Denial of service in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers positioned on an adjacent network segment, exploiting an improper array index boundary check (CWE-129). The flaw allows a crafted network request to trigger an out-of-bounds array access, crashing or degrading availability of the affected system. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; a vendor patch is available via IBM Support.
Information disclosure in Splunk Enterprise and Splunk Secure Gateway exposes sensitive SAML configuration and instance settings to any authenticated low-privilege user lacking the 'admin' or 'power' role. The Splunk Secure Gateway REST API endpoints responsible for returning SAML setup data fail to enforce authorization checks, allowing role-restricted users to retrieve IdP metadata, certificates, and SSO configuration they should not access. No public exploit code or active exploitation has been identified; a vendor patch is available and remediation is straightforward.
Heap-based buffer overflow in IBM i 7.3 through 7.6 allows a remote, low-privileged authenticated attacker to overwrite adjacent memory regions by triggering an integer underflow in the bounds checking logic. The CVSS scope change (S:C) reflects that the overwrite can cross component boundaries, though direct impact is rated low integrity only with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing are identified at time of analysis; a vendor patch is available.
Sensitive Active Directory response data exposure in the AD LDAP App for Splunk SOAR (versions below 2.3.8) allows authenticated users holding action-execution permissions to cause AD directory data to be written to a persistent debug log file. The flaw is rooted in CWE-532 (insertion of sensitive information into log files) and is reachable over the network by any low-privileged SOAR user with the appropriate role. No public exploit code or active exploitation has been identified; Splunk has released a patch at version 2.3.8.
SQL injection in Splunk Enterprise's REST API allows low-privileged authenticated users to embed attacker-controlled SQL fragments into backend database queries, potentially exposing data beyond their authorized scope. Four actively maintained version branches are affected - 9.4.x, 10.0.x, 10.2.x, and 10.4.x - with patched releases available across all branches per the vendor advisory SVD-2026-0801. The CVSS score of 4.3 reflects a read-only confidentiality impact (C:L/I:N/A:N) with no public exploit identified at time of analysis, though the attack pattern is well-understood and the REST API is network-accessible by default.
Improper authorization in the PPWP - Password Protect Pages WordPress plugin (all versions ≤1.9.15) allows authenticated Contributor-level users to invoke the vulnerable `can_access` function, retrieve the site's master password, and bypass protection on any password-gated page, post, or partial content. The CVSS vector (PR:L) confirms exploitation requires at minimum a valid WordPress account with Contributor privileges, limiting but not eliminating real-world risk given that Contributor accounts are often granted to guest authors or untrusted parties. No active exploitation confirmed (not listed in CISA KEV); no public exploit code status confirmed from available data.
Splunk SOAR versions below 8.6.0 expose tenant names and identifiers to authenticated users whose roles restrict them to a subset of tenants, due to a REST API authorization enforcement gap. In multi-tenant deployments, a low-privileged user can enumerate out-of-scope tenant metadata - names and identifiers - without triggering any access control check. No active exploitation or public exploit code has been identified; the CVSS score of 4.3 (Medium) reflects limited confidentiality impact with no integrity or availability consequence.
Unauthorized information disclosure in Splunk SOAR (On-premises) below version 8.6.0 exposes system health and cluster telemetry to any authenticated user, including those with no assigned role, via the /rest/health REST endpoint. The root cause is a missing authorization check (CWE-862) that validates session authentication but omits role-membership verification before returning restricted operational data. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified; vendor patch is available in version 8.6.0 per advisory SVD-2026-0804.
Horizontal privilege escalation in Snipe-IT prior to 8.6.3 allows any authenticated company user to read asset maintenance records - including purchase costs, supplier details, asset tags, and notes - without holding asset view or maintenance permissions. The root cause is a missing `authorize()` call in `MaintenancesController.php show()`, which the company-scoped route-model binding did not compensate for since it only blocks cross-company access, not intra-company unauthorized reads. No public exploit has been identified at time of analysis; vendor-released patch is available in version 8.6.3.
Missing authorization in Splunk AI Toolkit below version 6.0.1 allows any authenticated low-privilege user to delete the experiment history belonging to another user via the REST API. The root cause is a sequencing flaw: the Toolkit executes the deletion operation before verifying whether the requesting user holds permission to delete the target experiment, violating the principle of check-before-act. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; however, a patch is available in version 6.0.1.
Information disclosure in the RSA SecurID Authentication Manager app for Splunk SOAR (versions below 1.0.5) exposes RSA token serial numbers in cleartext to any authenticated user with action-run permissions. The app's 'enable token' and 'revoke token' actions fail to mark the token_serial parameter as a password field, causing it to render unmasked in the Splunk SOAR user interface. No public exploit has been identified at time of analysis, and exploitation is constrained by the requirement for an existing Splunk SOAR account with action-execution privileges.
Information disclosure in the Cisco Webex App for Splunk SOAR (versions below 2.2.1) exposes Webex meeting passwords in cleartext within the SOAR platform interface. Authenticated users holding roles with action-execution permissions who invoke the 'schedule meeting' action can read the plaintext meeting password directly from the UI, because the app's action manifest fails to designate the password parameter as a masked field. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known; real-world impact is bounded by the requirement for existing SOAR action permissions.
Cleartext exposure of a sensitive sample password in the Cisco Secure Malware Analytics App for Splunk SOAR (versions below 2.4.5) allows authenticated users with action-run permissions to read the sample_password parameter value directly from the Splunk SOAR user interface. The root cause is the app's failure to mark the sample_password field as a password type in the detonate file action, meaning the platform never applies its standard masking behavior to that parameter. No public exploit code or active exploitation has been identified; vendor patch is available at version 2.4.5.
Insecure Direct Object Reference in the KiviCare WordPress plugin before 4.5.4 allows authenticated patient-level users to cancel or reschedule appointments belonging to other patients. The plugin fails to verify ownership of the appointment resource before permitting modification, enabling horizontal privilege escalation between patient accounts. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at the 4th percentile.
Missing capability checks on two AJAX actions in the SmartCrawl SEO WordPress plugin (before 3.16.3) expose private and draft post titles and post-meta key names to any authenticated Subscriber-level user. The CVSS score of 4.3 (Medium) accurately reflects the constrained impact: exploitation requires a valid site account, and the disclosed data is limited to content metadata rather than full post bodies or credentials. No public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.14% (4th percentile) confirms negligible current exploitation interest.
Insecure direct object reference in WCFM Marketplace WordPress plugin before 3.8.1 allows any authenticated vendor to unapprove or permanently delete reviews belonging to other vendors' storefronts. The plugin fails to verify review ownership before processing modification or deletion requests, meaning any low-privilege vendor account can manipulate competitor reviews by supplying arbitrary review IDs. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified, and the CVSS score of 4.3 reflects a moderate-severity, limited-integrity-impact issue.
Partial API key exposure in Splunk On-Call (VictorOps) app versions below 1.0.43 allows any authenticated Splunk user - regardless of role - to read a partially masked VictorOps API key from the App Key Value Store (KV Store). The app fails to fully mask the API key prior to persisting it in a KV Store collection that is readable by low-privileged users who do not hold the 'admin' or 'power' Splunk roles, violating the principle of least-privilege for credential storage. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the CVSS score of 4.3 aligns with the limited, partial credential exposure.
Cleartext exposure of Zoom meeting passwords in the Splunk SOAR interface affects all deployments running the Zoom app for Splunk SOAR below version 3.2.2. Any authenticated SOAR user holding a role with permission to run actions can invoke the create meeting, update meeting, or update user settings actions and observe meeting passwords and personal meeting ID (PMI) passwords in plaintext within the SOAR UI. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cleartext exposure of archive passwords in Splunk Attack Analyzer Connector for Splunk SOAR (versions below 2.2.1) allows authenticated users with action-running permissions to view sensitive archive_password values unmasked in the SOAR user interface. The connector's detonate file and detonate url actions fail to mark the archive_password parameter as a password type, causing the SOAR framework to render it in plaintext during and after action execution. No active exploitation has been identified - the CVE carries no CISA KEV listing and no known public exploit code - but insider or compromised-account exposure is straightforward for any SOAR user with the relevant role.
Cleartext exposure of archive passwords in Splunk SOAR's Phantom app (versions below 3.8.5) allows authenticated users with action-running permissions to read sensitive credentials directly from the platform's user interface. The deflate item action fails to mark its password parameter as a sensitive field, causing the archive password to be rendered in plaintext in the SOAR UI to any user who invokes the action. Splunk has released a patch in version 3.8.5 per advisory SVD-2026-0806; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cleartext exposure of temporary Active Directory passwords in the MS Graph for Active Directory app for Splunk SOAR (versions below 1.5.2) allows authenticated users with action-run permissions to capture credentials generated during password reset operations, as the temp_password parameter is rendered in plaintext in the SOAR interface rather than being masked. The flaw stems from the app failing to declare the affected parameter as a password type, causing the Splunk SOAR UI to treat it as generic text output. No active exploitation has been confirmed and no public POC is reported; risk is bounded by the requirement for an authenticated internal SOAR account with specific action-run role permissions.
Cleartext exposure of document passwords in the CrowdStrike OAuth API app for Splunk SOAR (versions below 5.1.3) allows any authenticated user with action-running permissions to read sensitive document_password values directly from the Splunk SOAR user interface. The root cause is the app's failure to mark the document_password parameter as a password type in both the detonate file and detonate url actions, meaning the platform's built-in masking mechanism is never invoked. Vendor patch version 5.1.3 has been released and confirmed via Splunk advisory SVD-2026-0806; no public exploit code or active exploitation has been identified at time of analysis.
Cleartext exposure of temporary passwords in the Azure AD Graph app for Splunk SOAR (versions below 2.5.3) allows authenticated action-runners to read Azure AD reset credentials directly from the SOAR interface. The app's reset password action fails to classify the temp_password parameter as a sensitive field, so Splunk SOAR renders it unmasked in the UI rather than applying its standard password-masking behavior. Vendor patch 2.5.3 is available per Splunk advisory SVD-2026-0806; no public exploit code and no CISA KEV listing identified at time of analysis.
Credential exposure in the AWS IAM App for Splunk SOAR (all versions below 2.1.9) enables any authenticated user holding a role with action-execution permission to view AWS credentials in cleartext directly within the Splunk SOAR user interface. The root cause is the app's failure to designate the credentials action parameter as a password type field (CWE-312), causing the SOAR platform to render it unmasked rather than redacted. No active exploitation (CISA KEV) or public exploit code has been identified; however, because the exposed material consists of AWS access credentials rather than generic application data, the downstream business risk - potential cloud account compromise - substantially exceeds what the CVSS 4.3 Medium score conveys.
Cleartext credential exposure in Venafi app for Splunk SOAR versions below 2.1.4 allows any authenticated user with action-run permissions to read keystore and private-key passwords directly from the Splunk SOAR user interface. The root cause is that the app's `keystore_password` and `password` parameters in the 'get certificate' action are not flagged as password-type fields, bypassing the SOAR platform's native masking mechanism. No public exploit code identified at time of analysis, and there is no CISA KEV listing; however, the exposed credentials could enable downstream PKI compromise if observed by a malicious insider.
Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote authenticated attackers to trigger memory corruption leading to partial information disclosure and denial of service. The flaw (CWE-787) requires low-privilege credentials and high attack complexity, placing it at CVSS 4.2 Medium - a realistic but bounded threat profile. No public exploit code or active exploitation is confirmed at time of analysis; IBM has released a vendor patch via advisory at https://www.ibm.com/support/pages/node/7283858.
Stored XSS in Splunk SOAR below 8.6.0 enables an authenticated 'Incident Commander' role user to inject JavaScript into a note, which executes in the browser of any user who subsequently opens it. The flaw stems from unsanitized HTML rendering triggered by a note format change, meaning content stored safely in one format becomes executable in another. No public exploit code exists and the vulnerability is absent from CISA KEV; however, successful exploitation could compromise victim session integrity within the SOAR platform.
Heap-based buffer overflow in Wireshark's RDP protocol dissector (CWE-122) crashes the application when processing malformed RDP traffic, causing denial of service across two active release branches. Affected versions span 4.4.0-4.4.17 and 4.6.0-4.6.7 of the Wireshark Foundation's Wireshark (CPE: cpe:2.3:a:wireshark_foundation:wireshark). A proof-of-concept exists per SSVC data, though EPSS (0.17%, 7th percentile) and SSVC's 'Automatable: no' assessment indicate real-world mass exploitation is not occurring; no public exploit identified at time of analysis beyond the poc designation, and the flaw is absent from CISA KEV.
Search Head Cluster member control endpoints in Splunk Enterprise fail to enforce HTTP method-based authorization, allowing a user holding the high-privilege `list_search_head_clustering` capability to send read-typed HTTP requests that alter cluster state and cause a denial of service. Four release branches are affected - 9.4.x, 10.0.x, 10.2.x, and 10.4.x - with fixed versions available from Splunk (SVD-2026-0801). No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; exploitation is constrained to authenticated insiders or post-compromise attackers holding a high-privilege Splunk role.
Path traversal in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 exposes sensitive files to remote, unauthenticated attackers over the network. The flaw (CWE-22) allows directory traversal sequences to escape an intended path boundary, enabling read access to files that should not be externally accessible. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Integer overflow in IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 allows a local attacker with limited privileges to extract sensitive information or trigger a denial of service under specific high-complexity conditions. Rooted in CWE-190 (Integer Overflow or Wraparound), the vulnerability carries a CVSS 3.1 base score of 3.6 (Low), reflecting the mandatory local access requirement and elevated attack complexity. No public exploit code or active exploitation has been identified at the time of analysis.
Incorrect authorization in FreeBSD's ZFS_IOC_SET_PROP ioctl allows any local unprivileged user to set the internal '$hasrecvd' metadata flag on ZFS datasets - a capability that should be restricted to privileged ZFS receive operations. Affected release lines span FreeBSD 14.3, 14.4, 15.0, and 15.1 prior to their respective patch levels, as confirmed by FreeBSD Security Advisory FreeBSD-SA-26:40.zfs. No public exploit code exists and EPSS probability is 0.18% (8th percentile), indicating very low real-world exploitation pressure; no confirmed active exploitation or CISA KEV listing applies.
Kernel panic in FreeBSD's kernel TLS (kTLS) subsystem, specifically in ktls_ocf_tls_cbc_decrypt(), allows a remote TLS 1.2 peer to crash the kernel by exploiting an uninitialized iovec array bug during CBC record decryption. Affected versions span FreeBSD 14.3, 14.4, 15.0, and 15.1 prior to their respective patch levels, as confirmed by FreeBSD Security Advisory FreeBSD-SA-26:46.ktls. No public exploit code exists and EPSS is negligible at 0.15%, but the attack requires only that the remote peer engineer specific TCP segmentation - a condition achievable by the peer itself without any elevated privilege on the target system.
FreeBSD's kernel audit subsystem silently misreports the outcome of system calls injected into remote processes via ptrace(PT_SC_REMOTE), recording failed operations as successful in BSM audit logs. A local attacker with ptrace capability can exploit this to falsify audit trails and evade audit-based intrusion detection systems, since the IDS receives fabricated success records for operations that actually returned errors. No public exploit exists and EPSS exploitation probability stands at 0.15% (5th percentile), placing real-world exploitation risk at the low end of the spectrum; no active exploitation is confirmed.
Out-of-bounds memory read in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local authenticated attacker to disclose sensitive information from adjacent memory regions. The flaw is constrained entirely to local access with low privileges, yielding a CVSS score of 3.3 (Low), and poses greatest risk in shared or multi-tenant Power Systems environments where untrusted users hold shell access. No public exploit code or active exploitation has been identified at time of analysis.
Tanium Threat Response is affected by a compression bomb (zip bomb) vulnerability tracked as CWE-409, allowing an authenticated network attacker to submit a specially crafted highly-compressed file that expands during processing and exhausts host resources. The impact is limited to availability - confidentiality and integrity are unaffected per the CVSS vector. Exploitation requires high attack complexity and low-privilege credentials, yielding a CVSS base score of 3.1 (Low). No public exploit code or CISA KEV listing has been identified at time of analysis.
Compression bomb processing in Tanium Findings exposes authenticated network attackers to a limited availability impact by submitting specially crafted, highly compressed data that causes disproportionate resource consumption upon decompression. The CVSS score of 3.1 (Low) reflects the constrained impact - availability degradation rather than complete service loss - and the requirement for authenticated access with high attack complexity. No public exploit code has been identified and this vulnerability is not listed in CISA KEV. The EPSS score was not provided in source data.
Path traversal in Splunk SOAR below 8.6.0 enables users holding the OnPrem Broker role to write files to arbitrary locations outside the designated Automation Broker log directory. The flaw stems from the log upload endpoint accepting crafted filenames without adequate sanitization, allowing directory traversal sequences to escape the intended write boundary. No public exploit has been identified and no active exploitation is confirmed; the CVSS score of 2.7 (Low) accurately reflects the high privilege prerequisite and the limited, integrity-only impact.
Splunk SOAR versions below 8.6.0 expose a missing authorization flaw in the Playbook History feature that allows authenticated users holding the `playbooks:view` permission to read metadata about playbook repositories they are not explicitly authorized to access. The Playbook History endpoint omits repository-level permission checks before returning revision metadata, enabling unauthorized information disclosure within role-segregated SOAR deployments. No active exploitation has been confirmed - there is no CISA KEV listing and no public exploit code has been identified - and the CVSS base score of 2.7 reflects the high-privilege prerequisite and narrow confidentiality-only impact scope.
Splunk SOAR versions below 8.6.0 contain a Server-Side Request Forgery flaw in the connectivity check REST API endpoint (/rest/support/connectivity/.../check_connectivity) that allows an authenticated Administrator-role user to direct the SOAR platform to initiate outbound network connections to arbitrary destinations. This enables internal network enumeration - discovering reachable hosts and open ports using the SOAR instance's network position, which is typically privileged within enterprise SOC environments. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS score of 2.7 (Low) accurately reflects the high privilege prerequisite, though the risk is elevated in environments where the SOAR platform has broad internal network access.
FireAMP connector versions below 2.1.15 for Splunk SOAR allow authenticated playbook editors to bypass Safe Mode restrictions by invoking the add listitem action, which the connector manifest incorrectly classifies as read-only despite it performing write operations on file lists. Exploitation requires a high-privilege role (playbook edit/create/run), limiting the attack surface to trusted internal SOAR users. No public exploit code exists and this vulnerability has not been identified in CISA KEV, consistent with its low CVSS score of 2.7.
Broken object-level authorization in the Easy Appointments WordPress plugin (versions up to 3.12.28) exposes a REST endpoint that returns all site bookings - including customer names, appointment schedules, and statuses - to any authenticated contributor-level user, not just the records belonging to that user. The flaw is classified under CWE-200 (Exposure of Sensitive Information) and affects all sites running the plugin before version 4.0.1. No public exploit code or active exploitation has been identified at time of analysis, and EPSS places this in the 5th percentile for exploitation likelihood.
Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 exposes quiz email-notification and results-page configurations to unauthorized lateral reading by any authenticated contributor-level user on the same WordPress installation. The missing per-object ownership check on QSM REST API routes (CWE-639 IDOR) allows a contributor to query configuration data, including notification recipient email addresses, for quizzes created by other site users. No public exploit has been identified and SSVC classifies exploitation status as none, but the flaw represents a meaningful privacy control gap in multi-author WordPress environments where quiz surveys may collect sensitive respondent data.
Improper per-object authorization in the Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 permits any contributor-level (or higher) authenticated user to overwrite the front-end text settings of quizzes owned by other users. The flaw stems from a missing ownership check on the save action for quiz front-end text settings, meaning a contributor on a multi-author site can silently tamper with quiz content they did not create. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog; however, a vendor patch is available and should be applied promptly on any multi-author WordPress deployment running QSM.
Missing authorization in the Eventin WordPress plugin (versions before 4.1.21) permits any authenticated contributor-level user to overwrite other users' WordPress roles and metadata via the speaker creation feature, bypassing the platform's native capability enforcement. The vendor has released a patch in version 4.1.21 addressing the missing permission check. No public exploit code or active exploitation has been identified at time of analysis; however, the practical barrier to exploitation is lower than the published CVSS 2.7 score implies, because contributor accounts are commonly available on sites with open registration.
Integer truncation in the nnn terminal file manager (version 5.2 confirmed vulnerable) allows a local attacker who controls the victim's HOME environment variable to trigger an out-of-bounds read and write. By supplying a HOME path longer than 255 characters, the uchar_t homelen variable wraps to zero; the expression (homelen - 1) promotes to signed int as -1, indexing one byte before the intended path buffer. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 2.4 reflects the constrained attack conditions requiring local access and active user interaction.
Out-of-bounds write in nnn terminal file manager version 5.2 allows a local attacker who can place a malicious session file in the victim's session directory to corrupt adjacent global state when the victim loads the file using the -s option. The vulnerability stems from missing validation of attacker-controlled length fields during session file deserialization, enabling writes beyond fixed-size global buffers. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV; the overall risk is low given the local, user-interaction-dependent attack path.
Memory exhaustion in BuildKit prior to v0.31.1 allows a denial-of-service condition against the buildkitd daemon when it processes a maliciously crafted base image. The daemon reads /etc/passwd and /etc/group from attacker-controlled images without any size limit during UID/GID resolution, enabling an oversized file to exhaust host memory and trigger an OOM kill of buildkitd. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified, and the CVSS 4.0 score of 2.3 reflects the constrained impact: availability-only, requiring user interaction with a hostile image.
Coturn STUN/TURN server prior to version 4.15.0 allows an on-path attacker to tamper with authenticated STUN messages over plain UDP or TCP by appending arbitrary attributes after the MESSAGE-INTEGRITY field and recomputing the unkeyed FINGERPRINT. Because Coturn's server-side attribute iterator did not stop at the MESSAGE-INTEGRITY boundary as required by RFC 8489 Section 9, injected LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes were processed as legitimate, enabling allocation lifetime manipulation, unauthorized permission injection, or origin-check bypass. TLS and DTLS deployments are entirely unaffected; no public exploit has been identified at time of analysis.
DNS rebinding in keeper.sh's calendar module (versions prior to 2.18.14) allows authenticated attackers to bypass the SSRF guard and route outbound HTTP connections to private network addresses, including cloud instance metadata endpoints such as 169.254.169.254. The flaw arises from a two-phase design: the guard resolves a hostname's IP addresses, asserts they are public, then discards those resolved addresses before independently re-resolving the hostname at socket-open time - an attacker controlling authoritative DNS can serve a public IP during validation and swap it to a private IP for the subsequent connection. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 2.18.14.