Federation peer-registration authentication bypass in stigmem-node 0.9.0a1 lets a network-positioned attacker enroll a rogue federation peer without the required administrator out-of-band fingerprint approval, granting read access to and tampering ability over federation traffic. Reported by VulnCheck and tracked under CWE-295, it is rated CVSS 4.0 9.1 but carries meaningful exploitation prerequisites (high attack complexity plus a present attack requirement). No public exploit identified at time of analysis, and it is not listed in CISA KEV; fixed in 0.9.0a2.
Man-in-the-middle exposure in LINE's Armeria (armeria-xds module) versions prior to 1.41.0, where TLS peer (certificate) verification on xDS-managed upstream connections can be silently disabled, causing the client to trust unauthenticated or spoofed upstreams. Any attacker positioned on the network path between an armeria-xds client and its xDS-configured upstream service can intercept, read, and tamper with traffic that operators believe is protected by TLS. Reported by LY-Corporation; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cleartext exposure of federation traffic in eidetic-labs stigmem-node (versions before 0.9.0a2) occurs when operators explicitly disable mTLS while binding federation endpoints to non-loopback addresses, allowing an on-path attacker to intercept and tamper with inter-node federation data. Reported by VulnCheck and tracked as an information-disclosure issue (CWE-319), it carries a CVSS 4.0 base score of 9.1 driven by high confidentiality and integrity impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Improper authorization in the Ceph Monitor subscription handler lets any authenticated CephX user holding only `mon allow r` read the entire config-key (kv) store by sending a single crafted MMonSubscribe message, affecting Ceph releases prior to 20.2.4 (Squid) and 19.2.6 (Reef). Because that store holds OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key cephadm uses to reach every host as root, a low-privileged read-only account can escalate to full cluster and host compromise. There is no public exploit identified at time of analysis, though the vendor fix includes a QA reproduction test exercising the kv: subscription path.
Unauthenticated PHP object/global variable injection in the Broken Link Checker WordPress plugin before 2.4.12 allows attackers to overwrite arbitrary PHP global variables via unfiltered query variables on sites using plain permalinks, escalating to remote code execution when a classic (non-block) theme is active. The flaw is reachable by any unauthenticated visitor (CVSS 3.1 base 9.0, PR:N) but requires the AC:H preconditions of plain permalinks plus a classic theme, so it is not universally exploitable. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.22%, 13th percentile), indicating no observed mass exploitation yet.