RTMKit WordPress plugin versions before 2.0.9 allows users holding at least the Author role to invoke a restricted builder AJAX action without adequate capability verification, letting them create and activate site-wide templates that override globally displayed areas - headers, footers, and other layout regions - ordinarily controlled only by administrators. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile) and CISA KEV does not list active exploitation, suggesting opportunistic rather than widespread abuse. The integrity impact is real but bounded: no data theft or remote code execution occurs, only unauthorized content modification visible to all site visitors.
Unauthorized post title disclosure in the RTMKit WordPress plugin before 2.0.9 allows any site user holding at least the Contributor role to enumerate private, draft, pending, scheduled, and trashed posts authored by other users. The root cause is a missing capability check in an AJAX handler that resolves a caller-supplied post identifier directly - a classic IDOR (CWE-639) pattern. No public exploit is in CISA KEV, but a publicly available proof-of-concept exists per WPScan, and the vendor has released a patch in version 2.0.9.
Unhandled Go runtime panic in CoreDNS 1.9.4 through 1.14.4 allows a network-reachable DNS client with AXFR permission to crash the CoreDNS process via a zone transfer request, causing a denial of service against cluster DNS. The crash path is triggered only when the k8s_external plugin is configured for headless-service zone transfers and Kubernetes contains a headless service with no declared ports - a condition that causes an empty record batch to be forwarded to plugin/transfer/transfer.go, where an unchecked index access (records[0]) panics the Go runtime. No public exploit identified at time of analysis; the vendor fix is confirmed in v1.14.5.
Crash-inducing out-of-bounds panic in core-rs-albatross 1.5.1 and earlier allows a malicious state-sync peer to repeatedly restart a syncing Nimiq node without supplying a valid cryptographic proof. The panic fires in `KeyNibbles::Add` before `proof.verify()` is reached, meaning an unauthenticated network peer positioned as the victim's sync source can trigger the denial-of-service with a single crafted `TrieChunk` message. No CISA KEV listing exists and no public exploit code has been identified at time of analysis.
Panic-induced denial of service in nimiq-primitives (core-rs-albatross <= 1.5.1) allows a malicious state-sync peer to crash a syncing Nimiq blockchain node by sending a crafted TrieChunk whose proof contains two TrieProofNode entries with identical keys. The panic fires in TrieProof::verify() before any cryptographic proof validation occurs, so no valid proof is required to trigger it. The crash is transient - the node restarts and re-syncs - and no public exploit has been identified at time of analysis.
Cyrus IMAP through version 3.12.2 fails to invalidate URLAUTH-minted URLs when the authorizer's access is subsequently revoked, allowing continued unauthorized access to delegated mailbox content. The flaw (CWE-672: Operation on Resource after Expiration or Release) affects the URLAUTH extension defined in RFC 4467, which is designed to let users grant third-party access to mailbox data without sharing credentials. No public exploit code exists and this vulnerability is not listed in CISA KEV; real-world risk is highest in environments with active IMAP delegation workflows where access revocation is security-critical, such as departing employee scenarios.
Unauthorized mailbox access in Cyrus IMAP through 3.12.2 allows any authenticated user to read email from mailboxes they have no ACL permissions on by exploiting the GENURLAUTH command's failure to enforce access controls before issuing URLAUTH tokens. The authorization boundary between mailboxes is effectively eliminated for any user who can name a target mailbox, undermining the server's entire multi-user isolation model. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the impact is materially more significant in multi-tenant or shared-server environments than the CVSS score of 3.5 suggests.
Missing HSTS header in HCL DFXAnalytics exposes authenticated sessions to protocol downgrade and man-in-the-middle attacks by network-positioned adversaries. All versions per the CPE wildcard are affected, and the application fails to include the Strict-Transport-Security response header, leaving browsers without enforcement of HTTPS-only communication. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known, consistent with the low CVSS score of 3.1.
Heap over-read in Cyrus IMAP through version 3.12.2 enables authenticated IMAP users to leak server heap memory by submitting a crafted email containing an RFC 822 MIME comment whose final character is a backslash. During message parsing, the server reads past the end of the message buffer into adjacent heap memory and returns the exposed content to the requesting user, resulting in partial, non-deterministic heap disclosure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a fix is referenced in the Cyrus IMAP 3.12.3 release notes.
Cyrus IMAP through version 3.12.2 contains an authorization flaw in its XAPPLEPUSHSERVICE (XAPS) command that lets authenticated IMAP users enumerate arbitrary mailboxes belonging to other accounts and redirect Apple Push Notification Service alerts about those mailboxes to their own device. The flaw (CWE-863, Incorrect Authorization) does not expose message content - only whether a target mailbox exists and when its modification sequence (modseq) changes - but it enables cross-account probing and unauthorized push subscription in multi-tenant IMAP deployments. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the low CVSS score of 3.1 is consistent with the limited confidentiality impact and mandatory authentication requirement.
Group search in Keycloak's administrative API leaks unauthorized parent group details to delegated administrators when Fine-Grained Admin Permissions v2 (FGAP v2) is enabled. A delegated admin with read access to a child group can trigger the flaw simply by searching for that child group, causing the API response to incorrectly return full attribute and configuration data for parent groups they have no authorization to view. CVSS 4.3 Medium (PR:L, C:L) reflects its limited confidentiality impact and authenticated-only exploitability; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds write in Bouncy Castle BC-LTS bcprov-lts8on affects ARM deployments running versions 2.73.0 through 2.73.12.0, with high confidentiality impact if successfully exploited. The flaw resides in ARM-specific native C implementations of SHA3 and SHAKE algorithms and is only triggered when an application accepts memoable SHA3/SHAKE cryptographic states from potentially untrusted external sources. No public exploit code exists and no active exploitation has been confirmed at time of analysis; the CVSS 4.0 score of 1.7 reflects the very narrow exploitation conditions required to reach this code path.