Unauthorized template information disclosure in Apache InLong 2.0.0 through 2.3.x allows authenticated users who are not designated template responsible persons to view template configurations they should not have access to. The CVE is tagged CWE-400 (Uncontrolled Resource Consumption) and classified as Denial of Service, yet the description describes an access control bypass - this is a data contradiction that analysts should flag before making control decisions. No public exploit or active exploitation has been identified. Vendor fix is available in Apache InLong 2.4.0.
Insecure direct object reference in TREK collaborative travel planner before 3.1.3 allows any authenticated user with file-edit permission on any accessible trip to disclose reservation titles from private trips they do not own. By supplying attacker-controlled reservation_id, place_id, or assignment_id values to three file management API endpoints, the server joins the foreign reservation record in subsequent FILE_SELECT or getFileLinks() database queries and returns reservation_title in the response, crossing private trip boundaries. No public exploit code has been identified at time of analysis; vendor-released patch is confirmed in version 3.1.3.
Path traversal in Apple's open-source container runtime (versions before 1.2.0) enables a malicious builder peer to request host files by crafted names that resolve outside the build context, leaking arbitrary host filesystem contents. The CVSS vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation by a low-privileged builder peer with no user interaction required. No active exploitation has been identified (no CISA KEV listing), and SSVC rates exploitation as none and automatability as no, reducing immediate operational urgency.
Unauthorized page content disclosure in Wagtail's internal Pages admin API allows any authenticated Wagtail admin user to read draft and live page fields - including title, slug, seo_title, search_description, and all custom fields declared in api_fields - for pages outside their permitted access scope. The root cause is CWE-280: the get_base_queryset method on PagesAdminAPIViewSet does not scope its queryset through the page permission policy, bypassing page-level access controls entirely. Patched releases (7.0.9, 7.3.4, 7.4.3, 8.0rc2) are available, and no public exploit or active exploitation has been identified at time of analysis.