Stored XSS in the Booking System Trafft WordPress plugin (versions up to and including 1.0.17) allows authenticated attackers holding Subscriber-level access to permanently replace the plugin's embed-script origin with an attacker-controlled URL, causing arbitrary JavaScript to execute in every site visitor's browser on any page rendering the booking shortcode. The root cause is a missing capability check on the `set_options` AJAX handler - the plugin relies solely on a nonce that is printed inline on every WordPress admin page (including profile.php), making it reachable by any logged-in user when the plugin operates in agency mode. No public exploit has been identified at time of analysis, but the persistent site-wide impact - including against administrators - elevates real-world risk significantly beyond what the 6.4 CVSS base score alone conveys.
Stored Cross-Site Scripting in the WPC Badge Management for WooCommerce WordPress plugin (all versions through 3.1.6) allows authenticated attackers with Contributor-level access to inject persistent JavaScript via the 'text' attribute of the wpcbm_best_seller shortcode. The injected payload executes silently in the browser of any visitor who loads an affected page, with scope change indicated by the CVSS S:C metric. No public exploit or CISA KEV listing is identified at time of analysis.
Out-of-bounds read in Apache Traffic Server's DNS answer parser (CWE-125) allows unauthenticated remote attackers - or adversaries capable of influencing DNS responses - to leak partial heap memory contents or crash the ATS process, affecting all three active release branches (8.x, 9.x, 10.x). The CVSS 6.5 Medium rating reflects no authentication barrier and no user interaction required, though impact is limited to partial confidentiality and availability loss with no integrity impact. No public exploit code and no CISA KEV listing are identified at time of analysis, but the network attack surface is broad given that every proxied request triggers DNS resolution.
Buffer overrun in the Apache Traffic Server multiplexer plugin's chunk-decode logic allows network-adjacent attackers who can influence upstream origin responses to cause denial of service across versions 8.0.0 through 10.1.3. The flaw is classified as CWE-787 (Out-of-bounds Write) and is constrained to availability impact only - no code execution or data exposure is indicated. No public exploit or CISA KEV listing has been identified, and the CVSS 3.7 Low score reflects meaningful real-world limitations, primarily the high attack complexity imposed by the upstream-input dependency.
HTTPS session reuse in Node.js 22.x, 24.x, and 26.x fails to bind identity checks to reused TLS sessions, enabling a low-privileged attacker with access to a shared HTTPS agent context to obtain confidential data across session boundaries. Rated CVSS 6.3 Medium with Scope:Changed and C:H, reflecting the cross-connection identity confusion impact even though the attack is gated behind AC:H and PR:L. No public exploit code and no CISA KEV listing have been identified at time of analysis.
HTTP/2 HPACK dynamic table desynchronization in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) exposes a premature-state-update flaw in header compression logic. An unauthenticated remote attacker can trigger an HPACK encode failure, leaving the server's encoder table out of sync with the peer decoder's table and corrupting all subsequent header blocks transmitted on that HTTP/2 connection. No public exploit has been identified at time of analysis; the AC:H rating indicates reliable triggering requires specific conditions, and CISA KEV does not list this vulnerability.
HTTP/2-to-HTTP/1 protocol conversion in Apache Traffic Server 10.0.0-10.1.3 forwards origin HTTP/2 trailers to downstream HTTP/1 clients without the required chunked transfer encoding framing, enabling HTTP response smuggling. The CVSS 8.3 Scope:Changed rating reflects that exploitation impacts downstream HTTP/1 clients architecturally separate from ATS itself, with potential for cache poisoning, response injection, and limited information disclosure. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Persistent session hijacking in Grav Login Plugin before 3.8.13 allows any attacker holding a captured Remember Me cookie to authenticate indefinitely, bypassing the configured session timeout. The root cause is a PHP type-comparison bug in TokenStorage.php's findTriplet() method: the expiry check compares an array value against a scalar timestamp, a comparison that always evaluates incorrectly in PHP, effectively nullifying the token lifetime enforcement. No active exploitation confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, but the flaw is straightforward to weaponize given a captured cookie.
Port-based access-control bypass in Apache Traffic Server stems from URL and userinfo mis-parsing that causes the proxy to evaluate ACL rules against an incorrect port value, allowing restricted backend ports to be reached. All three maintained release branches are affected - 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 - meaning the majority of deployed ATS instances are vulnerable. No public exploit or active exploitation has been identified at time of analysis, but the Changed scope (S:C) in the CVSS vector signals that successful exploitation crosses the proxy-to-backend boundary, amplifying real-world impact beyond the ATS process itself.
Improper TLS certificate validation in Apache Traffic Server (ATS) versions 9.0.0-9.2.14 and 10.0.0-10.1.3 allows multiplexed HTTP/2 origin connections to be reused for requests targeting hostnames not covered by the existing connection's server certificate. When ATS coalesces HTTP/2 connections to origin servers, it omits the check confirming the server certificate's Subject Alternative Names cover the new request's hostname, meaning traffic may be silently routed over a connection authenticated for a different host. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 9.2.15 and 10.1.4.
Out-of-bounds write buffer handling in the Node.js built-in zlib module (v26.x prior to v26.5.1) fails to throw an exception when a write buffer exceeds valid bounds, enabling a local denial-of-service via process crash or uncontrolled resource consumption. The Node.js security team rated this Medium severity (CVSS 6.2, AV:L) and shipped a fix in v26.5.1 on 2026-07-29 as part of a broader security release addressing ten CVEs. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored cross-site scripting in the Gridbox Joomla extension by balbooa.com allows attackers to inject persistent malicious scripts via the comment avatar field, affecting all releases from version 1.0.0 through 2.20.1. The payload is stored server-side and executes in the browsers of all subsequent visitors who load the affected page, with scope change enabling cross-origin impact such as session theft or UI manipulation. No public exploit code or active exploitation has been identified at time of analysis; the vendor released version 2.20.2 as the corrective fix.
Node.js Permission Model fails to enforce filesystem write restrictions for the trace events subsystem, allowing a local attacker with low privileges to write files to paths explicitly blocked by the operator via the --experimental-permission flag. Rated Low severity (CVSS 3.3), this flaw affects Node.js 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0, and is one of ten CVEs addressed in the July 2026 Node.js security release. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the fix is available in Node.js 26.5.1 released 2026-07-29.
Cross-site scripting vulnerabilities in RO CSVI's AJAX endpoint handlers allow unauthenticated remote attackers to inject malicious scripts into the browsers of Joomla site users. All versions from 1.0.0 up to (but not including) 9.11.0 are affected. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS scope-changed vector (S:C) and absence of authentication requirement make this an accessible attack for opportunistic threat actors targeting Joomla deployments running the extension.
Reflected or stored cross-site scripting in Sourcecodester Fantastic Blog CMS 1.0 allows network-accessible attackers to inject malicious scripts via the address field in pageEditMember.php, executing arbitrary JavaScript in a victim's browser session. The Changed scope (S:C) in the CVSS vector confirms the injected script escapes the page context and can affect the victim's broader browser environment, enabling session hijacking or credential theft. EPSS stands at 0.14% (4th percentile), and no CISA KEV listing exists, though exploit documentation is publicly available via the TaintRadar research repository on GitHub.
Cross-origin credential header leakage in linuxfabrik-lib prior to v6.0.0 exposes API tokens from authenticated monitoring requests to attacker-controlled redirect targets. The lib.url.fetch() function relied on httpx's default redirect behavior, which strips only Authorization and Cookie on cross-origin hops - leaving custom credential headers like X-Auth-Token and X-Api-Key forwarded verbatim to whatever host the redirect points to. This is particularly severe for Redfish/BMC monitoring workflows where X-Auth-Token grants privileged hardware management access. No public exploit has been identified at time of analysis, and active exploitation is not confirmed in CISA KEV.
Uncontrolled resource consumption in Node.js 26.x DNS module allows a network-positioned attacker to trigger a denial-of-service condition by delivering an oversized `resolveAny` DNS reply to an affected application. The vulnerability (CWE-400) was patched in Node.js v26.5.1 released 2026-07-29 as part of a broader security release addressing ten CVEs. No public exploit code and no CISA KEV listing have been identified; the CVSS AC:H metric reflects the prerequisite of controlling or spoofing DNS responses reaching the target process.
Symlink-following in Linuxfabrik monitoring-plugins 6.0.0 allows a local low-privileged user sharing the plugin account to overwrite or corrupt arbitrary root-owned files. The logfile check's legacy database migration resolved a predictable /tmp path via os.rename() without guarding against symlink substitution, and sqlite3.connect() would then follow the attacker-planted link during a root-executed check run. No public exploit has been identified, and exploitation is additionally constrained by the non-default kernel setting fs.protected_symlinks=0, meaningfully reducing real-world risk on hardened systems.
Path traversal in pip (CWE-36) allows a malicious package index to write downloaded wheel files to arbitrary filesystem locations outside the intended download directory. The root cause is pip's `Link.filename` property double-decoding percent-encoded URL path segments, letting an attacker embed encoded path separators that survive initial URL parsing but resolve during the second `urllib.parse.unquote()` call. Practical impact is most material for `pip download --only-binary` workflows pointed at untrusted indexes; no public exploit or active exploitation has been identified at time of analysis.
Certificate trust bypass in S2OPC versions 1.5.0 through 1.x (prior to 2.0.0) allows a remote attacker to have certificates signed by an expired root CA accepted as fully trusted due to missing validity period enforcement in the CycloneCrypto wrapper layer. The flaw affects OPC UA communications protected by this library, enabling potential interception or tampering of industrial protocol traffic. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Missing authorization in Keycloak's administrative API allows a scoped administrator to exceed their privilege boundary by linking identity providers to organizations they are not authorized to manage. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and related Red Hat products. An administrator who holds identity provider management permissions but lacks organization management rights can silently reconfigure authentication flows for organizations outside their administrative scope, potentially redirecting user logins through attacker-controlled providers. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.
Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read arbitrary files in the context of the service account, bypassing all authentication controls. The root cause is unsanitized user-supplied path input passed directly into file operations (CWE-22), making exploitation mechanically trivial for any attacker with network reach to the affected port. No public exploit code or active exploitation has been identified at time of analysis; the ZDI-CAN-28719 disclosure was handled through the Zero Day Initiative responsible disclosure program.
Out-of-bounds read in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView is triggered when parsing maliciously crafted DWG or DXF files, potentially resulting in application crash or memory disclosure. The attack requires a user to open a weaponized design file, making social engineering the primary delivery mechanism. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via Autodesk advisory ADSK-SA-2026-0009.
Sensitive information disclosure in GitLab EE's virtual registries feature allows low-privileged authenticated users to trigger improper forwarding of upstream requests, potentially exposing sensitive data - such as credentials or authentication headers - to unintended hosts. All GitLab EE versions from 18.8 through pre-19.2.1 are affected, with patched releases now available at 19.0.5, 19.1.3, and 19.2.1. No public exploit code has been identified and this vulnerability does not appear in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Open redirect in Dify's OAuth flow enables remote attackers to hijack post-authentication redirections, sending users to attacker-controlled sites that can harvest OAuth tokens or credentials. The flaw resides in the AppInitializer component's oauth_redirect_url handling, where the redirect destination is not validated against an allowlist. Exploitation requires user interaction - a target must follow a crafted link - but no authentication is required of the attacker, making phishing-based delivery straightforward. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to access shared multi-tenant S3 buckets and SQS queues, leading to sensitive data disclosure, content injection, and job manipulation. No public exploit or active exploitation has been identified at the time of analysis.
The built-in sqlite module in Node.js 26.x before v26.5.1 fails to invalidate tag store iterators when a prepared statement is reset, creating a TOCTOU window that a network-reachable, unauthenticated attacker (requiring user interaction) can abuse to achieve high integrity impact against the affected application. Fixed in Node.js v26.5.1 released 2026-07-29 by Matteo Collina. No public exploit code exists and no CISA KEV listing is present at time of analysis; however, the High integrity impact (I:H) in the CVSS vector warrants prompt patching for any application actively using the Node.js built-in sqlite module.
Missing authorization in MWDB Core versions 2.0.0 through 2.18.x allows any authenticated user to bypass capability-based access controls and upload malware configuration and text blob objects they are not permitted to add. The deprecated legacy endpoints `/config/<parent_dhash>` and `/blob/<parent_dhash>` silently accept an undocumented POST method that carries none of the `adding_configs` or `adding_blobs` capability checks enforced on the documented PUT method. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the low attack complexity and network accessibility make it a meaningful privilege-boundary bypass in any multi-user MWDB Core deployment. Vendor-released patch v2.19.0 resolves the issue.
Rate-limit bypass in @fastify/rate-limit before 11.2.0 lets IPv6-capable clients defeat request throttling by rotating source addresses across a controlled /64 range or by re-encoding the same address in different textual forms, because buckets are keyed on the verbatim request.ip string. Applications relying on this plugin to protect authentication, password-reset, OTP, or expensive API endpoints can be brute-forced or abused when trustProxy is enabled and IPv6 reaches the origin. No public exploit identified at time of analysis; the flaw is fixed in 11.2.0 via IPv6 canonicalization and a default /64 prefix mask.
Approval bypass in GitLab Enterprise Edition allows authenticated users to merge code into protected branches without satisfying required approval rules by exploiting a race condition in the approval rule processing pipeline. Affected deployments span GitLab EE versions 17.0 through 19.2, with fixed releases available at 19.0.5, 19.1.3, and 19.2.1. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the integrity risk is significant in regulated environments where protected branch approvals serve as a primary code integrity control.
The BGR decoder in ImageMagick prior to 7.1.2-27 fails to check for end-of-file at all necessary code paths, allowing remote unauthenticated attackers to trigger a heap buffer over-read via a crafted image file. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms network-exploitable, zero-prerequisite access with impact limited to partial memory disclosure. No active exploitation (CISA KEV) and no public POC have been identified at the time of analysis; a vendor-released patch is available in version 7.1.2-27.
IP-based security controls in applications using @fastify/forwarded before 3.0.2 can be bypassed by injecting a horizontal tab character into X-Forwarded-For header entries. The parser strips only space characters during whitespace normalization, violating RFC 7230's definition of optional whitespace (which includes both SP and HTAB), causing the resolved IP string to carry a trailing tab. Any application performing exact-string security decisions on the resolved address - allowlists, blocklists, per-IP rate limit keys, or audit log correlation - will silently fail to match the expected value, allowing an attacker to evade those controls. No public exploit has been identified at time of analysis, and no KEV listing exists; however, exploitation requires no authentication or special configuration beyond controlling HTTP request headers.
Payment bypass in Gridbox (Joomla extension by balbooa.com) versions 1.0.0 through 2.20.1 allows unauthenticated remote attackers to circumvent payment enforcement due to improper authorization checks (CWE-285), enabling acquisition of paid content or order completion without payment. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely exploitable with no authentication or user interaction required. No public exploit has been identified at time of analysis, though SSVC designates the attack as automatable with partial technical impact, raising concerns about systematic financial fraud at scale.
Unauthenticated file system disclosure in balbooa.com's Gridbox extension for Joomla (versions 1.0.0 through 2.20.1) exposes arbitrary server-side file paths to remote unauthenticated attackers via multiple vulnerable endpoints. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms zero-barrier network exploitation requiring no credentials, interaction, or special configuration. SSVC assesses exploitation as none at time of analysis and the attack as automatable with partial technical impact; EPSS at 0.14% (4th percentile) reflects currently low exploitation probability despite the accessible attack surface. No public exploit code or active exploitation (CISA KEV) has been identified.
Unauthenticated settings hijacking in the Klubraum Membership Request WordPress plugin (versions ≤1.1.0) allows any remote attacker to overwrite the plugin's Klubraum API token and configuration by invoking the unprotected `kr_mr_store_settings()` function. Substituting the API token with an attacker-controlled value effectively redirects club membership request data to an adversary's Klubraum account, constituting full service integration takeover. No public exploit or CISA KEV listing is identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this trivially exploitable against any reachable WordPress installation running the plugin.
Blind SQL injection in Quick.CMS 6.8 is exploitable by a high-privileged administrator through multiple fields in the administration panel, bypassing front-end validation controls and enabling potential database destruction. The vendor has explicitly declined to patch this issue, citing the administration panel's existing broad modification capabilities as context that limits the incremental risk. No public exploit code or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 5.1 reflects the high-privilege prerequisite that significantly constrains real-world impact.
Information disclosure via SQL injection in the WP Photo Album Plus plugin for WordPress allows authenticated administrator-level users to extract sensitive database content. All versions up to 9.2.04.002 are vulnerable due to insufficient escaping and lack of prepared statements on the 'table' parameter. The missing nonce check on the export-table endpoint also enables CSRF exploitation, reducing the practical barrier for data theft.
SQL Injection in WP-Lister Lite for eBay (WordPress plugin, all versions ≤ 3.8.8) allows authenticated attackers holding administrator-level credentials to append arbitrary SQL clauses via the unsanitized 'orderby' parameter, enabling exfiltration of sensitive data from the WordPress database. The flaw spans at least three distinct model/table classes - ProfilesModel.php, StocksLogTable.php, and EbayOrdersModel.php - indicating a systemic lack of input preparation rather than an isolated oversight. No public exploit code or CISA KEV listing has been identified at time of analysis; the high privilege requirement substantially constrains the realistic attacker population.
Full-read Server-Side Request Forgery in WP CTA - Call Now Button, Sticky Button & Call to Action Builder (WordPress plugin, versions through 2.1.2) allows authenticated WordPress administrators to direct the web server to fetch arbitrary internal or external URLs, with the full response content persisted as a WordPress media attachment and thus retrievable by the attacker. The root cause is the import_sidebars() function in inc/import-export.php passing the attacker-controlled sticky_s_media URL from an imported JSON file directly to PHP's file_get_contents(), relying solely on FILTER_VALIDATE_URL validation, which does not block RFC 1918 private address ranges or localhost. No public exploit identified at time of analysis; a patch commit exists in the plugin's WordPress.org SVN repository.
Terminal control sequence injection in diff-so-fancy exposes developers to output manipulation, filename spoofing, terminal screen clearing, and clipboard hijacking when viewing diffs containing attacker-controlled content. The application filters only ANSI SGR sequences while passing OSC, CSI, carriage returns, and other VT100 control characters through unsanitized to the terminal, affecting all versions prior to commit 9c81294. No public exploit is identified at time of analysis, but the low attack complexity (CVSS 4.0 AV:L/AC:L) means the primary barrier is only the requirement for a developer to actively view the malicious diff.
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a valid one-time password, bypassing the second authentication factor. This can lead to unauthorized access to administrator accounts if TOTP is enabled. No public exploit or active exploitation has been identified at time of analysis.
GNU Bison's grammar directive processing exposes an arbitrary file write path via the %output and %header directives, which accept filesystem paths without restriction and silently override caller-supplied output options. Any environment that processes attacker-supplied Bison grammar files - including CI/CD build pipelines and developer workstations - is at risk of having generated parser files written to attacker-chosen locations, potentially overwriting sensitive files accessible to the Bison process. Version 3.8.2 is confirmed vulnerable; no public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
HTTPS agent connection pooling in Node.js fails to distinguish PFX credentials when encoded as an object versus an array, enabling authentication bypass under specific mutual-TLS configurations. Affected are Node.js 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0. A high-privileged local actor who controls HTTPS agent configuration can induce the runtime to reuse a TLS session authenticated with one PFX credential for a request that should require a different (or no) credential, undermining certificate-based identity verification. No public exploit or CISA KEV listing has been identified at time of analysis.
Authorization bypass in OliveTin's synchronous action execution endpoints exposes full command log output to users holding exec permission but explicitly denied logs access. Versions prior to 3000.17.0 of this Go-based web shell interface are affected; the StartActionAndWait and StartActionByGetAndWait handlers return a complete LogEntry without invoking the isLogEntryAllowed ACL check that governs log visibility elsewhere in the application. No public exploit code exists and no CISA KEV listing is associated with this issue, placing real-world exploitation risk in context with the required authenticated access.
Information disclosure in GitLab Enterprise Edition's AI-assisted code review feature allows authenticated users to access data from projects they are not authorized to view. Affected versions are 19.1.x before 19.1.3 and 19.2.x before 19.2.1. An attacker with any level of authenticated access can craft malicious code content that, when processed by the AI review engine, causes the model to return information from unauthorized projects - a classic prompt injection boundary-crossing attack. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Improper authorization enforcement during token generation in GitLab Enterprise Edition allows an authenticated low-privilege user to bypass administrator-configured tool governance policies. Affected are all GitLab EE installations running 19.1 before 19.1.3 and 19.2 before 19.2.1. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the network-accessible, low-privilege attack vector makes this a realistic insider threat in enterprises relying on GitLab EE's governance controls.
Authenticated authorization bypass in Event Booking Manager for WooCommerce ≤5.3.7 allows contributor-level users to modify site‑wide WooCommerce payment settings - including enabling/disabling payments, altering cart redirects, login requirements, confirmation pages, and ticket statuses - undermining booking integrity and checkout flows. No active exploitation or public exploit is currently reported.
The Survey Form Block WordPress plugin up to and including version 1.0.1 lacks a capability check in its get_all_data() AJAX function, enabling authenticated users with minimal Subscriber roles to export entire survey submission datasets and column metadata without authorization. This data exposure vulnerability (CVSS 4.3) is patched by the vendor but has not been observed in active exploitation or public exploits.
Authentication bypass on the Autel MaxiCharger AC Elite Home EV charger allows physically present attackers to access device functionality without credentials via the exposed USB interface. The CWE-306 flaw represents a complete absence of authentication on the USB attack surface, not a weak implementation - any USB-connected party is immediately granted access. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; real-world risk is bounded by the physical access prerequisite inherent to the AV:P vector.
Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requiring legitimate assessment completion. An attacker with a valid student account can retrieve answers and compromise exam integrity.