We need to parse the CVE data and synthesize into the required JSON fields. Let's go through each field. - product_name: 1-3 words. Affected products are Splunk Enterprise and Splunk Cloud Platform. The primary product could be "Splunk Enterprise" as the most common on-prem product, but description lists both. We can say "Splunk Enterprise" or "Splunk Cloud Platform". Since the vulnerability is in the apptemp directory handling and it's a low-privileged user with RCE, I'll pick "Splunk Enterprise" as the core product name. However, "Splunk" alone might be too generic, but allowed 1-3 words. So "Splunk Enterprise" is fine. - summary: 2-3 sentences plain-language, not copy of description. Must start with impact verb. Impact is RCE, so something like "Remote code execution in Splunk Enterprise and Splunk Cloud Platform allows...". Specific: low-privileged user (not admin/power) uploads malicious file to apptemp directory due to improper handling, leading to RCE. Affected versions: Enterprise below 10.2.1, 10.0.5, 9.4.10, 9.3.11; Cloud below various versions. Attacker can execute arbitrary code. EPSS low (0.13%), no KEV, no POC mentioned? Tags don't say POC. SSVC says exploitation none, automatable no, total impact. So not actively exploited. Summary: "Remote code execution in Splunk Enterprise and Splunk Cloud Platform allows low-privileged users without admin/power roles to execute arbitrary code by uploading a malicious file to the $SPLUNK_HOME/var/run/splunk/apptemp directory. Affects Enterprise versions before 9.3.11, 9.4.10, 10.0.5, 10.2.1 and Cloud Platform before respective fixed versions. No public exploit identified at time of analysis." - technical_context: underlying technology/protocol: Splunk apptemp directory is a temporary file storage used during app installation or updates. CWE-377 is Insecure Temporary File handling. The root cause is insufficient isolation: files in apptemp can be manipulated by low-privileged users to achieve RCE. CPEs indicate both Splunk Enterprise and Cloud Platform. Could explain that Splunk uses this directory for app staging, and improper handling of file permissions allows malicious upload to trigger code execution, possibly through app validation or loading mechanisms. Educational. - risk_assessment: CVSS 7.1, vector AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. So network attack, high complexity, low privileges required, user interaction required, scope unchanged, high impact on CIA. EPSS 0.13% (low probability of exploitation, 33rd percentile). Not in KEV. No POC evidence. SSVC: exploitation none, automatable no, technical impact total. So risk is moderate but not actively exploited. Complexity high and user interaction required reduce real-world risk. But total impact, so if exploited, serious. Compare: CVSS is high severity (7.1) but EPSS suggests low exploitation likelihood. Patches available. Real-world priority: apply patches as part of normal cadence, not emergency. Mention that despite low EPSS, the total impact makes it worth remediating. - affected_products: list products with version ranges. Splunk Enterprise: below 10.2.1, 10.0.5, 9.4.10, 9.3.11. Splunk Cloud Platform: below 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, 9.3.2411.127. Reference to vendor advisory: https://advisory.splunk.com/advisories/SVD-2026-0403. No bullet points. - remediation: action: upgrade to fixed versions. Provide exact versions: Enterprise: 9.3.11, 9.4.10, 10.0.5, 10.2.1; Cloud: 9.3.2411.127, 10.0.2503.13, 10.1.2507.19, 10.2.2510.9, 10.3.2512.5, 10.4.2603.0. Workaround maybe not mentioned. Possibly restrict file upload permissions or restrict access to apptemp directory. But no specific workaround in description. I'll say: "Upgrade Splunk Enterprise to version 9.3.11, 9.4.10, 10.0.5, or 10.2.1, and Splunk Cloud Platform to 9.3.2411.127, 10.0.2503.13, 10.1.2507.19, 10.2.2510.9, 10.3.2512.5, or 10.4.2603.0. As a temporary mitigation if upgrading is not possible, restrict write access to the apptemp directory to trusted roles only, but this may impact app installation functionality. Consult advisory SVD-2026-0403." - exploit_scenario: realistic attack: low-privileged Splunk user (without admin/power) uploads a malicious file to the apptemp directory (which they can access) via a crafted request or through app upload functionality if allowed; the file is then processed by Splunk in a way that leads to code execution, potentially via loading a malicious app or configuration. Attack complexity high due to need to trigger processing. Example: "A low-privileged user authenticates to Splunk Web and uploads a specially crafted file to the apptemp directory via the app import feature. When Splunk processes the temporary file for app installation, the malicious payload executes, giving the attacker remote code execution on the Splunk server." - exploitation_conditions: specific prerequisites from description: "low-privileged user that does not hold the admin or power Splunk roles". So attacker must have any low-privileged role, not power/admin. Also, the user must be able to upload a file to the `$SPLUNK_HOME/var/run/splunk/apptemp` directory. That directory might be writable by all authenticated users? The vulnerability is due to improper handling and insufficient isolation of temporary files. So condition: the Splunk instance must allow file uploads to apptemp by low-privileged users. It may be default. User interaction required (UI:R) could refer to the attacker needing to trick a user into processing? Actually UI:R in CVSS means the attacker must trick a user into taking some action. This might be that the low-privileged user must upload the file, but it's the attacker that is that user. In that case, it's not UI. Wait, CVSS says UI:R, which typically requires that the exploitation requires a user other than the attacker to take action. Could be that the attacker needs to convince a victim (another user) to upload the malicious file? The description says "a low-privileged user could potentially perform a Remote Code Execution by uploading a malicious file". That suggests the attacker is the low-privileged user themselves. So UI:R might be misinterpreted? Alternatively, the upload might be via some UI action that the attacker performs. But CVSS defines UI:R as "the vulnerable component requires user interaction to function. ... the user interaction is required from a user other than the attacker." So if the attacker themselves is the user performing the upload, then it's not UI:R but rather PR:L and no UI. The CVSS vector provided shows UI:R, but given descriptions, maybe the attacker must convince a user with low privileges to upload? Could be both: maybe the attacker can be a low-privileged user, but to trigger the RCE they need to interact with the apptemp directory in a way that involves some UI? Possibly the vulnerability is in the handling of uploaded files during app installation, which might be triggered by the user through UI. I think the vector might be AV:N/AC:H/PR:L/UI:N/..., but they put UI:R. I'll respect the given CVSS vector. So exploitation conditions: attacker must be authenticated as a low-privileged user (non-admin, non-power) and must be able to upload a file to apptemp, but also requires user interaction from another user? Perhaps the attacker uploads a file that is then executed when an admin installs or processes an app. That would be UI:R from the admin. So condition: "Exploitation requires an authenticated low-privileged user (without admin or power roles) to upload a malicious file to the apptemp directory, and a subsequent user action (e.g., by an administrator or automated process) that triggers processing of that file." But let's keep to the description. I'll state: "Requires an authenticated Splunk account with any low-privileged role (not admin or power). The attacker must be able to write files to the `$SPLUNK_HOME/var/run/splunk/apptemp` directory, which may be accessible by default. User interaction is required to trigger the RCE (CVSS UI:R), likely from another user such as an administrator performing an app management action." Also add that it's remote over network. So: "Exploitation requires authenticated access as a low-privileged user (non-admin, non-power) and the ability to upload files to the apptemp directory. No specific non-default configuration is required if the directory is writable; however, the high attack complexity and user interaction requirement imply that the attacker must either trick another user into processing the file or rely on specific workflow." - attack_chain: Based on kill chain: authenticated low-privileged user uploads malicious file to apptemp directory via Splunk Web or API → file is stored in apptemp with insufficient isolation → later, an administrator or cron job processes the file (e.g., during app installation or validation) → the malicious payload executes → attacker achieves remote code execution with Splunk service privileges. So chain: "Authenticate as low-privileged Splunk user → Upload malicious file to apptemp directory via app upload feature → Wait for file to be processed by Splunk (e.g., admin action or scheduled task) → Malicious code executes → Gain RCE on Splunk server." 5 steps. - confidence_notes: Vendor advisory exists (SVD-2026-0403) confirming affected versions and patches. EPSS score is low, no KEV. POC status unknown (not listed). The CVE description is from the advisory. SSVC indicates no exploitation, not automatable, total impact. So confidence: "Vendor-confirmed vulnerability with fixed versions published in Splunk advisory SVD-2026-0403. No evidence of public exploit or active exploitation. Affected version ranges and patch availability are confirmed. The exact mechanism of code execution and preconditions (UI:R) require further analysis." - prevalence: Splunk is a widely used enterprise SIEM and log management platform. It is common in large organizations. So prevalence likely "high". Many enterprise environments run Splunk. So "high". - prevalence_basis: "widely deployed enterprise SIEM and log management solution". - assessed_cvss_vector: I need to provide my own independent CVSS. Given the description, I might adjust. The provided CVSS is 7.1: AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. Is that reasonable? The attack requires network, low privileges, but also user interaction. However, if the attacker is the low-privileged user and they upload a file and that immediately triggers RCE, then UI:N would be more appropriate. But the description doesn't say what triggers the RCE. Could be that the file is uploaded and then automatically processed by some Splunk internal mechanism without user interaction? The CWE-377 is Insecure Temporary File, but the vulnerability could be that the file is placed and then later processed by a service (like a cron job) that doesn't require user interaction. In that case, UI:N. However, the given vector has UI:R, which I'll respect because it's from Splunk themselves. So my assessed vector might differ. I'll reason: The attack requires the attacker to upload a file, but if the processing is automatic, then UI:N. But high complexity maybe due to file format or timing. I'll lean towards UI:N if the description doesn't mention tricking a user. But let's read: "could potentially perform a Remote Code Execution by uploading a malicious file to the $SPLUNK_HOME/var/run/splunk/apptemp directory due to improper handling". So the act of uploading is the vector. The handling is improper, so the mere upload might cause RCE. That suggests no additional user interaction. So I'd set UI:N. Also, the attack complexity: maybe needs specific file content? High? Might be high if
Stored Cross-Site Scripting (XSS) in Nozomi Networks Guardian and CMC allows authenticated attackers with custom field privileges to inject malicious JavaScript payloads through the Assets and Nodes custom field functionality. When victims view affected pages, the XSS executes with high integrity and availability impact due to changed scope (CVSS S:C), enabling unauthorized actions including data modification and service disruption. No public exploit identified at time of analysis, though the attack complexity is low (AC:L) once custom field access is obtained.
Local privilege escalation in Lenovo Software Fix versions prior to 7.5.5.19 allows an authenticated user to execute arbitrary code with elevated privileges during installation via an uncontrolled search path (CWE-427). The vulnerability requires local access and user interaction to run the installer. No active exploitation or public exploit code is known at this time.
Arbitrary file write with elevated privileges exists in Lenovo Diagnostics and HardwareScanAddin components of Lenovo Vantage. A local authenticated user can overwrite files during installation or hardware scan, posing integrity and availability risks. No active exploitation or public exploits have been identified (EPSS 0.01%), and a vendor patch is available.
Authorization bypass in OAuth2 Proxy versions before 7.15.2 allows authenticated attackers to circumvent email domain restrictions by presenting an email claim containing multiple '@' symbols (e.g., attacker@evil.com@company.com). The flaw affects deployments that rely on email_domain enforcement with identity providers that do not strictly validate email syntax; no active exploitation or public exploit code is currently reported, and EPSS indicates low exploitation probability.
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation memory API. Versions prior to 5.17 are affected; the fix in 5.17 adds filename validation to prevent directory traversal and restricts remote URLs to allowed domains. No active exploitation has been reported (CISA KEV not listed, SSVC exploitation status none), and EPSS risk is very low (0.04%).
Mattermost versions 10.11.x through 10.11.12, 11.3.x through 11.3.2, 11.4.x through 11.4.2, and 11.5.0 fail to validate CSRF tokens on authentication endpoints, allowing remote attackers to update a targeted user's authentication method by tricking them into visiting a malicious page. The attack requires user interaction (UI:R) and results in high confidentiality and integrity impact, but no public exploit or CISA KEV confirmation has been identified at the time of analysis.
Account management inconsistencies in Splunk Enterprise and Splunk Cloud Platform allow users with the high-privilege 'edit_user' capability to create specially crafted usernames containing null bytes or non-UTF-8 percent-encoded bytes. This can lead to improper storage of usernames, resulting in inability to edit or delete affected users. No active exploitation has been identified and the EPSS score is very low (0.04%), indicating minimal real-world risk.
Prototype pollution in mafintosh's protocol-buffers-schema 3.6.0 allows remote attackers to inject arbitrary properties into JavaScript objects by supplying a malicious protocol buffer schema definition to the parse function. This can lead to application logic manipulation, security check bypass, denial of service, or remote code execution. Public exploit code exists, but no active exploitation has been confirmed by CISA KEV at this time.
Arbitrary file download in Cisco Unity Connection allows authenticated, remote attackers with administrative credentials to exfiltrate system files via crafted HTTPS requests. The flaw stems from improper input sanitization (CWE-23) in the web-based management interface. No active exploitation or public proof-of-concept is known, and EPSS (0.08%) indicates low exploitation likelihood, making this a moderate priority for patching in environments where the management interface is already adequately protected.
File disclosure vulnerability in Cisco Unity Connection's web-based management interface allows authenticated attackers with administrative credentials to download arbitrary files via crafted HTTPS requests. The flaw stems from improper sanitization of user input leading to relative path
A remote attacker can trigger a heap out-of-bounds write in FFmpeg's DVD subtitle parser by providing a crafted MPEG-PS/VOB file containing a malicious subtitle stream. This signed integer overflow flaw leads to application crash or potential arbitrary code execution, affecting any software that relies on FFmpeg for media parsing. No public exploit is known, and EPSS indicates a low exploitation probability (0.04%).
Information disclosure in Google Chrome prior to version 147.0.7727.101 allows a remote attacker to obtain sensitive information from process memory by enticing a user to open a crafted file. The vulnerability, rated Medium severity by Chrome, resides in the Skia graphics library and is not currently listed in CISA KEV, with a low EPSS exploitation probability (0.03%). A patch is available from Google.
Arbitrary directory deletion in Eleganzo theme for WordPress up to version 1.2 allows authenticated attackers with Subscriber-level access to delete any server directory, including the WordPress root directory, via a path traversal flaw in the akd_required_plugin_callback function. No active exploitation or public proof-of-concept is known, and EPSS probability is very low.
Stored cross-site scripting in Emarket-design's YouTube Showcase WordPress plugin up to version 3.5.1 allows authenticated attackers to inject malicious scripts that execute in the context of other users' browsers. No active exploitation or public exploit code has been reported, and EPSS indicates a low 0.03% probability of exploitation over the next 30 days. The vulnerability carries a medium CVSS 6.5 score and requires low-privilege access and user interaction.
DOM-based Cross-Site Scripting in the Zahlan Categories Images WordPress plugin through version 3.3.1 permits authenticated low-privileged attackers to inject arbitrary web scripts. When a victim visits a page embedding the manipulated content, the script executes in their browser, potentially leading to session hijacking or content spoofing. No active exploitation or public exploit code has been identified; EPSS indicates very low exploitation probability (0.03%).
Mattermost versions 10.11.x through 10.11.12, 11.3.x through 11.3.2, 11.4.x through 11.4.2, and 11.5.0 fail to enforce atomic consumption of guest magic link tokens, allowing unauthenticated attackers to establish multiple concurrent authenticated sessions from a single valid magic link. This enables unauthorized access and potential information disclosure without requiring additional credentials or user interaction beyond intercepting or obtaining the link.
2-3 sentence plain-language synthesis. Not copy description. Start with impact, product, etc. Mention actively exploited? KEV? None. POC? Not mentioned, so
Stored Cross-Site Scripting in WP Circliful plugin for WordPress up to version 1.2 allows authenticated attackers with Contributor-level access to inject arbitrary HTML and JavaScript via insufficiently sanitized shortcode attributes in [circliful] and [circliful_direct] shortcodes. The vulnerability exists in the circliful_shortcode() and circliful_direct_shortcode() functions, which concatenate user input directly into HTML attributes without escaping. When a user visits a page containing the injected shortcode, the malicious script executes in their browser. No public exploit code or active exploitation in the wild has been confirmed at time of analysis.
Server-side request forgery (SSRF) in NocoBase's workflow HTTP request and custom request action plugins allows authenticated workspace members to access internal network services, cloud metadata endpoints, and localhost. The vulnerability has a public proof-of-concept and a low EPSS exploitation probability, with no confirmed active exploitation. A vendor-released patch is available in version 2.0.37.
Stored cross-site scripting in Power Charts Lite WordPress plugin versions up to 0.1.0 allows authenticated contributors and above to inject arbitrary JavaScript into pages via the 'id' parameter of the [pc] shortcode. The vulnerability exists because the plugin extracts user-supplied shortcode attributes, directly concatenates them into HTML class attributes without sanitization, and then decodes HTML entities, creating a persistent XSS payload that executes for all users viewing the affected page. No active exploitation has been confirmed, but the attack requires only standard WordPress contributor permissions and no additional complexity.
Stored cross-site scripting in WM JqMath WordPress plugin up to version 1.3 allows authenticated contributors and above to inject arbitrary JavaScript via the 'style' shortcode attribute, which executes in the browsers of all users viewing affected pages. The vulnerability stems from direct concatenation of unsanitized user input into HTML without proper escaping (missing esc_attr() calls). CVSS 6.4 reflects moderate risk with scope change; no public exploit code or active KEV status identified at time of analysis.
Stored cross-site scripting in Coachific Shortcode plugin for WordPress versions up to 1.0 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into pages via the 'userhash' shortcode attribute. The plugin sanitizes input with sanitize_text_field() but fails to apply JavaScript-specific escaping before interpolating the value into a script tag, enabling persistent XSS attacks visible to all page visitors. EPSS score of 6.4 reflects moderate real-world risk constrained by the requirement for authenticated contributor access and user interaction.
Stored Cross-Site Scripting in VI: Include Post By WordPress plugin up to version 0.4.200706 allows authenticated contributors and above to inject arbitrary JavaScript via the 'class_container' shortcode attribute, which executes in the browsers of any user viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied shortcode parameters. No public exploit code or active exploitation has been reported; however, the low attack complexity and broad scope of impact (affecting all site visitors) make this a moderate-priority issue for WordPress installations using this plugin.
Signature verification bypass in Bouncy Castle BC-JAVA (bcpkix module versions 1.49-1.83) allows remote unauthenticated attackers to forge cryptographic signatures by submitting empty signature sequences that are incorrectly accepted as valid by the draft CompositeVerifier implementation. This critical flaw (CVSS 4.0: 10.0) enables complete subversion of digital signature trust chains, potentially allowing authentication bypass, code signing forgery, and man-in-the-middle attacks against Java ap
An unauthenticated remote attacker could execute cross-site scripting in Cisco Webex Contact Center’s Desktop Agent, stealing authentication and session data from victims who clicked a malicious link. Cisco fully patched the cloud service, eliminating the vulnerability without requiring any customer action. No active exploitation has been reported, and EPSS indicates very low exploitation probability.
Cross-site scripting (XSS) in Cisco Unity Connection's web-based management interface enables unauthenticated remote attackers to execute arbitrary script code in a victim's browser context by tricking them into clicking a crafted link. This reflected XSS vulnerability (CVE-2026-20059, CVSS 6.1) affects multiple 14.x and 15.x SU releases, requiring user interaction to exploit. While no active exploitation or public exploit code has been identified, the EPSS score of 0.04% indicates a very low likelihood of widespread attacks.
Cross-site scripting (XSS) in ApostropheCMS 4.28.0 and sanitize-html 2.17.1 allows remote attackers to bypass HTML tag filtering and inject arbitrary tags through entity-encoded payloads in textarea and option elements. A regression in the sanitize-html parser incorrectly assumes htmlparser2 does not decode entities within non-text elements, causing encoded HTML to be decoded and written directly to output without sanitization. Exploitation requires non-default configurations where textarea or option tags are in the allowedTags list, commonly found in form builders, and user interaction to submit form content. No active exploitation has been identified at time of analysis, but the vulnerability is trivial to exploit once configuration conditions are met.
Cross-Site Request Forgery (CSRF) in OPEN-BRAIN plugin for WordPress versions up to 0.5.0 allows unauthenticated attackers to inject malicious web scripts by tricking site administrators into clicking a malicious link, due to missing nonce verification in the func_page_main() settings form handler. With a CVSS score of 6.1 and network-level attack surface requiring only user interaction, this vulnerability affects any WordPress installation using the affected plugin. No public exploit code or active exploitation has been confirmed at time of analysis.
Buffer overflow in GIMP's file-seattle-filmworks plugin allows denial of service when a user opens a specially crafted Seattle Filmworks file. A remote attacker can deliver the malicious file via email or download, triggering a crash of the plugin and potentially impacting GIMP's stability. No active exploitation or public exploit code has been identified.
Cross-Site Request Forgery (CSRF) in Product Pricing Table by WooBeWoo plugin for WordPress allows unauthenticated attackers to inject arbitrary web scripts or delete pricing tables by tricking site administrators into clicking a malicious link, exploiting missing nonce validation in the updateLabel() and remove() functions across all versions up to and including 1.1.0. No public exploit code identified at time of analysis, but the vulnerability requires only user interaction (UI:R) and has a network attack vector, making it moderately exploitable in real-world scenarios.
Privilege escalation to root in Cisco ISE CLI allows an authenticated local attacker with administrative privileges to inject and execute arbitrary commands on the underlying operating system. This command injection flaw stems from insufficient input validation in a specific CLI command, granting full control of the network access control appliance. No public exploit or active exploitation has been identified, and the EPSS score of 0.05% indicates very low likelihood of widespread exploitation.
Stored cross-site scripting (XSS) in Mini Ajax Cart for WooCommerce up to version 1.3.4 allows authenticated administrators to inject malicious scripts into pages. When other users view these pages, the scripts execute, potentially leading to session theft or defacement. No active exploitation reported (CISA KEV not listed, SSVC exploitation none); EPSS score very low (0.03%).
LDAP injection in Bouncy Castle BC-JAVA bcprov module (versions 1.49 through 1.83) allows remote unauthenticated attackers to manipulate LDAP queries via specially crafted input to LDAPStoreHelper.java, enabling complete compromise of confidentiality, integrity, and availability across security boundaries. This critical vulnerability (CVSS 10.0) affects a widely deployed cryptographic library used throughout the Java ecosystem. No active exploitation confirmed (not in CISA KEV), but the attack r
GIMP's FITS image loader contains an integer overflow that can be triggered by a specially crafted file, leading to a heap buffer overflow and potential denial of service or arbitrary code execution. The vulnerability is patched by the vendor, and no active exploitation or public exploit code has been identified.
Denial of service in GIMP's PVR image loader on Red Hat Enterprise Linux 6 through 9 allows an attacker to crash the application by tricking a user into opening a specially crafted PVR file. The flaw arises from a stack-based buffer overflow and out-of-bounds read, causing the application to terminate unexpectedly. It is not known to be actively exploited; proof-of-concept code has not been publicly identified.
Local denial of service in SSSD's PAM passkey responder allows a low-privileged attacker to crash the daemon by sending crafted passkey authentication data, disrupting authentication services on affected Red Hat Enterprise Linux and OpenShift systems. The vulnerability is not known to be actively exploited, and its EPSS score is negligible (0.01%).
Local file overwrite in Cisco ThousandEyes Enterprise Agent allows authenticated, low-privileged CLI users to overwrite arbitrary files by placing a symbolic link in a specific directory, achieving integrity compromise on the agent host. This vulnerability (CVE-2026-20161) has low exploitation probability (EPSS 0.01%) and is not listed in CISA KEV; no public exploit code is currently known.
Arbitrary WordPress action execution in Avada (Fusion) Builder plugin versions up to 3.15.1 allows authenticated attackers with Subscriber-level access to invoke unvalidated WordPress action hooks via the Dynamic Data feature, potentially enabling privilege escalation, file inclusion, denial of service, or remote code execution depending on available hooks in the WordPress installation. The vulnerability stems from the `output_action_hook()` function accepting user-controlled input without authorization checks. No public exploit code or active exploitation has been confirmed at time of analysis.
Authorization bypass in KubeVirt's RBAC evaluation logic allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing restricted actions. Additionally, legitimate users may be denied resource access. Exploitation requires prior authentication and the presence of custom RBAC roles; no active exploitation or public exploit code is known at time of analysis.
Stored cross-site scripting in ApostropheCMS versions 4.28.0 and prior allows authenticated editors to inject arbitrary JavaScript into the color-field widget, executing in the browsers of all site visitors. Exploitation enables mass session hijacking and privilege escalation to administrative control; publicly available proof-of-concept exploit code exists, though no active exploitation has been confirmed. The vulnerability has been patched in version 4.29.0.
Stored cross-site scripting in Kimai before 2.53.0 allows authenticated low-privilege users to inject JavaScript via the profile alias field. The incomplete `escapeForHtml()` function fails to escape double and single quotes, enabling HTML attribute injection when the alias is rendered in the team member widget, and leading to privilege escalation if an administrator views the page. Public proof-of-concept code exists, but no active exploitation has been confirmed in the wild.
Authorization policy bypass in Istio service mesh due to incorrect handling of dots (.) as regular expression metacharacters in service account names. In affected versions 1.25.0–1.27.8, 1.28.0–1.28.5, and 1.29.0–1.29.1, the `serviceAccounts` and `notServiceAccounts` fields in AuthorizationPolicy misinterpret dots, causing an ALLOW rule for e.g. `cert-manager.io` to also match `cert-manager-io` and similar variants, while a DENY rule fails to block them. An authenticated attacker with low privileges can exploit this to gain unauthorized access or bypass restrictions. No active exploitation or public proof-of-concept has been identified; EPSS indicates very low exploitation probability (0.03%). Patches are available.
Unauthorized modification of data in Tutor LMS 3.9.7 and earlier allows authenticated attackers with low privileges to exploit missing authorization checks, potentially altering course content or causing limited service disruption. The vulnerability carries a CVSS score of 5.4 but an EPSS score of 0.02% with no known active exploitation or public proof-of
We need to generate a JSON object for CVE-2026-1636. All fields must be plain text strings. Use all provided data: EPSS, KEV not mentioned (so not in KEV), tags, CPE, CVSS 4.0 vector, SSVC, etc. First, understand the vulnerability: "potential DLL hijacking vulnerability was reported in Lenovo Service Bridge that, under certain conditions, could allow a local authenticated user to execute code with elevated privileges." CWE-427: Uncontrolled Search Path Element (DLL hijacking). CVSS 4.0: AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. That is local, low attack complexity, Attack Requirements: P (present? AT:P means attack requirements present, maybe specific conditions), Privileges Required: Low, User Interaction: Passive (UI:P means limited user interaction, e.g., user must open a file or perform some action). Impact: High on vulnerable system confidentiality, integrity, availability; no impact on subsequent system. This matches the description: local authenticated user, elevated privileges. The vector indicates PR:L, so authenticated. AT:P suggests there are some attack requirements beyond just running code, like needing to place a DLL in a specific path or something. EPSS 0.01%, percentile 2%, very low exploitation probability. SSVC: exploitation: none, automatable: no, technical impact: total. So not currently exploited, not automatable, total impact if exploited. Patch available, affected versions: Service Bridge 0 <5.0.2.20 (from EUVD). So fix version is 5.0.2.20 or later. Reference: Lenovo advisory LEN-211071. So we have exact patch. Now, fields: product_name: "Lenovo Service Bridge" (3 words) summary: Synthesize a 2-3 sentence plain-language summary, not copying description. Start with impact verb and product. For example: "Elevation of privilege in Lenovo Service Bridge allows a local authenticated user to execute code with elevated privileges via DLL hijacking." Then mention who is affected (Lenovo Service Bridge prior to 5.0.2.20), and that p
Information disclosure in ApostropheCMS 4.28.0 and earlier allows unauthenticated attackers to bypass admin-configured field restrictions on the piece-type REST API, exposing sensitive content such as internal notes or draft metadata. Public exploit code is available, though the EPSS score (0.09%) indicates low current exploitation probability; no active exploitation has been confirmed.
Authentication policy bypass in Cisco Secure Web Appliance (AsyncOS) allows unauthenticated, remote attackers to send restricted HTTP requests through the appliance by exploiting improper validation of authentication input. The vulnerability (CWE-305) carries a CVSS 3.1 score of 5.3 and low EPSS likelihood (0.07%), with no active exploitation reported. Successful exploitation bypasses policy enforcement but does not directly compromise the appliance, resulting only in low integrity impact.
CPU exhaustion in python-multipart versions before 0.0.26 allows remote attackers to degrade service availability by sending crafted multipart/form-data requests containing oversized preamble or epilogue data. The parser inefficiently processes leading CR/LF data before the first boundary and continues to scan trailing epilogue data after the closing boundary, increasing CPU usage linearly with input size. No active exploitation or public proof‑of‑concept is known at this time, and EPSS indicates a very low likelihood of real‑world attacks.
Remote attackers can manipulate payment amounts in Stripe and PayPal transactions through the MetForm Pro WordPress plugin by submitting arbitrary values in the 'mf-calculation' field, bypassing price validation. Versions up to 3.9.7 are affected; the plugin fails to recompute or validate user-submitted calculation fields against configured form prices, allowing unauthenticated attackers to reduce or alter payment amounts on vulnerable forms. No active exploitation has been publicly confirmed, though the attack requires minimal complexity and produces direct financial impact.
Unauthenticated attackers can bypass field-level authorization in Advanced Custom Fields (ACF) plugin versions up to 6.7.0 via AJAX endpoints that process user-supplied filter parameters without proper privilege checks, enabling disclosure of draft, private, and restricted post/page content that should be hidden by field configuration. The vulnerability affects any WordPress site with ACF installed and frontend forms exposed, requiring only network access and no user interaction. CVSS 5.3 reflects confidentiality impact with low attack complexity; no KEV status or public POC confirmed at analysis time.