Unauthenticated information disclosure in DHL Shipping Germany for WooCommerce (versions before 4.0.1) exposes stored shipping labels - each containing customer name and postal address - to any visitor who can request predictable filenames from the label storage directory. The plugin relies exclusively on an Apache .htaccess file for directory access control, which nginx and other non-Apache web servers silently ignore, leaving the directory fully browsable over the network. A publicly available exploit exists (via WPScan), though EPSS of 0.14% at the 4th percentile indicates low observed exploitation activity, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in GeoDirectory WordPress plugin before 2.8.110 allows authenticated editors and higher-privileged users to persist malicious JavaScript via the place-category setting, which is rendered unsanitized on admin pages. The vulnerability is specifically significant in WordPress multisite deployments where the unfiltered_html capability is intentionally revoked for editors, as it bypasses that restriction through the plugin's own inadequate output handling. A public proof-of-concept exists via WPScan, though EPSS at 0.16% (6th percentile) and SSVC exploitation status of 'none' indicate no confirmed active exploitation at time of analysis.
Insecure Direct Object Reference (IDOR) in the MultiVendorX WordPress plugin before 5.0.11 exposes confidential financial and commission data across vendor accounts. Any authenticated vendor-level user can query a REST API endpoint using an arbitrary store identifier to retrieve another vendor's earnings and commission records, bypassing per-store ownership validation entirely. No active exploitation is confirmed in CISA KEV, but a publicly available exploit exists per WPScan, and the low EPSS score (0.14%, 4th percentile) suggests limited opportunistic scanning activity at this time.
Path traversal in InnoShop versions 0.8.0 through 0.8.2 allows remotely authenticated low-privilege users to delete arbitrary files on the server via the FileManagerController::destroyFiles function exposed through the panel REST API. The affected PHP e-commerce platform by yushine has no vendor-released patch - the vendor did not respond to responsible disclosure - and a public proof-of-concept exploit is available on GitHub. The CVSS 4.0 score of 2.1 reflects limited per-request impact (low integrity, low availability, no confidentiality loss), but the unpatched status combined with public exploit code elevates operational urgency for any deployment.
Path traversal in yeqifu warehouse (all commits up to aaf29962ba407d22d991781de28796ee7b4670e4) enables authenticated remote attackers to read arbitrary files outside the intended web root by supplying directory-traversal sequences in the `path` argument handled by FileController.java. The exploit has been publicly disclosed and proof-of-concept code is available via VulDB and an external Notion document, raising the urgency despite a moderate CVSS 4.0 score of 5.3. No vendor patch exists - the vendor did not respond to coordinated disclosure - leaving all deployments of this Java-based warehouse management application unmitigated.
Reflected cross-site scripting in ttttonyhe OBlog's /tags.php endpoint allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers by manipulating the unsanitized `day` parameter. All installations up to commit 3ca6a45a2fcc81f6086751d8af124658720e8f8f are confirmed affected under CPE cpe:2.3:a:ttttonyhe:oblog:*:*:*:*:*:*:*:*. A public proof-of-concept is available on GitHub Gist, and no patch has been issued - the vendor was unresponsive to coordinated disclosure.
Unrestricted file upload in imranrisal-dev's Student-Management-System (PHP) permits authenticated remote attackers to upload arbitrary file types through the storeProfileImage function in student_profile_pic.php by manipulating the choose_file argument. In a PHP application where uploaded files are served under the web root, this class of flaw (CWE-434) directly enables webshell deployment and full server-side remote code execution. A proof-of-concept exploit has been publicly disclosed on GitHub; the vendor did not respond to responsible disclosure, and no patch exists given the project's rolling-release model with no versioned releases.
SQL injection in lavkush-maurya Student-Registration-System 1.0 allows authenticated remote attackers to manipulate backend database queries via the unsanitized `oldpass` parameter in `/student/changepass.php`, potentially exposing or modifying student records. A proof-of-concept exploit has been publicly disclosed on GitHub, making exploitation trivial for any holder of a low-privileged student account. No vendor patch exists - the maintainer did not respond to coordinated disclosure - leaving all deployments of this version permanently unmitigated absent manual intervention.
Server-side request forgery in Rhymix CMS up to version 2.1.33 enables authenticated administrators to direct the server to fetch arbitrary internal or external URLs via the Data Import Module. The vulnerable entry point is the `procImporterAdminCheckXmlFile` function, where the `filename` argument is passed to server-side request logic without adequate validation, per CWE-918. Publicly available exploit code exists on GitHub (MCzhao2006/Rhymix-SSRF-Report), and this vulnerability is not currently listed in CISA KEV; EPSS data was not provided in source intelligence.
SQL injection in the ZTE Smart Life mobile app enables a local attacker with physical device access to execute UNION SELECT statements against the app's feedback.db SQLite database, extracting sensitive personal data including user account details, phone numbers, feedback content, and local debug log paths. Exploitation is severely constrained by the CVSS:3.1/AV:P/AC:H/PR:L/UI:R vector, requiring physical access to the device, a low-privilege authenticated session within the app, user interaction, and non-trivial attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, and the vendor (ZTE PSIRT) has published a bulletin acknowledging the issue.
Out-of-bounds memory read in Electron's offscreen rendering pipeline allows a compromised GPU process to cause the browser/main process to read beyond a shared memory mapping boundary when producing `paint` event images, disclosing process memory or crashing the application. Exploitation requires two independent preconditions: the host application must enable `webPreferences.offscreen` (non-default) and an attacker must have already achieved code execution in the GPU process via a separate vulnerability. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Improper TLS hostname verification in IBM Business Automation Workflow exposes high-privilege sessions to man-in-the-middle interception by failing to validate that server certificates match the target hostname. Affected deployments span both containerized (Kubernetes/OpenShift) and traditional on-premises models across multiple release trains from 24.0.0 through 26.0.0. No public exploit has been identified and the vulnerability is not listed in CISA KEV; real-world risk is substantially bounded by the PR:H requirement - an attacker must already hold administrative credentials before exploitation is feasible.
CVE-2026-70437 is part of the Jenkins project's August 5, 2026 security advisory (jenkins.io/security/advisory/2026-08-05/), which addressed vulnerabilities across Jenkins core and at least ten plugins. The specific description for CVE-2026-70437 was not included in the provided data excerpt - the source text enumerates CVE-2026-70426 through CVE-2026-70435 before truncating. Based on sequential CVE assignment within this advisory, CVE-2026-70437 likely maps to one of the plugin fixes not yet accounted for: External Workspace Manager Plugin 1.4.2, SCM-Manager Plugin 1.12.1, or Webhook Secret Credentials Provider Plugin 32.v09c9b_522f0a_8, or to an unresolved issue in one of the eleven plugins named without fixes.
Cross-origin iframe autofill popup positioning in Electron allows a malicious iframe to render the native autofill popup outside its own bounds, overlapping the embedding application's trusted UI and enabling clickjacking or UI spoofing attacks. Affected are only Electron applications that deliberately embed untrusted cross-origin iframes within windows that also present trusted native UI - apps without such patterns are explicitly not at risk. No public exploit code has been identified at time of analysis, and the vendor-confirmed CVSS score of 3.1 (Low) reflects the high attack complexity and constrained impact, though the nature of the spoofing risk makes it qualitatively more dangerous than the score alone suggests for vulnerable app architectures.
Unrestricted object instantiation in Jenkins 2.575 and earlier (LTS 2.568.1 and earlier) allows users holding Overall/Manage permission to instantiate arbitrary Java types through the project naming strategy configuration, including configuration objects intended exclusively for full administrators. This effectively breaks the permission boundary between Overall/Manage holders and full system administrators, enabling privilege escalation within the Jenkins controller. No public exploit has been identified at time of analysis, but fixed releases (Jenkins 2.576 and LTS 2.568.2) are available and should be applied promptly.
AES-GCM nonce exhaustion in Kong Event Gateway 1.0.0-1.1.1 and 1.2.0 allows an authorized consumer to recover partial message plaintext when the AWS IAM encryption feature is enabled and key rotation has not occurred. Because keys are only rotated on gateway reboot, a producer sustaining a high message rate can exhaust the NIST SP 800-38D-recommended random nonce limit (~2^32 encryptions), making nonce collisions statistically likely and enabling ciphertext XOR attacks. No public exploit exists and the vulnerability is not in CISA KEV; the CVSS 4.0 score of 2.3 reflects the narrow, condition-heavy exploitation path.
Integer underflow in the popt command-line option parsing library can crash any application that links against it when help text is rendered under specific terminal-width conditions. Affects local, low-privileged users on systems running popt-linked applications - a broad attack surface given popt's presence across Red Hat-derived Linux distributions. Impact is strictly denial of service against the affected application; no confidentiality or integrity loss is possible. No public exploit code or active exploitation has been identified at time of analysis.