Information disclosure in ApostropheCMS 4.28.0 and earlier allows unauthenticated attackers to extract distinct field values via the choices and counts REST API query parameters, bypassing publicApiProjection restrictions. The vulnerability exposes sensitive schema field values, including those protected by viewPermission, and a proof-of-concept exploit exists, though no active exploitation is confirmed.
Unauthenticated attackers can retrieve sensitive PDF metadata and configuration values through a missing authorization flaw in the Katalogportal PDF Sync WordPress plugin (versions up to 1.0.0). The katalogportal_popup_shortcode() AJAX handler lacks capability checks and nonce verification, allowing any user to enumerate all synchronized PDF attachments-including those from private or draft posts-along with filenames and the katalogportal_userid configuration. This information disclosure has a CVSS score of 5.3 (low-to-medium severity) but enables reconnaissance for further attacks against WordPress installations.
Authenticated users with Subscriber-level access or above can modify WordPress form field configurations in the e-shot form builder plugin (versions up to 1.0.2) due to missing authorization checks in the eshot_form_builder_update_field_data AJAX handler. The function lacks both capability checks and nonce verification, allowing attackers to manipulate form field properties such as mandatory status, visibility, and display preferences without proper permission validation. No public exploit code or active exploitation has been confirmed at this time.
Information disclosure in Majestic Support versions 1.1.2 and below allows unauthenticated remote attackers to bypass authorization checks and view restricted data. The missing authorization flaw (CWE-862) has a CVSS 5.3 base score, with low confidentiality impact and no privilege escalation or system compromise. No active exploitation or public proof-of-concept is known, and EPSS predicts only a 0.02% chance of exploitation in the wild.
Missing authorization check in Royal Elementor Addons WordPress plugin allows unauthenticated attackers to modify data with low integrity impact. Affects versions up to 1.7.1056. No active exploitation has been reported, and the EPSS score of 0.02% indicates a very low probability of exploitation.
Sensitive data exposure in Nelio AB Testing WordPress plugin allows unauthenticated attackers to access restricted A/B test configurations and results. Affecting versions up to and including 8.2.8, this missing authorization vulnerability (CWE-862) can be exploited remotely without authentication. No public exploit or active exploitation has been identified, and EPSS score is low (0.02%), reducing immediate risk.
Unauthorized data access in VillaTheme COMPE WordPress plugin versions ≤1.1.4 allows remote attackers to retrieve sensitive information by manipulating user-controlled keys. The vulnerability (CWE-639) is trivially exploitable over the network with no authentication, but impact is limited to confidential data exposure. No active exploitation or public exploit is currently known.
Information disclosure via missing authorization in ThemeGrill Demo Importer allows unauthenticated remote attackers to access sensitive demo import data. The vulnerability affects all plugin versions up to 2.0.0.6 and requires no user interaction. No active exploitation or public exploit code has been reported, and the EPSS exploitation probability is very low (0.02%).
Path traversal in Grafana Loki 2.3.0 through 3.5.8 allows unauthenticated remote attackers to read arbitrary files on the server via double encoding of the namespace parameter in the Ruler API endpoint /loki/api/v1/rules/{namespace}. This bypasses the fix for CVE-2021-36156, which sanitized the parameter only after a single URL decode. While the CVSS base score is 5.3 (Medium), EPSS exploitation probability is extremely low (0.01%), and no active exploitation or public exploit code is known.
Arbitrary file write with elevated privileges in Lenovo Software Fix installer allows local authenticated users to overwrite system files during installation. Affected versions before 7.5.5.19. No public exploitation reported, EPSS low (0.01%), and SSVC
HTML injection in Pega Platform 8.1.0 through 25.1.1 allows an authenticated high-privileged user with developer role to inject malicious HTML into a user interface component. This could enable cross-site scripting attacks against other users or content manipulation, but exploitation requires
Cross-site scripting (XSS) in goldmark HTML renderer before version 1.7.17 allows unauthenticated remote attackers to execute arbitrary JavaScript by encoding dangerous URL schemes (such as javascript:) using HTML5 named character references, bypassing the renderer's prefix-based protocol validation due to improper ordering of entity resolution. Applications using affected versions can be exploited via crafted markdown containing malicious links that render unsafe protocols in user contexts, with a CVSS score of 6.1 indicating moderate real-world impact driven by the requirement for user interaction (UI:R) and change of scope across trust boundaries.
Low-severity path traversal in Weblate prior to 5.17 allows authenticated users to bypass repository boundary checks by crafting symlinks with colliding path prefixes, potentially reading files outside the intended repository scope. No active exploitation or public exploit code is known, and the vulnerability has been patched in version 5.17.
Server-Side Request Forgery in Weblate's project-level machine translation configuration allows an authenticated project administrator to probe internal network services and read partial responses. Any user holding the per-project 'Administration' role (which grants project.edit permission) can supply a crafted URL as a machine translation service endpoint; during validation Weblate issues an outbound HTTP request to that URL and reflects up to 200 characters of the response body in the resulting error message. All Weblate deployments running versions prior to 5.17 are affected; no public exploit code exists and no active exploitation has been confirmed at time of analysis.
Server-Side Request Forgery in Weblate prior to version 5.17 allows authenticated users to bypass the ALLOWED_ASSET_DOMAINS allowlist via HTTP redirects, forcing the server to request unintended hosts. This can lead to low confidentiality impact through information disclosure. The vulnerability is fixed in version 5.17, and no public exploit or active exploitation has been identified.
GIMP is vulnerable to a heap buffer over-read in the icns_slurp() function when processing malicious ICNS image files, potentially leading to application crashes or information disclosure. An attacker must trick a local user into opening a specially crafted file, with no known public exploit or active exploitation at this time. A vendor patch is available from Red Hat for affected RHEL distributions.
Denial of service in GIMP allows local attackers to crash the application by tricking a user into opening a malicious TIM image file. The vulnerability resides in the TIM image loader's 4BPP decoding path, where an unconditional stack buffer overflow occurs when processing a specially crafted file, with no impact on confidentiality or integrity. No active exploitation or public exploit is known, and a vendor patch is available.
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows an authenticated administrator to read arbitrary files on the underlying operating system via crafted HTTP requests. The vulnerability requires valid administrative credentials. No public exploit code or active exploitation has been reported.
Stored cross-site scripting in Pega Infinity allows high-privileged users with developer roles to inject scripts in the UI, potentially affecting other users who view the injected content. No known exploitation or public exploit code exists, and exploitation requires authentication as a developer. The vulnerability has a CVSS 4.0 score of 4.8 (Medium)
Stored and reflected cross-site scripting vulnerabilities in Cisco Identity Services Engine's web-based management interface allow an authenticated attacker holding administrative write privileges to inject malicious JavaScript that executes in the context of other users' browsers. Affected releases span ISE 3.1 through 3.4 (including multiple patch releases). No active exploitation has been identified and no public exploit code exists; the EPSS score of 0.03% and SSVC exploitation status of 'none' align with the high privilege bar required.
Stored cross-site scripting in GROWI v7.4.6 and earlier allows authenticated users to inject malicious scripts that execute in other users' browsers, compromising confidentiality and integrity of user sessions. The vulnerability requires user interaction (clicking a link or viewing affected content) and authenticated access, resulting in a CVSS score of 5.4 (medium severity). No public exploit code or active KEV confirmation is indicated in available data.
We are to synthesize data from multiple sources about CVE-2026-20060 into a comprehensive analysis. Return a JSON object. We need to follow all instructions strictly. First, understand the CVE data: - CVE ID: CVE-2026-20060 - Description: A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious web page. - CVSS Score: 4.7 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')) - EPSS Score: 0.02% (percentile 5%) - Reported by: cisco - CPE: cpe:2.3:a:cisco:cisco_unity_connection:*:*:*:*:*:*:*:* (this is a wildcard version, meaning all versions? But EUVD gives specific versions) - Tags: Open Redirect, Cisco, Cisco Unity Connection - SSVC: Exploitation: none, Automatable: no, Technical Impact: partial - References: Cisco advisory, vuldb (advisory), NVD - EUVD EUVD-2026-22953: affected versions listed. Now, build the JSON fields. product_name: "1-3 words ONLY. The specific product or service name affected." This is Cisco Unity Connection. So "Cisco Unity Connection". That's 3 words. summary: 2-3 sentence plain-language summary for security professionals. Start with specific impact verb and product. "Remote attackers can redirect users to malicious web pages via open redirect in Cisco Unity Connection's web management interface." The CVSS shows AV:N, PR:N, UI:R, so unauthenticated remote, requires user interaction. Mention that it's an open redirect (CWE-601). Actively exploited? KEV not mentioned in input, no KEV field in input data, but we have SSVC exploitation: none. So not actively exploited. EPSS is low (0.02%, 5th percentile)
Stored cross-site scripting in List View Google Calendar WordPress plugin 7.4.3 and earlier allows authenticated administrators to inject web scripts via event descriptions. Exploitation requires a multi-site installation or disabled unfiltered\_html, and enables script execution in other users' sessions. No active exploitation or public exploit code is known, and EPSS indicates very low exploitation probability (0.03%).
Financial rate manipulation in Kimai versions up to 2.52.0 allows any authenticated user (even with lowest privileges) to set their own hourly and internal rates via the User Preferences API, bypassing the role-based disable flag that otherwise hides these fields in the UI. This enables unauthorized inflation of billing rates, potentially leading to fraudulent invoices. Exploitation is confirmed by a public proof-of-concept, but no active exploitation has been reported and the EPSS score is low.
Out-of-bounds memory access via use-after-free in Google Chrome’s codec components can be triggered by a crafted video file, affecting versions prior to 147.0.7727.101. Remote attackers can leak limited sensitive memory with user interaction; the flaw is rated High by the Chromium team, but CVSS score is 4.3 and EPSS indicates very low exploitation probability.
Missing authorization check in ProfilePress (WordPress membership plugin) versions ≤4.16.12 allows authenticated attackers (Subscriber+) to subscribe to inactive membership plans via a manipulated checkout request. This bypasses plan status enforcement, potentially granting access to restricted content without proper validation. EPSS indicates low exploitation probability, and no active exploitation or public exploit
Improper access control in Splunk Enterprise
Avada (Fusion) Builder plugin for WordPress up to version 3.15.1 allows authenticated Subscriber-level users and above to access protected post metadata through the Dynamic Data feature's `post_custom_field` parameter due to insufficient validation of underscore-prefixed metadata keys. The `fusion_get_post_custom_field()` function fails to enforce metadata access controls, enabling disclosure of sensitive metadata that should be restricted. No public exploit code or active exploitation has been confirmed at the time of analysis.
Authenticated SQL injection in Cisco Unity Connection allows attackers with valid user credentials to view arbitrary data from the backend database via the web management interface. The vulnerability requires low privileges and leads to low confidentiality impact, with no integrity or availability compromise. No public exploit or active exploitation has been reported at time of analysis, and EPSS scores indicate low exploitation probability.
Cross-site request forgery leading to stored cross-site scripting in Inquiry Form to Posts or Pages plugin version 1.0 for WordPress allows unauthenticated attackers to inject arbitrary scripts into administrator settings. The vulnerability stems from missing nonce validation on the settings update handler combined with insufficient input sanitization and output escaping, enabling an attacker to craft a malicious request that, when visited by a logged-in administrator, stores persistent XSS payloads. With a CVSS score of 4.3 and no evidence of public exploitation, this represents a moderate-severity threat requiring administrator interaction.
Authenticated low-privilege users can modify settings in the MyRewards WordPress plugin through missing authorization checks, leading to limited integrity impact. Affected versions are up to 5.7.3. No active exploitation or public exploit code is known.
Missing authorization in the bPlugins 3D viewer WordPress plugin allows authenticated users with low privileges to bypass access controls and modify content. Affected versions up to and including 1.8.5. No public exploitation has been identified, EPSS score is very low (0.02%), and SSVC indicates no exploitation, so real-world risk is minimal.
An authorization bypass in BlockArt Magazine Blocks for WordPress (≤1.8.3) lets authenticated users with lower privileges perform unauthorized data modifications. The vulnerability is not known to be actively exploited, and exploitation probability is assessed as low (EPSS 0.02%). The issue stems from missing capability checks that allow modified data access without proper permission verification.
Cross-site request forgery in Petje.af WordPress plugin versions up to 2.1.8 allows unauthenticated attackers to force authenticated users into destructive actions-including revoking OAuth2 tokens, deleting user metadata, and permanently removing WordPress user accounts with the 'petjeaf_member' role-by crafting malicious requests that bypass nonce validation in the ajax_revoke_token() AJAX handler. The vulnerability requires user interaction (victim must click a link or visit a malicious site) but carries moderate integrity impact due to the ability to delete user accounts.
Cross-Site Request Forgery in the Smart Online Order for Clover WordPress plugin allows unauthenticated attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings or creating orders. The vulnerability affects versions up to 1.6.0, requires user interaction (admin clicking a crafted link), and has a low CVSS score of 4.3. No active exploitation has been reported (CISA SSVC: exploitation none) and the EPSS exploitation probability is very low (0.01%).
Cross-Site Request Forgery in Userpro WordPress plugin before 5.1.11 allows an attacker to perform unauthorized actions on behalf of an authenticated user, such as modifying profile settings, by tricking them into clicking a malicious link. No active exploitation or public exploit code has been identified, and EPSS predicts a 0.01% exploitation probability.
Low-privileged users can modify Weblate translation memory via improperly exposed API endpoints in versions prior to 5.17, leading to unauthorized data manipulation without affecting confidentiality or availability. The vulnerability is not known to be actively exploited and has a very low exploitation probability (EPSS 0.01%).
Information disclosure in Google Chrome prior to 147.0.7727.101 allows a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. No public exploit or active exploitation has been identified at this time, and EPSS indicates very low exploitation probability (0.01%).
Server-side request forgery in Weblate's webhook add-on allows high-privileged users to bypass existing SSRF protections and make requests to internal network resources. Versions prior to 5.17 are affected; the fix introduces a new restriction setting that blocks private IP ranges by default. No active exploitation is reported (EPSS 0.01%, no CISA KEV entry), and no public exploit code has been identified at this time.
User enumeration via a timing side channel in ApostropheCMS versions 4.28.0 and prior allows unauthenticated attackers to identify valid usernames and emails. The password reset endpoint fails to normalize response time when a valid user is found, enabling an attacker to distinguish valid accounts from invalid ones by repeatedly probing the endpoint. This can facilitate credential stuffing and targeted phishing against instances that have explicitly enabled the password reset feature.
Cross-tenant information disclosure and deletion in Grafana allows a high-privilege authenticated user to read and permanently delete legacy correlation records belonging to
Weblate's tasks API prior to version 5.17 permitted authenticated users to retrieve operation logs for pending (in-flight) background tasks belonging to project scopes outside their access level. The access control check enforcing component-level permissions was not applied to tasks in PENDING state because the component context was unavailable until task completion; the fix caches component metadata at task creation so permissions can be verified regardless of task state. No public exploit code exists, exploitation probability is very low (EPSS 0.03%), and CISA KEV does not list this vulnerability.
Cross-origin data leak in Google Chrome prior to 147.0.7727.101 through insufficient CORS enforcement when the renderer process is already compromised. An attacker who has first achieved code execution inside the renderer can bypass cross-origin restrictions to expose sensitive data from other origins via a crafted HTML page. No active exploitation or public proof-of-concept has been identified, and the EPSS probability is extremely low at 0.01%.
Cross-origin data leakage in Google Chrome prior to 147.0.7727.101 allows a remote attacker to leak sensitive password data from other origins via a crafted HTML page, but only after they have already compromised the renderer process via a separate exploit. The vulnerability requires user interaction (visiting a malicious page) and has high attack complexity, resulting in a CVSS 3.1 base score of 3.1 (Low severity). No public exploit or active exploitation has been identified at time of analysis, and the EPSS probability is extremely low (0.01%).
Untrusted DLL search path vulnerability in Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 allows local attackers to achieve privilege escalation or code execution by placing a malicious DLL in a directory searched before the legitimate library location. The vulnerability requires local access and high complexity conditions but affects three widely-used FIDO2 authentication libraries; no public exploit code identified at time of analysis.
HCL AION allows local attackers with high privileges to explore internal filesystem structures through certain system behaviors, potentially disclosing information about the underlying environment that could facilitate further targeted attacks. The vulnerability requires local access, high privileges, and user interaction to trigger, with a CVSS score of 2.9 reflecting low immediate risk. No public exploit code or active exploitation has been identified.
Mattermost versions 10.11.0 through 10.11.12 fail to validate workspace ownership during Connected Workspaces API interactions, allowing a malicious remote server with high privileges to modify the displayed status of local users. This affects organizations using the Connected Workspaces federation feature and requires an attacker to already possess high administrative privileges on a connected remote instance. The vulnerability has CVSS 2.7 (low severity) and no public exploit code or active exploitation has been identified.
Information disclosure in Grafana Alerting allows users with the 'Contact Point Writer' role (part of Editor role) to extract redacted credentials from third-party integrations. By editing a contact point's endpoint URL to an attacker-controlled server and invoking the test function, redacted settings such as Slack tokens are sent to the attacker. Affected versions are Grafana Alerting 8.0.0 through 12.3.0; no public exploit or active exploitation identified, and the EPSS score is very low (0.04%).