Integer coercion error in bettercap's MySQL Server module allows remote attackers to trigger information disclosure through malformed MySQL handshake packets. Versions up to 2.41.5 are affected. The vulnerability requires high attack complexity and has no impact on confidentiality, integrity, or service availability per CVSS 4.0 scoring (VA:L indicates only availability of a non-critical resource), but the described integer manipulation coupled with CWE-189 (numeric errors) suggests potential for partial data exposure or undefined behavior in packet parsing.
Zen Browser prior to 1.19.12b fails to validate item links within RSS/Atom feeds, allowing high-privileged users to inject malicious URLs that bypass feed URL restrictions and are opened as trusted tabs. An attacker with administrative or high privileges can craft a malicious RSS feed containing non-HTTP(S) links that are processed without validation and opened with elevated trust, potentially enabling script injection or protocol handler abuse.
Cross-site scripting (XSS) vulnerability in Wikimedia Scribunto 1.45.0 through 1.45.1 allows authenticated users to inject malicious scripts that may be executed in the context of other users' browsers, potentially compromising session security and enabling unauthorized actions on affected wiki installations. The vulnerability requires login credentials and elevated attack complexity but carries low availability impact; CVSS 2.3 reflects limited real-world threat when combined with the authentication requirement.
Cross-account email event leakage in Inbox Zero prior to 2.29.3 allows authenticated users of the cleaner feature to receive thread events intended for other authenticated accounts via a shared Redis subscription listener. The vulnerability requires both accounts to be actively using the cleaner feature simultaneously and affects only confidentiality of email metadata, with low attack complexity but requiring prior authentication and precise timing.
Sensitive notification data is exposed to authenticated but unauthorized actors through the Echo extension's API layer in MediaWiki. The vulnerability resides in includes/Api/ApiEchoNotifications.php, where insufficient access control on the notifications API allows a low-privileged authenticated user - under specific attack conditions (AT:P) - to retrieve notification content belonging to other users or restricted contexts. No active exploitation has been identified (SSVC: Exploitation none; EPSS 0.04%, 13th percentile), and the vendor has released patched versions across all supported branches.
OpenClaw before version 2026.4.20 misclassifies direct messages as group conversations in Feishu card-action callbacks, allowing authenticated attackers to bypass dmPolicy restrictions and trigger card-action flows that should have been blocked. The vulnerability affects direct message handling in the Feishu integration and requires authenticated access (PR:L per CVSS vector) but achieves both confidentiality and integrity impact with moderate CVSS score of 5.4.
Server-side request forgery in OpenClaw before version 2026.4.20 allows authenticated attackers to bypass strict-mode SSRF policy checks during browser CDP profile creation by storing profiles pointing to private-network or metadata endpoints, which are later probed during normal profile status operations. The vulnerability affects only strict-mode deployments that explicitly restrict private-network CDP targets; default configurations allow private-network endpoints and are not vulnerable. Vendor-released patch: 2026.4.20.
Authorization bypass in OpenClaw before 2026.4.21 allows non-owner senders to execute owner-enforced slash commands when channels are configured with wildcard inbound senders (allowFrom: ["*"]) without explicit owner allowFrom settings. Attackers with legitimate channel access can exploit this to bypass owner-only command authorization checks and execute commands such as /send, /config, or /debug. The vulnerability requires authenticated access to affected channels but is limited to command-owner authorization and does not grant tool access or gateway administrator scope.
OpenClaw before version 2026.4.20 allows authenticated local agents to bypass tool policy restrictions by appending bundled MCP and LSP tools to the effective tool set after policy filtering has completed. Attackers with local agent access can circumvent profile policies, allow/deny lists, owner-only restrictions, sandbox policies, and subagent policies, potentially gaining unauthorized access to restricted tools. This vulnerability requires a configured bundled tool source and an operator-defined restrictive policy; no active exploitation has been identified.
OpenClaw before 2026.4.22 fails to propagate security envelope constraints when spawning ACP child sessions, allowing authenticated restricted subagents to bypass depth limits, child-count restrictions, control scope, and target-agent constraints. An attacker with subagent privileges can exploit this by spawning child sessions that inherit insufficient security enforcement, potentially escalating privileges or accessing resources beyond their assigned scope.
Information disclosure in Wikimedia Foundation AbuseFilter allows low-privileged authenticated users with user interaction to access limited confidential data through a network vector. The vulnerability affects AbuseFilter versions prior to 1.43.7, 1.44.4, and 1.45.2, with very low CVSS score (2.1) indicating minimal real-world impact but potential for sensitive information leakage in filtered content or filter logic contexts.
OS command injection in Tenda AC6 firmware version 15.03.06.49_multi_TDE01 allows high-privilege remote attackers to execute arbitrary commands via manipulation of mac/ssid parameters in the fromSetWirelessRepeat function exposed through the /goform/WifiExtraSet HTTP endpoint. Public exploit code is available, though the CVSS 2.0 score reflects limited impact scope due to requirement of high-privilege authentication and minimal confidentiality/integrity/availability effects beyond low-severity damage.
MediaWiki versions before 1.43.7, 1.44.4, and 1.45.2 expose sensitive information to unauthorized actors through improper handling in the Skin.php component. The vulnerability requires authenticated user access and user interaction (CVSS:4.0/AV:N/AC:H/PR:L/UI:P), resulting in low confidentiality impact. With an EPSS score of 2.1 and no evidence of active exploitation, this poses limited real-world risk but should be patched as part of routine maintenance.
CRLF injection in cowlib's cow_cookie:cookie/1 encoder allows an attacker who controls cookie name or value strings to inject semicolons, commas, CR, LF, or TAB characters into a serialized Cookie: request header, enabling cookie smuggling and HTTP request header splitting against downstream proxies or servers. Affected applications are those built on cowlib 2.9.0 and later that pass externally-influenced data directly to this function without prior sanitization - notably Cowboy-based Erlang web services acting as reverse proxies or API gateways. No public exploit has been identified and no active exploitation is confirmed; EPSS stands at 0.02% (6th percentile) and CISA KEV status is absent, consistent with SSVC exploitation: none.
MediaWiki's article page rendering code in includes/Page/Article.php exposes limited confidential content to unintended users, constituting an information disclosure under CWE-668 (Exposure of Resource to Wrong Sphere). All MediaWiki deployments running versions prior to 1.43.7, 1.44.4, or 1.45.2 are affected, but exploitation is constrained by high privilege requirements, high attack complexity, and specific preconditions. With a CVSS 4.0 score of 2.0, an EPSS of 0.04% (12th percentile), no CISA KEV listing, and SSVC exploitation status of 'none,' this is a low-priority item suitable for routine patching; no public exploit has been identified at time of analysis.
Cross-site scripting (XSS) in Devs Palace ERP Online version 4.0.0 and earlier allows authenticated high-privilege users to inject malicious scripts via the /accounts/chart-save endpoint. The vulnerability requires user interaction (UI:P) to trigger and results in limited integrity impact. Publicly available exploit code exists, though the CVSS 4.0 score of 1.9 reflects low severity due to the high privilege requirement (PR:H) and user interaction dependency.
Cross-site scripting (XSS) in Devs Palace ERP Online up to version 4.0.0 allows high-privileged authenticated users to inject malicious scripts via the /inventory/sales_save endpoint with user interaction, resulting in integrity impact. The exploit code has been publicly released and the vendor has not responded to early disclosure attempts, leaving affected deployments without vendor-provided patches.
MediaWiki before versions 1.43.7, 1.44.4, and 1.45.2 exposes sensitive information to unauthorized actors through a vulnerability requiring user interaction. The flaw allows information disclosure via network access without authentication, though impact is limited (CVSS 1.3) and requires user participation to trigger. Vendor-released patches are available across all affected major versions.
MediaWiki's SpecialUserRights.php exposes sensitive information to authenticated low-privilege users across versions prior to 1.43.7, 1.44.4, and 1.45.2. The vulnerability resides in the user rights management special page, where insufficient access controls allow a logged-in actor with minimal privileges to read confidential data - likely user group memberships, rights assignments, or related administrative details - that should be restricted to privileged operators. No public exploit exists and SSVC rates exploitation as none, placing this firmly in low-urgency patch territory despite its network-accessible attack vector.
Information disclosure in WeGIA versions prior to 3.6.10 allows authenticated remote attackers to obtain sensitive technical details through overly descriptive error messages in the file upload endpoint (funcionario/docdependente_upload.php), expanding the attack surface for subsequent exploitation attempts.