Improper access control in the Easy Appointments WordPress plugin through version 3.12.26 allows any contributor-level WordPress user to delete the site's booking configuration and functionally disable the appointment system. The vulnerable action handler performs neither a WordPress capability check nor nonce validation, meaning any authenticated user at or above contributor role can trigger the deletion without administrative approval. A publicly available exploit exists per WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation; no CISA KEV listing is present.
Broken access control in the Easy Appointments WordPress plugin through version 3.12.26 permits any contributor-level authenticated user to perform privileged appointment-management actions - including reading all customer booking details and creating, modifying, or deleting appointments - without holding the required capabilities. The plugin relies exclusively on WordPress nonce verification as its authorization gate for these AJAX actions, but nonces are available to all authenticated users regardless of role and do not encode privilege level. A publicly available exploit exists per WPScan; no vendor patch has been identified at time of analysis.
Bit Form WordPress plugin before version 3.1.2 fails to enforce form deactivation state on its public submission handlers, enabling unauthenticated network-accessible attackers to submit data to forms the site owner has intentionally disabled and trigger any configured backend workflows such as email notifications. The vulnerability carries a low CVSS score of 3.7 with AC:H, reflecting that exploitation requires knowledge of a specific deactivated form's endpoint, and real-world impact is limited to low integrity effects - spurious entries and unwanted workflow executions rather than data exfiltration or system compromise. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.15% (5th percentile) indicates exploitation has not meaningfully materialized across the wild.
Easy Appointments WordPress plugin through version 3.12.26 exposes all stored customer personal information to any authenticated contributor-level user due to missing per-request capability and nonce validation on a customer-listing handler. Any user holding a contributor role - a low-privilege WordPress role normally limited to drafting posts - can invoke the unprotected endpoint and enumerate the full customer dataset. A publicly available proof-of-concept exists per WPScan, though EPSS places exploitation probability at 0.16% (5th percentile) and the flaw has not been listed in CISA KEV, suggesting limited observed exploitation.
Cross-buffer memory aliasing in msgpack-ruby prior to 1.8.2 allows same-process code to read or corrupt data belonging to a separate MessagePack::Buffer instance via a use-after-free in the rmem slab allocator. MessagePack::Buffer#clear returns a 4 KiB rmem page to the shared pool but leaves rmem_last, rmem_end, and rmem_owner pointing into the freed page; a subsequent write on the cleared buffer and a concurrent second Buffer allocation can claim the same physical page, creating a memory alias that exposes the second buffer's serialized bytes. A PoC is included in the vendor advisory (GHSA-4mrv-5p47-p938); no public exploit identified at time of analysis beyond that PoC, and the CVE is not in CISA KEV.
Insufficient audit logging in VMware ESX and related Broadcom virtualization platforms allows a malicious administrator to perform certain privileged operations without generating corresponding log entries. Affected products span the VMware ecosystem including Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud Platform. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the insider-threat and post-compromise forensic evasion implications are meaningful for organizations relying on audit logs for compliance and incident response.
Cross-origin data leakage in Google Chrome on Linux (prior to 151.0.7922.72) stems from an inappropriate implementation in the browser's Editing subsystem, enabling a remote attacker to exfiltrate limited cross-origin information when a victim interacts with a crafted HTML page. The CVSS vector (PR:L/UI:R) confirms exploitation requires both some authenticated context and active victim interaction, materially reducing opportunistic risk. No public exploit has been identified and EPSS sits at the 7th percentile, consistent with the vendor's own 'Low' severity classification.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) allows a local attacker to read clipboard contents belonging to a different browsing origin by luring a victim to a crafted HTML page. The flaw arises from insufficient input validation in Chrome's Clipboard component on Android, classified under CWE-20. No public exploit code exists and no active exploitation has been confirmed; EPSS of 0.13% at the 3rd percentile reflects a minimal real-world exploitation probability at this time.
Cross-origin data leakage in Google Chrome on Android prior to 151.0.7922.72 enables a local attacker to read data from a different origin by directing a victim user to a crafted HTML page. The flaw stems from an inappropriate browser implementation (CWE-346 Origin Validation Error), undermining the Same-Origin Policy's isolation guarantees on the Android platform. No public exploit code exists and no active exploitation has been observed; SSVC assessment confirms exploitation status as none, making this a low-urgency but noteworthy information-disclosure defect.
Omnibox spoofing in Google Chrome for Android prior to 151.0.7922.72 allows a local attacker to display falsified URLs in the browser's address bar by delivering a malicious file to the target device. The flaw stems from insufficient validation of untrusted input in the Mobile component, classified under CWE-20. With EPSS at 0.11% (2nd percentile) and no CISA KEV listing, real-world exploitation risk is low, though successful exploitation could undermine user trust in the displayed URL and facilitate phishing on compromised or shared devices.
Spring Tools language server exposes proxy Basic-auth credentials in cleartext log files, affecting Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode/Cursor/Theia 2.2.0 and earlier. When no explicit http.proxy workspace setting is configured, the language server reads the HTTP_PROXY/HTTPS_PROXY (and lowercase variants) environment variables and writes their raw values-including embedded credentials in the form http://user:pass@proxy:8080-to its log at INFO level without redaction. Because language server logs are often shared in bug reports or are readable by other local users and processes, this results in proxy credential disclosure. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
Cross-origin data leakage in Google Chrome's Passwords feature prior to version 151.0.7922.72 allows a remote attacker to read cross-origin data by convincing a victim to perform specific UI gestures on a crafted HTML page. Rated High severity by the Chromium security team - higher than the NVD CVSS base score of 3.1 suggests - reflecting the sensitivity of credential-adjacent cross-origin boundary violations. No public exploit identified at time of analysis, and SSVC assessment confirms no current exploitation activity.
Cross-origin data leakage in Google Chrome's Skia graphics library (all versions prior to 151.0.7922.72) enables a remote attacker who has already achieved renderer process compromise to exfiltrate cross-origin data via a crafted HTML page. The flaw is a CWE-346 Origin Validation Error within Skia's rendering pipeline and is constrained to an information-disclosure impact with no integrity or availability consequence. No public exploit or CISA KEV listing exists, and EPSS at 0.29% (21st percentile) alongside SSVC Exploitation: none signal this is a low-probability exploitation scenario requiring a multi-stage attack chain.
Cross-origin data leakage in Google Chrome for iOS (versions prior to 151.0.7922.72) allows remote attackers to read cross-origin data by delivering a crafted HTML page that socially engineers the victim into performing specific UI gestures. The root cause is an inappropriate implementation classified under CWE-346 (Origin Validation Error), meaning Chrome's iOS-specific code fails to correctly enforce same-origin policy boundaries under particular interaction sequences. No active exploitation has been confirmed - CISA KEV status is absent, SSVC exploitation rating is 'none', and EPSS sits at 0.21% (11th percentile) - placing this firmly in the low-priority tier despite its network delivery vector.
Cross-origin data leakage in Google Chrome's SVG implementation (all versions prior to 151.0.7922.72) enables remote attackers to read data from cross-origin resources by luring a victim to a crafted HTML page. The flaw, rooted in an origin validation error (CWE-346) in Chrome's SVG rendering engine, breaks same-origin policy protections. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to exfiltrate password data across origin boundaries via a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346: Origin Validation Error), meaning the browser's same-origin policy is not correctly applied within the Passwords subsystem when the renderer is already under attacker control. No public exploit code exists and no confirmed active exploitation has been observed; EPSS sits at 0.21% (11th percentile), and SSVC rates exploitation as none with non-automatable impact, making this a low-urgency but architecturally significant renderer sandbox concern.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the USB component, exploitable only after the attacker has already compromised the renderer process. Exploitation requires luring a victim to a crafted HTML page in a pre-compromised renderer context, making this a secondary-stage vulnerability in a chained attack rather than a standalone threat. EPSS sits at 0.19% (9th percentile), SSVC records no exploitation activity, and the vulnerability is not listed in CISA KEV - consistent with its low severity rating and demanding prerequisite.
Cross-origin data leakage in Google Chrome on Android (prior to 151.0.7922.72) results from an inappropriate UI implementation that allows a remote attacker to extract data from a different web origin when a user is socially engineered into performing specific UI gestures on a crafted HTML page. Rated CVSS 3.1 (Low) with EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none,' this vulnerability presents minimal immediate operational risk. No public exploit code exists and the issue is not listed in CISA KEV; a vendor-released patch is available in the stable channel update.
Cross-origin data leakage in Google Chrome's CORS implementation enables a post-exploitation information disclosure step for attackers who have already compromised the renderer process. All Chrome versions prior to 151.0.7922.72 are affected, with exploitation requiring both a pre-existing renderer compromise and user interaction with a crafted HTML page. No public exploit code exists and no CISA KEV listing; EPSS at 0.17% (7th percentile) and SSVC Exploitation: none confirm this is a low-priority, chained-attack-only vulnerability in practice.
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) exposes password-related data to attackers who have already compromised the renderer process and can deliver a crafted HTML page. The flaw stems from an inappropriate implementation that fails to enforce proper origin validation within the Passwords subsystem, making it a second-stage element in a chained attack rather than a standalone threat. No public exploit has been identified, EPSS is 0.16% (6th percentile), SSVC records no known exploitation, and Chromium internally rates this Low severity - consistent with the high prerequisite bar of prior renderer compromise.
Chrome for iOS prior to 151.0.7922.72 exposes potentially sensitive process memory contents to an attacker with physical access to the device through an inappropriate implementation flaw. The vulnerability is classified CWE-200 (Information Disclosure) and is iOS-platform-specific, not affecting Chrome on other operating systems. No public exploit code exists and CISA SSVC confirms no active exploitation, placing this firmly in the low-urgency tier despite requiring prompt patching for high-assurance mobile environments.
SFTPGo versions prior to 2.7.4 expose a permission bypass allowing authenticated users holding the create_symlinks permission to circumvent per-directory access controls by creating symbolic links that bridge permitted and restricted directories. Authorization is evaluated against the symlink's parent directory rather than the dereferenced target, so read and write operations succeed against paths the user should not be able to reach. No public exploit or CISA KEV listing has been identified; the CVSS 4.0 score of 2.3 reflects the combined effect of high attack complexity and low privilege requirements.