Privilege escalation in rConfig before 8.2.8 allows any authenticated low-privilege user to self-assign or assign the Admin role to arbitrary accounts via a missing allowlist and absent authorization check in the Users API. The StoreUserRequest handler accepts a caller-supplied role field without validating it against permitted values and without verifying the requesting account already holds Admin status, enabling direct mass-assignment of the Admin role to any user model during creation or profile updates. No public exploit code has been identified and CISA KEV listing is absent; a vendor-released patch is available in version 8.2.8.
Resource exhaustion in GLib's GDBus authentication component allows attackers to crash or hang processes by sending unbounded data streams before authentication completes. The `gdbusauth` handler reads lines from connecting clients without enforcing any maximum length, meaning an attacker who can reach a GDBus endpoint can force the target process to allocate unbounded memory and saturate CPU cycles. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the unbounded allocation primitive (CWE-770) in a widely-deployed system library warrants attention from Red Hat and GNOME ecosystem consumers.
Uncontrolled resource consumption in FreeScout's file upload endpoint allows any user to flood the server with upload requests, overloading the database and causing denial of service for all platform users on versions prior to 1.8.224. The root cause is the complete absence of rate limiting on the upload route - a low-complexity, network-accessible weakness requiring no special privileges per the CVSS vector. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial exploitation mechanics mean any motivated user can weaponize this without tooling.
Server-side request forgery in HyperDX before 2.31.0 allows authenticated team members to weaponize the server's network identity against internal infrastructure by supplying attacker-controlled URLs to the webhook test endpoint. The root cause is an insufficient hostname blacklist that can be bypassed using IPv6 notation (e.g., http://[fd00::1]/path) or other alternate IP representations, enabling enumeration of internal services, interaction with internal containers, and retrieval of cloud instance metadata including IMDSv1 credential endpoints. No public exploit code has been identified and the vulnerability is not in CISA KEV, though the GitHub issue and fix PR are publicly visible, making the attack surface discoverable.
Authorization bypass in SurrealDB LIVE SELECT subscriptions allows authenticated record users to receive real-time notifications for records that table-level SELECT permission expressions should have filtered out. Affected versions before 3.1.0 incorrectly evaluate permission expressions against attacker-supplied variable bindings rather than trusted document context when the expression references $value, $before, $after, or $event. No public exploit code has been identified and the issue is not listed in CISA KEV, but the bypass is straightforward for any authenticated subscriber on a vulnerable deployment using the affected variable names in permission logic.
SurrealDB before version 3.1.0 leaks restricted field values to authenticated record users by exploiting an indexed COUNT query optimization that skips field-level SELECT permission checks. When a field is protected by DEFINE FIELD ... PERMISSIONS FOR select but is also covered by a DEFINE INDEX, an attacker holding table-level SELECT can confirm or enumerate the field's contents by submitting SELECT count() FROM t WHERE hidden_field = 'guess' GROUP ALL - the query planner's indexed fast path returns a nonzero count for correct guesses without ever evaluating the permission predicate. No public exploit exists and the vulnerability is not in CISA KEV; however, the attack is straightforwardly reconstructable from the detailed vendor advisory.
Permissions bypass in SurrealDB before 3.2.0 allows any authenticated user to write to tables they lack explicit access to by embedding data-modifying statements inside PERMISSIONS clauses. Because the database disables enforcement during PERMISSIONS clause evaluation, embedded CREATE, UPDATE, DELETE, or UPSERT statements execute without access control checks, enabling unauthorized writes and data corruption across any table in the instance. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) indicates straightforward network exploitation by any low-privilege authenticated user.
LIVE SELECT subscriptions in SurrealDB before 3.1.0 persist real-time change notifications under revoked, expired, or superseded session credentials, violating session boundary enforcement. Authenticated users who register a LIVE SELECT query retain delivery of change notifications after their session is invalidated, expires via TTL, or is replaced by a different identity authenticating on the same WebSocket connection. No public exploit has been identified and no active exploitation is confirmed; vendor-released patch is available in SurrealDB 3.1.0.
Field-level SELECT permission bypass in SurrealDB 3.1.0-3.1.4 allows authenticated record users to recover field values explicitly hidden by DEFINE FIELD ... PERMISSIONS FOR select NONE by routing queries through graph-edge (`->`) or back-reference (`<~`) traversals rather than direct table scans. The shared `resolve_record_batch` helper used by the 3.1.x query planner's GraphEdgeScan and ReferenceScan paths enforces only table-level authorization, silently skipping the `build_field_state`/`filter_fields_by_permission` routines applied on all other read paths. No public exploit has been identified at time of analysis; vendor-released patch is available in version 3.1.5.
SurrealDB versions before 3.1.0 expose field values protected by field-level SELECT permissions through verbose error messages returned to authenticated users who hold UPDATE access. By issuing UPDATE statements that trigger arithmetic or extend operations against hidden fields - such as adding an integer to a string-typed email field - an attacker receives an error response embedding the raw operand value (e.g., 'Tried to compute "alice@example.com" + 1'). No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the technique is trivially repeatable across any field on any record the attacker holds UPDATE permission on.
Open redirect in cal.diy's conferencing OAuth callback endpoint (through v6.2.0) enables remote unauthenticated attackers to silently redirect authenticated users to attacker-controlled URLs by injecting a malicious external URL into the unsigned `onErrorReturnTo` field of the OAuth `state` parameter. Because the state payload is never cryptographically signed or validated against a trusted origin allowlist, the endpoint blindly issues a 301 redirect to any URL supplied by the caller, making the trusted cal.diy domain a transparent phishing launchpad. No public exploit code has been identified at time of analysis, but exploitation requires only a crafted URL - no special tooling - with user interaction as the sole barrier.
Authorization bypass in SurrealDB's KILL statement before version 3.1.0 allows any authenticated database-level user to silently terminate other users' LIVE SELECT real-time subscriptions by targeting their live query UUIDs, with no ownership verification performed. The affected user receives no notification of termination, breaking real-time data pipelines and multi-tenant isolation guarantees - a low-privilege record-scoped user can disrupt a root user's monitoring subscriptions within the same database. Discovered during a cure53 code audit and penetration test; no public exploit code or CISA KEV listing exists at time of analysis.
Authorization bypass in SurrealDB before 3.1.0 allows authenticated users to circumvent tenant-isolation and object-keyed permission rules by spoofing composite record-id field values through writable body fields. Attackers who can write to any record can set a same-named body field to an arbitrary value; because the permission evaluator incorrectly reads from the editable body rather than the immutable id key, `PERMISSIONS FOR` clauses gating access on `id.<field>` (the common pattern for tenant isolation) are silently defeated. No public exploit has been identified at time of analysis, and the vulnerability requires valid credentials, but the impact includes cross-tenant data exposure and silent UNIQUE constraint corruption. Fix is available in 3.1.0.
Server-Side Request Forgery via HTTP redirect in SurrealDB before 3.1.0 allows authenticated users to circumvent port-scoped `--deny-net` network restriction rules. When an `http::*` function call targets an allowed hostname that responds with a 3xx redirect to a denied `host:port`, the redirect policy in `core/src/fnc/util/http/mod.rs` constructs the redirect `NetTarget` from `url.host_str()` alone - silently discarding the port - causing the capability matcher to skip port-specific deny rules entirely. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Blind server-side request forgery in AVideo's encoder download-by-URL flow allows authenticated attackers to probe internal network infrastructure by exploiting an unpinned cURL retry fallback. When the primary DNS-pinned fetch to a supplied downloadURL fails, the application retries with a null resolvedIP argument to ssrfPinnedFetchToFile, stripping the DNS-binding protection and allowing attacker-controlled HTTP redirects to reach RFC-1918 or loopback addresses. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; the CVSS 4.0 score of 5.3 with PR:L reflects a real but bounded risk gated behind authenticated access.
Field-level SELECT permission bypass in SurrealDB before 3.1.0 allows authenticated users to exfiltrate protected field values via a crafted JSON Patch operation. Submitting an UPDATE PATCH with an empty string as the `from` pointer in a `copy` or `move` operation causes the database to duplicate the entire record - including fields restricted by `PERMISSIONS FOR select` - into an attacker-controlled destination field that bypasses the post-query redaction filter. Impact is confidentiality-only and bounded to fields of the single targeted record; no KEV listing and no public exploit code identified at time of analysis, though exploitation requires only a valid authenticated session and standard JSON Patch syntax.
Authorization bypass in SurrealDB before 3.1.0 allows authenticated users holding only CREATE permission on an edge table to silently overwrite existing edge records without possessing UPDATE permission. By crafting a RELATE statement with an explicit SET id clause pointing to an already-existing edge id, the storage layer skips the expected conflict check and performs an overwrite instead of returning an error - violating the permission boundary between CREATE and UPDATE operations. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 5.3 reflects the network-reachable but low-privilege, integrity-only impact.
SurrealDB before v3.1.0 silently substitutes ES384 (P-384 curve) when operators configure JWT access methods with ALGORITHM ES512 (P-521 curve), because the underlying Rust jsonwebtoken crate v10.x omits an ES512 variant entirely. Operators who provision correct P-521 keys experience authentication handshake failures, and external systems expecting genuine ES512 signatures will reject SurrealDB-issued tokens. No public exploit has been identified at time of analysis; the vendor and GHSA advisory both confirm the flaw cannot be used to forge tokens or compromise confidentiality or integrity, as ES384 itself remains cryptographically strong.
XSS via unescaped attribute name interpolation in Astro's renderHTMLElement affects all versions of the npm package 'astro' prior to 7.0.6, representing an incomplete fix for CVE-2026-54298. The renderHTMLElement() function in dom.ts interpolates spread prop keys directly into HTML attribute names without sanitization - escaping only the value - allowing an attacker who controls prop key names on a native HTMLElement-subclass Astro component to inject event-handler attributes or sibling script elements into SSR-rendered output. Exploitation is constrained to SSR runtimes that expose a global HTMLElement (Deno, Bun with a DOM shim, jsdom/happy-dom in Node); standard Node.js SSR is not reachable. A proof of concept is publicly available in the GitHub advisory (GHSA-f48w-9m4c-m7f5). This CVE is not listed in CISA KEV.
Stored cross-site scripting in Quix Page Builder Pro, a Joomla CMS extension by ThemeXpert, allows authenticated builder-role users to inject persistent malicious scripts by breaking out of id/class HTML attribute fields rendered in public-facing pages. The payload executes in the browsers of any visitor loading the affected page, enabling session hijacking, phishing redirects, or malware delivery at scale across the site's audience. No public exploit code or active exploitation has been identified at time of analysis, and no confirmed patched version is available from the provided references.
Blind SSRF in SurrealDB's JWKS fetcher before 3.1.5 allows Owner-role database principals to bypass network capability controls by chaining an allowlisted host redirect to blocked internal addresses. The JWKS client in `core/src/iam/jwks.rs` applies `check_capabilities_url` only to the originally configured URL, not to 3xx redirect targets, while the hardened `HttpClient` used by `http::*` functions already re-validates each hop since 3.1.0. Exploitation requires Owner-level credentials and yields only blind timing-based probing of internal hosts - no response body is returned - with no public exploit identified at time of analysis.
Server-Side Request Forgery in the JMedia Extension for Joomla (themexpert.com) allows authenticated administrators to direct the extension's remote-URL download feature to issue server-side HTTP requests to internal or reserved IP address ranges, effectively using the Joomla host as a network proxy. With high privilege required (PR:H per CVSS 4.0 vector) and no direct impact on the vulnerable system itself (VC/VI/VA all N), real-world risk is primarily limited to internal network reconnaissance and interaction with co-located services. No public exploit code and no CISA KEV listing exist at time of analysis.
Server-Side Request Forgery in SurrealDB's JWKS fetcher allows an Owner-role attacker to weaponize the server as an internal network proxy. By configuring an access method with a JWKS URL whose hostname passes the string-based allow-list check but resolves via DNS to a private or loopback address, the attacker causes SurrealDB to issue GET requests to internal infrastructure that would otherwise be unreachable. No public exploit has been identified and no CISA KEV listing exists; exploitation is constrained by the requirement for Owner-level privileges, making this a meaningful but bounded risk in privileged-access-compromise scenarios.
Arbitrary file read via path traversal in FreeScout's App Logs feature exposes any server-local file readable by the PHP process to authenticated administrators prior to version 1.8.224. The bundled `rap2hpoutre/laravel-log-viewer` override decrypts a user-supplied `dl` parameter and resolves its absolute path before applying the intended `storage/logs` directory restriction, allowing the restriction to be bypassed entirely. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, successful exploitation could expose sensitive server files such as environment credentials or application secrets.
Missing length validation for the NEW_TOKEN format in HAProxy Community Edition 3.0 through 3.3 exposes network-accessible deployments to low-integrity and availability impacts via crafted requests. The flaw affects HAProxy Enterprise and ALOHA distributions as well, broadening the potential attack surface beyond the open-source edition. No public exploit code and no CISA KEV listing have been identified at time of analysis; patches are available across all affected release branches. Notably, the 'Information Disclosure' tag attached to this CVE conflicts with the CVSS C:N rating - defenders should consult the vendor advisory to clarify whether memory exposure is a realistic outcome.
Stored cross-site scripting in Frogman's chat-console markdown formatter allows a FreePBX admin with write access to entity fields (extension names, ring-group descriptions, IVR names, queue descriptions) to inject JavaScript payloads that execute in a second, higher-privileged admin's browser session when those fields are reflected through Frogman chat tool responses. All versions prior to 1.6.6 are affected; version 1.6.6, released following an internal audit on 2026-05-13, is the patching release. No public exploit code exists and no active exploitation has been confirmed (no CISA KEV listing); real-world risk is bounded by the product's experimental status and PR:H requirement.
Rsync daemon before version 3.4.3 allows hostname-based access control rules to be silently bypassed when the daemon is configured with chroot and the chroot directory lacks the files glibc requires for DNS resolution. When resolution fails inside the chroot, the client hostname is set to "UNKNOWN", which never matches administrator-defined "hosts deny" hostname patterns, effectively nullifying those rules. An attacker who controls the PTR record for their source IP can exploit this to connect to an rsync module they were explicitly denied access to; no public exploit code is identified and this is not listed in CISA KEV.
Prototype Pollution in FreeScout's client-side `getQueryParam` function allows an authenticated attacker to write arbitrary properties into `Object.prototype` via crafted URL query strings on any page loading `main.js`. An initial mitigation introduced in version 1.8.139 blocked direct top-level `__proto__` keys but failed to sanitize nested bracket-notation bypass forms such as `b[__proto__][polluted]=PWNED`, leaving all installations between 1.8.139 and 1.8.222 still exploitable. The complete fix shipped in version 1.8.223; no public exploit or active exploitation is confirmed at time of analysis.
Improper authorization in dataCycle-CORE versions up to and including 25.07.3 allows any Standard user to enumerate the full names and email addresses of other users - including internal staff, guest accounts, and external test accounts - via the `/users/search` endpoint, bypassing access controls that correctly deny direct user profile access. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low-complexity network exploitation by any authenticated Standard user with no user interaction required. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Cross-site request forgery in dataCycle-CORE (≤ 25.07.3) enables remote attackers to force authenticated users into unintended state changes by exploiting the application's use of GET routes for server-side mutations. Because Rails does not apply CSRF token validation to GET requests and browsers automatically submit session cookies on cross-site top-level navigations, an attacker who tricks a logged-in victim into visiting a malicious page can silently modify application state - confirmed with watch list manipulation on Standard accounts and potentially user impersonation for admin-level victims. No public exploit or active exploitation has been identified at time of analysis, and a vendor patch was released in version 26.06.08.
Client-side security enforcement bypass in Gobito's Corporate Training Management System permits authenticated users to manipulate input data that the server accepts without independent validation. The root cause is CWE-602: security controls enforced only in the browser are trivially circumvented by crafting direct HTTP requests, bypassing form-level restrictions. No active exploitation has been identified, and CVSS places this at Medium (4.3), reflecting limited integrity impact constrained by the authentication prerequisite.
Denial of service in claircore's Alpine APK package scanner affects Red Hat Advanced Cluster Security 4 and Red Hat Quay 3, where a low-privileged remote attacker can submit a container image containing malformed APK package-database data to trigger an out-of-bounds read (CWE-125) that panics the Go scanner. If the panic is not recovered, the Clair indexer process crashes, interrupting container vulnerability scanning workflows. No public exploit code exists and this CVE is not listed in the CISA KEV catalog, placing this at moderate priority despite network reachability.
HAProxy Community Edition 3.2.x and 3.3.x contains a varint mishandling defect that allows remote network clients to trigger an infinite loop or process crash, resulting in denial of service. The flaw affects Community Edition 3.2.x before 3.2.12 and 3.3.x before 3.3.3, and is explicitly confirmed to also affect HAProxy Enterprise and ALOHA commercial distributions. No public exploit has been identified and CISA has not listed this in KEV; however, HAProxy's role as a critical network gateway in many enterprise environments elevates the operational impact of even a Low-severity availability disruption.
NULL pointer dereference in NanoMQ 0.24.11 and earlier allows a malicious MQTT broker to remotely crash any connecting NanoMQ MQTTv5 client - including bridge mode - with a single 35-byte crafted packet, triggering SIGSEGV and denial of service. The bug in mqtt_codec.c:1863 arises when a CONNECT packet carries will properties (will_prop != NULL) but no connect-level properties (prop == NULL); the code erroneously dereferences prop->next, reading from virtual address 0x38 (NULL plus struct field offset). No CISA KEV listing or public exploit is confirmed at time of analysis, but the minimal 35-byte trigger and auto-reconnect behavior in bridge mode can convert a single crash into a persistent DoS loop.
Open redirect in the @astrojs/node standalone server's static file handler allows remote attackers to redirect authenticated or unauthenticated users to arbitrary external hosts via crafted slash-backslash paths. Versions 8.1.0 through 11.0.1 of the npm package fail to normalize backslash characters before the internal-path prefix check in `isInternalPath()`, causing the 301 `Location` header to echo back paths like `/\attacker.com/page` which browsers resolve as `//attacker.com/page` per the WHATWG URL specification. No public exploit is identified at time of analysis; exploitation is gated by a non-default configuration option and requires social engineering to deliver a crafted link to a victim.
Stack-based buffer overflow in rsyslog's optional mmpstrucdata module allows a remote, unauthenticated attacker to crash the rsyslog process and interrupt log collection, with theoretical code execution on weakly hardened builds. Affected versions span rsyslog 7.5.4 through 8.2605.x; the fix is included in 8.2606.0. No public exploit code or active exploitation has been confirmed, but the crash was independently reproduced over both TCP and UDP on Debian 12 with rsyslog 8.2302.0, and the corrective PR (#6991) was merged publicly before coordinated disclosure completed.