Information Disclosure

Local information disclosure in Apple iOS and iPadOS (and visionOS) before version 27 allows an app running on the device to read sensitive user data it should not be able to reach. Apple fixed the flaw through improved file handling in iOS 27, iPadOS 27 and visionOS 27. No public exploit code or active exploitation has been reported, and the EPSS score of 0.15% (5th percentile) plus SSVC 'exploitation: none' point to a low-volume, user-assisted local attack rather than a mass-exploited one.

A path validation weakness in Apple's iOS, iPadOS, and macOS allows a malicious application to reach files outside its intended sandbox and read user-sensitive data. Apple addressed the flaw with improved path validation in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8, so all older releases remain exposed until updated. Exploitation requires a locally installed app and some user interaction (CVSS AV:L/UI:R), exploit probability is currently very low (EPSS 0.20%, 10th percentile), and no public exploit code or CISA KEV entry has been identified at time of analysis.

A permissions-validation flaw (CWE-863) in Apple macOS versions prior to 27 (Golden Gate) and Xcode versions prior to 27 allows a locally installed app to reach user-sensitive data it should not be authorized to read. The issue is a local, confidentiality-only defect rated CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N): no privileges are needed, but the attack requires the victim to run the malicious application. Apple has released fixes in macOS 27 and Xcode 27; there is no CISA KEV listing, no public exploit code identified at time of analysis, and EPSS is very low at 0.16% (5th percentile), so real-world exploitation is unlikely to be widespread.

Apple fixed a kernel uninitialized-memory flaw (CWE-457) across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS in which a locally installed app can determine kernel memory layout, defeating address-space randomization. The impact is information disclosure only - high confidentiality, no integrity or availability impact - and exploitation requires a local app plus user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 5.5). Apple shipped patches on [dates not specified] for iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27; no public exploit code or active exploitation is indicated, and EPSS is low (0.21%, 11th percentile).

A race condition in Apple's kernel state handling lets a locally installed app corrupt kernel memory or trigger unexpected system termination across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple addressed the flaw in iOS 18.7.10 and 26.6, iPadOS 18.7.10 and 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, and tvOS/visionOS/watchOS 26.6, so exploitation is limited to unpatched devices running a malicious app plus user interaction. No public exploit code and no active exploitation are known; EPSS is 0.17% (6th percentile) and CVSS rates it 6.3, reflecting a local, high-complexity attack with no confidentiality impact.

A race condition in core Apple operating system components lets a locally installed app trigger an unexpected system termination on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Apple fixed the flaw through improved state handling in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Impact is availability-only (no data exposure or modification), exploitation requires a local malicious app and winning a timing window, EPSS is a low 0.21%, and no public exploit code or active exploitation has been identified at time of analysis.

Apple macOS contains an improper input validation flaw (CWE-20) that a remote attacker can leverage to crash affected system components, producing a denial-of-service condition on the host. Apple addressed the issue in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7, so all earlier builds of those release trains remain vulnerable. Exploitation requires the victim to interact with attacker-supplied content (CVSS UI:R), and there is no public exploit identified at time of analysis, though the CVSS 3.1 base score of 6.5 reflects a high availability impact with no confidentiality or integrity loss.

An out-of-bounds read in Apple's font parsing code lets a maliciously crafted font file leak process memory on unpatched builds of iOS, iPadOS, macOS, tvOS, visionOS and watchOS, with all affected platforms fixed in the version 27 releases. Triggering it requires the victim to render attacker-supplied content containing the crafted font — an email, document, web page or message preview — but no credentials or elevated privileges are needed once that interaction happens, and the resulting confidentiality impact is rated high with no integrity or availability effect. No public exploit code or active exploitation has been identified, and EPSS sits at a low 0.20% (10th percentile), so this is best handled as a scheduled platform update rather than an emergency response.

An out-of-bounds read in the font-parsing path of Apple's operating systems lets a remote attacker disclose the contents of process memory when a victim processes a maliciously crafted font. All Apple platforms are affected prior to the version 27 releases — iOS and iPadOS, macOS Golden Gate, tvOS, visionOS and watchOS — and Apple has shipped fixes for each. There is no CISA KEV listing and no public exploit code identified, and the EPSS score of 0.17% (7th percentile) indicates a low probability of near-term exploitation; because the sole impact is memory disclosure and exploitation requires the victim to open or render attacker-supplied content, this is a moderate-priority patch rather than an emergency.

Information disclosure in Apple's iOS, iPadOS, macOS, tvOS and watchOS platforms allows an app running on the device to reach sensitive user data that the operating system's data protection mechanisms were supposed to keep isolated from it. Apple resolved the issue with improved data protection in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27 and watchOS 27, with vendor advisories published across seven support pages. No public exploit code or active exploitation has been reported, EPSS is low at 0.20% (10th percentile), and the issue is not listed in CISA KEV, so this reads as a routine hardening fix rather than an urgent emergency-patch event.

A use-after-free memory-management flaw affects Apple's operating system family prior to the 26.6 releases — iOS and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6 and watchOS 26.6 — and allows a locally installed app to trigger unexpected system termination (a denial-of-service condition). The vulnerability is rated CVSS 5.5 with a local attack vector, low complexity and low privileges required, but no confidentiality or integrity impact; EPSS is only 0.19 percent and there is no CISA KEV listing and no publicly available exploit code identified at time of analysis. Apple has shipped fixes in all four platform advisories, so the practical risk is concentrated on unpatched devices rather than on active exploitation.

Connecting an Apple device to an attacker-controlled NFS server can cause the kernel NFS client to mishandle memory and return out-of-bounds kernel memory to the malicious server, an information-disclosure issue tracked as CVE-2026-43687. All shipping Apple platforms are affected — iOS/iPadOS before 26.7 and 27, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27 — while the fix is distributed across Apple's 26.7/27 update wave. Exploitation requires the victim to initiate a connection to the hostile server (UI:R), which keeps real-world risk moderate: EPSS is only 0.18% (7th percentile), CISA KEV does not list it, SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code was identified at time of analysis.

Local applications running on Apple macOS releases prior to Tahoe 26.6 can exploit a race condition in the validation path guarding protected user data, allowing an app to read data it should not be able to reach. The flaw is mitigated in macOS Tahoe 26.6 per Apple's advisory, and the attack is timing-dependent and local-only (CVSS 4.7, AV:L/AC:H/PR:L), which keeps practical risk moderate. EPSS is very low at 0.14% (4th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis.

A race condition in Apple's state-handling code allows a locally installed app to crash the system or cause unexpected termination of system processes on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. The flaw carries a CVSS 3.1 score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) — availability-only impact, local attack vector, high complexity — and is fixed in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and tvOS, visionOS and watchOS 27. Neither public exploit code nor CISA KEV activity has been recorded, and EPSS puts exploitation probability at roughly 0.2% (10th percentile), so this is a patching-hygiene item rather than an emergency.

Kernel memory disclosure in Apple's client operating systems - iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.8 and macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6 - allows a locally installed, low-privilege application to read portions of kernel memory that should have been redacted, leaking sensitive data from kernel address space. The flaw is rated CVSS 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and is bounded to confidentiality loss with no integrity or availability impact and no arbitrary kernel read. There is no public exploit identified at time of analysis, EPSS is only 0.20% (10th percentile), and the issue is not in CISA KEV; Apple has released fixes across all affected platforms. Because the attacker must already have a malicious or compromised app installed and running on the device, this is best treated as a low-priority information-disclosure building block rather than a standalone compromise path.

Information disclosure in Apple iOS and iPadOS (versions before 26.7 and before 27) lets a locally installed app determine which other apps the user has installed, exposing a device-fingerprinting and privacy surface rather than files, credentials, or user data. The root cause is a state-management defect (CWE-200) that Apple fixed in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires the victim to install and run a malicious sandboxed app on the target device (CVSS AV:L, PR:L), so there is no remote or unauthenticated path; no public exploit code has been identified at time of analysis, and EPSS is 0.17% (7th percentile), consistent with a low-severity, low-priority finding.

Processing a maliciously crafted file on Apple macOS versions below Golden Gate 27 can crash the affected component, causing a denial-of-service, and may potentially leak partial memory contents. The bug is an integer overflow (CWE-190) corrected through improved input validation, and exploitation requires a local victim to actually open or handle the attacker-supplied file, so both a local attack vector and user interaction are prerequisites. Severity is assessed as moderate (assessed CVSS 6.6-level, availability-high with limited-confidentiality impact); EPSS is low at 0.17% (7th percentile), CISA SSVC records no exploitation, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

A malicious application running on Apple macOS (versions prior to 27) or watchOS (versions prior to 27) can leak sensitive user information because the operating system fails to properly manage internal state. Apple addressed the flaw in macOS Golden Gate 27 and watchOS 27, so all earlier releases on both platforms remain exposed. The issue is rated CVSS 5.5 (local vector, low privileges, high confidentiality impact), EPSS is only 0.16% (5th percentile), and there is no public exploit code identified at time of analysis.

An out-of-bounds read in Apple's kernel, fixed across iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27, allows a locally installed application to disclose kernel memory to user space. The flaw (CWE-125) stems from insufficient input validation in a kernel code path reached by app-supplied data, and yields high confidentiality impact only - no integrity or availability loss. Apple has released patches for all affected platforms; EPSS is very low (0.15%, 5th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.

Improper certificate validation in Apple macOS allows an attacker positioned on the network path between the victim and a remote endpoint to intercept and potentially modify traffic that should have been protected by TLS. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate versions before 27, and is rated CVSS 4.8 (network vector but high attack complexity), with an EPSS score of only 0.12% (2nd percentile) and no public exploit or CISA KEV listing at time of analysis. Apple addressed the issue with improved certificate validation in the three corresponding releases, so the primary defense is straightforward patching; no public exploit code has been identified.

Opening a maliciously crafted file on an unpatched Apple device can crash the parsing process or disclose its memory contents, an out-of-bounds read that Apple addressed with improved input validation and fixed in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L), exploitation is unauthenticated from the network but hinges entirely on user interaction - the victim must open the crafted file - and impact is confined to the vulnerable process as a limited read-only disclosure or denial of service, with no code execution or data modification. EPSS is 0.18% (7th percentile), no public exploit has been identified at time of analysis, and vendor patches are already available, making this a low-priority issue despite the network attack vector.

Local applications on unpatched macOS can read sensitive user data from insufficiently redacted log files, affecting versions prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. Exploitation requires a malicious or compromised app already running with standard user privileges (AV:L/PR:L), yields confidentiality-only impact, and has no public exploit identified at time of analysis; EPSS is 0.17% (6th percentile). This is a genuinely low-priority, defensible-but-not-urgent issue per the independent assessment.

Processing a maliciously crafted image on unpatched Apple platforms can leak uninitialized process memory, exposing small, non-deterministic fragments of data that happened to be in memory at decode time. Affected are iOS and iPadOS before 26.7 and before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, plus tvOS, visionOS, and watchOS before 27; the CVSS vector (AV:N/AC:L/PR:N/UI:R) means no credentials or special configuration are needed but the victim must open, preview, or otherwise trigger decoding of the attacker-supplied image. Impact is limited to confidentiality (C:L) with no integrity or availability effect, EPSS is a low 0.18% (8th percentile), and no public exploit has been identified at time of analysis; Apple has shipped fixed versions for every affected platform, so the practical priority is routine patch cadence rather than emergency response.

A memory-safety defect (out-of-bounds read, CWE-125) in Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS can be triggered by a locally running application and causes an unexpected system termination - a denial-of-service/availability impact with no confidentiality or integrity loss. Affected versions are those prior to the fixed releases: iOS/iPadOS before 26.7 (and before 27), macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27, plus tvOS, visionOS, and watchOS before 27. Exploitation requires the attacker to already have a malicious app running on the device with its own app-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, scored 5.5); no public exploit code has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and there is no CISA KEV entry. Apple has released patched versions, so the practical exposure is limited to unpatched devices running a hostile app - a low-to-moderate priority issue.

Unexpected system termination in Apple macOS is caused by an out-of-bounds read in the SMB client that is triggered when a user initiates a connection to a malicious or spoofed SMB server. The affected versions are macOS releases before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27; the issue is not in CISA KEV, no public exploit code has been identified at time of analysis, and EPSS is a low 0.17% (6th percentile). An attacker who controls or spoofs the SMB endpoint the victim reaches can force a crash, with no privilege escalation, code execution, or data disclosure assessed.

A privacy flaw in Apple operating systems lets a malicious application already running on the device determine the user's current location, because location data was not properly redacted from log entries (CWE-532). The issue is local-only: the CVSS vector (AV:L, PR:L, UI:N, C:H/I:N/A:N) means an attacker must first get a malicious app installed and executing on the target device, after which no further user interaction is needed, and the impact is confined to confidentiality - the user's location is disclosed with no integrity or availability effect. Apple has fixed the flaw in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27; there is no public exploit identified at time of analysis, EPSS is very low (0.21%, 11th percentile), and the practical barrier is Apple's app-distribution controls rather than any remote attack path.

Kernel memory corruption in Apple's operating systems lets an app running on the device crash the system or corrupt kernel memory, with the independent assessment scoring integrity and availability impact as High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). Every unpatched device is exposed once a user launches a malicious or compromised app: no network vector, no user interaction beyond app execution, and no special configuration is required. There is no confirmed active exploitation (CISA KEV does not list this CVE) and no public exploit code identified at time of analysis, and EPSS is low at 0.21% (11th percentile), so real-world urgency is modest even though the flaw sits in the kernel. Apple has shipped fixed builds across all affected platforms: iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.

Local apps on iOS, iPadOS, and visionOS can bypass certain Privacy preference controls and reach sensitive data they were never authorized to see; Apple addressed it by removing sensitive data from the reachable location. Affected are iOS and iPadOS before 26.7 and before 27, plus visionOS before 27, with fixes shipped in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, and visionOS 27. Exploitation is local-only and requires a malicious or overprivileged app to already be installed and running on the device (CVSS 3.3, AV:L/PR:L/UI:N, low confidentiality impact); there is no public exploit identified at time of analysis and EPSS is negligible at 0.17% (7th percentile).

Kernel memory disclosure on unpatched Apple devices allows a locally running, low-privilege app to read kernel memory that it should not be able to access, potentially exposing sensitive kernel-side data. The issue - an information-disclosure weakness (CWE-200) caused by improper memory management - affects iOS and iPadOS before 26.7 and before 27, macOS Tahoe before 26.7 and macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27, and is fixed in the corresponding 26.7/27 releases. Exploitation requires the attacker to already be executing code inside a sandboxed app on the target device (CVSS 3.1 3.3, AV:L/AC:L/PR:L/UI:N, confidentiality-only impact), so overall risk is low; no public exploit identified at time of analysis, with an EPSS score of roughly 0.2% (10th percentile) and no CISA KEV listing.

A use-after-free in macOS memory management allows a locally running application to crash the operating system, resulting in unexpected termination and loss of unsaved work. The flaw affects macOS Tahoe before 26.6, macOS Sequoia before 15.7.8, and macOS Sonoma before 14.8.8, with exploitation requiring only low privileges (CVSS PR:L) and no additional user interaction. Apple has released fixes (patch available per vendor advisories), and although EPSS is very low at 0.19% (9th percentile) with no CISA KEV listing, no public exploit code identified at time of analysis, the flaw is a memory-safety bug that carries inherent risk of escalation beyond a simple denial of service.

Uninitialized kernel memory disclosure in Apple's operating system family allows a local app that already holds root privileges to read residual data left in kernel memory buffers, an information-leak primitive that exposes potentially sensitive kernel memory contents. The flaw is fixed across iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, so affected users should update promptly. No public exploit code has been identified at time of analysis, and EPSS places the probability of exploitation at roughly 0.17% (7th percentile), consistent with the assessment that the mandatory root prerequisite - the attacker must already be running code at the highest local privilege level - makes this a post-compromise leak rather than an initial-access or privilege-escalation primitive, and a genuinely low real-world priority despite the 6.2 Medium base score.

Apple macOS devices running versions below Sonoma 14.8.8 can retain a silently persisted Apple Account after the device is erased, because the erase/factory-reset workflow fails to fully clear that state. Exploitation requires physical possession of the Mac and interaction with the wipe process itself - no credentials or user interaction are needed once the hardware is in hand (CVSS:3.1/AV:P/AC:L/PR:N/UI:N), which confines realistic risk to lost, stolen, resold, or refurbished hardware rather than remote attack. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.17% (7th percentile), and this is a moderate, physically-gated issue that does not warrant emergency prioritization.

Conditionally exploitable information disclosure affects Apple macOS versions below Sequoia 15.8, Tahoe 26.7, and Golden Gate 27, where an attacker who already occupies a privileged network position - such as a rogue or compromised Wi-Fi access point, a controlled router or proxy, or a host performing ARP/DNS spoofing - can leak sensitive user information. The issue is rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), is confidentiality-only with no integrity or availability impact, requires no authentication and no user interaction, and is gated by the AC:H precondition that the attacker can actively intercept traffic. Apple fixed it in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code has been identified at time of analysis, EPSS is 0.19% (9th percentile), and this is a moderate-severity, conditionally exploitable flaw rather than a top-tier priority.

Locally installed apps on unpatched Apple platforms (iOS and iPadOS before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27) can read sensitive user data that the system wrote into logs without adequate redaction. Apple fixed the flaw by improving data redaction in the release train listed in its security advisories. Impact is confidentiality-only and strictly local, with no network attack path, and a low EPSS of 0.18% (7th percentile) reflects that; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. One prerequisite discrepancy is worth noting: the published vector requires user interaction (UI:R), while our assessed vector treats the app as already installed and running without interaction.

Mounting a maliciously crafted exFAT volume on an unpatched macOS system (versions before Golden Gate 27) can trigger an out-of-bounds read in the kernel, leading to kernel memory disclosure or unexpected system termination. Exploitation requires user interaction to mount the attacker-supplied volume, and no public exploit code or active exploitation has been identified at time of analysis (EPSS 0.16%).

iCloud Private Relay on Apple platforms could disclose a user's real IP address to a website even while the privacy proxy is active, because of a state-management flaw in the relay implementation. The issue affects iOS and iPadOS before 18.7.10 and before 26.6.1, macOS Tahoe before 26.6.2, and visionOS before 26.6.1, and requires the victim to browse to attacker-controlled web content (UI:R, no privileges needed). Severity is modest (CVSS 4.3, confidentiality-only) and there is no CISA KEV listing or public exploit identified at time of analysis, but the privacy impact is disproportionate for users who depend on Private Relay for anonymity.

An integer underflow in the macOS SMB client allows a malicious SMB server to crash the operating system, resulting in a denial of service, when a user connects to a shared folder or mount. The flaw affects macOS releases prior to Golden Gate 27, Sequoia 15.8 and Tahoe 26.7, and is fixed in those versions. Exploitation requires the victim to initiate a connection to an attacker-controlled SMB endpoint (CVSS UI:R), there is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is very low at 0.19% (9th percentile), so real-world exploitation pressure is currently minimal.

An information disclosure flaw in Apple's iCloud Private Relay lets a website determine a visitor's real IP address even when Private Relay is switched on, defeating the core privacy guarantee of the feature. The issue affects iOS and iPadOS before 26.6.1, macOS before 26.6.2 (Tahoe), and visionOS before 26.6.1, and is reachable from the network but requires the victim to browse to an attacker-controlled page. Apple addressed it through improved state management, and no public exploit code or active exploitation has been identified at time of analysis.

Information disclosure in Apple iOS and iPadOS versions before 27 allows a locally installed malicious or compromised app to access sensitive user data after the user installs and opens it. The flaw is a permissions issue (CWE-200) that Apple addressed with additional restrictions in iOS 27 and iPadOS 27. No public exploit identified at time of analysis and EPSS is 0.17% (7th percentile), but the CVSS score of 5.5 reflects the high confidentiality impact; exploitation requires local app execution and user interaction, with no remote path.

Sensitive user data can be read by a malicious or compromised app on unpatched Apple devices because a logic-validation flaw lets the app cross its data-access boundary. Affected platforms are iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7 and before Golden Gate 27, tvOS before 27, and visionOS before 27; the assessed vector (AV:L/AC:L/PR:N/UI:R/C:H/I:N/A:N) shows the attacker must first get a hostile app onto the device and the user must run it, with confidentiality-only impact. Vendor patches are available for every platform, EPSS rates exploitation probability at roughly 0.18% (7th percentile), and no public exploit has been identified at time of analysis.

A use-after-free (CWE-416) in the Apple macOS SMB client allows a maliciously crafted SMB network share to crash the operating system, causing system termination. Exploitation requires the user to mount the attacker-controlled share (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5), so impact is limited to denial of service with no confidentiality or integrity loss. Apple has released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7; there is no CISA KEV listing and no public exploit code identified, and EPSS is low at 0.17% (6th percentile).

Improper access control in Apple iOS and iPadOS, macOS Tahoe, and visionOS lets a locally installed app read user-sensitive data that it should not be able to reach. The flaw (CWE-284) stems from insufficient validation checks and is remediated in iOS/iPadOS 26.6, macOS Tahoe 26.6, and visionOS 26.6; the assessed vector (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) means exploitation requires the victim to install and launch a malicious app on an unpatched build, with no remote attack path and no integrity or availability impact. The attacker's app needs no special privileges, but there is no public exploit identified at time of analysis and EPSS is low at 0.19% (9th percentile), so this is a genuine but low-priority confidentiality issue.

Improper access control (CWE-284) in Apple iOS, iPadOS, and macOS allows a locally installed app to read user-sensitive data outside the permission boundary the operating system is supposed to enforce, an information-disclosure impact rated CVSS 5.5 (confidentiality High, integrity None, availability None). Exploitation is local and requires user interaction: the attacker must first get a malicious or compromised app onto the device and convince the user to launch it (AV:L, PR:N, UI:R), so there is no remote, network-triggerable, or self-propagating path. Apple has released fixes in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code has been identified at time of analysis and EPSS is low at 0.17 percent (7th percentile), with no CISA KEV listing.

Information disclosure in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS allows a locally installed and running app to read a persistent account identifier that the operating system should have kept out of its reach. The root cause is a permissions/sandbox restriction gap (CWE-200), fixed by Apple with additional access restrictions in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; successful exploitation requires the user to install and launch a malicious local app (AV:L/PR:N/UI:R), so a remote, unauthenticated network attack is not possible. There is no public exploit identified at time of analysis and EPSS is 0.18% (8th percentile), making this low-to-moderate risk rather than an urgent priority, with impact confined to the confidentiality of one identifier and no integrity or availability effect.

An out-of-bounds read in Apple's macOS SMB client allows a malicious SMB server to leak kernel memory to an attacker when a user connects to a shared folder, fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Exploitation requires the victim to initiate a connection to an attacker-controlled or compromised SMB share (CVSS UI:R), so it is user-interaction dependent rather than wormable, and the raw impact is confidentiality only — kernel memory disclosure, not code execution. EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit code has been identified; SSVC rates exploitation as 'none', automatable as 'no', and technical impact as 'partial'.

Local information disclosure in Apple macOS lets a malicious or compromised application read sensitive user data on hosts running versions earlier than macOS Sequoia 15.8, macOS Tahoe 26.7 or macOS Golden Gate 27. Apple fixed the issue with improved checks in three separate security advisories covering each release train. Exploitation requires the attacker to get an app running on the target Mac with user-level privileges; no public exploit code has been identified at time of analysis and EPSS is 0.17% (6th percentile), so this is a low-volume, targeted local threat rather than a mass-exploitation event.

Missing origin validation in IBM Verify Identity Access and Security Verify Access (including their container editions) lets an unauthenticated, remote attacker ride an authenticated user's live session and carry out operations as that victim, potentially enabling follow-on attacks against the deployment. Exploitation requires the victim - a logged-in Verify Identity Access / Security Verify Access user - to be lured into visiting attacker-controlled web content while their session is active (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, 5.4), so confidentiality and integrity impact is limited to the victim's own privilege scope with no availability loss. No public exploit code has been identified and the flaw is not confirmed actively exploited (CISA KEV); EPSS is 0.15% (4th percentile), and vendor-released fixes are available per IBM's advisory, making this a moderate-severity, likely low-priority issue in real-world terms.

Out-of-bounds read in FFmpeg's convolution video filter (libavfilter/vf_convolution.c, function setup_3x3) affects releases 4.4.0–4.4.6, 5.1.0–5.1.8, 6.1.0–6.1.4, 7.1.0–7.1.3 and 8.0.0–8.0.1, allowing crafted media input to read past allocated buffers and potentially disclose memory or crash the process. Publicly available exploit code exists via the FFmpeg issue tracker, and the fix commit (8970658472d1 / e24b9820b4) has been published, with corrected releases 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0. Impact is limited: CVSS 2.1, and exploitation requires the non-default convolution filter to be applied to attacker-influenced input, so this is a low-severity hardening issue rather than an urgent patch-now event.

Improper validation of the WebSocket origin in IBM i 7.3, 7.4, 7.5, and 7.6 allows a remote attacker to read limited sensitive information by luring a logged-in user into a cross-origin WebSocket connection. The vulnerability requires user interaction (the victim must visit an attacker-controlled page) and yields only low confidentiality impact, giving a CVSS 3.1 base score of 4.3. There is no public exploit identified at time of analysis and CISA SSVC reports no active exploitation, so this is a low-urgency information-disclosure defect rather than an emergency patch item.

Incorrect privilege assignment in the checkShellCommand permission check (src/capabilities/permissions.ts) of cosmicstack-labs mercury-agent through 1.2.0 lets a low-privileged remote caller obtain shell-command capabilities it should not have. Publicly available exploit code exists, and the maintainers have not responded to the issue report, so no fixed release is confirmed. Impact is limited to low confidentiality exposure per the CVSS 4.0 vector (VC:L, VI:N, VA:N), making this a modest-severity exposure rather than a full compromise.

Mercury Agent versions through 1.1.13 gate shell execution by validating commands before canonicalizing them, so a caller with low privileges can craft input that passes the raw-string permission check yet resolves to a protected target, disclosing restricted data over the network. The flaw is a validate-before-canonicalize ordering error (CWE-180) in checkShellCommand within src/capabilities/permissions.ts, and publicly available exploit code exists via the project's own issue tracker. The project was notified early but has not responded, so no vendor fix is available, and the CVSS 4.0 base score of 2.1 reflects only a limited confidentiality impact.

A local information-disclosure weakness in cosmicstack-labs mercury-agent through version 1.2.0 lets a low-privileged local user manipulate the Shell Permission Manifest so that PermissionManager.checkShellCommand in mercury-agent/src/capabilities/permissions.ts mis-evaluates which shell commands are permitted. Successful abuse exposes sensitive data readable through the agent's shell capability, though integrity and availability are unaffected. Public exploit code exists (linked issue report) and the vendor has not yet responded, but exploitation is limited to hosts already running the agent and requires local access, giving a very low CVSS 4.0 base score of 1.9.

A race condition in the IBM i WebSocket handshake process allows a remote authenticated attacker to obtain sensitive information on IBM i 7.6, 7.5, 7.4, and 7.3. The flaw requires valid credentials and a precisely timed concurrent request pattern (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.2), so it is a low-severity, non-automatable issue rather than a mass-exploitation candidate. CISA's SSVC assessment rates exploitation as 'none' with no automatable path, and no public exploit code has been identified at time of analysis; IBM has published a vendor patch.

Link-following (symlink) handling in NanoClaw's agent-to-agent attachment forwarding lets an authenticated, low-privileged user cause the service to read or modify files outside the intended attachment directory. The flaw is in forwardAttachedFiles() in src/modules/agent-to-agent/agent-route.ts and affects every NanoClaw release from 2.1.0 through 2.1.17; the attack is network-reachable and requires no user interaction. Public exploit code exists and the vendor fix is identified as commit 3f9ed607b7e7a4872747295f75286f1c377d7c33, but real-world risk is currently low (CVSS 4.0 base 2.1, EPSS 0.29%, no CISA KEV listing).

Local unprivileged users on hosts running the System Security Services Daemon (SSSD) can crash or destabilize the NSS responder by sending a crafted zero-length request to its socket, degrading name-service lookups for every process on the machine. The defect is an integer underflow (CWE-191) in the responder's request parsing, and it is scored CVSS 4.0 because only availability is impacted and the attack requires local access to the host. There is no evidence of active exploitation or public exploit code at the time of analysis, and no vendor-listed fix version is available in the supplied intelligence.

An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).

Cross-tenant sender alias disclosure in Froxlor before 2.3.7 allows any authenticated customer to enumerate and read other customers' allowed sender alias values via an IDOR flaw in the delete-confirmation flow of `customer_email.php`. The query fetching `allowed_sender` uses only the global auto-increment `senderid` parameter without scoping it to the requesting customer, making all sender alias records on the instance accessible to any authenticated tenant. Publicly available exploit code exists, verified against Froxlor 2.3.6 with `mail.enable_allow_sender` enabled; no active exploitation has been identified.

Apache Syncope, the Apache open-source identity governance and administration (IGA) platform, writes audit events to its configured audit store without adequately masking sensitive values carried in event payloads, so an operator with administrative access to that store can read credentials and other secrets that should have been redacted. All releases from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 are affected. The vulnerability is rated 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/C:H/I:N/A:N), is not listed in CISA KEV, and no public exploit code has been identified at time of analysis.

Sensitive information exposure in Apache Syncope allows a privileged administrator with Derived Schema entitlements to craft a malicious JEXL (Java Expression Language) expression that, when evaluated during User read operations, leaks LinkedAccount or Manager sensitive data - including hashed credentials - to any admin with User read access. Affected versions span three release lines: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No public exploit code has been identified and CISA has not listed this in KEV; exploitation requires high-privilege access, limiting real-world risk to insider threats or compromised admin accounts.

The YAMAP - Social Trekking GPS App for Android exposes users to information leakage and unauthorized redirects through an improperly controlled WebView (in-app browser) implementation. The vulnerability stems from insufficient access control over which URLs or communication sources the WebView will process, allowing a crafted link or external input to steer the browser toward attacker-controlled content or harvest app-internal data. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at the time of analysis, but user interaction is required, making social engineering the realistic attack vector.

Plaintext credential storage in CONTEC's CONPROSYS nano Series industrial remote I/O devices exposes passwords to attackers with physical device access. Affecting multiple coupler unit models (server-type, EtherNet/IP adapter, and software PLC variants), the flaw means credentials are recoverable without decryption from device storage. No public exploit code or active exploitation has been identified; the physical access prerequisite and high attack complexity substantially limit real-world risk.

Directory listing exposure in CONTEC CONPROSYS PAC Series enables unauthenticated network attackers to enumerate internal directory structures by requesting a specific URL on the device's embedded web server. Affected models include the Integrated Type CPS-PC341 and Configurable Type CPS-PCS341, both deployed in industrial automation environments. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; impact is limited to information disclosure that could assist subsequent reconnaissance against the device.

Directory listing exposure in Contec's CONPROSYS M2M Gateway and M2M Controller Series allows a remote attacker to enumerate server-side directory structures by accessing a specific URL on the device's web interface. The affected hardware includes both integrated and configurable variants of the CPS-MG341, CPS-MGS341, CPS-MC341, and CPS-MCS341 product lines. Exposed directory listings reveal file and path structures that can facilitate reconnaissance for follow-on attacks against these industrial gateway devices. No public exploit or active exploitation has been identified at time of analysis.

Database field disclosure in four Regular Labs Joomla extensions - Advanced Module Manager, Conditional Content, Content Templater, and ReReplacer - allows an authenticated high-privilege user to read arbitrary database fields outside the intended scope. The Conditions editor feature accepts user-supplied database table and column names from the HTTP request, which are quoted as SQL identifiers (preventing SQL injection) but are not restricted to the tables and columns supported by Regular Labs integrations. An attacker with administrative access can therefore query unrelated database fields, potentially exposing sensitive Joomla database content such as user records or configuration values. No public exploit code or active exploitation is identified at time of analysis.

Improper SSH host key validation in andreashappe/cochise through version 0.4.1 allows a network-positioned attacker to perform Man-in-the-Middle attacks against SSH sessions established by the tool. The vulnerable component is the `asyncssh.connect()` call in `src/cochise/ssh_connection.py`, where the SSH Host Key Handler fails to verify server host keys, enabling silent impersonation of target SSH hosts. A public proof-of-concept exists as GitHub issue #13; no vendor patch has been released and the maintainer had not responded to the disclosure at time of reporting.

Untrusted pointer dereference in the camera driver of Samsung Exynos 1580 and 2500 mobile processors allows a local low-privileged attacker to cause denial of service or leak limited kernel information across security boundaries by sending a malformed message to the driver. The scope-changed CVSS vector (S:C) indicates impact extends beyond the immediate process context into privileged system components. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Out-of-bounds read in the Wi-Fi driver subsystem of Samsung Exynos mobile processors allows a local low-privileged attacker to leak kernel memory by sending a malformed Netlink command, potentially exposing sensitive in-kernel data. Affected processors span Samsung's mid-range and flagship mobile lineup plus wearable chips: Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930. No public exploit has been identified at time of analysis, and Samsung has published a product security advisory addressing the issue.

SMTP evasion via incomplete state reset in an Ubuntu-reported component allows an attacker to bypass protocol-level security controls by exploiting improper state machine cleanup between SMTP sessions or command sequences. The vulnerability enables crafted SMTP interactions to carry over state from a prior transaction into a new one, potentially allowing filter evasion, spoofed sender identity acceptance, or bypass of per-message security checks. No CVSS score, CWE, or patch version is currently assigned in NVD, and data is extremely sparse - the analysis below reflects significant inference from the vulnerability class.

IPv4/IPv6 hash collision in Suricata's IPPair tracking mechanism causes the engine to reuse state belonging to the wrong IP pair, leading to incorrect stateful evaluation of network traffic. The vulnerability affects deployments where both IPv4 and IPv6 traffic is processed and IPPair-based rules or datasets are active. An attacker who can craft traffic that induces a hash collision may cause Suricata to apply the wrong connection state, potentially bypassing detection rules that depend on per-pair tracking. No public exploit or CISA KEV listing has been identified at time of analysis.

Samsung Exynos camera driver firmware on eight mobile processor variants leaks sensitive information through debug instrumentation that was not removed from production builds (CWE-215). The flaw affects Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680 SoCs - processors found in Samsung Galaxy smartphones and tablets - allowing a local low-privileged attacker to read sensitive data that crosses the kernel-to-userspace security boundary. No public exploit code exists and the vendor-assigned CVSS score of 2.8 (Low) accurately reflects the narrow, local-only attack surface and limited confidentiality impact.

Out-of-bounds memory access in Samsung's CustOS Driver on Exynos 1580 processors exposes a local low-privileged attacker to cross-TEE-boundary memory read and write primitives. The fault is triggered by submitting an oversized shared memory allocation request to the custos_iwc inter-world communication device, which the driver services without adequate bounds validation, potentially leaking secure-world data or corrupting CustOS runtime state. No public exploit code has been identified and CISA has not listed this in KEV at time of analysis.

The Storm UI topology REST endpoint (`GET /api/v1/topology/{id}`) in Apache Storm 3.0.0 returned a merged Nimbus daemon and topology configuration without credential redaction, exposing ZooKeeper authentication payloads and TLS keystore/truststore passwords to any principal holding topology read-only access. This privilege gap is significant because the dedicated `getNimbusConf` API already redacted these secrets and required elevated `nimbus.users` membership, yet the topology page - which merges in strictly more daemon state - was unprotected. No public exploit is identified at time of analysis, but exploitation requires only a single authenticated HTTP GET call, making the effective complexity trivially low for any principal with read-only cluster access.

Two authorization and redaction failures in Apache Storm 3.0.0 expose credential-bearing cluster configuration to under-privileged or entirely ungated callers. The Nimbus `getNimbusConf` Thrift API serves the full daemon configuration-including ZooKeeper authentication payloads and TLS keystore and truststore passwords-after only a user-level authorization check, silently omitting the credential masking applied everywhere else in the product. The Storm UI REST endpoint `/api/v1/cluster/configuration` is worse: the missing `@AuthNimbusOp` annotation causes the authorization filter to treat the endpoint as ungated, proxying requests under the UI daemon's own principal so that any caller passing `ui.filter` receives the full unredacted configuration regardless of their privilege level. No public exploit has been identified and this CVE is not in CISA KEV.

Unauthenticated password reset in jaychouchannel's Tourism-Management-System allows any remote attacker to overwrite an arbitrary user's credentials by supplying only a known username to the resetPass endpoint - no current password, token, or session is required. All three Java Spring controllers (UsersController, DaoyouController, YonghuController) share the vulnerable pattern, enabling forced account lockout or, if the API response includes the newly generated random password, full account takeover. Publicly disclosed exploit code exists and the upstream fix is available via commit 9cb6215.

Improper privilege assignment in PHPGurukul Bank Locker Management System 1.0 allows remote authenticated attackers to bypass access controls by manipulating the `UserType` parameter in `sidebar.php`. The server fails to validate the supplied privilege level against the authenticated session, permitting lateral or vertical privilege escalation within the application. A public proof-of-concept exploit has been released per the VulDB disclosure, though the CVSS 4.0 base score of 2.1 reflects limited actual impact across confidentiality, integrity, and availability dimensions.

Terminal escape sequence injection in procs (the Rust-based `ps` replacement by dalance) through version 0.14.12 enables a local attacker to embed ANSI, CSI, or OSC control sequences in process argv that are rendered unfiltered into other users' terminals when they run procs. The Command column in `src/columns/command.rs` only stripped literal newlines and tabs, leaving ESC bytes and derived sequences intact; a victim running procs on the same host will have those sequences interpreted by their terminal emulator, enabling clipboard overwrite via OSC 52, screen manipulation via CSI, or hyperlink spoofing. No public exploit exists beyond the fix-commit unit test, and the CVSS 4.0 score of 2.4 (Low) accurately reflects the narrow, local-only, limited-integrity impact.

Prototype pollution in hapijs/joi's messages compilation function allows network-reachable attackers to replace an object's prototype chain by supplying `__proto__` as an error-code key in custom validation messages. Affected versions are joi before 17.13.8 and before 18.2.9. Applications that pass externally-controlled data (e.g., JSON request bodies) to `.messages()` or `.prefs({ messages: ... })` can have downstream code silently broken when it relies on standard `Object.prototype` methods. No public exploit identified at time of analysis, though the patch commit ships a working proof-of-concept test file.

Hard-coded AES encryption in dromara orion-visor up to version 2.5.7 renders all SSH private keys and host passwords stored by the application recoverable by any attacker who can access the data store. The vulnerable function `HostKeyServiceImpl.encryptKey` in the asset-service module applies a fixed, unchanging key that is embedded in the publicly available GitHub source - making the key universally known to anyone who inspects the repository. A proof-of-concept demonstrating full plaintext recovery of stored SSH credentials has been publicly disclosed, and the maintainer has not responded to the issue report.

Race condition in vvbbnn00's WARP-Clash-API Save Account Job component allows authenticated low-privilege remote attackers to exploit improper synchronization during concurrent account-state operations, yielding limited confidentiality, integrity, and availability impacts. The project has been abandoned by its maintainer, who did not respond to disclosure, and operates on a rolling release model with no versioned releases - meaning no patch will be issued. A publicly available proof-of-concept exploit exists on GitHub, though the CVSS 4.0 score of 1.3 and high attack complexity rating indicate that reliable exploitation is difficult in practice.

Race condition in the `doUpdateLicenseKey` function of vvbbnn00/WARP-Clash-API allows authenticated remote attackers with low privileges to exploit concurrent state manipulation for limited confidentiality, integrity, and availability impacts. The affected product is an abandoned, unsupported open-source Cloudflare WARP license key management tool with no versioning scheme and an unresponsive maintainer. A public proof-of-concept exploit exists on GitHub, though the high attack complexity (AC:H) and requirement for prior authentication substantially limit real-world risk.

Information disclosure in Chengdu Qilu Technology Ludashi 6.1026.4715.714 allows a local high-privileged attacker to read arbitrary physical memory by sending a crafted IOCTL with a manipulated PhysicalAddress argument to the kernel driver ComputerZ_x64.sys. The vulnerable function sub_11008 exposes physical memory read capability to user-mode callers without adequate address validation, a classic pattern in poorly designed Windows kernel drivers that can expose sensitive in-memory data such as credentials or cryptographic material. A public exploit has been published; no vendor patch exists as the vendor did not respond to coordinated disclosure.

Unauthenticated information disclosure in the Bookit - Booking & Appointment Calendar WordPress plugin (versions before 2.6.0.1) exposes appointment records belonging to other customers via the availability-check endpoint. Any unauthenticated visitor can query this endpoint and receive free-text booking comments, personal contact information, and appointment details that belong to other registered users. A publicly available proof-of-concept exploit exists (documented by WPScan), lowering the skill barrier for abuse. No active exploitation has been confirmed in CISA KEV.

Unauthenticated information disclosure in the User Registration & Membership WordPress plugin (versions 5.0 through 5.2.7) exposes arbitrary users' email addresses, profile fields, roles, and membership order details to any visitor. The plugin's membership confirmation page performs no ownership verification - an attacker who supplies another user's identifier in the request receives that user's data if the site operator has configured user smart tags on the page's message template. No public exploit confirmed in CISA KEV, though a publicly available proof-of-concept is documented by WPScan.

Unauthenticated information disclosure in the 'Contact Form to Chat Apps | Click to Chat to Order' WordPress plugin before 2.15.8 exposes all submitted form entries to any anonymous HTTP client. The plugin registers a public WordPress AJAX action that performs no capability check, nonce verification, or session validation - three standard WordPress authorization layers - allowing any remote actor to dump contact form submissions. A publicly available proof-of-concept exploit exists, reported by WPScan, making opportunistic mass scanning trivial.

CyberPanel before version 2.4.4 contains a logic omission in the `checkOwnership()` access control function that allows authenticated low-privilege users to bypass domain ownership verification. The `plogical/acl.py` module's `checkOwnership()` function lacked a `return 0` in its denial branch, causing it to implicitly return `None` instead of an explicit denial signal when a requesting user does not own the target domain. An authenticated user can exploit this to access domain-level information belonging to other panel users. No public exploit or CISA KEV listing exists at time of analysis.

Heap-based buffer over-read in TinyEXIF before 1.1.0 allows an attacker who can supply a crafted JPEG image to crash applications that use the library for EXIF metadata parsing. EntryParser::Fetch methods compute SubjectArea IFD entry offsets without validating them against the actual buffer length, producing out-of-bounds reads when processing malformed tags. No public exploit exists and no CISA KEV listing is present; impact is limited to availability and assessed as Low severity.

Path traversal in Zettlab D6 Ultra NAS (versions before 1.7.0) permits a low-privileged local user to mount arbitrary host paths - including /etc/passwd and /etc/shadow - into a container with read-write access by embedding '../' sequences in Docker Compose volume declarations. An attacker with compose-file write privileges can exfiltrate password hashes or overwrite authentication files, enabling full host privilege escalation. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; version 1.7.0 resolves the issue.

Out-of-bounds read in Freeciv 3.1.0-3.2.5 allows a crash or limited heap memory exposure when a user loads a maliciously crafted savegame file with an invalid unit activity index. The flaw exists in `sg_load_player_unit()` in both savegame2.c and savegame3.c, where the activity index `ei` is used to index into `loading->activities.order[]` without first validating it falls within `[0, loading->activities.size)`. No public exploit has been identified and the vulnerability is not on the CISA KEV list; vendor-released patch Freeciv 3.2.6 is available.

Missing authorization in the PlayerSkins mediaSession.json.php endpoint of WWBN AVideo exposes protected video metadata to unauthenticated network attackers. By supplying a video ID parameter to this endpoint, any remote attacker can retrieve the title and owner email address of password-protected videos without providing credentials, defeating the access-control intent of password protection. No public exploit or KEV listing is identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects a narrowly scoped confidentiality impact limited to metadata rather than video content.

Unauthenticated information disclosure in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 exposes password-protected video metadata to anonymous remote attackers via a missing authorization check on the videosAndroid.json.php endpoint. Any unauthenticated guest can retrieve sensitive owner data - including email addresses, last login timestamps, filenames, and hashIds - with a trivial GET request, bypassing the password-protection intent entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication, zero-complexity attack surface makes opportunistic mass harvesting straightforward.