Information Disclosure

Missing TLS certificate validation in epa4all-client allows adjacent network attackers to intercept SOAP traffic between ePA services and Konnektor systems. The vulnerability affects versions prior to 1.2.2 and enables man-in-the-middle attacks using self-signed, expired, or otherwise invalid certificates to access patient identifiers (KVNR), SMC-B card operations, document content, and credential exchanges. No public exploit identified at time of analysis, with CVSS 8.1 indicating high impact on adjacent network segments.

Insufficient entropy in Trog::TOTP for Perl (versions before 1.006) allows remote attackers to predict TOTP secrets generated using Perl's built-in rand() function, undermining the security of two-factor authentication tokens issued by applications relying on this module. The flaw was reported by CPANSec and a fixed release (1.006) is available on CPAN. No public exploit identified at time of analysis, and the EPSS score is very low (0.02%).

Tabby terminal emulator before version 1.0.232 automatically renders malicious URIs from SSH/Telnet servers as clickable links without validating the protocol scheme, allowing attackers to trigger arbitrary OS protocol handlers when users click these links. The vulnerability requires user interaction (clicking the malicious link) and affects all platforms where Tabby runs. EPSS data unavailable, not currently in CISA KEV, indicating no confirmed active exploitation at this time.

Symbolic link following vulnerability in Microsoft APM dependency manager versions 0.5.4 to 0.12.4 allows remote attackers to read arbitrary files from the victim's system through malicious dependencies. The vulnerability occurs when APM processes symlinks in remote dependencies, following them to read local files and potentially exposing sensitive data that gets staged in git repositories. No public exploit identified at time of analysis.

Uninitialized memory disclosure in the ws WebSocket library for Node.js (versions 8.0.0 through 8.20.0) allows a connected peer to receive leaked process memory when an application calls websocket.close() with a TypedArray as the reason argument. Because the close-frame reason buffer is not zero-initialized, fragments of adjacent heap memory - potentially containing secrets, tokens, or other clients' data - are transmitted over the wire. No public exploit is identified at time of analysis (SSVC lists POC-class maturity but EPSS is only 0.01%), and the issue is fixed in ws 8.20.1.

Race condition in HarmonyOS web component enables local privilege escalation to full system compromise without authentication. The TOCTOU flaw (CWE-362) allows local attackers to achieve high confidentiality, integrity, and availability impact through unauthorized permission escalation. Huawei has released patches via May 2026 security bulletins for both mobile and laptop devices. EPSS data not yet available for this 2026 CVE; no confirmed active exploitation or public POC identified at time of analysis.

Cross-site request forgery in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier enables remote attackers to execute unauthorized operations through victim's authenticated session via malicious web pages. Successful exploitation achieves high confidentiality and integrity impact without requiring attacker authentication. Reported by JPCERT to JVN, indicating likely targeting of Japanese enterprise deployments. No active exploitation (CISA KEV) or public POC identified at time of analysis.

python-utcp CLI subprocess environment passes all process-level secrets to every tool call. When chained with CVE-2026-45369 command injection, remote authenticated attackers with low-privilege LLM tool access can exfiltrate AWS credentials, API keys, database URLs, and other environment variables in a single HTTP request. Patch available in version 1.1.2 (NVD references 1.1.3 as fixed version). GitHub security advisory confirms proof-of-concept demonstrating credential theft via env dump to attacker-controlled endpoint.

Prototype pollution in @ranfdev/deepobj npm package (versions ≤1.0.2) allows remote unauthenticated attackers to modify JavaScript object prototypes when property paths containing '__proto__', 'constructor', or 'prototype' are processed. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial exploitation against network-accessible applications, though real-world impact depends critically on whether user-controlled input is passed to property path parameters. EPSS data unavailable; not listed in CISA KEV. Publicly available exploit code exists (GitHub advisory GHSA-x7q7-fchv-8h2j). Vendor-released patch available in version 1.0.3.

SQL injection in Marten's PostgreSQL full-text search APIs allows remote unauthenticated attackers to execute arbitrary database commands when applications pass user-controlled input to the regConfig parameter. The vulnerability affects all five search method overloads (SearchAsync, PlainTextSearchAsync, PhraseSearchAsync, WebStyleSearchAsync, PrefixSearchAsync) where the regConfig parameter is interpolated directly into SQL without validation. Confirmed exploit payloads demonstrate time-based blind extraction, information disclosure via SELECT statements, and DDL execution including table drops. Vendor-released patch available in Marten 8.37.0 via GitHub PR #4343. No public exploit identified at time of analysis, though the advisory includes working proof-of-concept payloads for all affected methods.

Horizontal privilege escalation in Open WebUI versions through 0.3.15 allows any authenticated user to enumerate, read, and delete all files uploaded by all other users via missing authorization checks in the files API endpoints. The vulnerability requires only low-privilege authenticated access to the web interface and has publicly available exploit code with a detailed proof-of-concept demonstrating how attackers can list all uploaded files regardless of owner, retrieve file contents, and delete arbitrary user files. Organizations running multi-user Open WebUI deployments face immediate risk of data breach and integrity loss, as file upload features in conversational AI platforms commonly handle sensitive documents and internal communications.

Out-of-bounds memory read in Google Chrome on iOS versions before 148.0.7778.168 enables remote attackers to access sensitive memory contents through a compromised renderer process. The vulnerability requires user interaction to visit a malicious webpage and exploitation of a prior renderer compromise. With EPSS at 0.03% and no known active exploitation, this represents a moderate risk primarily in targeted attack chains.

Sandbox escape in Google Chrome for Android before 148.0.7778.168 lets an attacker who has already compromised the renderer process break out of the sandbox through insufficient policy enforcement in the GPU component, escalating a contained renderer bug into fuller device compromise via a crafted HTML page. Rated Medium by Chromium but scored CVSS 8.3 by NVD due to the scope change and total technical impact. There is no public exploit identified at time of analysis and EPSS probability is low (0.09%).

Sandbox escape in Google Chrome's Payments component before 148.0.7778.168 lets a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox by winning a race condition. Rated Critical by Chromium and scored CVSS 8.3, it carries a scope-changing high-impact profile, though EPSS is a low 0.06% and there is no public exploit identified at time of analysis. A vendor patch is available and the flaw is not listed in CISA KEV.

Hardware random number generator (HRNG) in Silicon Labs RS9116 SDK versions up to 2.13.1 produces predictable cryptographic values when the wireless module operates in power save mode, enabling adjacent attackers with user interaction to compromise encrypted communications and authentication mechanisms. Vendor patch available via GitHub; no active exploitation confirmed but cryptographic weakness poses high risk to WiFi/Bluetooth IoT deployments relying on the affected module's entropy source.

Remote code execution in OpenImageIO versions before 3.0.18.0 and 3.1.13.0 allows unauthenticated attackers to achieve arbitrary read/write memory access by delivering a maliciously crafted kABGR DPX image file with oversized dimensions. The signed integer overflow in SwapRGBABytes() creates a negative pointer offset that enables both out-of-bounds read via memcpy and subsequent out-of-bounds writes, potentially leading to code execution when a user opens the malicious image. EPSS data not available; no confirmed active exploitation (not in CISA KEV), though the vendor-disclosed nature and VFX industry targeting suggests focused adversary interest in content creation pipelines.

Microsoft Authenticator on Android and iOS leaks sensitive information to unauthenticated remote attackers through network-based exploitation requiring user interaction. The scope change (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the vulnerable component, suggesting potential cross-account or session data exposure. Microsoft has released a patch addressing this exposure. EPSS data not available, not listed in CISA KEV, indicating no confirmed widespread exploitation at time of analysis.

Token leakage in Portainer's authentication middleware allows JWT bearer tokens passed via the `?token=<JWT>` URL query parameter to be harvested from reverse-proxy access logs, browser history, and HTTP Referer headers, enabling account takeover for the validity window of the token (default 8 hours). The flaw affected any user with container exec/attach rights - not just administrators - and a leaked admin token grants full control of Portainer and every managed Docker/Kubernetes environment. No public exploit identified at time of analysis, though the underlying behavior was present since JWT auth was introduced and the GitHub Security Advisory provides sufficient detail to weaponize.

Prototype pollution leading to remote code execution in n8n workflow automation platform allows authenticated users with workflow create/modify permissions to corrupt the global Object prototype via an unvalidated pagination parameter in the HTTP Request node. Affecting n8n versions before 1.123.43, 2.20.7, and 2.22.1, the flaw chains with other techniques to escalate to full instance compromise. No public exploit identified at time of analysis, with EPSS at 0.05% (16th percentile) indicating low observed exploitation interest despite CVSS 4.0 9.4 critical rating.

Insecure Direct Object Reference in wger fitness platform exposes any authenticated user's complete workout history, session notes, and training statistics through template routine API endpoints. Attackers with free accounts enumerate public template routine IDs and retrieve owners' private health data including workout notes, weights, repetitions, and performance metrics via /api/v2/routine/{id}/logs/ and /api/v2/routine/{id}/stats/ endpoints. Detailed proof-of-concept with Python exploit confirms trivial exploitation against wger <= 2.5.0a2. CVSS 7.5 rates this High severity, but NOTE: vector PR:N appears inconsistent with authenticated-only access described - attackers need valid credentials, suggesting actual vector should be PR:L. EPSS data not available. No CVE KEV listing or public exploit repositories identified beyond GitHub advisory disclosure. Patch status unconfirmed - GitHub advisory references fix commit but no released version number provided in available data.

Remote code execution in soundcloud-rpc Electron app prior to 0.1.8 allows attackers to execute arbitrary commands on victim machines through maliciously crafted SoundCloud track metadata. When a user plays a SoundCloud track with HTML payload in its title, the application renders the metadata as raw HTML in privileged Electron views with Node.js integration enabled, leading to local command execution. User interaction is required (victim must play the malicious track), but no authentication is needed to upload crafted metadata to SoundCloud. Publicly disclosed via GitHub Security Advisory. EPSS data not available; no CISA KEV listing identified.

Infinite recursion in Vvveb admin controller exhausts PHP memory through repeated permission checks when low-privilege users access forbidden admin URLs. Sustained requests deplete worker memory causing site-wide denial of service. Fixed in version 1.0.8.3 via commit c766e84b which removes Base class inheritance from Error403 controller to break the dispatch cycle. No evidence of active exploitation but trivial to reproduce with authenticated low-privilege account.

Fleet server crashes from a single malformed gRPC request to the PublishLogs endpoint, allowing complete denial of service. An attacker with any enrolled Launcher node key can terminate the Fleet server process instantly via a crafted gRPC call. CVSS 8.7 (High) reflects the ease and impact, though exploitation requires prior enrollment of a Launcher host. Vendor-released patch version 4.81.0 available. No public exploit identified at time of analysis, but attack requires minimal sophistication given authenticated access.

Client certificate validation bypass in Fleet's Windows MDM management endpoint allows remote attackers to impersonate enrolled devices and exfiltrate sensitive configuration data. With high attack complexity (CVSS:4.0 AV:N/AC:H), attackers possessing a valid device identifier can retrieve MDM payloads containing Wi-Fi credentials, VPN configurations, certificates, and other secrets. Vendor-released patch (Fleet v4.81.0) available. No public exploit or CISA KEV listing identified at time of analysis, though CVSS 8.2 severity reflects potential for credential theft and lateral movement.

PostgreSQL libpq client library allows malicious server superusers to execute arbitrary code on connecting clients by overwriting stack buffers via unbounded responses to PQfn() calls. The vulnerability affects lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions used by psql and pg_dump utilities. A compromised or malicious PostgreSQL server can exploit clients running these common administrative tools during routine operations like database backups or large object exports. EPSS and KEV data not available for this recent CVE. CVSS 8.8 reflects the network attack vector with user interaction requirement (connecting to malicious server).

Symlink following vulnerabilities in PostgreSQL pg_basebackup and pg_rewind enable database superusers to overwrite arbitrary files on the destination server's filesystem, leading to local OS account takeover. Exploitation requires a malicious origin database superuser convincing an administrator to run these backup/replication tools (UI:R in CVSS), with practical impact limited to scenarios where database files are transferred between systems or snapshotted before server restart. No public exploit identified at time of analysis. CVSS 8.8 reflects theoretical severity, but real-world risk depends on specific operational workflows involving backup file transfers across trust boundaries.

Unauthenticated attackers can export complete database tables from WordPress Multisite installations running Database Backup for WordPress plugin ≤2.5.2, exposing credentials, user data, and site content. The vulnerability stems from improper enforcement of authorization check return values, bypassing security controls. Exploitation is limited to legacy WordPress Multisite environments using the deprecated is_site_admin() function. CVSS 7.5 (High) with network attack vector and no authentication required. No CISA KEV listing indicates limited widespread exploitation, though the unauthenticated remote access vector presents significant risk for affected configurations.

Arbitrary file read and deletion in Database Backup for WordPress (versions ≤2.5.2) allows unauthenticated attackers on WordPress Multisite installations to access sensitive files and potentially achieve site takeover. The vulnerability stems from improper authorization enforcement combined with user-controlled backup directory parameters, exploitable only in Multisite environments using the deprecated is_site_admin() function. CVSS 8.1 with high attack complexity (AC:H) reflects the Multisite-only prerequisite. No CISA KEV listing indicates limited observed exploitation despite the critical authorization bypass nature.

Authorization bypass in Database Backup for WordPress plugin (≤2.5.2) enables unauthenticated attackers to redirect scheduled backup files to publicly accessible directories and retrieve them before cleanup. By poisoning the wp_db_temp_dir parameter via wp-cron.php, attackers can intercept database backups containing credentials, password hashes, and PII. Backup filenames follow predictable patterns (database name, table prefix, date, Swatch Internet Time), making interception reliable. Exploitation requires administrator-configured scheduled backups but no authentication or user interaction (CVSS AV:N/AC:L/PR:N/UI:N). EPSS and KEV data not provided; Wordfence-reported vulnerability with publicly accessible source code references enabling attack reproduction.

Arbitrary file deletion in the Motors - Car Dealership & Classified Listings Plugin for WordPress (versions up to and including 1.4.107) allows authenticated users with subscriber-level access or higher to delete arbitrary files on the server by supplying a malicious filesystem path through the become-dealer logo upload flow. The flaw was reported by Wordfence and carries a CVSS of 8.1, but EPSS remains very low (0.05%) and CISA SSVC reports no observed exploitation, indicating risk is theoretical rather than active. No public exploit identified at time of analysis.

Authentication bypass in Yubico java-webauthn-server (webauthn-server-core) 2.8.0 through 2.8.1 allows an attacker holding any valid registered credential to impersonate other users during the second-factor flow. The flaw stems from an unchecked return value in finishAssertion that accepts a successful authentication result even when the authenticated credential belongs to a different user than the one named in StartAssertionOptions.username. No public exploit identified at time of analysis, and EPSS is very low (0.01%), but CISA SSVC rates the technical impact as total.

Credential interception in cPanel/WHM and WP Squared DNS Cluster system allows network-positioned attackers to perform man-in-the-middle attacks because SSL/TLS certificate verification is disabled when DNS Cluster nodes communicate. An attacker able to intercept traffic between cluster peers can impersonate a legitimate DNS Cluster server and capture authentication credentials transmitted during the request. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%), but SSVC marks the flaw as automatable with partial technical impact.

Account and store takeover in CubeCart 6.6.x through 6.7.1 is possible because the CC_STORE_URL constant is derived from the unvalidated Host header at bootstrap and embedded into password-reset emails. A remote unauthenticated attacker who knows a victim's email address can trigger a host-header poisoning attack that emails the user a reset link pointing at attacker-controlled infrastructure, capturing a valid 3,600-second token on click. SSVC reports a public POC and total technical impact, while EPSS remains low (0.03%) and no public exploit is identified as in-the-wild.

Authenticated server-side template injection in CubeCart v6 before 6.7.0 lets administrators escape the Smarty template sandbox and invoke native PHP functions through modules such as Email Templates and Documents. Attackers can call readgzfile() to exfiltrate configuration secrets and error_log() with message_type=3 to drop a PHP webshell, yielding full remote code execution. No public exploit identified at time of analysis, but a SSVC 'poc' status and an upstream commit hardening the Smarty allowlist indicate the technique is documented.

Mass assignment in Quark Auto Save (also referenced as Quark Drive) before version 0.8.5 lets authenticated users overwrite administrator credentials by posting an arbitrary 'webui' object to the config_data dictionary through the POST /update endpoint. Successful exploitation locks out legitimate administrators and grants persistent control over scheduled tasks, cloud storage tokens, and notification integrations. No public exploit identified at time of analysis, and EPSS rates exploitation probability at just 0.05% (16th percentile), though a vendor patch is available in release v0.8.5.

Authentication bypass in Grafana OSS Auth Proxy allows remote attackers to circumvent IPv6 allow-list restrictions because the feature applies a /32 default mask to IPv6 addresses instead of the appropriate /128, dramatically widening the trusted address space and potentially admitting unauthorized clients into authenticated sessions. The flaw is confined to the Auth Proxy authentication path - Okta, SAML, and LDAP integrations are unaffected - and at this time there is no public exploit identified at time of analysis, with EPSS at 0.03% and SSVC marking exploitation as 'none.'

Sensitive key material disclosure in Arqit Symmetric Key Agreement Platform versions before 26.03 allows remote unauthenticated attackers to retrieve the QKEY (a critical input to the OTA-Quantum device registration process) along with internal system keys via a plain HTTP GET request. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.03%), but the high CVSS of 8.7 with scope-change reflects the severe downstream cryptographic compromise possible once these keys leak. A vendor patch is available in version 26.03.

Sandbox escape in vm2 (patriksimek/vm2) versions prior to 3.11.3 enables remote code execution on the host Node.js process by abusing async generator `yield*` semantics to smuggle a host-realm exception into sandbox code, where the attacker pivots through `.constructor.constructor` to reach `process` and `child_process.execSync`. The flaw is exploitable by any attacker who can run JavaScript inside the sandbox, has publicly available exploit code, and carries SSVC technical impact 'total' with automatable=yes, though EPSS remains low at 0.05% (17th percentile) and the CVE is not listed in CISA KEV.

Authorization bypass in SiYuan note-taking platform versions up to and including v3.6.5 allows publish-mode Readers (anonymous visitors) and read-only Editors to invoke eight state-mutating APIs that are missing CheckAdminRole and CheckReadonly middleware. Attackers with only basic CheckAuth (including unauthenticated publish visitors) can rewrite the workspace conf.json, manipulate cloud sync intervals, overwrite graph configuration, poison the SQL block index, and tamper with the admin's recent-documents list. No public exploit identified at time of analysis, but a detailed PoC accompanies the advisory and EPSS sits at 0.04% (12th percentile).

Authenticated users with GitRepository modification privileges in Nautobot can manipulate the current_head field via REST API to force local repository clones to check out arbitrary commits, causing repository state inconsistency or denial of service. The unintended write access stems from improper REST API serializer configuration (CWE-471: Modification of Assumed-Immutable Data). Vendor-released patches in versions 2.4.33 and 3.1.2 add field-level access controls and input validation to prevent manipulation of the internal current_head tracking field. No public exploit identified at time of analysis, though exploitation requires only low-privilege authenticated API access.

Double-free condition in the Linux kernel's net-shapers subsystem allows local low-privileged attackers to corrupt kernel memory via the generic netlink interface. The flaw occurs because net_shaper_nl_get_doit() and net_shaper_nl_cap_get_doit() incorrectly call nlmsg_free() on a reply skb that was already consumed by genlmsg_reply(), enabling potential privilege escalation. No public exploit identified at time of analysis and EPSS scoring places exploitation probability at only 0.02%.

Local privilege escalation potential exists in the Linux kernel's IIO chemical sensor subsystem, specifically the sps30_i2c driver, where an incorrect sizeof() calculation in sps30_i2c_read_meas() uses sizeof(size_t) instead of sizeof(*meas), creating a buffer size mismatch. Affecting Linux kernel versions from 5.14 onward, the flaw could lead to memory corruption or out-of-bounds access when handling measurement data from Sensirion SPS30 particulate matter sensors over I2C. EPSS is very low at 0.02% and there is no public exploit identified at time of analysis, but a CVSS of 7.8 reflects high local impact on confidentiality, integrity, and availability.

Memory disclosure and denial-of-service in NGINX's SCGI and uWSGI proxy modules allow attackers with man-in-the-middle position between NGINX and upstream servers to read worker process memory or crash the service. Affects both NGINX Open Source and NGINX Plus when scgi_pass or uwsgi_pass directives are configured. The vulnerability requires network positioning between NGINX and its backend servers (AV:N with AT:P - Present attack complexity), making exploitation dependent on network architecture. No public exploit identified at time of analysis. CVSS 8.3 (High) reflects potential for confidential data exposure but limited by MITM prerequisite.

Traffic Management Microkernel (TMM) denial-of-service in F5 BIG-IP DNS affects systems with DNS cache-enabled profiles on virtual servers. Remote unauthenticated attackers can crash TMM using undisclosed malicious traffic patterns, causing complete service disruption. CVSS 7.5 High severity with network vector and low complexity. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis. Vendor patch available per F5 K000160945.

Incorrect permission assignment in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and iControl REST allows authenticated attackers to view network status of destination systems. Affected versions vary by product line; vendor has released patches. Authentication is required, limiting exposure to users with valid credentials, but the high confidentiality impact (CVSS 6.5) makes this a material information disclosure risk for organizations managing sensitive network infrastructure.

Arbitrary command execution in F5 BIG-IP and BIG-IQ Certificate Manager allows highly privileged attackers with Certificate Manager role to run OS commands by modifying configuration objects. The vulnerability requires network access and high privileges (PR:H) but enables scope change (S:C) with high confidentiality and integrity impact. Vendor-released patch available per F5 Security Advisory K000160971. EPSS data not provided; no confirmed active exploitation (not in CISA KEV) or public exploit code identified at time of analysis.

Incorrect permission assignment in F5 BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST allows authenticated attackers to view sensitive adjacent network information due to improper access controls. The vulnerability affects multiple product lines and requires valid authentication to exploit, making it a privilege escalation concern for environments where lower-privileged users have access to management interfaces.

Resource exhaustion in BIG-IP Configuration utility allows remote unauthenticated attackers to trigger file descriptor exhaustion in the httpd process when LDAP authentication is enabled. The attack achieves complete denial of service (CVSS A:H) through network-accessible undisclosed traffic patterns. F5 has released patches addressing this vulnerability. EPSS data not available, not listed in CISA KEV, indicating no confirmed widespread exploitation at time of analysis.

F5 BIG-IP TMOS shell (tmsh) allows authenticated administrators and resource administrators to execute arbitrary system commands with elevated privileges via an undisclosed command, potentially crossing security boundaries in Appliance mode deployments. The vulnerability requires high-privilege account access and local command-line interaction but poses significant risk to appliance-mode BIG-IP systems where privilege escalation could compromise the entire platform.

F5 BIG-IP iControl REST allows authenticated attackers with Manager role or higher to execute arbitrary commands through malicious configuration objects. This authenticated remote code execution vulnerability carries a CVSS score of 7.2 but requires high privileges (Manager role), significantly limiting the attack surface to insider threats or compromised administrator accounts. No public exploitation or proof-of-concept has been identified at time of analysis, and F5 has released vendor patches per advisory K000160916.

Authenticated attackers with Manager role or higher in F5 BIG-IP can execute arbitrary commands via malicious configuration objects in iControl REST API and TMOS Shell (tmsh). This privilege escalation vulnerability allows administrators to break out of their intended access boundaries and achieve full system control. CVSS 7.2 (High) reflects network accessibility with high privileges required. No public exploit code or active exploitation confirmed at time of analysis.

Privilege escalation in F5 BIG-IP allows authenticated Resource Administrators to gain full Administrator privileges by exploiting insecure iControl SOAP API configuration handling. Attackers with high-privilege Resource Administrator access can modify configuration objects to escalate to Administrator level, achieving cross-scope access to confidential data and integrity compromise. EPSS risk assessment unavailable, but exploitation requires legitimate Resource Administrator credentials and network access to management interface, limiting attack surface to insider threats or compromised administrative accounts.

F5 BIG-IP Advanced WAF and Application Security Manager (ASM) suffer from a denial-of-service vulnerability when processing specially crafted requests against virtual servers with active security policies. Undisclosed malformed requests cause the bd process to terminate, disrupting service availability. Remote unauthenticated attackers can exploit this with low complexity (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) achieving high availability impact (CVSS 7.5). EPSS data not provided, no active exploitation confirmed via CISA KEV at time of analysis. Vendor patch available per F5 advisory K000160727.

Authenticated users of F5 BIG-IP iControl SOAP interface can access account information belonging to other users due to insufficient access controls. The vulnerability affects BIG-IP systems where iControl SOAP is accessible and requires valid authentication credentials to exploit, allowing attackers with legitimate access to enumerate or retrieve confidential account details beyond their authorization scope.

Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are configured without hardware crypto acceleration, allowing remote unauthenticated attackers to cause denial of service via undisclosed traffic patterns. CVSS 7.5 (High) with network attack vector and no prerequisites. EPSS data not provided, no CISA KEV listing identified, indicating theoretical rather than observed exploitation. Vendor patch available per F5 advisory K000158082.

Remote denial-of-service in F5 BIG-IP Policy Enforcement Manager (PEM) allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM) via undisclosed traffic patterns when PEM-specific iRules are configured on a virtual server. The vulnerability is a use-after-free memory corruption issue (CWE-416) affecting CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and urlcatquery iRule commands. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates straightforward remote exploitation with high availability impact. EPSS data not provided, but F5 has released a vendor patch (K000160875). No public exploit or CISA KEV listing identified at time of analysis.

Information disclosure in F5 BIG-IP Configuration utility allows low-privileged authenticated attackers to access sensitive information through undisclosed pages, affecting the confidentiality of administrative data without requiring user interaction or privileged credentials beyond standard authentication.

BIG-IP QKView utility fails to properly sanitize sensitive data in diagnostic files, allowing authenticated attackers to extract confidential information including credentials and system configuration details. The vulnerability affects both BIG-IP and BIG-IQ platforms and requires valid user credentials to exploit, limiting exposure to insider threats and compromised accounts within authorized access tiers.

Incorrect permission assignment in F5 BIG-IP iControl REST and TMOS shell (tmsh) allows authenticated attackers to view sensitive information through an undisclosed command. The vulnerability affects BIG-IP systems and requires valid credentials but no user interaction to exploit, enabling confidentiality compromise of data restricted to higher-privilege accounts.

Local File Inclusion vulnerability in RTMKit Addons for Elementor plugin versions up to 2.0.2 allows authenticated attackers with Author-level privileges to include and execute arbitrary PHP files via the 'path' parameter in the 'get_content' AJAX action, enabling remote code execution. The vulnerability requires low-privilege WordPress account access (Author role or higher) and has a CVSS score of 8.8, indicating high impact across confidentiality, integrity, and availability. EPSS data not available, but exploitation requires specific WordPress role assignment, limiting attack surface to sites where untrusted users have Author-level access. No active exploitation confirmed by CISA KEV at time of analysis.

Unauthenticated remote access to ELECOM wireless LAN access points (WRC-BE72XSD, WRC-BE65QSD, WRC-W702 models) allows attackers to perform administrative operations via specific URLs that bypass authentication (CWE-288). With CVSS 4.0 score 9.3 (AV:N/AC:L/PR:N), this represents a critical access control failure enabling complete device compromise over the network. EPSS data not available; no confirmed active exploitation (not in CISA KEV) or public POC identified at time of analysis, though the vendor advisory from ELECOM and JPCERT coordination suggests real-world discovery.

Remote unauthenticated attackers can crash Klever-Go blockchain validators by sending a single 48 KiB compressed gossip packet that decompresses to multi-gigabyte allocations, killing the process via out-of-memory condition. The vulnerability in Batch.Decompress performs unbounded gzip decompression before anti-flood checks execute, enabling a single malicious peer to OOM-kill validators and disrupt chain liveness. Proof-of-concept demonstrates 45,604× amplification (48 KiB wire → 2.1 GiB heap). No public exploit identified at time of analysis, but vendor confirms internal discovery and patch development in progress.

Authenticated attackers can exhaust MongoDB Server memory using malicious bitwise match expressions ($bitsAllSet, $bitsAnySet, $bitsAllClear, $bitsAnyClear), leading to out-of-memory denial of service. Affects MongoDB Server 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. Vendor-released patches are available across all affected major versions. EPSS score of 0.04% (12th percentile) indicates low observed exploitation probability in the wild, and no public exploit code has been identified at time of analysis.

Cypher query injection in Flowsint, an open-source OSINT graph-exploration tool, allows an authenticated remote attacker to break out of an application-generated Cypher statement and run arbitrary queries against the backing graph database. By creating a node whose 'type' value contains malicious Cypher syntax, the attacker escapes the intended query context (CWE-943) and can read or manipulate arbitrary graph data. Publicly available exploit code exists per the CISA SSVC assessment; the flaw affects all versions prior to 1.2.3 and is not currently listed in CISA KEV.

Local privilege escalation in Fuji Electric TELLUS 5.0.2 arises because its installer registers a kernel-mode driver with permissions that grant read and write access to all users. A low-privileged local user can therefore interact with a privileged driver interface to read or corrupt kernel-controlled data, undermining the confidentiality, integrity, and availability of the host. No public exploit identified at time of analysis, and CISA SSVC currently marks exploitation status as none.

Denial-of-service via memory exhaustion affects UltraJSON (ujson) versions 5.12.0 and earlier, where the ujson.dump() function fails to release (Py_DECREF) the serialized JSON string object when the target file-like object's write() method raises an exception. Each failed write leaks the full serialized payload, so an attacker who can repeatedly trigger write failures - for example by disconnecting mid-response from a web server that streams JSON via ujson.dump() - can drive linear, unbounded memory growth. A proof-of-concept exists in the vendor advisory (GHSA-c38f-wx89-p2xg), but there is no public exploit identified as weaponized and no active exploitation; EPSS is very low at 0.04% (12th percentile).

Remote denial of service in OWASP ModSecurity (libmodsecurity3) 3.0.0 through 3.0.14 allows unauthenticated attackers to crash the WAF engine when the deployed rule set uses the @verifySSN, @verifyCPF, or @verifySVNR operators. An unsigned-integer underflow (CWE-191) produces an out-of-range value that throws an unhandled std::out_of_range exception, terminating the process protecting Apache, IIS, or Nginx. Publicly available exploit code exists per the CISA SSVC assessment, though EPSS remains very low (0.04%) and it is not in CISA KEV; fixed in 3.0.15.

Heap out-of-bounds read and subsequent heap corruption in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated remote SMB client with directory-creation rights corrupt kernel memory through the ACL inheritance path. By writing a crafted DACL whose SID carries an inflated num_subauth field and then creating child entries, an attacker can crash the kernel (DoS) or potentially escalate to kernel code execution. No public exploit identified at time of analysis; EPSS is low (0.18%, 39th percentile) and the flaw is not in CISA KEV, so exploitation is not confirmed in the wild.

Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated attacker to crash a critical system process by sending specially crafted network messages to a protocol-handling service (CWE-20, insufficient input validation). Reported by HPE with no public exploit identified at time of analysis; EPSS is very low (0.03%, 9th percentile) and CISA SSVC records exploitation status as none, though the flaw is rated automatable. Impact is limited to availability (CVSS 7.5, A:H) with no confidentiality or integrity loss.

Cross-origin API-key theft in Cleanuparr before 2.9.10 lets a malicious website read authenticated API responses-including the admin's permanent API key-because the global CORS policy reflects any request Origin while also setting AllowCredentials. The exposure is unlocked when the DisableAuthForLocalAddresses option is enabled, which authenticates callers purely by source IP, so a browser on a trusted network becomes a confused deputy. No public exploit identified at time of analysis; EPSS is negligible (0.01%) and it is not in CISA KEV, but the technical impact is total account/API compromise.

Local privilege escalation in Microsoft Office Click-To-Run (the servicing/update engine behind Microsoft 365 Apps, Office 2019, and Office LTSC 2021/2024) lets an already-authenticated low-privileged user escalate to higher privileges on the host due to insufficiently granular access control (CWE-1220). The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) shows a scope change with total confidentiality, integrity, and availability impact, meaning a successful attacker crosses a security boundary from the Office servicing context to the wider system. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC rates exploitation as 'none', so this is a serious-but-not-actively-exploited local EoP that should be patched on the normal accelerated cycle.

Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an already-authenticated low-privileged user gain SYSTEM-level rights on affected Windows client and server builds by triggering an integer underflow (CWE-191) in the driver's log-file parsing. The flaw yields total confidentiality, integrity, and availability impact on the local machine. There is no public exploit identified at time of analysis, EPSS risk is low (0.06%, 19th percentile), and CISA SSVC records exploitation status as none - but CLFS is a historically heavily-targeted attack surface, so patching is warranted.

Local privilege escalation in the Windows Kernel affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where an untrusted pointer dereference (CWE-822) lets an already-authenticated local attacker execute code with SYSTEM-level privileges. Microsoft has released a patch, and no public exploit is identified at time of analysis; EPSS exploitation probability is very low (0.03%) and the flaw is not on CISA KEV. Despite the 'Information Disclosure' tag applied in vendor metadata, the CVSS vector and description describe a privilege-elevation primitive with total confidentiality, integrity, and availability impact on the affected host.

Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) lets an authenticated attacker with low-privilege database access run arbitrary code on the server via external control of a file name or path (CWE-73). The CVSS 3.1 base score is 8.8 with high impact to confidentiality, integrity, and availability; publicly available exploit code exists, though the flaw is not on CISA KEV and EPSS remains very low (0.06%, 20th percentile), indicating minimal observed exploitation to date. Microsoft has released patched builds across all affected branches.

Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated attacker with low-privilege access to execute arbitrary code across the network by abusing insufficiently granular access controls (CWE-1220). The flaw carries a CVSS 8.8 rating with full confidentiality, integrity, and availability impact; however EPSS estimates only a 0.06% exploitation probability and CISA SSVC records no observed exploitation, so this is currently no public exploit identified at time of analysis. Microsoft has released patches for all affected editions.

Local privilege escalation in the Windows Link-Layer Discovery Protocol (LLDP) component affects a broad range of Windows client and server builds, where a CWE-415 double-free condition can be leveraged by an already-authenticated low-privileged user to gain higher privileges. The flaw was reported by Microsoft and is addressed in the July 2026 servicing updates; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is negligible (0.04%, 12th percentile), consistent with the high attack complexity (AC:H) and local-only vector.

Local privilege escalation in the Microsoft Windows TCP/IP networking stack allows an already-authenticated attacker to win a race condition and elevate to SYSTEM-level privileges across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025). Exploitation requires local, low-privileged access rather than remote reach, and Microsoft rates the technical impact as total (full confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis and EPSS probability is very low (0.04%), consistent with CISA SSVC marking exploitation as none and not automatable.

Local privilege escalation in Microsoft Windows Message Queuing (MSMQ) allows an authenticated low-privileged user to corrupt kernel/service memory through a double free (CWE-415) and elevate to SYSTEM. It affects a broad range of Windows client and server releases from Windows Server 2012/Windows 10 1607 through Windows 11 26H1 and Windows Server 2025 where the MSMQ feature is installed. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC records no known exploitation, though the technical impact is rated total.

Information disclosure in Microsoft Edge (Chromium-based) before 148.0.3967.55 allows a remote, unauthenticated attacker to read data they should not have access to by luring a victim into interacting with malicious web content. Rooted in external control of a file name or path (CWE-73) with a changed CVSS scope, it can leak sensitive information across security boundaries. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.05%).

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an already-authenticated low-privileged user to elevate to SYSTEM across Windows 10, Windows 11 (21H2 through 26H1), and Windows Server 2022/2025. The flaw stems from external control of a file name or path (CWE-73) inside the kernel-mode WinSock support driver, yielding total confidentiality, integrity, and availability impact per CVSS 7.8. There is no public exploit identified at time of analysis, EPSS is very low (0.07%), and CISA SSVC records exploitation as none, but the total technical impact and near-universal Windows footprint make it a standard Patch Tuesday priority.

Local privilege escalation in Microsoft Dynamics 365 Business Central (2024 Release Wave 2 through 2026 Release Wave 1) lets an already-authenticated, low-privileged user elevate to higher privileges on the host through a weak authentication mechanism (CWE-1390). Successful exploitation yields total compromise of confidentiality, integrity, and availability of the affected instance. There is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as 'none' with an EPSS of just 0.04% (12th percentile), indicating low near-term exploitation likelihood.

Information disclosure in Microsoft Excel (and the broader Office family - Office 2019, Office LTSC 2021/2024, Office for Mac, Microsoft 365 Apps for Enterprise, and Office Online Server) allows an attacker to read memory beyond an allocated buffer when a victim opens a crafted spreadsheet, potentially leaking sensitive in-process data. Exploitation is local and requires user interaction (opening the malicious file); there is no public exploit identified at time of analysis and CISA SSVC scores exploitation as 'none'. EPSS is very low (0.06%, 18th percentile), indicating negligible observed exploitation activity, though the technical impact is rated 'total'.

Local privilege escalation in the Windows Win32K kernel-mode subsystem (ICOMP component) lets an already-authenticated low-privileged attacker gain SYSTEM-level control across a broad range of supported Windows client and server builds. The flaw is a type-confusion (CWE-843) memory-corruption issue reported by Microsoft; there is no public exploit identified at time of analysis and the EPSS probability is low (0.11%), but SSVC rates the technical impact as total. This is a standard Patch-Tuesday-class kernel EoP whose value is as the second stage of an intrusion after an attacker already has a foothold.

Local privilege escalation in Windows TCP/IP stack affects Windows 10 (1607-22H2), Windows 11 (22H3-26H1), and Windows Server 2012 through a race condition vulnerability. Low-complexity exploitation requires only low-privilege authenticated access with no user interaction (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). Vendor-released patch available from Microsoft Security Response Center. No public exploit code or active exploitation confirmed at time of analysis, though the low attack complexity and local vector suggest feasibility for post-compromise privilege escalation in enterprise environments.

Race condition in Windows Ancillary Function Driver for WinSock (AFD.sys) enables local privilege escalation for low-privileged authenticated users across Windows 10 (1607-22H2), Windows 11 (22H3-26H1), and Windows Server 2016. Microsoft confirmed the vulnerability and released patches via their March 2026 security updates. The flaw requires high attack complexity (CVSS AC:H), suggesting exploitation depends on winning a narrow timing window in concurrent socket operations. EPSS data unavailable, no CISA KEV listing at time of analysis, but Microsoft's rapid patch indicates credible exploit risk.

Type confusion vulnerability in Windows Ancillary Function Driver for WinSock enables local authenticated users to escalate privileges to SYSTEM level on Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-26H1), and Windows Server 2012. Microsoft has released patches through their March 2026 security update cycle. The vulnerability requires low-privilege local access but no user interaction, making it a high-value target for post-compromise lateral movement and persistence. CVSS 7.8 reflects complete system compromise potential, though EPSS data and KEV status are not available for this future-dated CVE.

Local privilege escalation in Windows Print Spooler Components affects Windows 10, Windows 11, and Windows Server 2012 through race condition exploitation. Authenticated low-privileged attackers can elevate to SYSTEM privileges via concurrent resource access attacks, though attack complexity is rated high (AC:H). Vendor-released patch available from Microsoft Security Response Center. No active exploitation confirmed in CISA KEV at time of analysis, but Print Spooler remains a historically attractive target with established attack patterns (PrintNightmare, SpoolFool precedents).

Race condition in Windows Win32K graphics subsystem enables authenticated local users with low privileges to escalate to SYSTEM-level access on Windows 10 (1607 through 22H2), Windows 11 (all versions through 26H1), and Windows Server 2012. Microsoft has released patches through their monthly security update cycle (MSRC advisory CVE-2026-34331). EPSS data unavailable; no CISA KEV listing or public POC identified at time of analysis. The CVSS 7.0 score reflects high attack complexity (AC:H) requiring precise timing to exploit the synchronization flaw, reducing practical exploit reliability compared to simpler privilege escalation vectors.

Local privilege escalation in Windows Win32K GRFX component allows authenticated low-privilege users to gain SYSTEM-level access through race condition exploitation. Affects Windows 10 (1809, 21H2, 22H2), Windows 11 (22H3 through 26H1), and Windows Server 2019 including Server Core installations. Microsoft has released patches via their May 2026 security updates. Attack complexity is high (AC:H), requiring precise timing to win the race condition, limiting widespread automated exploitation despite the severe impact on confidentiality, integrity, and availability.

Path traversal in Azure Monitor Agent enables low-privileged local attackers to escalate to SYSTEM/root privileges via malicious file path manipulation. Microsoft has released security patches. Attack vector is local (AV:L) with low complexity (AC:L), requiring only basic local credentials (PR:L) but no user interaction. EPSS exploitation probability is 0.04% (4th percentile), indicating low likelihood of mass exploitation, though the attack is straightforward once local access is obtained.