Stored cross-site scripting in the Event Tickets and Registration WordPress plugin before 5.28.4 enables Editors and above to inject malicious scripts in event titles, which execute against higher-privileged users on multisite setups when they view the ticket history log. The vulnerability has a low CVSS of 3.5 and a low EPSS of 0.15%, but exploit code is publicly available. A patch in version 5.28.4 is available from the vendor.
The Quiz and Survey Master WordPress plugin before version 11.1.5 permits authenticated users with contributor-level permissions to delete arbitrary output templates due to a missing capability check. Public exploit code is available, though no active exploitation has been confirmed. A vendor patch (version 11.1.5) addresses this issue.
Sensitive header disclosure in datamodel-code-generator allows Authorization, Cookie, and Proxy-Authorization headers to be leaked to cross-origin redirect targets when fetching remote schemas. Affects versions prior to 0.63.0. A public proof-of-concept exploit exists, but no active exploitation has been reported and the CVSS score is low (3.7).
Rate-limiting bypass vulnerability in an unspecified screen-sharing application allows an attacker with local network access to brute-force the screen-sharing code, potentially displaying harmful content on the target screen. The vulnerability has a CVSS score of 3.3 (Low) with a local attack vector, though the description suggests network-adjacent access. No evidence of active exploitation or public exploit code identified at the time of analysis.
Information disclosure in gst-plugins-good's FLAC header parser within Matroska/WebM containers allows a local attacker to leak 4 bytes of heap memory by tricking a user into opening a malicious media file. The flaw has a low CVSS score (3
We need to generate a comprehensive vulnerability analysis for CVE-2026-18028 based on the provided data. The user gave description, CVSS, CWE, tags, and a reference. There's no explicit mention of KEV, EPSS, POC, patch availability, CPEs. I need to synthesize from this. First, parse the input: CVE ID: CVE-2026-18028 Description: The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed request to create products, quotas, set bank transfer configuration, or connect a stripe account to an event they do not have access to. CVSS Score: 2.3 (but vector is CVSS 4.0 base, score 2.3 is likely base score from CVSS 4.0, low severity) CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-639 (Authorization Bypass Through User-Controlled Key) Tags: Authentication Bypass References: [nvd] (None) https://pretix.eu/about/en/blog/20260728-release-2026-6-1/ From the reference URL: pretix.eu about blog release 2026-6-1. So it's for pretix, an event ticketing platform. The release note likely mentions this vulnerability. Need to infer affected product: pretix (maybe pretix event management software). The description mentions "quick setup" view after creating an event. So the product is pretix. The description states permission check missing: user can modify config for events they don't have access to via a well-timed request. So it's a broken access control issue, CWE-639 is "Authorization Bypass Through User-Controlled Key" (missing object-level authorization). The tag "Authentication Bypass" might be misleading but it's authorization bypass. The CVSS vector: AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:
Remote information disclosure in nextlevelbuilder GoClaw up to version 3.13.2 allows authenticated low-privilege attackers to extract sensitive data from internal tool execution. The vulnerability is in the ExecTool.Execute function of the jq handler, and publicly available exploit code exists. Users are urged to patch via PR #1230 or upgrade to a fixed version when released.
Quadratic time complexity in CPython's xml.etree.ElementTree.findall(), iterfind(), and find() methods allows denial of service when processing XML documents with many same-tag siblings and XPath index predicates. Affected versions are CPython before 3.15.0. No active exploitation or public exploit identified at time of analysis.
We need to produce a JSON output with the specified fields, based on the provided CVE data. Start by analyzing the CVE: CVE-2026-54620, for sqlite3-ruby gem. The description: using aggregate functions after closing database leads to use-after-free and segfault. CWE-416 Use After Free. CVSS N/A but we can assess it. Patch available, upgrade to v2.9.5. Low severity per maintainers. No KEV, no EPSS provided (we have to infer from known data? We don't have EPSS score input, so we might note it's unknown). Tags: Denial of Service, Use After Free, Memory Corruption. CPE: pkg:rubygems/sqlite3-ruby, pkg:rubygems/sqlite3 (both refer to the same gem). Affected versions: >=2.1.0, <=2.9.4, fixed in 2.9.5. Exploitation conditions: Requires using a database aggregate function after explicitly closing the database. This is a specific API usage pattern. So the exploitation condition is explicit: "using an aggregate function on a statement after the database connection has been closed." The maintainer says "reliably triggered after GC when code is structured in a particular way". So it's not a default scenario. Now, produce each field: product_name: "sqlite3-ruby" (the specific gem name, 1-3 words). Could be "sqlite3-ruby gem" but that's 2 words? "sqlite3-ruby" is one word? Actually "sqlite3-ruby" is hyphenated, considered one word. So "sqlite3-ruby". summary: Need original synthesis. Avoid copying description. Start with impact verb and product. The impact is denial of service (segfault) due to use-after-free. So: "Use-after-free in sqlite3-ruby gem via aggregate functions after database close may cause denial of service." Add specific version range, and that it can lead to a crash, no remote code execution mentioned. Mention that it's not actively exploited (no KEV, no POC? The advisory doesn't indicate POC, but it's a publicly known issue from GHSA, so there might be no published exploit. We'll state "no public exploit identified". EPSS unknown. We'll write something like:
A use-after-free vulnerability in the sqlite3-ruby gem allows an attacker to crash the Ruby process by defining a custom SQLite function with the same name but a different number of arguments or text encoding, leading to an invalid memory read and segmentation fault. The issue affects versions prior to 2.9.5 and was assessed as low severity by the maintainers due to the specific code pattern required for exploitation.