Excessive Kubernetes RBAC privileges in the insights-client ServiceAccount within Red Hat Advanced Cluster Management for Kubernetes 2 expose all cluster Secrets to any attacker who compromises the pod or obtains its token. The ServiceAccount is bound to a ClusterRole granting cluster-wide get, list, and watch on all Secrets, far exceeding the single Secret the component actually requires. If the insights-client pod is breached, an attacker can read every Secret across the hub cluster - including managed-cluster kubeconfigs - enabling lateral movement to downstream managed clusters. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Secret exposure in Apache Airflow's Rendered Templates UI allows any authenticated user with task-level view access to read plaintext credential values that should have been masked. The secrets masker's `isinstance(str)` guard silently skips dict-typed Python objects, meaning JSON Variables accessed via `var.json` and containing dict payloads (e.g., database credentials, API keys stored as structured JSON) are rendered in cleartext rather than redacted. No public exploit is identified at time of analysis; however, the disclosure requires nothing more than standard UI navigation by a legitimately authenticated user.
Unauthenticated path traversal in SP Page Builder (Joomla extension by joomshaper.com) versions prior to 6.8.0 permits remote attackers to create arbitrary directories and write files with predefined names on the underlying server filesystem without any credentials. The CWE-22 root cause indicates the extension fails to sanitize user-supplied path segments before constructing filesystem paths. No public exploit code exists and no active exploitation has been confirmed at time of analysis, though the unauthenticated network vector with no user interaction requirement makes this accessible to opportunistic attackers.
Incomplete Zsh special-character escaping in Shescape allows unauthenticated attackers who control input strings to bypass sanitization and trigger home directory expansion or glob pattern matching, leaking file and directory paths from the host system. Affected are npm/shescape versions below 2.1.14 (v2 branch) and 3.0.0-3.0.0 inclusive (v3 branch) on Unix systems where Zsh is the configured or default shell using the escape or escapeAll methods. No public exploit identified at time of analysis, though the GitHub security advisory GHSA-6v4m-fw66-8r4x includes functional proof-of-concept code; KEV listing is absent.
Incomplete tilde-escaping in Shescape's Dash shell mode allows attacker-controlled input to bypass sanitization and trigger home-directory expansion. Shescape versions prior to 2.1.14 (v2 branch) and 3.0.1 (v3 branch) on Unix systems fail to escape `~` when it follows `:` or `=`, characters that Dash recognizes as tilde-expansion triggers in assignment contexts. An attacker supplying values such as `:~` can disclose the server process's home-directory path and potentially redirect the filesystem location on which the downstream command operates. No public exploit identified at time of analysis, though a functional proof-of-concept is documented in the vendor's security advisory GHSA-q53c-4prm-w95q.
Unauthenticated comment creation in SP Page Builder for Joomla (versions prior to 6.8.0) allows remote attackers to bypass the disabled guest commenting restriction by supplying crafted user input that overrides the server-side access control setting. The vulnerability stems from improper access control (CWE-284), where a client-influenced parameter can override a site administrator's explicit configuration decision to disable public commenting. No public exploit or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 6.3 reflects limited integrity impact with no confidentiality or availability consequence.
SQL parameter injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to bypass security restrictions by submitting specially crafted SQL input that is not properly neutralized before processing. The CWE-78 (OS Command Injection) classification combined with the SQL-parameter attack surface suggests that malicious input may propagate beyond the SQL layer to OS-level command execution, though the exact propagation path is not fully detailed in available data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
MongoDB Atlas SQL ODBC Driver and Schema Builder CLI fail to validate URI schemes in authorization and token endpoints returned by an OIDC issuer's discovery document, allowing an attacker-controlled MongoDB deployment to dispatch arbitrary URIs to a victim's operating system protocol handler. Users employing MONGODB-OIDC authentication who are induced to connect to a rogue or compromised MongoDB deployment may have OIDC credentials exposed or, under conditions where a dangerous OS protocol handler is registered, experience code execution within their user session context. No public exploit has been identified at time of analysis, and exploitation carries meaningful social engineering prerequisites that constrain real-world reach despite the network-accessible attack vector.
XML External Entity (XXE) injection in UYAP Document Editor versions 4.5.17 through 5.4.17 allows a local attacker to exfiltrate sensitive file system contents by tricking a user into opening a specially crafted document. The vulnerability enables serialized data external linking via uncontrolled XML external entity resolution, resulting in high confidentiality impact with scope change to the underlying operating system. Reported by TR-CERT; no public exploit code or CISA KEV listing identified at time of analysis.
Privilege escalation in LuminalShine prior to version 26.05.0-rc4 stems from a latent file permission gap where `apps.json`, written by the SYSTEM service to `C:\ProgramData\LuminalShine\config\`, could be overwritten by local users if directory ACLs deviate from Windows defaults. On a default Windows installation this EoP path does not trigger because `BUILTIN\Users` inherits only Read+Execute rights from `C:\ProgramData`; the vulnerability is only exploitable when an administrator has loosened those inherited permissions. No public exploit code has been identified and no active exploitation is confirmed.
OS command injection in PDF::WebKit for Perl (versions through 1.2) allows arbitrary command execution under the process UID when untrusted input is forwarded as an output path or stylesheet path to `to_pdf`, `to_file`, or `_style_tag_for`. The root cause is Perl's 2-arg `open()` combined with the diamond operator, which interprets pipe-flanked strings (`| cmd` or `cmd |`) as shell commands and redirect-prefixed strings (`> path`) as file write operations rather than filenames. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but the technique exploits well-documented Perl behavior making reproduction trivial for any developer familiar with the language.
Stored cross-site scripting in Vulnerability-Lookup's render_tag_badges Jinja filter allows an authenticated user holding the vulnerability:create or vulnerability:modify permission to persist arbitrary JavaScript in public vulnerability record pages by submitting crafted reference tags via the CNA API. The flaw stems from markupsafe.Markup being applied to attacker-controlled tag values before HTML escaping, effectively suppressing Jinja's automatic sanitization and causing the payload to execute in any visitor's browser - including unauthenticated users - upon page load. No public exploit has been identified at time of analysis beyond the functional XSS payload embedded in the fix's test suite; a patch is available as upstream commit d29901655c50cf3c25737d9ea86180268df51b57.
Object Lock COMPLIANCE retention enforcement in RustFS fails open when bucket metadata is absent, unreadable, or corrupt - treating any metadata error as 'no lock configured' rather than blocking the operation. All RustFS versions prior to 1.0.0-rc.1 are affected, exposing COMPLIANCE-retained objects to unauthorized deletion via explicit delete calls, delete_prefix operations, and automated lifecycle or scanner sweeps. No public exploit or CISA KEV listing exists at time of analysis; the risk is primarily to organizations relying on COMPLIANCE-mode immutability for regulatory or legal-hold data retention obligations.
Reflected cross-site scripting in ScadaLTS 2.7.8.1 enables an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that causes the application to echo unsanitized user-supplied input into an HTML response. Because SCADA operators - the likely victims - typically hold privileged authenticated sessions controlling industrial processes, successful exploitation could lead to session token theft, credential harvesting, or unauthorized commands issued through the victim's browser context. No public exploit code and no CISA KEV listing are identified at time of analysis, but the SCADA operational environment elevates the realistic impact of even a medium CVSS score.
Cross-site scripting in Apache Allura's Markdown rendering (versions 1.10.0 up to but not including 1.19.1) allows an attacker to inject script-related HTML into content that other users view, executing arbitrary JavaScript in their browsers. Because Allura is a collaborative forge where users routinely post Markdown in tickets, wiki pages, and comments, the payload is most likely stored and delivered to victims who open the affected page. No public exploit identified at time of analysis, and there is no CISA KEV listing or POC signal; the Apache PMC has released version 1.19.1 as the fix.
Cross-site scripting (XSS) in Apache Allura's code-display feature allows an attacker who can place crafted content into a rendered code view to execute arbitrary JavaScript in the browser of any user who views that code, in all versions before 1.19.1. Because Allura is forge/project-hosting software, a successful attack can hijack the sessions of project members or administrators. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-site request forgery protection bypass in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows unauthenticated remote attackers to execute monitoring commands with the privileges of authenticated users by exploiting a flawed double-submit cookie implementation. The CSRF defense can be entirely circumvented by supplying self-crafted, matching cookie and request parameter values - no server-validated token is required - enabling command execution via maliciously crafted links sent to authenticated administrators. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the low attack complexity and broad target population make this a meaningful risk for any externally reachable Nagios deployment.
Out-of-bounds read in GStreamer's avidemux plugin (gst-plugins-good) allows a remote, unauthenticated attacker to crash media-processing applications and potentially leak memory contents by supplying a crafted AVI file. The flaw resides in gst_avi_demux_riff_parse_vprp(), where the count of video field descriptors is derived by dividing remaining buffer size by an attacker-controlled vprp->fields value rather than the struct size, causing the parser to treat more descriptors as valid than the buffer holds. User interaction is required to trigger the bug (the victim must open or stream the malicious AVI via playbin or decodebin), and the primary confirmed impact is denial of service; limited information disclosure is also possible. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote authenticated users can crash applications built on Amazon aws-sdk-cpp versions before 1.11.862 by supplying crafted Base64-encoded input that triggers an out-of-bounds read in the SDK's Base64 decoder. Exploitation is constrained to authenticated users, requires high attack complexity, and is platform-specific - not all deployments are vulnerable. The CVSS 4.0 vector (VA:H, VC:N, VI:N) confirms impact is limited to availability (denial of service); no public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
SPIFFE identity impersonation in Kong Mesh universal mode allows an authenticated dataplane operator to assume another workload's mTLS identity by exploiting an incomplete workload-binding enforcement in the XDS authenticator. The kuma-cp authenticator validates the kuma.io/workload label only when a dataplane token is explicitly bound to a workload; because workload binding is optional, a tags-only-bound token can register any kuma.io/workload label value and receive the corresponding SPIFFE ID, bypassing MeshIdentity-enforced access controls. No public exploit has been identified at time of analysis; vendor-confirmed patches are available via upstream Kuma PRs.
Out-of-bounds write in the Base64 decoder of Amazon's aws-sdk-cpp (all versions before 1.11.862) exposes applications to heap memory corruption or crash when processing attacker-supplied Base64-encoded content. Remote authenticated attackers can trigger the defect by submitting crafted input to any application built on this SDK that routes user-controlled data through the affected decoder path. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, though the CWE-787 heap write class carries inherent tail risk beyond the denial-of-service primary impact.
Unauthorized artifact access in JFrog Artifactory allows unauthenticated network attackers to retrieve restricted artifacts under specific, high-complexity conditions. The flaw stems from a missing authorization check (CWE-862) that can be triggered without credentials, directly exposing confidential build artifacts, proprietary binaries, or sensitive packages stored in the repository. No public exploit code or active exploitation has been identified at time of analysis, and the high attack complexity requirement (AC:H) limits opportunistic mass exploitation.
SQL injection in Winter CMS Backend Filter widget (versions <= 1.2.12) allows authenticated backend users to read arbitrary database contents by submitting crafted AJAX requests to the `numberrange` filter scope handler. Exploitation requires a third-party plugin to have registered a `numberrange` filter scope with the `conditions` configuration key - no built-in Winter CMS views use this combination, making vanilla installations unexploitable. The fix is confirmed in v1.2.13 via GitHub Advisory GHSA-m7jc-g4rc-jmvh; no public exploit code or active exploitation has been identified at time of analysis.
Credential interception in Red Hat Multicluster Engine for Kubernetes (MCE) exposes newly rotated provider credentials through an authorization bypass in the provider-credential-controller component. An attacker with specific hub cluster permissions and prior knowledge of a credential value can manipulate `copiedFrom` labels to hijack the credential rotation process, gaining unauthorized read access to sensitive credentials scoped across managed clusters. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the high confidentiality impact and cross-cluster scope change make this a meaningful risk in mixed-trust MCE deployments.
TLS certificate verification bypass in Kong Mesh's kuma-dp data plane component exposes authentication tokens to on-path interception in Universal mode deployments lacking explicit CA certificate configuration. An adjacent attacker who can position themselves between the data plane and control plane can intercept the dataplane authentication token, impersonate the control plane, inject a forged bootstrap configuration, and fully take over the Envoy proxy. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the high subsequent-system impact (SC:H/SI:H/SA:H in CVSS 4.0) underscores the severity for affected Universal mode deployments. Vendor-confirmed patches are available across four release branches.
Docker Sandboxes (sbx) fails to enforce read-only semantics on virtio-fs host mounts: the in-guest bind correctly receives the read-only flag, but the underlying host-edge grant omitted from the policy-share allowlist carries no access mode, leaving the shared-export path fully writable at the host level. Low-privileged code executing inside the sandbox can enumerate or derive the virtio-fs export path and write to host directories the operator explicitly attached as read-only, breaking the isolation guarantee that is the product's core security promise. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
IBM Db2 on Linux, UNIX, and Windows exposes cleartext database passwords by writing them into diagnostic trace files, affecting versions 11.5.0-11.5.9 and 12.1.0-12.1.5, including DB2 Connect Server. Any low-privilege local OS user with read access to the Db2 trace directory can harvest plaintext credentials without requiring database-level authentication or elevated system rights. IBM has released a patch; no active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Use-After-Free vulnerabilities in the GNU linker (ld) component of binutils crash the linker process when processing crafted object or archive files during LTO-enabled linking on Red Hat Enterprise Linux systems. The flaws exist at three distinct dereference points in add_archive_element() in ld/ldmain.c, where plugin_maybe_claim() frees the BFD object but the caller retains dangling pointers that are subsequently accessed. The attack surface is confined to build-time environments, with the primary realistic threat being a supply chain attack introducing a malicious object file into CI/CD pipelines or developer build systems; no public exploit code or active exploitation has been confirmed at time of analysis.
The Autodesk Installer IPC frame parser fails to properly validate attacker-controlled position and offset fields (CWE-1285), allowing a locally authenticated low-privileged user to trigger an out-of-range substring operation that crashes the NT AUTHORITY\SYSTEM service. Affected scope covers all tracked versions per the wildcard CPE string, and Autodesk has confirmed and patched the issue via advisory ADSK-SA-2026-0013. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
TLS certificate verification is silently disabled in the kumactl CLI (Kong Mesh / Kuma) when an operator registers an HTTPS control plane profile without specifying a CA certificate via --ca-cert-file, causing API tokens to traverse the connection without server identity validation. A network-adjacent attacker capable of intercepting traffic between the operator's workstation and the control plane can steal user or administrator API tokens and subsequently issue arbitrary authenticated commands against the control plane. No active exploitation confirmed (not in CISA KEV) and no public exploit code has been identified; patch versions are confirmed by the vendor advisory GHSA-v95x-xhq5-4929.
Unsafe deserialization in Apache Airflow's XCom REST API allows an authenticated user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the API server by smuggling reserved serialization keys inside JSON string literals. The `_check_forbidden_xcom_keys` guard inspected `dict`, `list`, and `tuple` types but did not attempt to JSON-decode `str` values, so a payload like `json.dumps({"__classname__": "airflow.sdk.definitions.connection.Connection"})` passed the write-time check and was later reconstructed into a live Python object when read back via `?deserialize=true`. No public exploit has been identified at time of analysis; vendor-released patch is available in apache-airflow 3.3.1.
Cross-site scripting in IBM i 7.3 through 7.6 allows a remote authenticated attacker to inject and execute arbitrary JavaScript in the browser context of another user by exploiting improper neutralization of user-controlled input in a web interface component. The CVSS Scope:Changed (S:C) metric confirms the XSS payload escapes the IBM i application and executes in the victim's browser, enabling session hijacking, credential theft, or unauthorized page manipulation. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a remediation via vendor advisory.
Cross-team credential access in Apache Airflow before 3.3.1 allows authenticated members of one team to invoke another team's Connection credentials through the POST /api/v2/connections/test API endpoint, exploiting a broken namespace-isolation guard in the environment-variable secrets backend. The flaw-confirmed by Apache with patches in PRs #70736 and #70902-combines a guard that only triggered on unscoped (global) requests with a regex incapable of matching team names containing underscores, even though underscores are explicitly permitted in Airflow team name validation. Exploitation requires a precise configuration alignment of multi_team mode, an explicitly enabled test_connection endpoint, and environment-variable-provisioned team secrets; no public exploit has been identified at time of analysis.
Authorization bypass in RustFS FTPS MKD handler allows authenticated FTPS users to create S3 buckets in violation of enforced IAM-style policies. All RustFS releases prior to 1.0.0-beta.12 are affected via the `FtpsDriver::mkd` function in `crates/protocols/src/ftps/driver.rs`, which calls `storage.create_bucket` without invoking `authorize_operation` for `S3Action::CreateBucket`. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Stored cross-site scripting in IBM i versions 7.3 through 7.6 allows an authenticated low-privileged user to inject persistent JavaScript into the Web UI, executing it in other users' browser sessions within the same trusted environment. The Scope:Changed CVSS metric confirms the payload crosses session boundaries, enabling credential theft or session hijacking against other authenticated users. IBM has released a patch via advisory node/7283292; no public exploit code or active exploitation has been identified at time of analysis.
Insufficient session expiration in JFrog Artifactory (all versions per CPE wildcard) permits an attacker who holds valid credentials for a recently deleted user account to continue authenticating for a brief window after account removal. Classified under CWE-613, the flaw arises from credential invalidation logic that does not immediately propagate account deletion state under specific triggering conditions, leaving a short-lived but exploitable gap. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, but the network-accessible vector means any party with knowledge of the deleted account's credentials could attempt opportunistic access during this window.
Denial-of-service risk in Fortinet FortiOS across five major version branches (6.4.x through 7.6.6) stems from unbounded resource allocation (CWE-770), allowing unauthenticated remote attackers to degrade availability of affected network appliances. The CVSS temporal metric E:P confirms proof-of-concept exploit code exists, and an official patch is available per Fortinet PSIRT advisory FG-IR-26-162. No active exploitation is confirmed in CISA KEV at time of analysis, but the broad version coverage and perimeter-facing nature of FortiOS appliances elevate practical risk.
SQL LIKE wildcard injection in phpMyFAQ's chat user search endpoint (GET /api/chat/users?q=) allows any authenticated user to bypass the intended display-name filter and enumerate all active user accounts. The vulnerability exists because the Chat::searchUsers() method applies database escape() to prevent SQL string breakout but omits escaping of the LIKE metacharacters % and _, which the database engine still interprets as wildcards. A PoC is publicly available demonstrating full user enumeration via q=%25%25 and q=__; no KEV listing exists at time of analysis.
Authentication bypass in JFrog Artifactory exposes protected repository resources to unauthenticated remote users when specific cache conditions are met. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network position - any user who can reach the Artifactory instance over the network can potentially trigger this condition. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis, but the unauthenticated network attack vector elevates real-world concern for internet-facing deployments.
Unauthenticated access control bypass in Fortinet FortiWeb - spanning the 7.0 line through 8.0.2 - and multiple FortiOS branches stems from an incomplete list of disallowed inputs (CWE-184), allowing remote attackers to circumvent input-filtering enforcement and achieve unauthorized integrity modifications. The vulnerability extends to FortiOS, implicating shared blocklist logic across Fortinet's platform stack according to EUVD-2026-57192 and CPE data. Publicly available exploit code exists (CVSS temporal E:P), an official fix has been released (RL:O/RC:C), and no active exploitation has been confirmed in the CISA KEV catalog at time of analysis.
Path traversal in JFrog Artifactory exposes arbitrary repository content to low-privileged users holding the cache-deploy permission under specific, unspecified triggering conditions. An authenticated repository reader with cache-deploy rights can read artifacts outside the configured upstream path boundary, potentially accessing sensitive build artifacts, credentials embedded in packages, or proprietary code across repository namespaces they should not reach. No public exploit code exists and no CISA KEV listing is present, but the CVSS confidentiality impact is rated High, making this significant in multi-tenant or shared Artifactory deployments.
Inconsistent authorization enforcement in Vulnerability-Lookup's SSE streaming interface allows self-registered but unconfirmed or inactive accounts to subscribe to Pub/Sub event streams, accessing pre-moderation data that the REST API correctly restricts. The platform's self-registration flow issues an API key before account confirmation is complete, and the token_required decorator on /pubsub/subscribe/<topic> validated only that the key matched a known user - not that the account was active or confirmed. No public exploit has been identified at time of analysis, and a vendor-released patch correcting the authorization gap is confirmed available via upstream commit.
Unauthenticated exposure of Envoy admin data in kuma-dp (Kong Mesh data plane) allows any pod on the Kubernetes cluster network to retrieve internal service mesh configuration without credentials. The readiness service on TCP port 9902, bound to all interfaces, acted as an unprotected reverse proxy forwarding nearly all Envoy admin read endpoints - including config dumps, cluster and listener lists, stats, and the mesh trust bundle - to any adjacent network caller. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is bounded by the adjacent network prerequisite, but the risk is elevated in multi-tenant clusters where untrusted pods share the pod network.
Denial-of-service in Kong Mesh's kuma-cp control plane allows unauthenticated network-adjacent attackers to crash the entire control plane process by submitting a JWT token whose kid header is a JSON number instead of a string. Because the Go runtime panics on the unchecked type assertion before any signature, claims, or authorization logic executes, the crash takes down kuma-cp's HTTP API, health and readiness endpoints, and xDS simultaneously. No public exploit has been identified at time of analysis, but the attack is trivially reproducible from the PR diff; sustained availability loss requires repeated requests since the process will restart.
Unauthorized repository information disclosure in JFrog Artifactory allows unauthenticated remote users to read restricted repository content under specific deployment conditions. Rooted in CWE-862 (Missing Authorization), the flaw bypasses access controls without credentials, confirmed by a PR:N/AV:N CVSS vector. No public exploit code and no CISA KEV listing exist at time of analysis, and the 'specific conditions' qualifier in the vendor's own description limits the realistic attack surface compared to the raw CVSS score suggests.
Object version metadata exposure in RustFS allows anonymous HTTP clients to enumerate all stored object versions via GET /<bucket>?versions= even after an operator enables RestrictPublicBuckets. The authorization fallback in rustfs/src/storage/access.rs grants listing through an s3:ListBucket check but returns before applying the public-access block controls, silently contradicting the operator's intent to restrict anonymous access. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor-released fix is available in 1.0.0-beta.12.
Unauthorized read access to restricted JFrog Artifactory content is possible when a credentialed remote repository is configured in a specific non-default manner, triggering a missing authorization check (CWE-862). The flaw affects all Artifactory versions per the CPE wildcard, exposing proprietary artifacts such as internal libraries, Docker images, or build dependencies to network-accessible requests without credential validation. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the high confidentiality impact (C:H in CVSS) means successful exploitation results in full read exposure of the targeted restricted repository.
IBM i versions 7.3 through 7.6 expose sensitive information to remote authenticated attackers via a race condition (CWE-362). The flaw allows a low-privileged network-authenticated user to read data outside their authorization boundary during a timing window in an undisclosed subsystem. Vendor-released patch is available; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Insecure Direct Object Reference (IDOR) in CERT/CC's VINCE coordination platform allows an authenticated vendor admin to manipulate or read notification configuration for contacts belonging to other vendors. The ModifyEmailNotifications view in vinny/views.py resolves a VinceCommEmail record by raw primary key supplied in the URL without verifying that the targeted record belongs to the requesting admin's own vendor group, enabling unauthorized cross-tenant read and write of email routing settings. No public exploit has been identified and EPSS is negligible (0.15%), but the flaw undermines the trust isolation between vendor tenants in a vulnerability coordination context.
Improper origin validation in the TP-Link TL-WR820N V2 router's web management interface allows adjacent unauthenticated attackers to extract device configuration details and sensitive information by sending HTTP requests with an absent or empty Referer header. The router relies on the HTTP Referer header as a request legitimacy check, but fails to enforce its presence or value consistently, allowing the validation to be trivially bypassed. No public exploit or active exploitation has been identified at time of analysis, though the attack requires only network adjacency and no credentials.