Reflected cross-site scripting in Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser of an authenticated victim. The injection point is the NagFormId parameter in cmd.cgi, which is insufficiently sanitized before being reflected in server responses. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and zero-privilege requirement for the attacker make phishing-style delivery straightforward against administrators of these monitoring platforms.
Server-side request forgery in Vulnerability-Lookup's remote-instance synchronization feature enables an authenticated administrator holding the admin:access permission to pivot HTTP requests through the application server's network context. By registering a remote instance whose address resolves to a loopback, private, link-local, or cloud metadata endpoint - or by using a public URL that redirects to such a destination - the attacker causes the background sync worker to issue HTTP GET requests from the server's own network position, potentially exposing internal services or cloud instance metadata credentials. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; a patch is available as an upstream commit from CIRCL.
Kong Mesh's control plane (kuma-cp) exposes the admin bootstrap token and JWT signing keys to any malicious webpage visited by an operator while the control plane is browser-reachable, due to two compounding default misconfigurations. The default CORS wildcard (`CorsAllowedDomains: [".*"]`) reflects any attacker-controlled `Origin` header, and the default `LocalhostIsAdmin: true` promotes loopback-sourced browser requests to `mesh-system:admin` without credential validation - a cross-origin `fetch()` from an attacker page is sufficient to receive full administrative credentials. This affects kuma-cp versions prior to 2.7.25, 2.9.15, 2.11.13, and 2.12.10; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored XSS in Craft CMS's control panel allows a low-privilege author to execute arbitrary JavaScript in an administrator's authenticated session by injecting a malicious payload into a draft name, which is rendered without HTML encoding in element chips and cards. All Craft CMS installations running versions 5.0.0-RC1 through 5.10.8 (exclusive) are affected. An attacker who can create element drafts can harvest the administrator's CSRF token and issue privileged control-panel actions - including creating new administrator accounts - without the victim taking any action beyond routine browsing of element indexes or relation fields. No public exploit identified at time of analysis, though the vendor's GHSA advisory verified the account-creation impact end-to-end.
Cross-site request forgery in Astro 7.0.0-7.0.5 allows unauthenticated network attackers to trigger state-mutating Actions and on-demand page endpoints using a victim's session cookies when the composable `astro/hono` pipeline is configured with `actions()` or `pages()` mounted without a preceding `middleware()` call. The default non-composable `astro()` pipeline is entirely unaffected; only deployments following the vulnerable pipeline composition pattern - which was demonstrated in the official `examples/advanced-routing` example and Cloudflare Hono documentation - are exposed. The attack is blind write-only: the attacker can mutate server state but cannot read the cross-origin response body. No public exploit or CISA KEV listing exists at time of analysis; the issue is fixed in Astro 7.0.6.
DOM-based cross-site scripting in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows an authenticated low-privileged attacker to execute arbitrary JavaScript in the browser of any user who views pages rendered by the vulnerable jsonquery.js component. The flaw is stored rather than reflected, meaning injected payloads persist server-side and activate without requiring a victim to follow a crafted link. No CISA KEV listing and no public exploit code have been identified at time of analysis; the vendor has released patches for both product lines.
Remote authenticated exploitation of a race condition in IBM i 7.3 through 7.6 allows attackers with low-privilege credentials to obtain sensitive information and bypass platform security restrictions. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates the flaw is reachable over the network without user interaction, though authentication is required. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via its support portal.
Stored cross-site scripting in Ultimate POS (Stock Management & Point of Sale) version 7.2 and earlier enables low-privileged authenticated attackers to compromise higher-privileged user sessions by injecting script payloads into the first-name field at account creation time. When the attacker submits a leave request through the HRM/Leave module, the unsanitized first-name payload is rendered in the leave-application notification pane of any administrator or manager who views it, executing within the admin browser origin and enabling session theft or unauthorized administrative actions. A researcher-published proof-of-concept is publicly available; no CISA KEV listing has been confirmed at time of analysis.
SVG href attribute bypass in Loofah prior to 2.25.2 allows a crafted sanitized SVG to reference arbitrary same-origin external documents, defeating the HTML5 sanitizer's local-reference restriction. Applications accepting user-supplied SVG content and rendering it to other users are directly affected: SVG use elements can load and render same-origin external SVG containing scripts, while feImage elements can silently fetch external images for tracking. No public exploit or CISA KEV listing exists at time of analysis, but the bypass technique is straightforward and publicly disclosed via the GHSA advisory and PR diff.
CryptoPro Secure Disk for BitLocker versions before v7.7.4 leaks TPM2.0 unsealing secrets by persisting them in a serialized binary format within unused disk sectors - raw storage areas that survive reboots and are accessible without operating system authentication. An unauthenticated attacker with physical access to the drive can image these sectors, extract the serialized secrets, and reconstruct a compatible TPM environment to unseal the BitLocker volume, effectively defeating the hardware-backed disk encryption the product is designed to enforce. No public exploit code has been identified at time of analysis; CISA SSVC rates exploitation as 'none', but the attack's low complexity once physical access is obtained was detailed publicly in a Black Hat USA 2026 research presentation, materially lowering the skill barrier for motivated actors.
Path traversal in IBM i 7.3 through 7.6 enables remote authenticated attackers to read sensitive files outside authorized directory boundaries by supplying crafted path strings that the platform fails to properly validate (CWE-22). Impact is limited to confidentiality - no integrity or availability exposure - and exploitation requires prior authentication. A vendor-released patch is available via IBM's support portal, and no public exploit code has been identified at time of analysis.
Parameter injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to append unexpected parameters to system commands, with a vendor-confirmed availability impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) places this at Medium severity, requiring only valid credentials and network access with no user interaction. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Sensitive values stored as deeply nested lists, tuples, or sets in Apache Airflow Variables are displayed unmasked in the Variables UI due to a recursion-depth logic error in the secrets masker. This is an incomplete-fix follow-up to CVE-2026-42358: that prior fix made dictionary traversal unbounded but left list/tuple/set structures subject to the depth cutoff, allowing values beyond that depth to appear in plaintext on screen. The practical impact is narrow - any authenticated user who can see the Variable in the UI already has read access to the full value through the Variables REST API - making this a shoulder-surfing defense gap rather than an access-control bypass. No public exploit has been identified at time of analysis.
Path traversal in JFrog Artifactory permits authenticated low-privilege users to write files outside the intended working directory under specific conditions. Reported directly by JFrog, this CWE-22 flaw carries a CVSS 3.1 score of 4.3 (Medium), reflecting network reachability with limited integrity impact and no confidentiality or availability exposure. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Improper authorization in IBM i versions 7.3 through 7.6 allows remote authenticated attackers to bypass security restrictions and perform unauthorized write operations on protected objects or data. The flaw, rooted in CWE-285, requires only low-privilege credentials and no user interaction, making it accessible to any authenticated user on the platform. IBM has released patches via their support advisory, and no active exploitation or public proof-of-concept has been identified at time of analysis.
SQL injection in IBM i 7.3 through 7.6 enables remote authenticated attackers to modify data in certain SQL tables by injecting malicious SQL commands through improperly neutralized input. The CVSS score of 4.3 (Medium) reflects a constrained impact profile - integrity in specific tables is at risk, but confidentiality and availability are unaffected. A vendor patch is available via IBM's support portal, and no public exploit code has been identified at time of analysis.
Security restriction bypass in IBM i 7.3 through 7.6 exploits an interpretation conflict in the multipart parser, enabling a remote attacker with high administrative privileges to circumvent configured access controls with low integrity impact. The flaw (CWE-436) arises when the security enforcement layer and the processing layer disagree on how to interpret multipart message boundaries, allowing carefully crafted requests to evade security checks. No public exploit code and no CISA KEV listing have been identified at time of analysis; IBM has released a patch via its support portal.
Authorization bypass in LXD (Canonical) allows authenticated project members to circumvent container privilege isolation restrictions enforced at the project level. When a project is configured with `restricted.containers.privilege=isolated`, LXD's enforcement logic fails to apply the restriction if an instance is created or updated without explicitly setting the `security.idmap.isolated` key - effectively treating omission as permission. No public exploit code or CISA KEV listing exists at time of analysis, but the bypass is exploitable by any authenticated LXD user with instance-creation rights in a restricted project.
Improper authorization checks on a GitLab Enterprise Edition group settings page allow any authenticated user to view restricted configuration settings they should not have access to. GitLab EE versions from 17.7 through 19.0.5, 19.1.0 through 19.1.3, and 19.2.0 through 19.2.1 are affected; patched releases (19.0.6, 19.1.4, 19.2.2) are available. No public exploit code and no confirmed active exploitation exist at time of analysis.
Package metadata authorization bypass in JFrog Artifactory 7.161.0 through 7.161.15 allows authenticated low-privileged users to read package metadata from repositories they are explicitly denied read access to, under specific undisclosed conditions. The flaw is a missing authorization check (CWE-862) in the metadata access path, creating an unintended privilege boundary crossing within Artifactory's permission model. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit code has been identified, but the network-accessible attack vector with no user interaction required makes this relevant for any multi-tenant or externally accessible Artifactory deployment.
JFrog Artifactory exposes private Puppet module metadata to authenticated users who lack repository read access, constituting a missing authorization control on a specific metadata retrieval endpoint. Any low-privilege user with a valid Artifactory account can silently enumerate Puppet module metadata from repositories they are explicitly denied access to, potentially revealing module names, versions, dependencies, and authorship details. No public exploit code has been identified at time of analysis, and this vulnerability has not been listed in the CISA KEV catalog, though the CVSS 4.3 score reflects a real, network-exploitable authorization bypass with limited but concrete confidentiality impact.
Unauthorized NuGet metadata exposure in JFrog Artifactory allows an authenticated user who lacks repository read permission to read private NuGet feed metadata under specific conditions, constituting a missing authorization control (CWE-862). All versions covered by the CPE wildcard (cpe:2.3:a:jfrog:artifactory:*) appear affected. An attacker with any valid Artifactory account can potentially enumerate or read package metadata from private NuGet repositories they should not have visibility into, leading to information disclosure of internal package names, versions, or dependency structures. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Insufficient authorization in JFrog Artifactory allows an authenticated user lacking repository read permissions to access private OCI referrer metadata under specific conditions. The flaw maps to CWE-862 (Missing Authorization), meaning the access control check for OCI referrer metadata is absent or bypassed rather than misconfigured. No public exploit or active exploitation has been identified at time of analysis, but the information disclosure could expose artifact relationship graphs and supply chain metadata that organizations intend to keep private.
Log injection in IBM i Navigator (versions 7.3 through 7.6) permits remote authenticated attackers to write arbitrary content into Navigator log files by exploiting improper output neutralization for logs (CWE-117). An attacker with low-privilege credentials can forge, corrupt, or spoof log entries, undermining audit trails and potentially masking malicious activity. IBM has released a patch via advisory node 7283292, and no public exploit code has been identified at time of analysis.
Incorrect authorization (CWE-863) in JFrog Artifactory allows an authenticated bundle writer to generate misleading release promotion metadata under specific operating conditions, undermining the integrity of the software release pipeline. Affected scope spans all Artifactory versions per the wildcard CPE string, impacting both self-managed and potentially cloud deployments where the bundle writer role is in use. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog, though the supply-chain integrity risk in production DevSecOps pipelines may exceed the moderate CVSS score.
Improper authorization in WhatsUp Gold's Scheduled Reports API allows any authenticated user to invoke actions that should be restricted to privileged roles. Affecting all versions prior to 2026.0.2, the flaw (CWE-862, Missing Authorization) means the API enforces authentication but performs no role-based access check on sensitive operations, enabling horizontal or vertical privilege escalation within the application. No public exploit has been identified at time of analysis, and a vendor-released patch is available as of version 2026.0.2.
Race condition in IBM DataPower Gateway across three concurrent version lines (10.5.0.x, 10.6.0.x, and 11.0.0.x) permits state contamination of the built-in X-Client-IP header under concurrent request load, enabling IP spoofing and cross-client IP address disclosure. The flaw resides in IBM's enterprise API gateway and integration middleware, commonly deployed in high-throughput service meshes where simultaneous request processing is routine. IBM has released a patch via advisory 7282770, and no public exploit has been identified at time of analysis.