Denial of service in Apache HttpComponents Client (versions 5.0-alpha1 through 5.6.2) arises when the classic/blocking I/O HttpClient fails to release the underlying connection back to the pool after receiving a response carrying an invalid or unsupported Content-Encoding header. An attacker who controls or can influence the server a client talks to can repeatedly return such headers to leak connections until the pool is exhausted, halting further outbound HTTP requests from the affected Java application. The async I/O HttpClient is explicitly unaffected; there is no public exploit identified at time of analysis and no CVSS or EPSS data was supplied.
pgAdmin 4 SERVER mode (versions 9.3 through 9.16) allows authenticated users to fully bypass administrator-configured per-tool role-based access controls by exploiting incomplete permission enforcement across backend routes and Socket.IO handlers. The Flask-Security `permissions_required` decorator was applied only to a single front-door route per tool, while all secondary routes and Socket.IO event handlers checked only authentication, not tool permissions - meaning a user who received a 403 on the initial gated endpoint could still drive the complete tool workflow through its other endpoints. Affected tools include Query Tool, Grant Wizard, Schema Diff, ERD, PSQL (interactive terminal), Debugger, Backup, Restore, Maintenance, and Import/Export. No dedicated public exploit has been identified, though the fix commits and GitHub issue are publicly visible; exploitation requires a valid authenticated pgAdmin session.
Checkmk's reporting module fails to enforce the 'Edit foreign Reports' permission, allowing any authenticated user - regardless of their assigned role - to modify reports belonging to other users. Affected are all Checkmk deployments running versions prior to 2.5.0p10, 2.4.0p35, or 2.3.0p49, as well as the end-of-life 2.2.0 branch. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is bounded to report integrity rather than system compromise, but the permission bypass undermines multi-tenant trust boundaries in shared monitoring environments.
Verbose API error responses in HCL iControl 4.3.0 and 4.4.0 leak internal endpoint names, request parameters, error codes, and authentication status directly to unauthenticated network clients. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network-accessible, unauthenticated exposure but with high attack complexity - specific error-triggering conditions must be crafted. No public exploit exists and this is not in CISA KEV; however, the disclosed metadata constitutes meaningful reconnaissance leverage that can lower the cost of subsequent targeted attacks against the platform.
HCL iControl versions 4.3.0 and 4.4.0 expose authentication-related sensitive data through browser autocomplete functionality on login forms, classified under CWE-522 (Insufficiently Protected Credentials). Valid usernames, email addresses used for login, and account identifiers can be surfaced by the browser's autocomplete engine to subsequent users on shared workstations or kiosk environments. No active exploitation has been identified at time of analysis, and the CVSS score of 3.7 accurately reflects a low-severity, opportunistic information disclosure issue rather than a remotely exploitable critical flaw.
Improper error handling in HCL iControl 4.3.0 and 4.4.0 exposes sensitive information through verbose error messages triggered by common fault conditions - out of memory events, null pointer exceptions, database unavailability, network timeouts, and system call failures. CWE-209 classifies this as generation of error messages containing sensitive information, meaning stack traces, internal paths, configuration data, or environment details may be disclosed to a network-accessible observer who can trigger or observe these fault states. CVSS scores this at 3.7 (Low), reflecting high attack complexity and limited confidentiality impact; no public exploit identified at time of analysis.
Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge gateways allows an authenticated attacker to overflow a fixed-size stack buffer in the device's file-upload functionality and execute arbitrary code on the controller. The flaw affects all versions listed in the CSA advisory (AL-2026-097) and, given the device's role in OT/SCADA data acquisition, a successful exploit yields full control of an industrial edge node. No public exploit has been identified at time of analysis, and high attack complexity plus a high-privilege requirement temper the network-facing CVSS 4.0 base score of 7.5.
Unauthenticated remote manipulation of user state is possible in StylemixThemes MasterStudy LMS WordPress plugin through version 3.7.39, due to insufficient verification of data authenticity (CWE-345). The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication or user interaction is required, allowing any network-accessible attacker to tamper with LMS user state - such as enrollment records, course progress, or quiz scores. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this straightforward to abuse against unpatched installations.
Reflected XSS in PHP Jabbers PHP Poll Script allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted URL. The vulnerability affects versions prior to 4.1 and was reported by CERT.pl. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has issued a fix in version 4.1.
Broken access control in Keycloak's RoleContainerResource component allows delegated administrators with manage-realm permissions to remove child roles from built-in admin roles via name-based endpoints in the admin REST API that skip proper authorization checks. Affected distributions include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat JBoss EAP Expansion Pack, and Red Hat Data Grid 8. An attacker exploiting this flaw can degrade or disrupt administrative functions within a realm by stripping essential role assignments from built-in admin roles, effectively undermining the role-based access control structure of the affected deployment. No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis.
Incomplete HTTP parameter pollution validation in Keycloak's keycloak-services component exposes OIDC authentication flows to session fixation and account confusion attacks. The security check inspects only the query string of redirect URLs while ignoring the URL fragment, enabling an attacker to inject duplicate security parameters when a client is configured with a wildcard redirect URI. No public exploit has been identified at time of analysis; the CVSS score of 3.4 (AC:H, UI:R) correctly reflects that exploitation requires both a permissive wildcard redirect URI configuration and a non-spec-compliant client application that trusts attacker-injected parameters over Keycloak-issued values.
SAML HTTP-Redirect binding in Keycloak allows network-based attackers to inject malicious parameters into authentication requests targeting clients configured with wildcard redirect URLs. When a victim user completes authentication, Keycloak appends its legitimate SAML response to the attacker-controlled URL parameters, which can cause susceptible service providers to process the attacker's data instead of the real login assertion - potentially resulting in the victim being logged into the wrong account. No public exploit is identified at time of analysis, and the CVSS score of 3.4 (Low) reflects the high attack complexity and limited integrity-only impact.
Buffer overflow in NTPsec's Zyfer refclock driver crashes the ntpd daemon on affected systems running versions prior to 1.2.5. A local, low-privileged attacker with high attack complexity can trigger the CWE-120 classic buffer overflow, resulting in a denial-of-service impact limited to availability - no confidentiality or integrity exposure exists. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
HCL iControl versions 4.3.0 and 4.4.0 expose a network-accessible integrity bypass to authenticated low-privileged attackers through a broken input validation mechanism. The implementation flaw in an architectural security tactic fails to enforce type conformance on received input, enabling an attacker to manipulate application logic and circumvent security controls. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, though the vendor-assigned 'Authentication Bypass' tag elevates operational concern beyond what the CVSS score alone suggests.
Sensitive data exposure in the WP Maps WordPress plugin (versions through 4.9.6) allows authenticated low-privilege users to retrieve embedded sensitive information - likely including API keys such as Google Maps API credentials - from data returned by the plugin. Exploitation requires a valid WordPress account with minimal permissions (CVSS PR:L), making it accessible to any registered user on an affected site. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible attack vector lowers the bar for opportunistic discovery.