Null pointer dereference in NVIDIA Display Driver for Linux allows an already-authenticated local user to crash the display/GPU subsystem and cause a denial of service, with no confidentiality or integrity impact. The issue is rated CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and EPSS is low at 0.22% (11th percentile). No public exploit code or CISA KEV active exploitation was identified at time of analysis.
Denial of service in NVIDIA Display Driver for Linux occurs when a local, authenticated low-privileged user triggers a null pointer dereference by allocating a specific kernel memory resource through the GPU driver interface. Only Linux systems running the affected NVIDIA display/kernel driver are exposed; there is no remote vector, and impact is limited to availability with no privilege escalation or data exposure. No public exploit was identified at time of analysis, and EPSS is 0.15% (4th percentile), consistent with a low-priority local crash issue.
Authenticated privileged operators can bypass competency and expiry enforcement in Gallagher Command Centre Server because the validation is performed only in the client and never re-verified server-side (CWE-602), allowing invalid competency data to be written into the system. Affected builds are Command Centre Server 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), and all versions of 9.00 and earlier. The impact is confined to data integrity (I:H, C:N, A:N) with no confidentiality or availability effect, exploitation requires an already-privileged operator account on the server, no public exploit code has been identified at time of analysis, EPSS is 0.14% (3rd percentile), and the issue is not in CISA KEV - so practical risk is bounded to insider misuse or operator error rather than external compromise.
Over-broad cardholder data visibility in Gallagher Command Centre Server builds 9.30.1874 (MR1), 9.20.2337 (MR3) and 9.10.3194 (MR6) allows a low-privileged, already-provisioned Operator to view limited personal data about a Cardholder that their role should not expose, due to insufficient authorization filtering on cardholder records (CWE-359). Exploitation requires an authenticated Operator account with at least low-level privileges on the Command Centre Server (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and yields read-only disclosure of a constrained set of personal fields - there is no write, configuration-change or availability impact. No public exploit has been identified at time of analysis, EPSS is 0.13% (3rd percentile) and the issue is not in CISA KEV, so this is a low-to-moderate priority privacy/authorization defect rather than a high-urgency threat.
Denial of service in Gallagher Command Centre Server allows an authenticated operator with both Authorized and Privileged rights to crash the server at will by triggering an uncaught exception (CWE-248). Affected versions include 9.30 before vEL9.30.2482 (MR2), 9.20 before vEL9.20.2819 (MR4), 9.10 before vEL9.10.3672 (MR7), 9.00 before vEL9.00.3831 (MR8), and all versions of 8.90 and prior. No public exploit identified at time of analysis, and EPSS is 0.12% (2nd percentile), reflecting low predicted exploitation activity; the primary risk is availability loss for deployments that grant such privileged operator access.
Keycloak continues to honor OIDC offline sessions after an administrator removes the offline_access client scope, so a previously issued offline refresh token is still accepted at the token endpoint and can mint new access tokens. Affected are Keycloak deployments (including Red Hat build of Keycloak and RH-SSO via the referenced errata) where clients have been granted offline access; an attacker must already hold a valid offline refresh token (authenticated, PR:L) and the flaw only manifests after the administrative scope removal that was intended to revoke that access. Impact is confidentiality and integrity limited (CVSS 5.4, CWE-613 Insufficient Session Expiration) and bounded by the offline session's idle/max lifetime; EPSS is only 0.30% (21st percentile), there is no CISA KEV entry, and no public exploit code was identified at time of analysis.
Keycloak fails to enforce a realm administrator's decision to disable the "Remember Me" login option against sessions that were created while the option was still enabled, so those sessions keep their extended lifetime until they lapse naturally. An attacker who already holds one of those session cookies or its associated refresh token (authentication is required, PR:L) can therefore keep using it well past the point where the administrator intended to shorten session lifetimes, widening the window for session hijacking and long-term persistence. Exploitation is highly situational - it requires the realm to have had Remember Me on, a user to have logged in with the checkbox selected, and an administrator to have later disabled the realm setting - and no public exploit code or CISA KEV entry exists; EPSS is low at 0.24% (13th percentile). The issue is fixed in Keycloak 26.4.1, which marks such sessions invalid the next time the cookie or token is presented.
Stored cross-site scripting in the Beaver Builder Lite (Starter) plugin for WordPress affects all versions up to and including 2.9.2.1, where an authenticated user holding Contributor-level access or higher can inject arbitrary JavaScript through the 'auto_play' parameter that later executes in the browser of anyone viewing the injected page. The CVSS vector (PR:L, UI:R, S:C, 5.4) confirms exploitation requires a valid low-privilege account and fires only when another user - typically a higher-privileged admin reviewing or previewing the content - interacts with the page, which materially limits practical risk to multi-author sites that provision untrusted Contributor accounts. No public exploit code has been identified at time of analysis, the EPSS score is low at 0.18% (6th percentile), and there is no CISA KEV listing.
Reflected XSS in AcBakImzala, ArkSigner's document signing application, affects all versions before v5.1.4 and allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser. The attack requires the victim to interact with a crafted URL, limiting automated exploitation, but the low attack complexity and absence of authentication requirements make social-engineering-based delivery straightforward. No public exploit code or CISA KEV listing has been identified; EPSS is very low at 0.03% (9th percentile), consistent with limited observed exploitation interest at this time.
Information disclosure in the Moodle router (r.php) lets a remote unauthenticated requester receive internal directory listings when the deployment's HTTP headers are not properly configured. The flaw is scored 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), with impact confined to confidentiality - exposure of internal directory and file structure - and no effect on integrity or availability. Exposure is conditional on the header misconfiguration: instances with correctly configured HTTP headers are not expected to expose the listings, and EPSS is low at 0.30% (23rd percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
Blind server-side request forgery in the MxChat - AI Chatbot for WordPress plugin (mxchat-basic) up to and including version 2.4.6 lets remote attackers coerce the WordPress server into making HTTP requests to arbitrary destinations through the unauthenticated mxchat_handle_chat_request AJAX action, which passes user-supplied URLs into the plugin's PDF processing routine without adequate validation. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or victim interaction are required, but impact is confined to confidentiality (C:L) with no integrity or availability effect, and the blind nature of the flaw means the attacker never sees the fetched response - real-world risk therefore hinges on whether the host can reach sensitive internal services or a cloud metadata endpoint. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE; EPSS is only 0.29% (20th percentile), consistent with a moderate-severity, low-priority issue that should not jump the patch queue despite being remotely and unauthenticatedly reachable.
Cross-site request forgery in KeeneticOS before version 4.3 allows remote attackers to take over Keenetic routers by forging authenticated requests to the /rci (Remote Configuration Interface) API endpoint, resulting in the creation of unauthorized full-permission admin accounts. The attack requires tricking a currently-authenticated router administrator into visiting a malicious page, giving attackers persistent full-device control without needing credentials of their own. No public exploitation confirmed in CISA KEV, but a public researcher writeup is available on GitHub; EPSS stands at 0.02% (7th percentile), suggesting exploitation remains limited at time of analysis.
Information disclosure through an enabled serial console on BLU-IC2 and BLU-IC4 devices (firmware through 1.19.5) lets someone with physical access to the device's serial interface observe diagnostic and boot-level output that can reveal further weaknesses and ease follow-on research or attack development. The vendor's own CVSS 4.0 vector scores this 5.2 with AV:L/AC:H/PR:N/UI:P, meaning unauthenticated but local (physically adjacent) access, high attack complexity, and only low confidentiality/integrity/availability impact to the device itself; our independent assessment corroborates this as a genuinely low-priority issue (CVSS 3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). There is no KEV listing and no public exploit code identified at time of analysis, and EPSS is only 0.11% (1st percentile), so remote or scaled exploitation is not a realistic concern - the real risk is an attacker who already has hands on the hardware.
Open redirection in MOLGENIS EMX2 v11.14.0 allows attackers to craft manipulated URLs using the redirection parameter formatted as '/%2f%2f<MALICIOUS_DOMAIN>', sending victims to phishing sites or other malicious destinations. The vulnerability is remotely reachable and does not require authentication to craft the malicious link (CVSS 4.0 base score 5.1; independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), but successful exploitation depends entirely on social engineering because the victim must click the crafted link. There is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV), and EPSS is 0.30% (21st percentile), consistent with a low-priority issue whose impact is limited to the external phishing destination rather than the EMX2 application itself.
Stored cross-site scripting in Energy CRM v2025 allows an authenticated attacker holding a valid CRM account to inject a malicious script into the JobCreatedBy parameter of a POST request to /crm/create_job_submit.php, which is then persisted and executed in the browser of any authenticated CRM user who opens the affected job record. The result is client-side compromise of the victim's browsing session, with the described objective being theft of cookie session details; the vendor's own CVSS 4.0 base is 5.1, and the independent assessment reaches a comparable medium-severity rating (CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that an attacker needs both a CRM account and a victim who views the poisoned record, with no server-side confidentiality, integrity, or availability impact. Exploitation status: no public exploit identified at time of analysis; EPSS is 0.21% (10th percentile), and the flaw is not listed in CISA KEV, so real-world prioritization is modest.
Reflected cross-site scripting in GROWI v4.2.7 and earlier lets an attacker execute arbitrary script in a logged-in user's browser when the user opens a crafted URL that abuses the page alert function. The attacker does not need credentials but must convince an authenticated victim to interact with the link, so exploitation depends on user action and an active GROWI session. EPSS is 0.20% (10th percentile), no CISA KEV entry is present, and no public exploit identified at time of analysis.
Server-side request forgery in the Feedzy RSS Aggregator plugin for WordPress (all versions up to and including 5.1.0) allows an authenticated attacker with Subscriber-level access or above to point the plugin's feed-sanitization routine at arbitrary URLs, causing the web server to fetch internal-only hosts, intranet services, or cloud metadata endpoints on their behalf. The flaw is remote and requires no user interaction, and it carries a scope change because the vulnerable application is used as a proxy into other systems, but the consequence is confidentiality-only - reading responses from reachable internal targets - with no integrity or availability effect. No public exploit code has been identified at time of analysis and EPSS is 0.29% (20th percentile), so opportunistic mass exploitation is unlikely; the practical barrier is that an attacker must first obtain a low-privilege account, which sites with open self-registration effectively hand out.
Denial of service in NVIDIA Display Driver for Linux occurs when a local, low-privileged user with user interaction reaches a kernel-module code path that dereferences a null pointer, crashing the driver or system. The CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H vector confirms the issue is local, requires an authenticated account and user interaction, and affects only availability. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.14% (3rd percentile).
Slack Nebula before 1.9.7 can be induced to accept traffic from source IP addresses that a host certificate should not be entitled to use, allowing a firewall-rule bypass inside the Nebula overlay network. The flaw affects only deployments whose host certificates carry subnet prefixes (for example a /24 network) or unsafe_networks entries rather than single-host addresses; when this configuration is present, the firewall treats the entire subnet as the peer's legitimate source range. The attacker must be an authenticated participant holding a certificate signed by the deployment's CA (CVSS vector PR:L), so this is an in-mesh integrity/access-control issue rather than an external attack, and there is no confidentiality exposure. A vendor patch is available, EPSS is low at 0.22% (11th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting (XSS) in the web management interface of Moxa Ethernet switches lets an attacker who already holds administrative credentials plant persistent scripts that execute in the browsers of other authenticated users who view the affected page. Because the attacker must first obtain high-privilege admin access and a second user must interact with the compromised interface, exploitation is constrained, and the device itself suffers no loss of confidentiality, integrity, or availability - only other users' browser sessions are exposed. EPSS is low (0.33%, 24th percentile), no public exploit code or CISA KEV entry is associated with the issue at time of analysis, making this a low-to-moderate priority finding for environments where administrative access to the switch UI is shared among multiple users.
Reflected cross-site scripting in the Vilar VS-IPC1002 IP camera firmware lets unauthenticated attackers run arbitrary JavaScript in the browser of a logged-in administrator, enabling session theft or unauthorized camera actions. Exploitation requires the admin to be induced to open a crafted GET request to the /cgi-bin/action endpoint (active user interaction) and typically needs adjacent-network positioning, since these cameras normally sit on LANs; no public exploit code has been identified and CISA KEV does not list this issue. The vendor never responded to CERT.pl, so no patch exists, EPSS is 0.22% (11th percentile), and only firmware 1.1.0.18 has been confirmed affected.
Stored cross-site scripting in the slider editor (sliders-form) of OpenSolution Quick.Cms lets an authenticated administrator inject arbitrary HTML and JavaScript that is persisted and rendered on every page of the site. The flaw is notable as a bypass of an intended restriction: by default admin users are not supposed to be able to add JavaScript to the website, so the slider editor provides a route around that control. Realistic risk is limited because exploitation requires a pre-existing admin account (PR:H) and a victim must subsequently load an affected page (UI:P); only version 6.8 has been tested and confirmed vulnerable, vulnerability applicability to other versions is unverified, EPSS is low at 0.19% (8th percentile), and no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Quick.Cms page editor (pages-form) allows an authenticated administrator to inject arbitrary HTML and JavaScript that is persisted and then executed in the browser of any user who later visits the edited page. Only version 6.8 has been tested and confirmed vulnerable; the vendor was notified early but did not respond with vulnerability details or an affected version range, so other versions remain untested and may also be affected. A key limiting factor noted by the researcher is that Quick.Cms by default does not allow the admin user to insert JavaScript into the site, meaning full script execution likely depends on a non-default configuration that permits raw HTML/script entry; EPSS is low at 0.19% (8th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Out-of-bounds read in the video decoder of NVIDIA Display Driver for Windows and Linux can allow a locally authenticated, low-privileged user to disclose limited information or crash the decoding path, resulting in denial of service. Exploitation requires prior local access and submission of a crafted video stream to the decoder; the flaw is not remotely reachable, and the supplied data shows low EPSS risk (0.16%, 5th percentile) with no public exploit identified at time of analysis.
Self-cross-site scripting in Liferay Portal and Liferay DXP lets an authenticated Knowledge Base editor store a crafted script or HTML payload in an attachment filename, which then executes in that same user's browser when the article edit page renders the filename. Affected releases are Liferay Portal 7.4.0 through 7.4.3.101, Liferay DXP 2023.Q3.1 through 2023.Q3.5 and 7.4 GA through update 92, and older unsupported versions; the CVSS 4.0 score is 2.0 and the assessed CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N. No public exploit has been identified at time of analysis, CISA KEV does not list this CVE, and EPSS is 0.21% (11th percentile), consistent with a low-priority, self-contained XSS requiring authentication and user interaction.
Host header injection in Moxa Ethernet switches allows an attacker who already holds administrative access to the device's web service to inject crafted HTTP Host headers into requests, enabling redirects, forged links, and phishing against users who interact with manipulated URLs. The device's own confidentiality, integrity, and availability are unaffected, and exploitation requires prior administrative access plus victim interaction, making this a low-priority, post-authentication issue. EPSS is 0.18% (8th percentile), and no public exploit or CISA KEV entry is identified at time of analysis.