blueprintUE prior to version 4.2.0 fails to invalidate active user sessions when passwords are changed or reset, allowing attackers with compromised sessions to maintain indefinite account access even after the legitimate user detects the breach and changes their password. The attacker retains full account privileges until the session naturally expires (default 24 hours) or is manually cleared, creating a critical window where password changes provide no security benefit.
Textpattern CMS 4.9.0 allows authenticated low-privilege users to modify articles owned by higher-privilege users by manipulating the article ID parameter in the duplicate-and-save workflow, bypassing authorization checks in the article management system. The vulnerability affects only authenticated users with existing CMS access and requires no user interaction or special network access. No public exploit code or active exploitation has been identified, though the EPSS score of 0.02% suggests minimal real-world attack probability despite the moderate CVSS 6.5 score.
A cross-site request forgery (CSRF) mitigation bypass in the DOM postMessage component of Firefox allows authenticated attackers to trigger denial of service against affected systems. The vulnerability bypasses existing CSRF protections through improper validation of postMessage origin checks, affecting Firefox versions prior to 150. No public exploit code has been identified, and exploitation requires authenticated network access without user interaction.
Local denial-of-service in the Oracle Solaris 11.4 Kernel component allows a low-privileged authenticated attacker to hang or crash the operating system with scope change implications for co-hosted workloads. The vulnerability stems from uncontrolled resource consumption (CWE-400) in the kernel and is addressed in Oracle's April 2026 Critical Patch Update. No public exploit or active exploitation has been identified; EPSS at 0.01% (2nd percentile) and SSVC exploitation rating of none confirm negligible exploitation activity at time of analysis.
Improper access control (CWE-284) in the C Oracle SSL API component of Oracle Security Service 12.1.3.0.0 and 12.2.1.4.0 - part of Oracle Fusion Middleware - allows a low-privileged network attacker to compromise the service via HTTPS, resulting in unauthorized read access to all critical data and unauthorized creation, modification, or deletion of critical data. The attack is constrained by high complexity and mandatory human interaction from a third party, making automated or mass exploitation infeasible; EPSS exploitation probability is extremely low at 0.03% and CISA SSVC classifies exploitation as none. No public exploit has been identified at time of analysis.
Inverted time comparison logic in the Data Sharing Framework (DSF) OIDC cache layer creates two compounding defects in all versions prior to 2.1.0: the JWKS and Metadata Document caches never serve cached values, forcing a live HTTP fetch to the OIDC provider on every authenticated request, while the FHIR client token cache never expires entries, allowing revoked or expired OIDC tokens to be accepted indefinitely. Both conditions require OIDC bearer-token authentication or back-channel logout to be enabled on the DSF FHIR Server or BPE Server. No public exploit exists and SSVC confirms exploitation status as none, but the expired-token acceptance path represents a meaningful authentication integrity gap in deployments relying on token revocation.
Improper access control in the IDM Authentication component of Oracle Life Sciences InForm 7.0.1.0 and 7.0.1.1 exposes the platform to unauthenticated network-based attacks over HTTP that require victim user interaction to succeed. Successful exploitation yields unauthorized partial read, write/delete, and denial-of-service impact against InForm clinical trial data. No public exploit code exists and no active exploitation has been identified; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' confirm minimal real-world threat at this time.
Honor E App discloses sensitive information to unauthorized users via network-accessible endpoints, requiring user interaction but affecting service confidentiality across all product versions. The vulnerability carries a moderate CVSS score of 6.3 (AV:N/AC:L/PR:N/UI:R) indicating remote exploitation without authentication, though successful attack requires user interaction. Patch availability and exploitation status remain unconfirmed from available sources.
DOM spoofing in Firefox allows remote attackers to deceive users about webpage origin and integrity through rendering manipulation, requiring user interaction. Affects Firefox 149 and earlier, Firefox ESR 115.34 and earlier, and Firefox ESR 140.9 and earlier. Fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10. EPSS score of 0.02% indicates low exploitation probability despite CVSS 6.3 rating, suggesting practical exploitation constraints despite network accessibility.
Invalid pointer handling in Firefox's JavaScript-WebAssembly component allows remote attackers to disclose information or cause limited memory corruption via a malicious webpage, requiring user interaction. The vulnerability affects Firefox versions prior to 150 and Firefox ESR prior to 140.10, with an EPSS score of 0.02% indicating minimal real-world exploitation probability despite moderate CVSS severity. Vendor-released patches are available in Firefox 150 and Firefox ESR 140.10.
Cassandra export module in Glances prior to version 4.5.4 allows local privilege-escalated users to redirect monitoring data to attacker-controlled databases by injecting CQL statements through unvalidated configuration parameters. An authenticated local attacker with write access to the Glances configuration file can modify keyspace, table, and replication_factor settings to execute arbitrary CQL, enabling data exfiltration or denial of service against the monitoring infrastructure. This vulnerability requires elevated local access but carries high confidentiality and integrity impact.
Denial of service in Next AI Draw.io prior to version 0.4.15 allows local attackers to crash the embedded HTTP sidecar by sending oversized request bodies to three POST endpoints (/api/state, /api/restore, /api/history-svg) without size limits, exhausting Node.js V8 heap memory and forcing an out-of-memory shutdown. CVSS 6.2 reflects local attack vector and high availability impact; no public exploit code confirmed at time of analysis.
Reflected cross-site scripting (XSS) in the Website LLMs.txt WordPress plugin versions up to 8.2.6 allows unauthenticated attackers to inject arbitrary JavaScript via the 'tab' parameter due to improper use of filter_input() without sanitization and insufficient output escaping. Exploitation requires social engineering an administrator to click a malicious link, but once successful grants the attacker ability to execute scripts in the admin's browser session with access to sensitive WordPress functions and data.
Reflected XSS in Astro's SSR pipeline allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by bypassing the incomplete `</script>` tag sanitization in the `defineScriptVars` function. All Astro versions prior to 6.1.6 running in SSR mode are affected when user-controlled input reaches a `define:vars` script block - a documented and common usage pattern. A detailed public proof-of-concept is available via GHSA-j687-52p2-xcff; EPSS is low (0.03%, 8th percentile) consistent with the required victim interaction, and no CISA KEV listing indicates no confirmed mass exploitation at time of analysis.
Stored cross-site scripting (XSS) in FreeScout prior to version 1.8.213 allows remote attackers to inject arbitrary HTML attributes into email message bodies by embedding unescaped double-quote characters in URLs. When the linkify() function converts plain-text URLs to anchor tags without proper escaping, attackers can break out of the href attribute and inject malicious JavaScript or event handlers. This requires user interaction (UI:R) to view a crafted email, but once viewed, the injected script executes in the context of the victim's session with potential for account compromise or data theft.
Cross-site scripting or improper access control in the Human Workflow component of Oracle Business Process Management Suite (versions 12.2.1.4.0 and 14.1.2.0.0) allows unauthenticated remote attackers to read a subset of BPM data and perform unauthorized data modifications via HTTP, provided a legitimate user interacts with attacker-controlled content. The attack carries a scope change, meaning successful exploitation can impact components beyond the BPM Suite itself within the Oracle Fusion Middleware stack. No public exploit code has been identified and CISA has not listed this in KEV; EPSS places exploitation probability at 0.03% (8th percentile), consistent with low near-term exploitation risk.
Improper access control in Oracle Identity Manager's Identity Console component (versions 12.2.1.4.0 and 14.1.2.0.0) allows unauthenticated remote attackers to partially compromise confidentiality and integrity via HTTP when a victim user interacts with attacker-controlled content. The scope change designation confirms that a successful attack can cascade beyond OIM itself to additional Oracle Fusion Middleware components integrated within the same environment. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.03% (8th percentile) reflects very low real-world exploitation probability.
Cross-site scripting or improper access control in Oracle Configurator's User Interface component allows unauthenticated remote attackers to compromise data confidentiality and integrity across Oracle E-Business Suite. Affected versions span the full supported range of 12.2.3 through 12.2.15, requiring an authenticated victim to interact with attacker-controlled content to trigger the flaw. The scope change (S:C) signals that exploitation can pivot beyond Oracle Configurator itself into adjacent E-Business Suite products; no public exploit code has been identified and SSVC confirms exploitation status as none at time of analysis.
Improper access control (CWE-284) in the Portal component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 permits unauthenticated remote attackers to perform unauthorized data reads and writes against PeopleTools and connected downstream products, contingent on luring an authenticated user into triggering the vulnerable endpoint via HTTP. The CVSS vector pattern (AV:N/PR:N/UI:R/S:C) combined with the Authentication Bypass tag strongly suggests a client-side injection vector such as reflected XSS or CSRF that operates within the victim's session context. No public exploit code has been identified and CISA has not added this to the KEV catalog; EPSS of 0.03% (8th percentile) and SSVC Exploitation:none corroborate the absence of observed active exploitation at time of analysis.
Excessive memory allocation in the golang.org/x/image/font/sfnt SFNT font parser allows denial of service when processing a malicious font file. All versions of the package prior to 0.39.0 are affected, as confirmed by the Go vulnerability database (GO-2026-4962) and EUVD-2026-24245. An attacker who can supply a crafted font file to any Go application using this library can cause the application to exhaust available memory and crash. No public exploit has been identified and SSVC confirms no active exploitation at time of analysis.
Missing authorization on the `/api/v1/delete/fwdhost` endpoint in mailcow-dockerized allows any low-privileged authenticated user to delete Forwarding Hosts, disrupting outbound mail routing and overall service availability. All versions prior to 2026-03b are affected; the flaw is rooted in inconsistent access control - add/edit operations are gated to administrators but the delete pathway is not. EPSS is low (0.04%) and the vulnerability is not in CISA KEV, though SSVC data indicates POC code exists, lowering the exploitation barrier for users with valid credentials.
Integrity and availability compromise in Oracle Java SE's Hotspot component affects versions 8u481 and 8u481-b50, as well as GraalVM Enterprise Edition 21.3.17, but exclusively in client-side sandboxed deployments running untrusted code via Java Web Start or applets. A low-privileged local attacker who can also induce human interaction from a third-party victim may trigger uncontrolled resource consumption (CWE-400) in Hotspot, resulting in unauthorized modification or deletion of critical data accessible to the JVM, or a complete denial of service via hang or repeatable crash. No public exploit code exists and no active exploitation has been confirmed; EPSS at 0.01% (2nd percentile) and SSVC Exploitation=none corroborate negligible current threat activity.
Confidentiality breach in Oracle VM VirtualBox 7.2.6 Core allows a high-privileged local attacker to gain complete read access to all data accessible by the VirtualBox process, with scope change indicating potential data leakage beyond the primary VM boundary into adjacent virtualized environments. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:C) confirms local-only exploitation requiring administrative-level host access, substantially limiting the realistic attacker pool. No active exploitation is confirmed - EPSS sits at 0.01% (2nd percentile), SSVC rates exploitation as none, and the vulnerability is absent from CISA KEV.
FreeScout versions prior to 1.8.214 allow authenticated agents in shared mailboxes to recall another agent's reply within a 15-second undo window due to insufficient authorization checks on the undo-send endpoint. The vulnerability requires agent-level authentication and shared mailbox access but enables one user to suppress a colleague's outbound communication, affecting message integrity and audit trails in multi-agent help desk environments.
Oracle Identity Manager Connector 12.2.1.4.0 exposes a missing authentication control (CWE-306) in its Core component, reachable over HTTPS by unauthenticated network attackers. Successful exploitation yields unauthorized read access to critical data or complete access to all data accessible by the connector - a significant confidentiality breach in an identity governance system. No public exploit code has been identified at time of analysis, and EPSS at 0.03% (9th percentile) alongside SSVC's 'none' exploitation rating indicate low real-world exploitation pressure despite the network-accessible vector.
Unauthenticated network access to Oracle Identity Manager Connector 12.2.1.4.0 enables complete confidentiality compromise of all data accessible by the connector via an authentication bypass in its Core component. The flaw (CWE-306, Missing Authentication for Critical Function) is reachable over HTTP without credentials but carries high attack complexity, constraining exploitation to actors capable of meeting undisclosed preconditions. No active exploitation has been identified - EPSS sits at the 9th percentile (0.03%) and CISA SSVC rates it as non-automatable with partial technical impact - suggesting limited near-term risk despite the identity management context.
Improper access control in Oracle Identity Manager Connector 12.2.1.4.0 exposes the Microsoft Active Directory component to network-based exploitation via LDAP, enabling low-privileged authenticated attackers to perform unauthorized creation, deletion, or modification of critical data and read a subset of accessible data. The vulnerability carries a CVSS 3.1 score of 5.9 (Medium), tempered by high attack complexity (AC:H) and a near-zero EPSS of 0.03% (8th percentile). No public exploit code exists and no active exploitation has been reported; this is a real but difficult-to-trigger integrity-focused flaw in Oracle's enterprise identity management stack.
OpenClaw before version 2026.4.2 transmits stored gateway credentials over unencrypted WebSocket (ws://) connections when accepting non-loopback endpoints, allowing adjacent network attackers with user interaction to forge discovery results or craft malicious setup codes that redirect clients to attacker-controlled endpoints and exfiltrate plaintext credentials. No public exploit code has been identified, but the vulnerability requires proximity to the target network and user interaction to trigger the credential disclosure.
HTML injection in FreeScout prior to version 1.8.213 allows unauthenticated attackers to inject arbitrary HTML into outgoing support emails by crafting a malicious From display name. The unsanitized name is stored in the database and rendered unescaped via the {%customer.fullName%} template variable in reply emails, enabling attackers to embed phishing links, tracking pixels, and spoofed content in emails sent from the organization's legitimate address. No public exploit code identified at time of analysis.
Confidentiality breach in Oracle MySQL Shell's Core Client component across three major version branches (8.0.x, 8.4.x, and 9.0.x) permits a high-privileged, network-connected attacker to gain unauthorized access to critical or complete MySQL Shell-accessible data, with a CVSS scope change (S:C) indicating potential impact on adjacent systems. No public exploit code has been identified at time of analysis, and an EPSS score of 0.03% at the 8th percentile reflects near-zero observed exploitation probability. SSVC classifies exploitation status as none and technical impact as only partial, underscoring that despite the scope-change flag and high confidentiality impact, real-world urgency is low given the steep access prerequisites.
Fortra GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 use a static initialization vector (IV) for encryption, allowing authenticated administrative users to brute-force decryption of encrypted data. The vulnerability requires high-privilege access and computational effort but results in complete confidentiality loss of encrypted values. No public exploit code or active exploitation has been confirmed at time of analysis.
Stored cross-site scripting in Twenty CRM versions prior to 1.20.6 allows authenticated attackers to inject malicious JavaScript URIs into file block attachments via the BlockNote editor, executing arbitrary code in the browsers of users who click the malicious link. The vulnerability bypasses protocol validation in the FileBlock component and lacks server-side sanitization of block content; exploitation requires user interaction (clicking the attachment) but persistence is stored on the server, affecting all subsequent users who view the compromised document.
FreeScout versions prior to 1.8.213 expose complete customer PII through an authentication bypass in the `load_customer_info` action of POST /conversation/ajax, allowing any authenticated user to retrieve sensitive profile data for arbitrary customers by providing only a valid email address. The vulnerability affects the authorization layer rather than authentication, enabling lateral access to customer records across mailboxes without proper access control verification.
Unauthorized read access to student records data in Oracle PeopleSoft Enterprise CS Student Records 9.2 (Research Tracking component) can be triggered by a low-privileged authenticated attacker over HTTP, provided a victim user interacts with attacker-controlled content. The flaw is rooted in improper access control (CWE-284), enabling horizontal or vertical privilege escalation within the application to expose the full scope of student records data. No public exploit exists and EPSS is extremely low at 0.03% (9th percentile), though the confidentiality impact is rated High by Oracle given the breadth of data potentially accessible.
Denial-of-service in Zyxel WRE6505 v2 firmware via improper encoding in the CGI program allows an adjacent WLAN attacker to crash the web management interface by crafting a malformed SSID and convincing an authenticated administrator to visit the 'AP Select' page. CVSS 4.5 (moderate) with attack vector limited to adjacent networks (Wi-Fi range). No public exploit code identified; Zyxel has marked this as unsupported (end-of-life product).
Oracle Workflow (E-Business Suite component, versions 12.2.3-12.2.15) exposes its Workflow Loader component to unauthorized data manipulation and partial denial of service by highly privileged network attackers over HTTP. The CVSS S:C (scope changed) designation confirms that a successful attack can cascade beyond Oracle Workflow itself to affect other products within the E-Business Suite application tier, amplifying the business impact beyond what the base score of 5.5 initially suggests. No public exploit has been identified and EPSS sits at 0.04% (11th percentile), indicating negligible exploitation probability at time of analysis; SSVC likewise assesses exploitation status as none.
VolumeMount path restriction bypass in Tekton Pipelines prior to v1.11.1 permits authenticated users holding Task or TaskRun creation permissions to mount volumes over internal /tekton/ paths using dot-dot traversal sequences, violating Tekton's internal execution isolation boundary. The flaw exists in both the v1 and v1beta1 API validation layers (pkg/apis/pipeline/v1/container_validation.go and pkg/apis/pipeline/v1beta1/task_validation.go), where strings.HasPrefix is applied to the raw, un-normalized mount path instead of the filepath.Clean-resolved form. No public exploit code has been identified and SSVC assessment confirms no active exploitation; however, in shared or multi-tenant Kubernetes CI/CD environments the integrity risk is meaningful - an attacker can inject falsified task results trusted by downstream pipelines, alter step scripts before execution, or disrupt entrypoint coordination state.
SSH key brute-force attack against GoAnywhere MFT SFTP service allows remote unauthenticated attackers to compromise Web User accounts configured with SSH key authentication in versions prior to 7.10.0. The SFTP service fails to enforce login attempt limits when SSH key authentication is used, enabling attackers to programmatically guess private keys. EPSS and KEV data not provided; vendor Fortra disclosed this vulnerability directly (FI-2026-004).
Mitigation bypass in Firefox's DOM Security component allows authenticated remote attackers with user interaction to circumvent security controls and gain limited read/write access to sensitive data across security boundaries. Firefox 150 and later versions contain the fix; versions prior to 150 are vulnerable. SSVC assessment indicates no current public exploitation, though the vulnerability requires user interaction and authentication to trigger.
Stored XSS in WWBN AVideo 29.0 and below allows authenticated attackers to inject arbitrary JavaScript via markdown comment links using `javascript:` URI schemes that bypass the platform's custom `ParsedownSafeWithLinks` sanitization. The incomplete fix for CVE-2026-27568 patched raw HTML `<a>` tag processing through `inlineMarkup()` but left Parsedown's `inlineLink()` and `inlineUrlTag()` methods unguarded, while simultaneously disabling Parsedown's built-in `safeMode` filtering - creating a clear bypass path. No public exploitation has been confirmed (not in CISA KEV), though SSVC designates a proof-of-concept as existing; EPSS is very low at 0.03% (9th percentile), indicating no widespread active exploitation at time of analysis.
Stored XSS in WWBN AVideo 29.0 and below allows authenticated uploaders to inject persistent JavaScript payloads via a malformed video duration field that bypasses input validation due to a missing regex end anchor. The crafted payload is stored in the database and rendered unescaped across trending, playlist, and gallery thumbnail pages, enabling session hijacking or credential theft against any visiting user including administrators. A proof-of-concept is documented in the GitHub Security Advisory; however, EPSS probability is very low (0.03%, 8th percentile) and no CISA KEV listing confirms active exploitation.
Stored cross-site scripting in Docmost's comment system allows authenticated users to plant javascript: URI hyperlinks that execute arbitrary JavaScript when victims click them. All Docmost instances prior to version 0.80.0 are affected (CPE: cpe:2.3:a:docmost:docmost:*). No active exploitation has been confirmed - SSVC exploitation status is 'none' and the vulnerability is absent from CISA KEV - and EPSS at 0.03% (8th percentile) indicates minimal real-world exploitation probability. Vendor-released patch is available in version 0.80.0.
Improper access control in the Dynamic Monitoring Service (DMS) component of Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 enables low-privileged authenticated attackers to perform unauthorized read and write operations on accessible Fusion Middleware data over HTTP. The scope change in the CVSS vector (S:C) indicates successful exploitation can extend impact to additional co-deployed Oracle middleware components beyond DMS itself. No public exploit has been identified, EPSS stands at a low 0.03%, and SSVC records exploitation as none - positioning this as a normal-cycle patch priority rather than an emergency response.
Improper access control in the Workflow component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a low-privileged, network-authenticated attacker to compromise confidentiality and integrity of accessible data when a victim user interacts with attacker-controlled content. The scope change (S:C) in the CVSS vector indicates successful exploitation can impact resources beyond the vulnerable component, consistent with client-side attack patterns such as stored or reflected XSS enabling cross-context data access. No public exploit code has been identified and EPSS sits at 0.03% (8th percentile), indicating negligible observed exploitation pressure at time of analysis.
Improper access control in the Person Search component of Oracle PeopleSoft Enterprise HCM Shared Components 9.2 enables an authenticated low-privileged attacker to compromise confidentiality and integrity of HCM data, with scope change indicating the impact extends to additional PeopleSoft products beyond the vulnerable component. Exploitation requires human interaction from a victim other than the attacker, consistent with a client-side injection pattern. No public exploit or KEV listing is present, and EPSS at 0.03% (8th percentile) with SSVC exploitation status of 'none' confirms low real-world exploitation activity at time of analysis.
Cross-site scripting or equivalent client-side injection in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 - specifically the Employee Snapshot component - enables a low-privileged authenticated attacker to compromise confidentiality and integrity of HR data and trigger a scope change affecting additional products, provided a victim user interacts with attacker-controlled content over HTTP. The CVSS 3.1 score is 5.4 Medium (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting the scope change that elevates impact beyond the directly vulnerable system. No public exploit code exists and EPSS is 0.03% (8th percentile), indicating very low likelihood of opportunistic exploitation at time of analysis.
Cross-site request forgery in WWBN AVideo 29.0 and prior allows an unauthenticated attacker to trigger mass comment deletion on behalf of any authenticated victim (moderator, video owner, or comment author) who visits a malicious page. The attack is critically amplified by AVideo's deliberate platform setting of `session.cookie_samesite=None`, which strips the browser's native CSRF defense and guarantees the victim's session cookie travels with every cross-origin request. Publicly available exploit code exists per SSVC data; the vulnerability is not listed in CISA KEV at time of analysis.
Cross-site request forgery in WWBN AVideo 29.0 and prior allows unauthenticated attackers to force logged-in victims into performing state-changing actions - posting attacker-authored comments under the victim's identity, manipulating comment likes/dislikes, and deleting category assets when the victim holds management rights. Exploitation requires only that the victim loads an attacker-controlled HTML page, making the attack trivially deliverable via email, forum post, or any embedded image. No public exploit confirmed beyond SSVC poc status; no officially released patched version has been confirmed despite a fix commit existing upstream.
Cross-site request forgery (CSRF) in FreeScout prior to version 1.8.215 allows unauthenticated remote attackers to disconnect OAuth integrations from a mailbox by tricking a logged-in admin into visiting a malicious web page, resulting in loss of email synchronization and potential service disruption. The vulnerability stems from the OAuth disconnect endpoint using GET HTTP method without CSRF token validation, enabling attackers to craft simple links or embed requests in third-party sites to trigger account modifications.
Private repository name disclosure in GitHub Enterprise Server allows any authenticated user to enumerate the names of private repositories by their numeric ID via a missing authorization check in the mobile upload policy API endpoint. Validation error responses included full repository names even when the requesting user lacked access to those repositories. No public exploit has been identified, EPSS is 0.05% (15th percentile), SSVC rates exploitation as none, and this was responsibly disclosed through the GitHub Bug Bounty program - indicators that real-world risk is low but the confidentiality impact is meaningful in environments with sensitive project naming conventions.