Server-Side Request Forgery in Pentestify's PDF export pipeline allows authenticated users to induce the server-side headless browser to issue outbound HTTP GET requests to arbitrary attacker-specified destinations by storing remote URLs in the finding images field or the report client_logo field. All Pentestify installations prior to version 1.1.0 are affected (CPE: cpe:2.3:a:ccyl13:pentestify). No active exploitation has been confirmed (not in CISA KEV, no public POC identified), but the vulnerability enables internal network reconnaissance and cloud metadata endpoint access from the Pentestify server's network context, posing meaningful risk in cloud-hosted or internally-networked deployments.
Denial of service in Apache HttpComponents Client (versions 5.0-alpha1 through 5.6.2) arises when the classic/blocking I/O HttpClient fails to release the underlying connection back to the pool after receiving a response carrying an invalid or unsupported Content-Encoding header. An attacker who controls or can influence the server a client talks to can repeatedly return such headers to leak connections until the pool is exhausted, halting further outbound HTTP requests from the affected Java application. The async I/O HttpClient is explicitly unaffected; there is no public exploit identified at time of analysis and no CVSS or EPSS data was supplied.
pgAdmin 4 SERVER mode (versions 9.3 through 9.16) allows authenticated users to fully bypass administrator-configured per-tool role-based access controls by exploiting incomplete permission enforcement across backend routes and Socket.IO handlers. The Flask-Security `permissions_required` decorator was applied only to a single front-door route per tool, while all secondary routes and Socket.IO event handlers checked only authentication, not tool permissions - meaning a user who received a 403 on the initial gated endpoint could still drive the complete tool workflow through its other endpoints. Affected tools include Query Tool, Grant Wizard, Schema Diff, ERD, PSQL (interactive terminal), Debugger, Backup, Restore, Maintenance, and Import/Export. No dedicated public exploit has been identified, though the fix commits and GitHub issue are publicly visible; exploitation requires a valid authenticated pgAdmin session.
Checkmk's reporting module fails to enforce the 'Edit foreign Reports' permission, allowing any authenticated user - regardless of their assigned role - to modify reports belonging to other users. Affected are all Checkmk deployments running versions prior to 2.5.0p10, 2.4.0p35, or 2.3.0p49, as well as the end-of-life 2.2.0 branch. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is bounded to report integrity rather than system compromise, but the permission bypass undermines multi-tenant trust boundaries in shared monitoring environments.
Verbose API error responses in HCL iControl 4.3.0 and 4.4.0 leak internal endpoint names, request parameters, error codes, and authentication status directly to unauthenticated network clients. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network-accessible, unauthenticated exposure but with high attack complexity - specific error-triggering conditions must be crafted. No public exploit exists and this is not in CISA KEV; however, the disclosed metadata constitutes meaningful reconnaissance leverage that can lower the cost of subsequent targeted attacks against the platform.
HCL iControl versions 4.3.0 and 4.4.0 expose authentication-related sensitive data through browser autocomplete functionality on login forms, classified under CWE-522 (Insufficiently Protected Credentials). Valid usernames, email addresses used for login, and account identifiers can be surfaced by the browser's autocomplete engine to subsequent users on shared workstations or kiosk environments. No active exploitation has been identified at time of analysis, and the CVSS score of 3.7 accurately reflects a low-severity, opportunistic information disclosure issue rather than a remotely exploitable critical flaw.
Improper error handling in HCL iControl 4.3.0 and 4.4.0 exposes sensitive information through verbose error messages triggered by common fault conditions - out of memory events, null pointer exceptions, database unavailability, network timeouts, and system call failures. CWE-209 classifies this as generation of error messages containing sensitive information, meaning stack traces, internal paths, configuration data, or environment details may be disclosed to a network-accessible observer who can trigger or observe these fault states. CVSS scores this at 3.7 (Low), reflecting high attack complexity and limited confidentiality impact; no public exploit identified at time of analysis.
Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge gateways allows an authenticated attacker to overflow a fixed-size stack buffer in the device's file-upload functionality and execute arbitrary code on the controller. The flaw affects all versions listed in the CSA advisory (AL-2026-097) and, given the device's role in OT/SCADA data acquisition, a successful exploit yields full control of an industrial edge node. No public exploit has been identified at time of analysis, and high attack complexity plus a high-privilege requirement temper the network-facing CVSS 4.0 base score of 7.5.
Unauthenticated remote manipulation of user state is possible in StylemixThemes MasterStudy LMS WordPress plugin through version 3.7.39, due to insufficient verification of data authenticity (CWE-345). The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication or user interaction is required, allowing any network-accessible attacker to tamper with LMS user state - such as enrollment records, course progress, or quiz scores. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this straightforward to abuse against unpatched installations.
Reflected XSS in PHP Jabbers PHP Poll Script allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted URL. The vulnerability affects versions prior to 4.1 and was reported by CERT.pl. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has issued a fix in version 4.1.
Broken access control in Keycloak's RoleContainerResource component allows delegated administrators with manage-realm permissions to remove child roles from built-in admin roles via name-based endpoints in the admin REST API that skip proper authorization checks. Affected distributions include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat JBoss EAP Expansion Pack, and Red Hat Data Grid 8. An attacker exploiting this flaw can degrade or disrupt administrative functions within a realm by stripping essential role assignments from built-in admin roles, effectively undermining the role-based access control structure of the affected deployment. No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis.
Incomplete HTTP parameter pollution validation in Keycloak's keycloak-services component exposes OIDC authentication flows to session fixation and account confusion attacks. The security check inspects only the query string of redirect URLs while ignoring the URL fragment, enabling an attacker to inject duplicate security parameters when a client is configured with a wildcard redirect URI. No public exploit has been identified at time of analysis; the CVSS score of 3.4 (AC:H, UI:R) correctly reflects that exploitation requires both a permissive wildcard redirect URI configuration and a non-spec-compliant client application that trusts attacker-injected parameters over Keycloak-issued values.
SAML HTTP-Redirect binding in Keycloak allows network-based attackers to inject malicious parameters into authentication requests targeting clients configured with wildcard redirect URLs. When a victim user completes authentication, Keycloak appends its legitimate SAML response to the attacker-controlled URL parameters, which can cause susceptible service providers to process the attacker's data instead of the real login assertion - potentially resulting in the victim being logged into the wrong account. No public exploit is identified at time of analysis, and the CVSS score of 3.4 (Low) reflects the high attack complexity and limited integrity-only impact.
Buffer overflow in NTPsec's Zyfer refclock driver crashes the ntpd daemon on affected systems running versions prior to 1.2.5. A local, low-privileged attacker with high attack complexity can trigger the CWE-120 classic buffer overflow, resulting in a denial-of-service impact limited to availability - no confidentiality or integrity exposure exists. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
HCL iControl versions 4.3.0 and 4.4.0 expose a network-accessible integrity bypass to authenticated low-privileged attackers through a broken input validation mechanism. The implementation flaw in an architectural security tactic fails to enforce type conformance on received input, enabling an attacker to manipulate application logic and circumvent security controls. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, though the vendor-assigned 'Authentication Bypass' tag elevates operational concern beyond what the CVSS score alone suggests.
Sensitive data exposure in the WP Maps WordPress plugin (versions through 4.9.6) allows authenticated low-privilege users to retrieve embedded sensitive information - likely including API keys such as Google Maps API credentials - from data returned by the plugin. Exploitation requires a valid WordPress account with minimal permissions (CVSS PR:L), making it accessible to any registered user on an affected site. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible attack vector lowers the bar for opportunistic discovery.
Wildcard domain validation in Keycloak's keycloak-services component can be bypassed by an attacker who controls their connection's reverse DNS, enabling unauthorized client registration or modification against a Keycloak realm. The flaw stems from the system accepting any hostname that merely ends with the configured domain suffix (e.g., 'attackerexample.com' satisfying a '*.example.com' restriction) rather than enforcing true subdomain membership. Exploitation requires high attack complexity due to the reverse DNS control prerequisite, and no public exploit or CISA KEV listing has been identified at the time of analysis.
HCL iControl versions 4.3.0 and 4.4.0 expose internal configuration files to local access due to improper web server or application hardening, classified under CWE-497 (Exposure of Sensitive System Information). Local actors without any privileges can read configuration data that should be restricted, potentially revealing sensitive system details usable for follow-on attacks. No public exploit or active exploitation has been identified at time of analysis, and the CVSS score of 4.0 (Medium) reflects the limited local attack surface.
HCL iControl versions 4.3.0 and 4.4.0 publicly expose internal configuration files due to inadequate web server or application hardening, mapping to CWE-15 (External Control of System or Configuration Setting). The misconfiguration allows attackers to retrieve sensitive configuration data that may contain credentials, internal paths, service endpoints, or other operational details usable for further lateral movement or privilege escalation. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at the time of analysis.
Cross-job file read in Contao CMS 5.7.0-5.7.6 allows authenticated backend users to exfiltrate job attachments belonging to other jobs by injecting path traversal sequences into the attachment identifier parameter. The job attachment download controller authorizes only the jobUuid route parameter, then constructs the actual file path by joining that authorized UUID with the attacker-supplied identifier; Contao's VirtualFilesystem::resolve() canonicalizes the combined path but rejects only escapes from the filesystem mount, not cross-job traversals within the mount. No public exploit has been identified at time of analysis, and the CVSS 3.1 Low score of 3.1 reflects meaningful exploitation barriers: backend authentication and prior knowledge of a victim job UUID are both required.
Server-Side Request Forgery in Contao CMS's Feed Reader front-end module enables authenticated backend users to pivot the web server against internal network resources, cloud metadata endpoints, or loopback services. Affected are Contao 5.3.35-5.3.47 and 5.7.0-RC1-5.7.8; exploitation requires a backend account with module-edit permissions. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; risk is primarily relevant to multi-tenant or SaaS Contao deployments where untrusted backend users exist.
sigstore-go versions up to and including 1.2.0 accept Sigstore bundles signed with expired long-lived public keys because the verifier omits the timestamp-validity check when using `ExpiringKey`-wrapped verifiers. An attacker who obtains expired signing key material can produce bundles that pass verification despite the key's configured expiry window, undermining supply chain integrity guarantees enforced by key rotation policies. This affects only the self-managed long-lived key workflow - standard Sigstore deployments using Fulcio certificate authorities are explicitly unaffected. No public exploit identified at time of analysis.
Contao CMS's crawler leaks HTTP authentication credentials to external hosts due to an option-name mismatch in its credential-scrubbing logic, affecting versions 4.13.40-5.3.46 and 5.7.0-RC1-5.7.6. The cleaner is coded to remove the non-existent keys `basic_auth` and `bearer_auth` rather than Symfony HttpClient's actual `auth_basic` and `auth_bearer` options, so credentials configured in `contao.crawl.default_http_client_options` are silently passed through to external domains. An attacker who can place an external link on any page crawled by Contao's broken-link checker can receive those credentials on an attacker-controlled server. No public exploit or CISA KEV listing exists at time of analysis.
Open redirect in Serendipity's exit.php allows unauthenticated attackers to craft URLs on a legitimate blog domain that silently forward victims to arbitrary attacker-controlled sites. All Serendipity installations prior to version 2.6.1 are affected, but only when the Track Exits plugin is active and configured with commentredirection set to "s9y" - a non-default, explicit setting. No public exploit code and no CISA KEV listing exist at time of analysis; the CVSS 4.0 score of 2.1 reflects limited direct technical impact, though the phishing, malware-delivery, and URL-reputation-bypass potential represents meaningful real-world risk for organizations where blog domain credibility matters.
CRLF injection in ufirstgroup's ymlr Elixir YAML library (versions 0.0.1 through < 5.1.6) allows an attacker who controls comment strings passed to any Ymlr document function to inject arbitrary content into the generated YAML output by embedding newline characters. Because ymlr emits each comment as '# {string}\n' without inspecting the string for embedded line breaks, anything after the first newline exits comment context and is written as raw YAML body content, enabling forged mapping keys, value overrides, and document-boundary markers. Every document-encoding entry point - document!/2, document/2, documents!/2, and documents/2 - shares the same vulnerable code path. No confirmed active exploitation or public exploit code exists at time of analysis; the CVSS 4.0 score of 2.1 reflects the constrained preconditions required.