Mad-proxy versions 0.3 and earlier fail to enforce their HTTP/HTTPS traffic interception rules, allowing remote, unauthenticated attackers to bypass the proxy's detection and blocking of malicious web activity and potentially expose sensitive traffic that should have been inspected. This protection-mechanism failure (CWE-693) carries a CVSS 5.3 score with only low confidentiality impact, and no public exploit code or active exploitation has been identified (EPSS 0.24%, 14th percentile). Exploitation is only meaningful where mad-proxy is deployed as an enforcement point, and no vendor fix is available at the time of analysis.
Unauthorized invocation of the AudioLink service on Tecno devices running version 1.3.0.87 lets a local attacker overwrite system files, an Incorrect Authorization flaw (CWE-863) in a service that is exposed without any permission or authorization check. Exploitation requires prior local code execution on the affected device - a co-resident malicious application or a local shell capable of reaching the AudioLink service - and is rated moderate severity (assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, integrity impact only, no confidentiality or availability loss, no RCE on its own). There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is only 0.21% (11th percentile), indicating low near-term exploitation likelihood, and the vendor's published advisory page is the only reference provided.
Cross-site request forgery in 1Panel versions 1.10.33 through 2.0.15 allows a remote attacker to change an authenticated user's panel name by luring them to a malicious webpage. The panel name management endpoint omits both anti-CSRF tokens and Origin/Referer header validation, so the victim's browser automatically includes valid session cookies when the forged request fires. No public exploit code and no CISA KEV listing exist at time of analysis; real-world impact is limited to low-integrity panel configuration tampering.
Local path traversal in usbmuxd (all builds predating upstream commit 3ded00c9985a5108cfc7591a309f9a23d57a8cba) lets an existing, unprivileged local user escape the daemon's intended directory and operate with the privileges of the usbmuxd service account, breaking the isolation between the calling user and the daemon's service identity. The attack is purely local - there is no remote vector - so the attacker must already hold an account on a host where usbmuxd is installed and running, and the resulting privilege is the service user's, not root, which is why the assessed impact is a moderate loss of integrity and availability (CVSS 3.1 AV:L/AC:L/PR:L, base ~5.1). Exploitation likelihood is currently low: EPSS is 0.15% (4th percentile), no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV; note that the vendor-supplied CVSS 4.0 vector records PR:N while the assessed vector rates PR:L, reflecting that some form of local access is still a practical prerequisite.
Command injection in the Jenkins Git client Plugin 6.4.0 and earlier allows a user who can influence the name of a job's workspace directory to execute arbitrary OS commands on the Jenkins controller or build agent, because the plugin fails to escape that path when it is embedded as an argument in a temporary shell script. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) shows this is not unauthenticated exploitation: the attacker needs authenticated, configuration-level access sufficient to set or control a custom workspace path, and the high attack-complexity rating reflects that merely reaching Jenkins is not enough - the workspace naming condition must be specifically achieved. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and EPSS is low at approximately 0.21% (11th percentile), so this is a genuine but low-priority vulnerability whose real-world risk is concentrated in multi-tenant Jenkins instances where less-trusted users can define job and workspace settings.
Path traversal in the WordPress plugin Simple Download Counter through version 2.2.2 lets an authenticated Administrator read arbitrary files on the server, including wp-config.php, via the simple_download_counter_parse_path() function. Exploitation requires high privileges (WordPress Administrator or above) but needs no user interaction and is network-reachable, so impact is confidentiality-only (CVSS 4.9). No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low (0.52%, 43rd percentile); the vendor chose not to fully remove the behavior on single-site installs, disabling it only on multisite and adding a readme warning.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - including AEM as a Cloud Service and AEM 6.5 LTS - allows an attacker who already holds a high-privileged AEM account to plant malicious JavaScript in vulnerable form fields, which then executes in the browser of any user who browses to the page rendering that field. The privilege prerequisite (PR:H) and required victim interaction (UI:R) mean realistic exploitation is limited to insider abuse or a compromised author/administrator credential rather than an anonymous external attacker, and the vulnerability cannot be triggered by low-privilege or unauthenticated users. There is no public exploit code identified at time of analysis and no evidence of active exploitation; EPSS is 0.21% (roughly the 10th percentile), consistent with a low-priority, defense-in-depth issue rather than an urgent compromise vector.
Authenticated path traversal in the Jenkins Redpen - Pipeline Reporter for Jira plugin (1.054.v7b_9517b_6b_202 and earlier) allows a user holding Item/Configure permission to read files from the Jenkins controller workspace directory when the plugin uploads build artifacts to Jira. Because the plugin fails to correctly validate the workspace path, the file being attached to a Jira issue can be resolved outside the intended build workspace, exposing controller-side files to anyone who can configure a job. No public exploit code has been identified at time of analysis, there is no indication of active exploitation, and the EPSS score is low at 0.34% (26th percentile), so this is a moderate-to-low priority issue whose risk is driven mainly by the privileged permission required of the attacker.
Jenkins 2.540 and earlier, along with Jenkins LTS 2.528.2 and earlier, allow an authenticated user who already holds View/Read permission to view encrypted password values exposed in views because of a missing permission check. The disclosure is limited to encrypted rather than plaintext secrets, so turning the exposure into usable credentials requires separately defeating Jenkins' encryption or reusing the encrypted form; no public exploit code has been identified at time of analysis and EPSS is low (0.25%, 15th percentile). This is a low-to-moderate priority information-disclosure issue rather than a high-urgency flaw.
Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier fails to set the correct context when resolving Vault credentials, letting an authenticated Jenkins user who holds Item/Configure permission access and potentially capture Vault secrets that belong to a different, more privileged scope. The path is network-reachable with low privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3), and it only applies where the plugin is installed and configured to resolve Vault credentials - anonymous and read-only users cannot reach it. No public exploit identified at time of analysis, and EPSS is only 0.23% (13th percentile), so this is a moderate-to-low priority information-disclosure issue rather than an emergency.
Information disclosure in Jenkins 2.540 and earlier and Jenkins LTS 2.528.2 and earlier exposes build authorization tokens in cleartext inside job config.xml files on the Jenkins controller, allowing any user holding Item/Extended Read permission - or anyone with read access to the controller filesystem - to recover tokens that can trigger builds remotely. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3) confirms the attacker must be authenticated at low privilege and that impact is limited to confidentiality, with no integrity or availability effect, so this is a low-to-moderate priority issue rather than an urgent threat; there is no confirmed actively exploited (CISA KEV) status, no public exploit identified at time of analysis, and the EPSS score of 0.18% (7th percentile) indicates very low predicted exploitation activity. Only jobs that have a build token configured expose anything - jobs without a configured build authorization token store no such secret.
Build authorization token disclosure in Jenkins 2.540 and earlier (weekly) and LTS 2.528.2 and earlier allows authenticated users with permission to view job configuration pages to see tokens in cleartext, potentially leading to token compromise (CWE-312). The vulnerability requires a valid account with access to the affected job's configuration (PR:L), and only affects confidentiality (C:L); there is no code execution or integrity impact. No public exploit code has been identified, and the EPSS score is 0.16% (5th percentile), indicating low exploitation likelihood.
DijiDemi, a platform by Im Park Information Technology, contains an authorization bypass vulnerability (CWE-639) that allows authenticated low-privileged users to access data belonging to other users by manipulating user-controlled identifier keys. Affecting all versions through 28.11.2025, the flaw enables horizontal privilege escalation - an attacker with a valid low-privilege account can exploit trusted identifiers to read confidential data outside their authorized scope. No public exploit code exists and no KEV listing is present; with an EPSS of 0.03% (10th percentile), active exploitation is not currently anticipated.
Information disclosure in Mastodon allows unauthenticated remote attackers who already know a status identifier to confirm whether that status exists by sending a request with a non-English Accept-Language header, exploiting a language-dependent error-handling discrepancy. This is a low-severity issue (CVSS 3.7, EPSS 0.22%) that cannot reveal status content or enable enumeration; no public exploit code or active exploitation has been identified. Affected versions are 4.2.27 and earlier, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9, and 4.5.0-beta.1 through 4.5.2; fixed in 4.2.28, 4.3.15, 4.4.10, and 4.5.3.
The CNI portmap plugin versions 1.6.0 through 1.8.0 contain a traffic interception vulnerability when configured with the nftables backend, allowing containers to receive and intercept all traffic destined for their configured HostPort regardless of destination IP address. This affects Linux Foundation's CNI Network Plugins, and an attacker with local privileges and control over a container can intercept traffic intended for other containers or services on the same node. The vulnerability has a published patch available in version 1.9.0, an extremely low EPSS score of 0.02% indicates minimal real-world exploitation likelihood, and there is no indication of active exploitation in the wild.
Login CSRF in Jenkins 2.540 and earlier (LTS 2.528.2 and earlier) allows an attacker to trick a victim into authenticating into the attacker's own Jenkins account, after which the attacker can observe what the victim does inside that account. Exploitation requires the victim to be lured to an attacker-controlled page while their browser can reach the Jenkins instance (UI:R); the published vector lists PR:L while our independent assessment treats the flaw as reachable by an unauthenticated external attacker (PR:N), and impact is confined to low confidentiality with no integrity or availability loss. No public exploit code or active exploitation has been identified, EPSS is just 0.19% (8th percentile), and this is therefore a low-severity, low-priority issue that does not warrant emergency patching.
Cross-site scripting in GoldenHorn (a web-based trade management platform by TAC Information Services Internal and External Trade Inc.) allows a low-privileged authenticated attacker to inject malicious JavaScript into pages rendered by other users, resulting in limited confidentiality impact such as session token or data exfiltration. All versions prior to 4.25.1121.1 are affected. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.02% (7th percentile) indicates very low exploitation probability at time of analysis.
Keycloak Admin REST API discloses sensitive role metadata through insufficient authorization checks on the /admin/realms/{realm}/roles endpoint, allowing high-privileged authenticated users to access role information they should not have permission to view. With a CVSS score of 2.7 and EPSS of 0.01%, this is a low-severity information disclosure affecting confidentiality only; no public exploit identified at time of analysis.