Cleartext exposure of API tokens in the Jenkins ByteGuard Build Actions Plugin 1.0 allows any authenticated Jenkins user with permission to view a job's configuration form to read tokens that should have been masked. Because the plugin renders the token value directly in the configuration form instead of substituting a masked placeholder, an actor who can already reach that page can simply copy the credential; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms a confidentiality-only, low-severity impact with no integrity or availability effect. EPSS is 0.17% (6th percentile), no public exploit code or CISA KEV entry was identified at time of analysis, and the practical exposure is bounded by the requirement for a valid Jenkins account holding configuration-read rights on the affected job.
Cleartext storage of external-service API tokens by the Jenkins ByteGuard Build Actions Plugin 1.0 lets anyone with Item/Extended Read permission on an affected job - or read access to the Jenkins controller filesystem - recover those tokens directly from job config.xml. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms this is a low-privileged, network-reachable confidentiality-only issue: authentication requirements are low-privileged (PR:L), so an anonymous attacker cannot reach the token without first obtaining Extended Read or host-level file access, and impact is confined to whichever external service the leaked token authenticates to. EPSS is 0.17% (6th percentile) and no public exploit identified at time of analysis; this is a genuine but low-priority weakness that also depends on the non-default condition that the plugin is deployed with API tokens actually configured.
Broken access control in the Evergreen Content Poster WordPress plugin (versions through 1.4.5) permits authenticated low-privilege users to invoke restricted plugin functionality without proper authorization checks. The root cause is CWE-862 (Missing Authorization), where the plugin fails to verify whether the requesting user holds the appropriate role before executing sensitive operations - allowing, at minimum, availability-impacting disruption to content scheduling workflows. No public exploit code has been identified at time of analysis, and the EPSS score of 0.03% (10th percentile) signals minimal observed exploitation activity.
Cross-Site Request Forgery in the Super Store Finder WordPress plugin (versions through 7.5) enables remote unauthenticated attackers to perform unauthorized state-changing actions by forging requests on behalf of authenticated users. The plugin fails to implement WordPress nonce validation on one or more sensitive endpoints, meaning a logged-in administrator tricked into visiting a malicious page can have plugin data or settings modified without consent. With an EPSS of 0.02% (4th percentile), no KEV listing, and no public exploit identified at time of analysis, this is a genuine but low-urgency finding appropriate for routine patch cycles.
Cross-Site Request Forgery in the Premmerce Product Search for WooCommerce WordPress plugin (versions ≤ 2.2.4) enables a remote attacker to forge state-changing requests on behalf of an authenticated WordPress user. The attack requires no privileges from the attacker but depends on social engineering an authenticated administrator or shop manager into visiting a malicious page while logged in. No public exploit has been identified at time of analysis, and EPSS at 0.01% (3rd percentile) reflects very low real-world exploitation probability.
Cross-Site Request Forgery in the Premmerce WordPress plugin (versions through 1.3.19) enables network-based attackers to forge state-changing requests on behalf of authenticated WordPress users without their knowledge. The attack succeeds when a logged-in user visits an attacker-controlled page, causing the victim's browser to silently submit a crafted request to their WordPress site. No active exploitation is confirmed (absent from CISA KEV), no public exploit code has been identified, and EPSS sits at 0.01% (3rd percentile), collectively indicating very low real-world exploitation probability at this time.
Cross-Site Request Forgery in the WP Rentals WordPress theme (WpEstate) through version 3.13.1 allows unauthenticated remote attackers to perform unauthorized state-changing actions by tricking authenticated site users into visiting a crafted page. The CVSS vector (PR:N/UI:R) confirms the attacker needs no credentials themselves but must socially engineer a logged-in victim. With an EPSS of 0.01% (3rd percentile), no public exploit code, and no CISA KEV listing, real-world exploitation risk is low at this time.
Cross-site request forgery in the Stockie Extra WordPress plugin (versions through 1.2.11) enables unauthenticated remote attackers to perform unauthorized state-changing actions by tricking a logged-in WordPress user into visiting attacker-controlled content. The CVSS vector (PR:N/UI:R/I:L) confirms exploitation requires no attacker authentication but mandates victim interaction, and impact is bounded to limited integrity modification - not full site compromise. No public exploit identified at time of analysis; EPSS of 0.01% at the 3rd percentile indicates negligible exploitation interest in the wild.
Cross-Site Request Forgery in the PowerPress Podcasting WordPress plugin (versions through 11.13.12) enables remote attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated WordPress administrator into visiting a malicious page. The CVSS vector (PR:N/UI:R/I:L) confirms exploitation requires no attacker authentication but mandates a social-engineering step to lure a logged-in admin. No public exploit identified at time of analysis; EPSS at 0.01% (3rd percentile) reflects minimal observed exploitation interest.
LiteLLM installations can expose stored API_KEY credentials through the health endpoint to authenticated users, with exploitation requiring a valid low-privileged account and some victim interaction. The issue is a low-severity information disclosure (CVSS 3.5) that can leak sensitive credentials but does not directly affect integrity or availability. No public exploit code was identified at time of analysis, and active exploitation is not confirmed.
An unprotected alternate MQTT authorization channel in the Dyson cloud backend allows a former owner of a Dyson device (for example a Pure Hot+Cool purifier/heater) to retain control after ownership is transferred, provided the device is not factory-wiped and the previously sniffed AWS credentials-AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN-together with the device serial number remain valid. Exploitation is heavily constrained: the attacker must have legitimately held the device with full privileges, capture the AWS credentials, and complete an ownership-transfer sequence to the victim; the resulting impact is limited to setting the room temperature within the safe operating range (up to 37 Celsius), with no code execution and no sensitive data disclosure. No public exploit code or confirmed active exploitation is known, and EPSS places the probability of exploitation within 30 days at roughly 0.38% (29th percentile); Dyson states it can no longer replicate the behavior, which dates to its 2022 firmware generation.
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card In try_to_register_card(), the return value of usb_ifnum_to_if() is passed directly to usb_interface_claimed() without a NULL check, which will lead to a NULL pointer dereference when creating an invalid USB audio device. Fix this by adding a check to ensure the interface pointer is valid before passing it to usb_interface_claimed().
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix null-deref in agg_dequeue To prevent a potential crash in agg_dequeue (net/sched/sch_qfq.c) when cl->qdisc->ops->peek(cl->qdisc) returns NULL, we check the return value before using it, similar to the existing approach in sch_hfsc.c. To avoid code duplication, the following changes are made: 1. Changed qdisc_warn_nonwc(include/net/pkt_sched.h) into a static inline function. 2. Moved qdisc_peek_len from net/sched/sch_hfsc.c to include/net/pkt_sched.h so that sch_qfq can reuse it. 3. Applied qdisc_peek_len in agg_dequeue to avoid crashing.