Three concurrent design flaws in Etherpad's `/tokenTransfer` device-pairing endpoint (ep_etherpad-lite 2.6.0-3.0.0) enable persistent authorship impersonation: transfer UUIDs never expire, can be redeemed unlimited times, and the GET handler echoes the raw author token in the JSON response body - defeating the HttpOnly cookie boundary that was introduced specifically to keep the token out of JavaScript reach. Any attacker who obtains the UUID through realistic disclosure channels (browser history, intercepted QR code, server log, third-party plugin) can assume the victim's full read/write author identity indefinitely, re-authenticate on demand, and extract the cleartext token for replay against other endpoints. A working proof-of-concept is included in the advisory; no exploitation has been confirmed by CISA KEV at time of analysis.
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client to exhaust CPU, memory, async scheduling capacity, and engine request slots with a single crafted request. Affected versions span 0.19.0 through 0.25.x; the issue is fixed in 0.26.0. No public exploit code has been identified and CISA has not listed this in KEV, but the attack is trivially constructable by any client with a valid API credential.
Flowise before 3.1.4 exposes stored third-party API credentials (OpenAI, ElevenLabs) through a missing authorization check in the unauthenticated text-to-speech endpoint, enabling financial abuse at the chatflow owner's expense. The `/api/v1/text-to-speech/generate` endpoint is whitelisted from authentication and fetches any chatflow by UUID without verifying its `isPublic` status, allowing any network-reachable attacker with a valid chatflow UUID to generate unlimited TTS audio billed to the victim. A public proof-of-concept is included in the GHSA advisory; no CISA KEV listing exists at time of analysis.
Race condition in vLLM's prompt embedding loader allows concurrent API requests to bypass the sparse tensor invariant guard introduced for CVE-2025-62164, permitting an invalid sparse tensor to reach `tensor.to_dense()` and cause availability disruption. Affected deployments span versions 0.20.2rc0 through 0.25.x and are limited to instances with `enable_prompt_embeds` explicitly enabled. No public exploit code or CISA KEV listing exists at time of analysis; the fix is confirmed in v0.26.0.
Cache-poisoning XSS and open redirect in Etherpad (ep_etherpad-lite 2.1.0-3.0.0) stem from unsanitized reflection of the attacker-controlled `x-proxy-path` HTTP request header into admin HTML/JS/CSS assets and into a 302 Location target. The most severe vector is cache-poisoning: because no `Vary: x-proxy-path` header was emitted, a CDN or shared reverse proxy caches a single attacker-crafted response and serves the injected script to every authenticated admin who subsequently loads `/admin/index.html`, requiring no further attacker involvement. The timeslider redirect independently allows open redirect via protocol-relative URL injection (`//evil.example`). No CISA KEV listing is confirmed; a working PoC curl command is published in the GitHub advisory GHSA-fjgc-3mj7-8rg8.
Terminal escape sequence injection in Oh My Posh prior to version 29.35.1 allows an attacker who controls a Git repository or filesystem directory name to silently execute arbitrary ANSI/OSC escape sequences in a victim's terminal on every prompt render, without any user action beyond navigating to the attacker-influenced directory. The `write(s rune)` function in `src/terminal/writer.go` emitted attacker-controlled content — including Git commit subjects, author names and emails, upstream URLs, and working directory path components — verbatim to the terminal output buffer without stripping C0/C1 control characters such as ESC (0x1b), BEL (0x07), CSI, and OSC sequences. A publicly available proof-of-concept demonstrates OSC 52 clipboard overwrite and OSC 0 window title hijacking; no public exploit identified as confirmed actively exploited per CISA KEV at time of analysis.
Flowise's cloud billing API exposes a broken access control flaw at the GET /api/v1/organization/customer-default-source endpoint, enabling any authenticated user to retrieve payment and profile data belonging to arbitrary other customers by manipulating the customerId query parameter. Versions up to and including 3.1.2 are affected; the server authenticates the session but performs no ownership check on the requested customer object, returning full Stripe customer records - including email, balance, currency, and invoice metadata - for any valid customerId supplied. A proof-of-concept is publicly documented in GitHub security advisory GHSA-2364-jh4q-m9vm, and the predictable Stripe-format customer ID scheme (cus_XXX) makes systematic enumeration practical for any registered user.
Template-literal code injection in TypeORM's migration:generate command allows an attacker with database schema write access to achieve arbitrary JavaScript execution on any host that loads the generated migration file. Affected are TypeORM npm versions prior to 0.3.31 (0.x branch) and versions 1.0.0 through 1.0.x (fixed in 1.1.0), spanning PostgreSQL, MySQL, MariaDB, and CockroachDB drivers. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the GHSA advisory provides sufficient technical detail to reproduce the attack.
Prototype pollution in Quasar Framework's public extend() utility (npm package quasar, versions <= 2.21.4) allows attacker-controlled properties to be written to Object.prototype when applications pass user-controlled objects into deep merge calls. The flaw exists because extend(true, target, source) recursively copies source keys including __proto__ without rejection, enabling descent into the prototype chain. A working proof-of-concept is publicly documented in the GitHub security advisory (GHSA-3r53-75j5-3g7j); no public exploit identified at time of analysis as a weaponized payload. Downstream impact ranges from logic bypass and unsafe option injection to denial of service, depending entirely on how polluted properties are later consumed by the application.
SQL injection in SourceCodester Simple Student Information System exposes the admin department view endpoint to remote unauthenticated database manipulation via an unsanitized ID parameter in app/admin/departments/view_department.php. A public proof-of-concept is available through a GitHub issue, confirmed by VulDB (EUVD-2026-58068), lowering the barrier for opportunistic exploitation. The CVSS 4.0 score of 6.9 with E:P reflects partial confidentiality, integrity, and availability impact - no authentication or special configuration is required based on the provided vector.
Broken authorization in the Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin (versions before 7.0.9) allows any authenticated WordPress user - including the lowest-privilege subscriber role - to disconnect the site's Ecwid store and take the entire storefront offline. The affected store-management action performs neither a capability check nor a nonce verification, meaning the only barrier to exploitation is a valid WordPress session. A public exploit exists per WPScan reporting, and the fix is confirmed available in version 7.0.9.
Uncontrolled resource consumption in vLLM's lm-format-enforcer structured output backend (all versions prior to 0.26.0) enables unauthenticated remote denial of service via the /v1/completions API endpoint. By submitting a crafted catastrophically backtracking regular expression to the structured_outputs.regex parameter, a remote attacker can saturate an entire CPU core and stall the structured-output engine path indefinitely - blocking inference requests that rely on the lm-format-enforcer backend for all concurrent users. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the attack primitive (ReDoS against an exposed API) is well-understood and trivially constructible by any attacker familiar with catastrophic regex patterns.
Cross-user inference data leakage in vLLM prior to 0.27.0 exposes one batched user's prompt or completion output to another user sharing the same GPU inference batch. The root cause is a 32-bit integer overflow in the CUDA kernel `act_and_mul_kernel` within `activation_kernels.cu`, where the pointer arithmetic `blockIdx.x * 2 * d` wraps around when token indices and hidden-dimension sizes are large enough, redirecting the kernel to read from an adjacent user's input buffer. No active exploitation has been confirmed (no CISA KEV listing), but the vendor has patched the issue in v0.27.0 and a detailed GitHub advisory and PR diff are publicly available.
Information disclosure in vLLM prior to version 0.26.0 leaks server filesystem internals - including OS usernames, home and virtual-environment directory paths, Python version, internal package structure, line numbers, and endpoint handler names - through HTTP error responses. Any unauthenticated network attacker can trigger this by sending malformed JSON to the OpenAI-compatible API endpoints, requiring zero privileges and no special configuration beyond a default vLLM deployment. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; however, the trivial exploitation bar (a single malformed HTTP request) and the reconnaissance value of the leaked data elevate real-world risk above the CVSS 5.3 score alone implies.
Unauthenticated build triggering in OpenChoreo before v1.0.3, v1.1.3, and v1.2.0-rc.2 allows any remote attacker to fire CI/CD pipeline jobs without valid webhook credentials. The POST /api/v1alpha1/autobuild endpoint trusts the caller-controlled X-Event-Key header to select a webhook provider and does not enforce HMAC-SHA256 validation for Bitbucket events, permitting cross-provider spoofing and build triggers using attacker-supplied commit SHAs against any matched repository and branch. No public exploit is identified at time of analysis, and vendor-confirmed patches exist for all affected release lines.
Cross-site request forgery in phpList before 3.7.0-RC5 allows a remote, unauthenticated attacker to delete arbitrary bounce rules from a target phpList installation by tricking an authenticated administrator into loading a crafted URL. The deletion endpoint (bouncerules.php) accepts state-changing operations over GET and passes enforce=false to verifyCsrfGetToken, meaning the CSRF token check is only performed when the tk parameter is voluntarily present - effectively disabling the protection entirely. A publicly available exploit exists (GitHub issue #1116); the vendor has released a fix in v3.7.0-RC5, and no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.
Open redirect in Saurus CMS Community Edition's logout handler allows unauthenticated attackers to redirect authenticated users to attacker-controlled domains or javascript: URIs immediately after session destruction. The vulnerability exists in classes/port.inc.php, where the `url` GET/POST parameter is passed unsanitized into the HTTP Location header with no allowlist, scheme check, or path restriction. A publicly available proof-of-concept demonstrates exploitation; no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 5.1 with UI:A reflects the social-engineering dependency inherent to post-logout redirect abuse.
Reflected XSS in Next AI Draw.io 0.2.1 through 0.4.16 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the localhost origin by crafting malicious URLs containing a payload in the unsanitized `mcp` query parameter. Successful exploitation - which requires a victim to click the crafted link - enables theft of diagram session tokens and API credentials accessible within that browser origin. Publicly available exploit code exists (GitHub issue #917 via VulnCheck), though no CISA KEV listing confirms active exploitation at time of analysis.
Predictable temporary file paths in Etherpad's import and export handlers expose multi-tenant deployments to a symlink-based file overwrite attack. All ep_etherpad-lite versions through v3.0.0 are affected; exploitation requires local host access, an unprivileged OS account, and - for high-impact scenarios - the Etherpad process running as root, a common default in many Docker base images. A proof-of-concept sketch is included in the vendor advisory GHSA-2jwf-f4xq-f24h; no public weaponized exploit code beyond that sketch exists and this vulnerability is not listed in the CISA KEV catalog.
CyberPanel versions before 3.0.0 expose a path traversal in the cloudAPI ReadReport endpoint that allows authenticated administrators to read any file accessible by the root-privileged CyberPanel process. The `reportFile` parameter in the JSON request body is passed without sanitization directly to Python's `open()` in `cloudManager.py`, enabling directory traversal to credential files, SSL and SSH private keys, and JWT secrets. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, though the vulnerability is straightforward to abuse given administrative credentials.
Remote unauthenticated crash of the rsync daemon affects all versions from 3.0.0 through 3.4.x. The daemon child process dereferences the first file list entry as a directory structure pointer without verifying its type, so a dot entry not typed as a directory triggers a null or uninitialized pointer dereference (CWE-908) that terminates the connection. Impact is constrained to availability - a denial-of-service against individual daemon connections - with no confidentiality or integrity exposure. No CISA KEV listing and no confirmed public exploit code exist at time of analysis.
Memory exhaustion in rsync before 3.5.0 exposes receivers to remote denial of service through a logic error in --max-alloc handling, where passing --max-alloc=0 silently disables all allocation sanity checks instead of enforcing a zero-byte cap. Any rsync receiver reachable from an untrusted sender - including public mirrors and unauthenticated daemons - is at risk, as the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required to trigger the flaw. No active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the trivial trigger condition makes this a credible remote DoS threat against exposed rsync endpoints.
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticated remote attackers to crash the internal load balancer process by sending a single crafted packet. Exploitation is constrained to deployments with load balancing enabled; critically, the Secure Access server itself remains operational after the attack, continues to accept client connections, and retains the ability to failover - limiting real-world impact to partial load-distribution disruption rather than full service outage. No public exploit code has been identified and no confirmed active exploitation is recorded at time of analysis.
File ownership privilege confusion in rsync before 3.5.0 allows local attackers to cause transferred files to be assigned root (uid/gid 0) ownership by manipulating the name-converter subprocess into returning empty uid/gid lookup responses. The flaw stems from rsync misinterpreting an empty name-converter response as a valid resolution to uid/gid 0 rather than rejecting it as a lookup failure. No public exploit or CISA KEV listing has been identified at time of analysis; the vendor-released fix is rsync v3.5.0, designated a major security release.
Filter rule bypass in rsync before 3.5.0 allows remote clients connecting to an rsync daemon to override module-level filter restrictions by injecting malicious --filter merge file directives during filter evaluation. The daemon's intended access controls - designed to restrict which files a module exposes - can be circumvented, granting the attacker read and limited write access to files the module filter was meant to exclude. No public exploit has been identified at time of analysis, and the vendor has released a fix in v3.5.0 designated as a major security release.
Newline injection in rsync's name-converter uid/gid mapping interface (all versions before 3.5.0) allows local attackers to forge protocol messages by embedding newline characters in OS-level user or group names. Because the rsync daemon communicates with the name-converter over a pipe-based, line-oriented protocol, injected newlines create false protocol boundaries, causing the daemon to parse attacker-controlled strings as legitimate protocol directives and corrupting uid/gid mapping logic. No public exploit code and no CISA KEV listing are identified at time of analysis; rsync 3.5.0 was designated a major security release to address this issue.
Open redirect in Meeting Room Booking System (MRBS) prior to version 1.12.2 enables unauthenticated attackers to craft malicious URLs that silently forward victims from a trusted MRBS domain to any attacker-specified site, enabling phishing and credential harvesting. The vulnerability is specifically present in MRBS kiosk mode, where the application accepts a query-supplied redirect destination without validating it against an allowlist or trusted domain list. No public exploit code or CISA KEV listing has been identified; the vendor has released a fix in version 1.12.2 with no available workarounds.
Unauthenticated MQTT access on Philips Hue Bridge Pro exposes all connected Zigbee lighting devices to any attacker sharing the same network segment. The firmware ships Mosquitto MQTT broker v2.0.22 with anonymous access enabled and no interface binding restriction, meaning no credentials are needed to subscribe to device telemetry topics or publish commands that toggle, dim, or cycle lights. No public exploit code has been identified at time of analysis; however, CISA is tracking this vulnerability via CSAF advisory va-26-225-01, indicating active government-level monitoring.
The getLocalStorage API endpoint in SiYuan before v3.7.4 exposes the administrator's full local storage map to unauthenticated network callers and publish readers, with only three keys redacted by an incomplete sanitization filter. Sensitive operational metadata - including closed-tab history, search keywords, private document identifiers, and expanded folder paths - can be harvested in a single unauthenticated HTTP request against any network-accessible instance. No public exploit has been identified at time of analysis, but the zero-authentication, low-complexity attack path means any internet-exposed SiYuan deployment running a version below 3.7.4 is trivially reachable.
Privilege escalation in Teltonika Networks RUTOS (versions 7.07.1-7.24.1) and TSWOS (versions 1.03-1.10) allows an adjacent-network attacker with a low-privileged account to gain full administrative control of the device by exploiting unsafe argument handling in an execl() system call. The vulnerability enables complete integrity compromise of the affected router or switch operating system without requiring elevated privileges at entry. No public exploit code has been identified at time of analysis, and the flaw is not currently listed in the CISA KEV catalog.
The getBookmarkLabels API endpoint in SiYuan before v3.7.4 exposes all workspace bookmark labels to unauthenticated and publish-mode readers due to missing authorization checks (CWE-862), leaking organizational metadata - topic taxonomy, project labels, and subject-matter vocabulary - from documents the requester cannot otherwise access. Any network-reachable SiYuan instance prior to v3.7.4 is affected regardless of publish-mode configuration, as the endpoint applies no access-control filtering. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; risk is primarily reconnaissance-enabling intelligence disclosure rather than direct data exfiltration.
Unauthorized document outline disclosure in SiYuan before v3.7.4 exposes heading identifiers for any document to unauthenticated network callers via the `/api/storage/getOutlineStorage` endpoint, which performs no authorization verification whatsoever. Affected are all SiYuan deployments (cpe:2.3:a:siyuan-note:siyuan:*) configured to listen on externally reachable interfaces running any version prior to v3.7.4. No public exploit has been identified at time of analysis, though the attack requires no credentials and is trivially automatable - any caller who supplies a document identifier retrieves its structural outline regardless of document-level access restrictions.
Unauthenticated access to the /api/block/getRefIDs endpoint in SiYuan before v3.7.4 exposes block reference metadata from password-protected documents, allowing remote attackers without any credentials to enumerate internal document structures. The endpoint fails to enforce the document-level password tier before returning block identifiers, meaning the password protection on sensitive documents is effectively bypassed for this API route. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in v3.7.4 per the GitHub Security Advisory GHSA-vg99-7gj7-2fr5.
Unauthenticated filesystem reconnaissance in SiYuan versions before v3.7.4 allows any network-reachable anonymous reader to probe arbitrary absolute paths on the host via the `getUniqueFilename` endpoint, which performs no authorization check or path confinement before returning existence results. The missing authorization control (CWE-862) means the attack requires zero credentials and zero user interaction against any exposed SiYuan HTTP interface, enabling structured enumeration of filesystem layout, installed software, and sensitive path locations as a precursor to more targeted attacks. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-barrier exploitation profile makes pre-attack reconnaissance trivially achievable against internet-exposed or LAN-accessible instances.
Arbitrary file deletion with elevated privileges is possible in the VantageCoreAddin component of Lenovo Vantage and Lenovo Commercial Vantage via an improper link following (symlink) attack. A local authenticated user operating with low privileges can exploit this to delete files outside their authorized scope by placing a malicious symbolic or hard link in a path the addin traverses with elevated rights. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Path traversal in rsync before 3.5.0 allows a malicious sender to write arbitrary files outside the receiver's intended destination directory by exploiting symlink following in --relative mode. The make_path() function creates intermediate directories while following symlinks without enforcing that resolved paths stay within the destination tree boundary, enabling controlled file writes to arbitrary locations on the receiver's filesystem. No public exploit or CISA KEV listing is confirmed at time of analysis, but the CVSS 4.0 score of 6.9 with high integrity and availability impact reflects meaningful real-world risk given rsync's ubiquity in backup and synchronization workflows.
Arbitrary file deletion with elevated privileges affects Lenovo Dock Manager across all tracked versions (CPE: cpe:2.3:a:lenovo:dock_manager:*:*:*:*:*:*:*:*). An authenticated local user can exploit this CWE-59 link-following flaw to redirect the application's privileged file deletion routine to arbitrary targets outside the user's permitted scope, threatening both system integrity and availability. The vulnerability was identified through Lenovo's own internal security assessment; a vendor patch is available via advisory LEN-223470, and no public exploit has been identified at time of analysis.
Unauthorized Osquery live query execution in Elastic Kibana allows a low-privileged authenticated user to run endpoint queries against Elastic Agents assigned to Kibana spaces they have no authorization to access, violating the platform's space-based multi-tenancy access control model. By exploiting a user-controlled key authorization bypass (CWE-639 / CAPEC-1), an attacker can exfiltrate host telemetry - running processes, network connections, file system state - from isolated organizational spaces, with results written to the Osquery results data stream accessible to the attacker. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified at the time of analysis; however, the network-accessible vector and high confidentiality impact make this a meaningful risk in multi-tenant deployments.
Silent integer overflow in ERC7984ERC20Wrapper's confidential total supply counter allows fund loss when an fhEVM token wrapper is exhausted. In versions prior to 0.3.1, the wrap() and onTransferReceived() functions did not check whether the internal _mint call succeeded, meaning that once the euint64 supply counter reached its maximum (~18.4 trillion tokens), subsequent wrapping operations transferred the caller's underlying ERC-20 tokens into the contract while crediting no confidential wrapped tokens in return. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 0.3.1.
Process termination in baseline-browser-mapping 2.x before 2.11.0 can be triggered by supplying invalid or conflicting parameters to the library, causing the entire Node.js runtime to exit via `process.exit()` rather than throwing a catchable error. Any application that exposes externally-supplied input to this library's API - such as `getCompatibleVersions()` or `getAllVersions()` - is vulnerable to complete process-level denial of service that cannot be recovered by application-layer error handlers. No public exploit exists and exploitation is rated unlikely per the CVSS 4.0 supplemental E:U tag, but impact when triggered is absolute: the process dies and cannot be restarted without operator intervention.
Out-of-bounds memory read in sblim-sfcb's provider-manager IPC message parser allows a local low-privileged attacker to crash the provider-manager process, causing denial of service and potentially leaking limited adjacent memory contents. The vulnerability stems from unsafe deserialization of attacker-controlled IPC messages without adequate boundary validation, affecting sblim-sfcb as shipped across Red Hat Enterprise Linux versions 6 through 10. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained to local system access.
Prototype pollution in Mongoose's update casting mechanism allows remote attackers (PR:N per CVSS vector) to corrupt Object.prototype by embedding a __proto__-prefixed dotted key inside a $set operator in any update payload passed without sanitization to Mongoose update operations. All major Mongoose release lines are affected below versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2, impacting Node.js application integrity and availability wherever the req.body-to-updateOne anti-pattern exists. Publicly available exploit code exists in the GHSA advisory; no CISA KEV listing is recorded at time of analysis.
Buffer overflow in IBM i 7.3 through 7.6 enables remote authenticated attackers to obtain sensitive information from the system. The vulnerability (CWE-787, out-of-bounds write) exposes memory contents under network-accessible conditions, with IBM confirming a patch is available. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, and EPSS data was not provided.
Denial of service in Kibana allows an authenticated low-privileged user to crash the entire Kibana process by submitting specially crafted input data. The crafted payload triggers an uncaught exception (CWE-248) on a critical execution path, causing Kibana to terminate and become unavailable to all users until manually restarted. Because the condition is repeatable, an attacker holding only basic credentials can maintain a persistent denial-of-service state. No public exploit has been identified at time of analysis, and no KEV listing exists.
Stack exhaustion in Elasticsearch allows any low-privileged authenticated user to crash an Elasticsearch node with a single crafted request. Affected are all Elasticsearch versions across the 8.x and 9.x release lines, with Elastic releasing fixed versions 8.19.20, 9.4.5, and 9.5.1 under ESA-2026-78. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and minimal privilege requirement make this a straightforward denial-of-service vector for any credentialed user.
Node process termination in Elasticsearch via the ingest simulate pipeline API allows low-privilege authenticated users to crash individual cluster nodes by submitting a crafted request that induces uncontrolled recursion. The vulnerability affects multiple Elasticsearch version lines, with Elastic releasing fixes in versions 8.19.1, 9.3.8, and 9.4.4 per advisory ESA-2026-75. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, but the low attack complexity and broad enterprise footprint of Elasticsearch make this a meaningful availability risk, particularly in multi-tenant or shared-cluster deployments.
Sensitive subscriber data exposure in the Payment Forms for Paystack WordPress plugin (versions ≤ 4.0.5) allows authenticated users holding a subscriber-level WordPress account to retrieve confidential payment-related information beyond their authorization scope. Rooted in CWE-497, the flaw is network-exploitable with low attack complexity and requires no user interaction beyond possession of a valid low-privilege session. No public exploit identified at time of analysis; the vulnerability was disclosed by Patchstack and is tracked under ENISA EUVD-2026-57869.
Broken access control in the Service Finder Booking WordPress plugin (versions up to and including 6.2) allows authenticated subscribers to trigger high-availability-impact actions they should not be authorized to perform. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify that the requesting user has sufficient privileges before executing sensitive operations. No public exploit or active exploitation has been identified at time of analysis, though the low attack complexity and network accessibility make it straightforward to trigger once a subscriber account is obtained.
Broken access control in the AcyMailing SMTP Newsletter WordPress plugin (versions <= 10.11.1) permits subscriber-level users to access restricted functionality reserved for higher-privileged roles. The flaw, rooted in missing authorization checks (CWE-862), allows a low-privileged but authenticated WordPress user to read sensitive newsletter data - including subscriber lists, campaign details, or configuration - that should require administrator or editor access. No public exploit or active exploitation via CISA KEV is confirmed at time of analysis, though Patchstack has documented and disclosed the vulnerability.
Broken Access Control in the Tourfic WordPress plugin (all versions up to and including 2.23.1) allows authenticated subscriber-level users to access restricted functionality or data beyond their intended authorization scope. The flaw stems from missing authorization checks (CWE-862), enabling low-privileged authenticated users to bypass access controls and retrieve sensitive information, as reflected by the High confidentiality impact in the CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-complexity, network-accessible nature of the flaw makes it straightforward to exploit for any registered site user.