Cross-site request forgery in dataCycle-CORE (≤ 25.07.3) enables remote attackers to force authenticated users into unintended state changes by exploiting the application's use of GET routes for server-side mutations. Because Rails does not apply CSRF token validation to GET requests and browsers automatically submit session cookies on cross-site top-level navigations, an attacker who tricks a logged-in victim into visiting a malicious page can silently modify application state - confirmed with watch list manipulation on Standard accounts and potentially user impersonation for admin-level victims. No public exploit or active exploitation has been identified at time of analysis, and a vendor patch was released in version 26.06.08.
Client-side security enforcement bypass in Gobito's Corporate Training Management System permits authenticated users to manipulate input data that the server accepts without independent validation. The root cause is CWE-602: security controls enforced only in the browser are trivially circumvented by crafting direct HTTP requests, bypassing form-level restrictions. No active exploitation has been identified, and CVSS places this at Medium (4.3), reflecting limited integrity impact constrained by the authentication prerequisite.
Denial of service in claircore's Alpine APK package scanner affects Red Hat Advanced Cluster Security 4 and Red Hat Quay 3, where a low-privileged remote attacker can submit a container image containing malformed APK package-database data to trigger an out-of-bounds read (CWE-125) that panics the Go scanner. If the panic is not recovered, the Clair indexer process crashes, interrupting container vulnerability scanning workflows. No public exploit code exists and this CVE is not listed in the CISA KEV catalog, placing this at moderate priority despite network reachability.