass exploitation. Public exploit code exists, making this a critical priority for any environment running affected Java versions despite the vulnerability's age.
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute arbitrary code via malicious SWF content, actively exploited in targeted attacks in April 2011.
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execution, exploited in the wild via Flash content embedded in Microsoft Office documents and web pages.
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was actively exploited as a zero-day in December 2009 via crafted PDF files with ZLib compressed streams.
sdbootutil on SUSE Linux Enterprise Server 16.1, SLES for NVIDIA 16.1, openSUSE Leap 16.1, and Tumbleweed creates a world-readable debug log at /var/log/sdbootutil.log, enabling any local user to read potentially sensitive information from it. This local information disclosure (CWE-732) requires that the debug log has been generated and contains secrets. No public exploit has been identified at time of analysis, and the issue is not known to be actively exploited.
Local unprivileged users on SUSE Linux Enterprise Server 16.1, SLES for NVIDIA 16.1, openSUSE Leap 16.1 and openSUSE Tumbleweed can read a PIN or key secret that SUSE tooling renders as a QR code, because the secret is passed to qrencode as a command-line argument and is therefore exposed in /proc/<pid>/cmdline while the process runs. Exploitation requires the attacker to already hold a local low-privileged account on the same host (PR:L) and to win a short timing race against the brief qrencode invocation (AC:H), so this is a confidentiality-only credential-disclosure issue of modest severity with little realistic exposure on single-user or tightly controlled systems. There is no public exploit identified at time of analysis, and no vendor-released fix version has been confirmed in the available data, though SUSE tracks the issue through its Bugzilla and CVE pages.
Rancher Fleet's default SSH host-key validation trusts unverified server certificates when no known_hosts entry is present, enabling an on-path attacker to conduct a man-in-the-middle attack against SSH connections initiated by Fleet's git fetcher, cloner, or fleet apply command. Exploitation requires the attacker to occupy an on-path network position and the target server to lack a trusted known_hosts entry, yielding only low-level confidentiality, integrity, and availability impact. This is a moderate-priority issue, not a drop-everything emergency; no public exploit has been identified at time of analysis, and vendor-released patches are available in versions 0.10.12, 0.11.7, and 0.12.2.
A local, authenticated user on hosts running sssd (System Security Services Daemon) can stall the daemon's responder service by opening and holding a large number of concurrent connections to a responder socket while continuing to queue new connection attempts, driving the responder past its file-descriptor limit into an unthrottled retry loop. The result is a denial-of-service condition with high CPU consumption that blocks legitimate identity and authentication lookups (NSS/PAM) for other users. Exploitation requires local access and is rated high complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7), so realistic exposure is concentrated on shared or multi-user systems rather than single-administrator hosts; there is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing).
Authenticated users who are permitted to submit a Django model formset can delete database rows outside that formset's limiting queryset - without holding any permission on the targeted object - by forging management-form POST data when the affected model's primary key is editable through the form. The flaw is an authorization bypass through a user-controlled key (CWE-639) in django.forms.models.BaseModelFormSet.save_existing_objects(), rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) with integrity-only impact; it affects Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18, while models using the default AutoField/BigAutoField primary key are not affected. No public exploit code identified at time of analysis, and there is no confirmed active exploitation (not in CISA KEV); this is a genuinely moderate-severity authorization flaw and the signals are internally consistent.
Server-side request forgery (SSRF) in Django's GeoDjango spatial lookups allows remote unauthenticated attackers to make the Django process issue outbound network requests when an application passes attacker-controlled `bytes` raster values directly into a lookup against a `RasterField`. Affected versions are Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18; older unsupported series (5.1.x, 5.0.x, 4.2.x) were not evaluated and may also be affected. The flaw is an incomplete fix for CVE-2026-15307, and exploitation requires a deployment that uses GeoDjango raster fields and forwards raw untrusted bytes into spatial lookups - not a default Django configuration. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; Django rates it 'moderate' severity (CVSS 5.3), with impact limited to attacker-directed outbound requests rather than data compromise or code execution.
Quadratic-time parsing of quoted HTTP header parameters in Django 5.2 (before 5.2.18), 6.0 (before 6.0.9), and 6.1 (before 6.1.2) allows unauthenticated remote clients to consume disproportionate CPU by supplying a header value containing many separator characters inside a quoted parameter, potentially degrading or exhausting worker capacity. The vulnerable code path is reached by default through content negotiation such as HttpRequest.accepts() and Accept/Content-Type header handling, and the existing per-call length limit does not bound the combined size of repeated headers, so an attacker can amplify the cost across many headers in a single request. Impact is availability-only (CVSS 5.3, A:L, CWE-407); vendor patches are available in Django 6.1.2, 6.0.9, and 5.2.18, and no public exploit code was identified at time of analysis.
Remote denial-of-service in the Django web framework's language-negotiation helper django.utils.translation.get_supported_language_variant(), which caches attacker-supplied language codes as keys in an in-memory LRU cache before enforcing a length limit. An unauthenticated remote attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) who can influence the negotiated language - typically via the Accept-Language header, a language URL prefix, or LocaleMiddleware - can send many distinct, very long language codes so that each becomes a unique cache entry and steadily consumes process memory, degrading or exhausting the application worker. Affected are Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18; unsupported earlier series such as 5.1.x, 5.0.x, and 4.2.x were not evaluated and may also be affected. Impact is limited to availability (A:L) and requires sustained request volume rather than a single request, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Access control bypass in SSSD when configured with non-default ordering that evaluates password-expiration warnings before restrictive access rules allows remote authenticated users with expired passwords to gain unauthorized access to protected systems via alternative authentication methods such as SSH public key authentication. This flaw (CWE-393) affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 deployments using LDAP access control. Exploitation requires a specific non-default configuration, an expired password, and a non-password authentication path, making it a moderate conditional risk; no public exploit identified at time of analysis.
A malicious frontend can crash the BuildKit daemon (buildkitd) by submitting a crafted LLB (Low-Level Build) definition, causing a panic that terminates the daemon and interrupts all running builds. The vulnerability affects BuildKit versions prior to v0.33.1 and requires the attacker to have access to the build submission interface; no authentication is needed (PR:N) and no user interaction is required (UI:N), but the attack vector is local/adjacent (AV:L), making shared or multi-tenant build infrastructure the primary risk. No public exploit code has been identified at the time of analysis, and the vendor has released a patch in v0.33.1.
Moby BuildKit (all versions in the affected range per the unbounded CPE cpe:2.3:a:moby:buildkit:*:*:*:*:*:*:*:*) can be made to run its cleanup routine against a modified CA bundle when proxy networking with CA injection is enabled, a time-of-check-to-time-of-use (CWE-367) race that causes cleanup to block, operate outside the build rootfs, or fail without failing the build. The attacker must be able to submit or execute a build on the builder (local, low-privilege access; PR:L) and must first change the build's injected CA bundle before cleanup runs; the non-default proxy-with-CA-injection mode sharply narrows exposed deployments, and the dominant consequence is availability and integrity of the cleanup operation (VA:H, VI:L) rather than confidentiality loss. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; vendor-released patch v0.33.1 is available.
BuildKit (moby/buildkit) contains a policy-validation bypass in which a specially crafted Git source build step makes a repository appear to originate from a different remote URL than the one actually used during git clone, so repository-identity or URL-based policy rules can be evaded. The issue affects BuildKit builds prior to v0.33.1 and requires an attacker to hold build-submission privileges (CVSS vector PR:L); policies that validate commit SHA, commit data, or cryptographic signatures continue to apply correctly, which limits the practical impact (vendor CVSS 4.0 base 6.0, independent assessment 3.1 base with AC:H, low confidentiality and high integrity impact, no availability impact). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vendor reports a patch is available.
Denial of service in the BuildKit Dockerfile frontend (buildkitd) allows a user who can submit a build context to exhaust the daemon's memory and terminate it by placing an oversized Dockerfile or .dockerignore file in that context, because these files were loaded into memory without any size limit (CWE-789). The assessed vector (AV:L/PR:L) indicates low-privilege, local/context-level access is required to submit the build, so the practical risk is concentrated on shared or multi-tenant buildkitd instances such as CI/CD pipelines and hosted build services, where one submitter's crash interrupts other users' builds, while a single-user workstation daemon only harms its own environment. Impact is bounded to availability with no code execution, data disclosure, or integrity impact, no public exploit code or CISA KEV confirmation was identified at time of analysis, and the vendor has released BuildKit v0.33.1, which rejects such files above 16 MiB.
Denial of service in Moby BuildKit allows anyone able to submit an LLB build definition to a buildkitd daemon to panic and terminate the daemon process, aborting every build running on that instance. The flaw is an out-of-bounds array index (CWE-129) reached during processing of an attacker-controlled low-level build graph, and it affects all BuildKit releases prior to v0.33.1, including BuildKit embedded in Docker Engine and CI/build-service deployments. The assessed impact is availability-only (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.9), the attack surface is the local build API/daemon socket rather than arbitrary network exposure, and severity scales with multi-tenancy - a shared CI runner or multi-tenant build service loses all concurrent builds from a single crafted definition. Vendor patch v0.33.1 is available; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
BuildKit, the container build engine used by Docker and exposed through `docker build`/buildx, can be tricked into performing file operations on special file inodes - device nodes, FIFOs, or sockets - at paths where it expects ordinary regular files, a confused-deputy condition (CWE-441). A user who builds an attacker-controlled Dockerfile or build context can therefore cause build operations to hang/block, and on rootful workers can obtain unintended access to host devices; rootless configurations are effectively limited to availability and integrity effects. The attack is local and requires the victim to actively run a build on the malicious input, so exposure concentrates in multi-tenant or untrusted-source CI/CD pipelines that use rootful BuildKit workers; no public exploit has been identified at time of analysis and the flaw is not in CISA KEV. This is best treated as a medium-severity, defense-in-depth hardening issue rather than an urgent remote-exploitation priority.
Privilege-model bypass in Rapid7 Velociraptor's Windows.Sysinternals.SysmonLogForward artifact allows an authenticated operator who holds only the COLLECT_CLIENT permission (typically the built-in 'Investigator' role) to launch an arbitrary, attacker-chosen binary on monitored Windows endpoints instead of the installed Sysmon binary. Because the artifact exposes a user-controllable binary-path parameter and fails to enforce the additional EXECVE permission that gates comparable dangerous artifacts, successful collection results in code execution on the endpoint under the elevated privileges the artifact normally runs with, yielding high confidentiality, integrity, and availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exploitation is not anonymous: the attacker must already be a trusted Velociraptor operator with artifact-collection rights, and the chosen binary must be reachable or placeable on the target endpoint, which narrows realistic exposure to insiders or compromised operator accounts. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue is a moderate, privilege-escalation class flaw rather than a mass-exploitation threat.
A malicious external BuildKit frontend can issue crafted requests against the daemon's internal API that trigger a data race, causing the BuildKit daemon to panic and crash. The issue affects BuildKit deployments where the operator has opted into running an untrusted or attacker-controlled frontend (for example through a `# syntax=` reference to a third-party image); default builds that use trusted first-party frontends are not exposed. It is a medium-severity denial-of-service condition: exploitation requires low-level privileges (PR:L) through the frontend channel, local access (AV:L), and successful timing of a race (AT:P), and there is no public exploit identified at time of analysis. A vendor fix is available in BuildKit v0.33.1.
BuildKit can cache a fetched snapshot under a claimed content digest without adequately verifying that the blob bytes match that digest, letting an attacker who controls or compromises a registry or OCI-layout blob source poison the cache and compromise the integrity of later victim builds that reuse that digest. The attacker does not need credentials per the CVSS PR:N vector, but they must be able to serve BuildKit blob requests, and a victim must run a build against the attacker-influenced source for exploitation to matter. No public exploit was identified at time of analysis; vendor patch v0.33.1 is available, and an independent assessment rates this as a moderate, conditions-dependent integrity flaw rather than a drop-everything emergency.
Incorrect authorization in Rapid7 Velociraptor allows an authenticated user with the LABEL_CLIENTS permission to alter server-wide metadata via the SetClientMetadata operation, which should be restricted to server administrators. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) and classified as CWE-863 (Incorrect Authorization), producing high integrity impact with no confidentiality or availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis; the primary risk is privilege escalation for insiders or compromised low-privilege accounts, with impact scaling to how broadly LABEL_CLIENTS is delegated in a given deployment.
Cross-tenant event-stream disclosure in Rapid7 Velociraptor lets an authenticated API user who holds event-watching privileges in one organization read WatchEvent gRPC streams belonging to a different organization they are not authorized for, because the server validates permissions against the caller's own OrgId instead of the OrgId supplied in the request. Only multi-org (multi-tenant) deployments with more than one Org defined are meaningfully exposed; single-org installs have no other tenant to pivot to, and the impact is confidentiality-only with no write or denial-of-service effect. Exploitation requires valid low-privileged API credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and no public exploit code was identified at time of analysis.
Environment-variable and INI-file value disclosure in LibreOffice lets a crafted document exfiltrate host configuration data to a remote server when the victim opens it, because document-supplied URLs can still be expanded in code paths that the earlier CVE-2024-12426 fix missed. The incomplete fix overlooked XForms instance data and the Calc CSV and SQL data providers, which continue to resolve internal-scheme URLs originating from the document. This is a moderate-severity, confidentiality-only flaw (CVSS 4.0 base 6.7, CWE-200) that requires the victim to open an attacker-supplied file, with no public exploit identified at time of analysis; the independent assessment scores it as a local-vector, passive-user-interaction issue with no impact on integrity or availability.
Server-side request forgery in LibreOffice on Linux can expose local files and internal or remote URLs when a document links to a crafted HLS media playlist and the victim opens it and permits link updates. LibreOffice relies on the GStreamer media backend on Linux to play linked audio and video; a malicious playlist's listed resources were fetched while the document loaded and their contents could be written into the document, yielding confidentiality impact (VC:H, SC:H) with no integrity or availability impact in the assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N). The issue is moderate severity and interaction-dependent rather than an urgent priority; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and exploitation is constrained to Linux installations using the GStreamer backend.
Opening a crafted LibreOffice Calc document can cause a local text file on the victim's machine to be read into the spreadsheet, leaking its contents to anyone who later views or receives the file. The document must embed a saved external data link of the sql type that points at a local folder of text files as a database; vulnerable versions automatically restore that link at load time, whereas fixed versions restore only the csv, html and xml data providers. Exploitation requires the victim to open the attacker-supplied document (user interaction, UI:P in the vendor's CVSS 4.0 vector of 6.7, and UI:R in the independent CVSS 3.1 assessment), so exposure is limited to targeted social-engineering scenarios where the attacker also knows or guesses a useful local path and has a way to retrieve the populated sheet; no public exploit identified at time of analysis and the issue is not in CISA KEV.
LibreOffice Calc on affected versions automatically fetched external CSV data links embedded in a spreadsheet while the document loaded, so an attacker-crafted Calc file could read a local file into a sheet or force a request to a host of the document author's choosing (SSRF, CWE-918). Exploitation is local and interaction-gated - the attacker must deliver the malicious document and the victim must open it - and the flaw affects confidentiality only, with no impact on integrity or availability. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor addressed it by placing external data links under the same link-update control that governs other spreadsheet links.
LibreOffice Calc fails to confine file operations when processing an external data-source link to an embedded Firebird database, allowing a crafted document to write files to any location the user has write permission to. Exploitation requires the victim to open the malicious spreadsheet (user interaction) and does not by itself escalate privileges; no public exploit or active exploitation has been identified at time of analysis. The vulnerability is a moderate-severity, user-interaction-dependent file-write issue (CVSS 6.8) rather than a high-priority remote threat.
Key-size validation bypass in Bouncy Castle for Java before 1.86 (and Bouncy Castle for Java FIPS before bcpkix-fips 2.0.13 / 2.1.13) allows a key-transport EnvelopedData or AuthEnvelopedData message whose HKDF-derived content-encryption key does not match the advertised content-encryption algorithm to be accepted even when the application has explicitly enabled org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidation(true). The defect is confined to messages using RFC 9709 CEK derivation (id-alg-cek-hkdf-sha256); messages with a matching key size, non-HKDF messages, and recipients that never enable validation are unaffected, and the opt-in control is off by default, so this is a medium-severity defense-in-depth failure rather than a direct decryption or key-recovery primitive. Unauthenticated remote attackers who can supply CMS content to an application that has enabled the control can silently defeat the only mechanism the API offers for enforcing recovered key size; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor-released patch is available.
OpenBlocks firmware versions before 5.0.8 contain an authentication bypass vulnerability that allows unauthenticated attackers on adjacent networks to gain administrator access and reset passwords without valid credentials. This high-severity flaw affects all OpenBlocks series devices and requires no user interaction to exploit, though no patch is currently available.
Cpp-Httplib versions up to 0.30.0 contains a vulnerability that allows attackers to add extra headers, modify request body unexpectedly & trigger an SSRF attack (CVSS 7.5).
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
WinRAR for Windows contains a path traversal vulnerability allowing crafted archives to execute arbitrary code, discovered by ESET and exploited in the wild for targeted attacks.
Chrome's V8 engine contains a type confusion vulnerability (CVE-2025-6554, CVSS 8.1) enabling arbitrary read/write operations through crafted HTML pages. KEV-listed with public PoC, type confusion in V8 is the most reliable class of browser exploitation primitives, providing full memory read/write capability for code execution within the renderer sandbox.
Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot option, which loads /etc/nsswitch.conf from the user-controlled chroot directory instead of the host system. KEV-listed with EPSS 26.5% and public PoC, this vulnerability allows any user with sudo --chroot access to achieve root privileges by placing a malicious nsswitch configuration and library in their chroot.
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attackers to escalate privileges over the network. KEV-listed with EPSS 57.6% and public PoC, this vulnerability in the core Windows file sharing protocol affects every Windows system on the network, enabling lateral movement from any compromised domain account to SYSTEM-level access on SMB-accessible systems.
Chrome's V8 JavaScript engine contains an out-of-bounds read and write vulnerability (CVE-2025-5419, CVSS 8.8) enabling remote heap corruption through crafted HTML pages. KEV-listed with EPSS 3.0% and public PoC, this vulnerability provides both read and write primitives in V8's heap, making it highly reliable for exploitation.
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows authenticated users to achieve remote code execution through a crafted upload URL. With EPSS 90.4% and KEV listing, this vulnerability in one of the most widely deployed open-source webmail platforms enables any email user to compromise the mail server, accessing all hosted mailboxes.
Erlang/OTP SSH server allows unauthenticated remote code execution by exploiting a flaw in SSH protocol message handling, enabling unauthorized system access with CVSS 10.0.
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoints. The query_commited and high_availability parameters are passed directly to Python's eval() function, allowing authenticated users to execute arbitrary Python code on the pgAdmin server.
Google Chrome on Windows contains a Mojo IPC handle validation flaw enabling sandbox escape through a malicious file, exploited in targeted attacks against Russian organizations in March 2025.
A critical path equivalence vulnerability in Apache Tomcat's Default Servlet allows unauthenticated remote code execution through specially crafted PUT requests using internal dot notation in filenames. With EPSS of 94% and active exploitation in the wild, this represents one of the most dangerous Tomcat vulnerabilities in recent years, affecting versions 9.0.0-9.0.98, 10.1.0-10.1.34, and 11.0.0-11.0.2.
PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperly neutralize quoting syntax, enabling SQL injection when function results are used to construct psql input. This vulnerability was used as the initial access vector in the BeyondTrust RS compromise chain.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI that allows remote code execution on Wazuh management servers.
Cacti monitoring platform prior to version 1.2.29 allows authenticated users to achieve remote code execution through the graph creation and template functionality. Attackers abuse the graphing engine to create arbitrary PHP scripts in the web root, escalating from monitoring access to full server control.
7-Zip contains a Mark-of-the-Web bypass vulnerability allowing attackers to circumvent Windows security warnings when extracting files from malicious archives, exploited in campaigns targeting Ukrainian organizations.
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 56.5%.
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute arbitrary code without user interaction. Confirmed actively exploited (CISA KEV) in May 2016 with public exploit code available. EPSS score of 92.76% (100th percentile) reflects the extreme likelihood of exploitation. This was a critical zero-day vulnerability used in targeted attacks before Adobe released emergency patches in APSA16-02 and APSB16-15.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 94.0%.
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in Adobe Flash Player allows network attackers to execute arbitrary code via integer overflow exploitation. Confirmed actively exploited (CISA KEV) with 88.97% EPSS score indicating extremely high real-world exploitation probability. Affects Flash Player before 18.0.0.324/20.0.0.267, Adobe AIR before 20.0.0.233, and associated SDKs across Windows, OS X, and Linux platforms. Vendor-released patches available since December 2015.
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 63.0%.
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 47.6%.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitrary code via crafted Flash content exploiting a use-after-free flaw in the ByteArray class. Confirmed actively exploited (CISA KEV) in July 2015 following the Hacking Team data breach, which exposed weaponized exploit code targeting this vulnerability. With EPSS score of 93.21% (100th percentile) and publicly available proof-of-concept, this represents critical risk to unpatched Flash installations across Windows, OS X, and Linux platforms. Vendor-released patches available via Adobe APSB15-16.
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in June 2015 by APT3 (a Chinese cyber espionage group) in phishing campaigns targeting aerospace and defense organizations.
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 89.0%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 70.5%.
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 71.1%.
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthenticated attackers to execute arbitrary code and escape security restrictions. Affects Oracle JRE 5.0 through Update 45, 6 through Update 45, 7 through Update 21, and OpenJDK 7. Confirmed actively exploited (CISA KEV) with 93.22% EPSS probability and publicly available exploit code. Oracle released patches in June 2013 CPU addressing the vulnerability through image channel verification corrections.
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 54.7%.
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 57.9%.
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 88.0%.
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.4%.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 74.6%.
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 84.0%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.7%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise through malicious Java Web Start applications and untrusted applets exploiting the Scripting component. CISA KEV confirms active exploitation in the wild. EPSS score of 92.59% (100th percentile) indicates extremely high probability of mass exploitation. Public exploit code exists, making this a critical priority for any environment running affected Java versions despite the vulnerability's age.
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute arbitrary code via malicious SWF content, actively exploited in targeted attacks in April 2011.
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execution, exploited in the wild via Flash content embedded in Microsoft Office documents and web pages.
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was actively exploited as a zero-day in December 2009 via crafted PDF files with ZLib compressed streams.
sdbootutil on SUSE Linux Enterprise Server 16.1, SLES for NVIDIA 16.1, openSUSE Leap 16.1, and Tumbleweed creates a world-readable debug log at /var/log/sdbootutil.log, enabling any local user to read potentially sensitive information from it. This local information disclosure (CWE-732) requires that the debug log has been generated and contains secrets. No public exploit has been identified at time of analysis, and the issue is not known to be actively exploited.
Local unprivileged users on SUSE Linux Enterprise Server 16.1, SLES for NVIDIA 16.1, openSUSE Leap 16.1 and openSUSE Tumbleweed can read a PIN or key secret that SUSE tooling renders as a QR code, because the secret is passed to qrencode as a command-line argument and is therefore exposed in /proc/<pid>/cmdline while the process runs. Exploitation requires the attacker to already hold a local low-privileged account on the same host (PR:L) and to win a short timing race against the brief qrencode invocation (AC:H), so this is a confidentiality-only credential-disclosure issue of modest severity with little realistic exposure on single-user or tightly controlled systems. There is no public exploit identified at time of analysis, and no vendor-released fix version has been confirmed in the available data, though SUSE tracks the issue through its Bugzilla and CVE pages.
Rancher Fleet's default SSH host-key validation trusts unverified server certificates when no known_hosts entry is present, enabling an on-path attacker to conduct a man-in-the-middle attack against SSH connections initiated by Fleet's git fetcher, cloner, or fleet apply command. Exploitation requires the attacker to occupy an on-path network position and the target server to lack a trusted known_hosts entry, yielding only low-level confidentiality, integrity, and availability impact. This is a moderate-priority issue, not a drop-everything emergency; no public exploit has been identified at time of analysis, and vendor-released patches are available in versions 0.10.12, 0.11.7, and 0.12.2.
A local, authenticated user on hosts running sssd (System Security Services Daemon) can stall the daemon's responder service by opening and holding a large number of concurrent connections to a responder socket while continuing to queue new connection attempts, driving the responder past its file-descriptor limit into an unthrottled retry loop. The result is a denial-of-service condition with high CPU consumption that blocks legitimate identity and authentication lookups (NSS/PAM) for other users. Exploitation requires local access and is rated high complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7), so realistic exposure is concentrated on shared or multi-user systems rather than single-administrator hosts; there is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing).
Authenticated users who are permitted to submit a Django model formset can delete database rows outside that formset's limiting queryset - without holding any permission on the targeted object - by forging management-form POST data when the affected model's primary key is editable through the form. The flaw is an authorization bypass through a user-controlled key (CWE-639) in django.forms.models.BaseModelFormSet.save_existing_objects(), rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) with integrity-only impact; it affects Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18, while models using the default AutoField/BigAutoField primary key are not affected. No public exploit code identified at time of analysis, and there is no confirmed active exploitation (not in CISA KEV); this is a genuinely moderate-severity authorization flaw and the signals are internally consistent.
Server-side request forgery (SSRF) in Django's GeoDjango spatial lookups allows remote unauthenticated attackers to make the Django process issue outbound network requests when an application passes attacker-controlled `bytes` raster values directly into a lookup against a `RasterField`. Affected versions are Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18; older unsupported series (5.1.x, 5.0.x, 4.2.x) were not evaluated and may also be affected. The flaw is an incomplete fix for CVE-2026-15307, and exploitation requires a deployment that uses GeoDjango raster fields and forwards raw untrusted bytes into spatial lookups - not a default Django configuration. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; Django rates it 'moderate' severity (CVSS 5.3), with impact limited to attacker-directed outbound requests rather than data compromise or code execution.
Quadratic-time parsing of quoted HTTP header parameters in Django 5.2 (before 5.2.18), 6.0 (before 6.0.9), and 6.1 (before 6.1.2) allows unauthenticated remote clients to consume disproportionate CPU by supplying a header value containing many separator characters inside a quoted parameter, potentially degrading or exhausting worker capacity. The vulnerable code path is reached by default through content negotiation such as HttpRequest.accepts() and Accept/Content-Type header handling, and the existing per-call length limit does not bound the combined size of repeated headers, so an attacker can amplify the cost across many headers in a single request. Impact is availability-only (CVSS 5.3, A:L, CWE-407); vendor patches are available in Django 6.1.2, 6.0.9, and 5.2.18, and no public exploit code was identified at time of analysis.
Remote denial-of-service in the Django web framework's language-negotiation helper django.utils.translation.get_supported_language_variant(), which caches attacker-supplied language codes as keys in an in-memory LRU cache before enforcing a length limit. An unauthenticated remote attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) who can influence the negotiated language - typically via the Accept-Language header, a language URL prefix, or LocaleMiddleware - can send many distinct, very long language codes so that each becomes a unique cache entry and steadily consumes process memory, degrading or exhausting the application worker. Affected are Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18; unsupported earlier series such as 5.1.x, 5.0.x, and 4.2.x were not evaluated and may also be affected. Impact is limited to availability (A:L) and requires sustained request volume rather than a single request, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Access control bypass in SSSD when configured with non-default ordering that evaluates password-expiration warnings before restrictive access rules allows remote authenticated users with expired passwords to gain unauthorized access to protected systems via alternative authentication methods such as SSH public key authentication. This flaw (CWE-393) affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 deployments using LDAP access control. Exploitation requires a specific non-default configuration, an expired password, and a non-password authentication path, making it a moderate conditional risk; no public exploit identified at time of analysis.
A malicious frontend can crash the BuildKit daemon (buildkitd) by submitting a crafted LLB (Low-Level Build) definition, causing a panic that terminates the daemon and interrupts all running builds. The vulnerability affects BuildKit versions prior to v0.33.1 and requires the attacker to have access to the build submission interface; no authentication is needed (PR:N) and no user interaction is required (UI:N), but the attack vector is local/adjacent (AV:L), making shared or multi-tenant build infrastructure the primary risk. No public exploit code has been identified at the time of analysis, and the vendor has released a patch in v0.33.1.
Moby BuildKit (all versions in the affected range per the unbounded CPE cpe:2.3:a:moby:buildkit:*:*:*:*:*:*:*:*) can be made to run its cleanup routine against a modified CA bundle when proxy networking with CA injection is enabled, a time-of-check-to-time-of-use (CWE-367) race that causes cleanup to block, operate outside the build rootfs, or fail without failing the build. The attacker must be able to submit or execute a build on the builder (local, low-privilege access; PR:L) and must first change the build's injected CA bundle before cleanup runs; the non-default proxy-with-CA-injection mode sharply narrows exposed deployments, and the dominant consequence is availability and integrity of the cleanup operation (VA:H, VI:L) rather than confidentiality loss. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; vendor-released patch v0.33.1 is available.
BuildKit (moby/buildkit) contains a policy-validation bypass in which a specially crafted Git source build step makes a repository appear to originate from a different remote URL than the one actually used during git clone, so repository-identity or URL-based policy rules can be evaded. The issue affects BuildKit builds prior to v0.33.1 and requires an attacker to hold build-submission privileges (CVSS vector PR:L); policies that validate commit SHA, commit data, or cryptographic signatures continue to apply correctly, which limits the practical impact (vendor CVSS 4.0 base 6.0, independent assessment 3.1 base with AC:H, low confidentiality and high integrity impact, no availability impact). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vendor reports a patch is available.
Denial of service in the BuildKit Dockerfile frontend (buildkitd) allows a user who can submit a build context to exhaust the daemon's memory and terminate it by placing an oversized Dockerfile or .dockerignore file in that context, because these files were loaded into memory without any size limit (CWE-789). The assessed vector (AV:L/PR:L) indicates low-privilege, local/context-level access is required to submit the build, so the practical risk is concentrated on shared or multi-tenant buildkitd instances such as CI/CD pipelines and hosted build services, where one submitter's crash interrupts other users' builds, while a single-user workstation daemon only harms its own environment. Impact is bounded to availability with no code execution, data disclosure, or integrity impact, no public exploit code or CISA KEV confirmation was identified at time of analysis, and the vendor has released BuildKit v0.33.1, which rejects such files above 16 MiB.
Denial of service in Moby BuildKit allows anyone able to submit an LLB build definition to a buildkitd daemon to panic and terminate the daemon process, aborting every build running on that instance. The flaw is an out-of-bounds array index (CWE-129) reached during processing of an attacker-controlled low-level build graph, and it affects all BuildKit releases prior to v0.33.1, including BuildKit embedded in Docker Engine and CI/build-service deployments. The assessed impact is availability-only (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.9), the attack surface is the local build API/daemon socket rather than arbitrary network exposure, and severity scales with multi-tenancy - a shared CI runner or multi-tenant build service loses all concurrent builds from a single crafted definition. Vendor patch v0.33.1 is available; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
BuildKit, the container build engine used by Docker and exposed through `docker build`/buildx, can be tricked into performing file operations on special file inodes - device nodes, FIFOs, or sockets - at paths where it expects ordinary regular files, a confused-deputy condition (CWE-441). A user who builds an attacker-controlled Dockerfile or build context can therefore cause build operations to hang/block, and on rootful workers can obtain unintended access to host devices; rootless configurations are effectively limited to availability and integrity effects. The attack is local and requires the victim to actively run a build on the malicious input, so exposure concentrates in multi-tenant or untrusted-source CI/CD pipelines that use rootful BuildKit workers; no public exploit has been identified at time of analysis and the flaw is not in CISA KEV. This is best treated as a medium-severity, defense-in-depth hardening issue rather than an urgent remote-exploitation priority.
Privilege-model bypass in Rapid7 Velociraptor's Windows.Sysinternals.SysmonLogForward artifact allows an authenticated operator who holds only the COLLECT_CLIENT permission (typically the built-in 'Investigator' role) to launch an arbitrary, attacker-chosen binary on monitored Windows endpoints instead of the installed Sysmon binary. Because the artifact exposes a user-controllable binary-path parameter and fails to enforce the additional EXECVE permission that gates comparable dangerous artifacts, successful collection results in code execution on the endpoint under the elevated privileges the artifact normally runs with, yielding high confidentiality, integrity, and availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exploitation is not anonymous: the attacker must already be a trusted Velociraptor operator with artifact-collection rights, and the chosen binary must be reachable or placeable on the target endpoint, which narrows realistic exposure to insiders or compromised operator accounts. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue is a moderate, privilege-escalation class flaw rather than a mass-exploitation threat.
A malicious external BuildKit frontend can issue crafted requests against the daemon's internal API that trigger a data race, causing the BuildKit daemon to panic and crash. The issue affects BuildKit deployments where the operator has opted into running an untrusted or attacker-controlled frontend (for example through a `# syntax=` reference to a third-party image); default builds that use trusted first-party frontends are not exposed. It is a medium-severity denial-of-service condition: exploitation requires low-level privileges (PR:L) through the frontend channel, local access (AV:L), and successful timing of a race (AT:P), and there is no public exploit identified at time of analysis. A vendor fix is available in BuildKit v0.33.1.
BuildKit can cache a fetched snapshot under a claimed content digest without adequately verifying that the blob bytes match that digest, letting an attacker who controls or compromises a registry or OCI-layout blob source poison the cache and compromise the integrity of later victim builds that reuse that digest. The attacker does not need credentials per the CVSS PR:N vector, but they must be able to serve BuildKit blob requests, and a victim must run a build against the attacker-influenced source for exploitation to matter. No public exploit was identified at time of analysis; vendor patch v0.33.1 is available, and an independent assessment rates this as a moderate, conditions-dependent integrity flaw rather than a drop-everything emergency.
Incorrect authorization in Rapid7 Velociraptor allows an authenticated user with the LABEL_CLIENTS permission to alter server-wide metadata via the SetClientMetadata operation, which should be restricted to server administrators. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) and classified as CWE-863 (Incorrect Authorization), producing high integrity impact with no confidentiality or availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis; the primary risk is privilege escalation for insiders or compromised low-privilege accounts, with impact scaling to how broadly LABEL_CLIENTS is delegated in a given deployment.
Cross-tenant event-stream disclosure in Rapid7 Velociraptor lets an authenticated API user who holds event-watching privileges in one organization read WatchEvent gRPC streams belonging to a different organization they are not authorized for, because the server validates permissions against the caller's own OrgId instead of the OrgId supplied in the request. Only multi-org (multi-tenant) deployments with more than one Org defined are meaningfully exposed; single-org installs have no other tenant to pivot to, and the impact is confidentiality-only with no write or denial-of-service effect. Exploitation requires valid low-privileged API credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and no public exploit code was identified at time of analysis.
Environment-variable and INI-file value disclosure in LibreOffice lets a crafted document exfiltrate host configuration data to a remote server when the victim opens it, because document-supplied URLs can still be expanded in code paths that the earlier CVE-2024-12426 fix missed. The incomplete fix overlooked XForms instance data and the Calc CSV and SQL data providers, which continue to resolve internal-scheme URLs originating from the document. This is a moderate-severity, confidentiality-only flaw (CVSS 4.0 base 6.7, CWE-200) that requires the victim to open an attacker-supplied file, with no public exploit identified at time of analysis; the independent assessment scores it as a local-vector, passive-user-interaction issue with no impact on integrity or availability.
Server-side request forgery in LibreOffice on Linux can expose local files and internal or remote URLs when a document links to a crafted HLS media playlist and the victim opens it and permits link updates. LibreOffice relies on the GStreamer media backend on Linux to play linked audio and video; a malicious playlist's listed resources were fetched while the document loaded and their contents could be written into the document, yielding confidentiality impact (VC:H, SC:H) with no integrity or availability impact in the assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N). The issue is moderate severity and interaction-dependent rather than an urgent priority; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and exploitation is constrained to Linux installations using the GStreamer backend.
Opening a crafted LibreOffice Calc document can cause a local text file on the victim's machine to be read into the spreadsheet, leaking its contents to anyone who later views or receives the file. The document must embed a saved external data link of the sql type that points at a local folder of text files as a database; vulnerable versions automatically restore that link at load time, whereas fixed versions restore only the csv, html and xml data providers. Exploitation requires the victim to open the attacker-supplied document (user interaction, UI:P in the vendor's CVSS 4.0 vector of 6.7, and UI:R in the independent CVSS 3.1 assessment), so exposure is limited to targeted social-engineering scenarios where the attacker also knows or guesses a useful local path and has a way to retrieve the populated sheet; no public exploit identified at time of analysis and the issue is not in CISA KEV.
LibreOffice Calc on affected versions automatically fetched external CSV data links embedded in a spreadsheet while the document loaded, so an attacker-crafted Calc file could read a local file into a sheet or force a request to a host of the document author's choosing (SSRF, CWE-918). Exploitation is local and interaction-gated - the attacker must deliver the malicious document and the victim must open it - and the flaw affects confidentiality only, with no impact on integrity or availability. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor addressed it by placing external data links under the same link-update control that governs other spreadsheet links.
LibreOffice Calc fails to confine file operations when processing an external data-source link to an embedded Firebird database, allowing a crafted document to write files to any location the user has write permission to. Exploitation requires the victim to open the malicious spreadsheet (user interaction) and does not by itself escalate privileges; no public exploit or active exploitation has been identified at time of analysis. The vulnerability is a moderate-severity, user-interaction-dependent file-write issue (CVSS 6.8) rather than a high-priority remote threat.
Key-size validation bypass in Bouncy Castle for Java before 1.86 (and Bouncy Castle for Java FIPS before bcpkix-fips 2.0.13 / 2.1.13) allows a key-transport EnvelopedData or AuthEnvelopedData message whose HKDF-derived content-encryption key does not match the advertised content-encryption algorithm to be accepted even when the application has explicitly enabled org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidation(true). The defect is confined to messages using RFC 9709 CEK derivation (id-alg-cek-hkdf-sha256); messages with a matching key size, non-HKDF messages, and recipients that never enable validation are unaffected, and the opt-in control is off by default, so this is a medium-severity defense-in-depth failure rather than a direct decryption or key-recovery primitive. Unauthenticated remote attackers who can supply CMS content to an application that has enabled the control can silently defeat the only mechanism the API offers for enforcing recovered key size; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor-released patch is available.