Heap buffer overflow in msgpack-c through version 7.0.1 results from an integer overflow in msgpack_unpacker_expand_buffer, where unchecked size_t addition of the requested reservation size and current buffer usage wraps to near-zero on near-SIZE_MAX inputs, causing the allocator to receive a massively undersized target while the function falsely reports success to the caller. Integrations that pass attacker-controlled lengths to the msgpack_unpacker_reserve_buffer API - such as custom length-prefixed streaming transports - can trigger subsequent heap overwrites when the caller writes the full declared length into the undersized buffer. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires a specific non-default integration pattern not present in msgpack-c's own internal decode paths.
Heap buffer overflow in libvips prior to 8.18.3 allows up to 4032 bytes to be written beyond an allocated heap buffer during processing of untrusted uncompressed PPM images via custom source objects, potentially causing memory corruption or a process crash. The flaw exists specifically in vips_source_read_to_memory in libvips/iofuncs/source.c, where VIPS_MAX was used instead of VIPS_MIN when computing the remaining read size. No public exploit code exists and this is not listed in CISA KEV; the CVSS 4.0 score of 5.8 reflects meaningful constraints including local attack vector, high complexity, and a prerequisite of non-default custom source configuration.
Open redirect in Punk::OAuth2 before 0.03 for Perl allows an attacker to redirect authenticated users to an arbitrary external domain by exploiting a gap in the same_origin_path validation function. The return parameter in the OAuth2 login flow accepts backslash and tab characters that the WHATWG URL parser interprets as path/authority delimiters, enabling values like /\evil.example or tab-separated //evil.example to survive the check and become the post-login redirect target. No authorization code or access token is carried in the redirect, so the immediate impact is post-authentication phishing rather than token theft; no public exploit has been identified and EPSS sits at the 18th percentile.
Catalyst::Plugin::Static::Simple through 0.38 unconditionally marks all static file responses as publicly cacheable via Cache-Control: public, including responses to requests bearing an Authorization header. This means shared HTTP proxies may cache authenticated responses and serve them to subsequent unauthenticated requestors. The documented mitigation of setting expires to 0 is silently ignored, leaving operators with no effective means to restrict caching behavior until the patch is applied. No public exploit or CISA KEV entry exists; EPSS is 0.18% (8th percentile), indicating low opportunistic exploitation probability.
Use-after-free in libevent's WebSocket session initialization (ws.c) before version 2.2.2-alpha allows a local low-privileged caller to crash the hosting process by inducing a locking failure. When evhttp_start_ws_ succeeds but bufferevent_enable_locking_ subsequently fails, the cleanup function evws_connection_free calls TAILQ_REMOVE on a list the session was never inserted into, dereferencing an invalid pointer. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in 2.2.2-alpha.
Out-of-bounds read in liftoff-sr CIPster's TCP Encapsulation Receive Path allows remote unauthenticated attackers to crash or disrupt EtherNet/IP adapter availability. The vulnerability in `Encapsulation::ReceiveTcpMsg` (`encap.cc`) causes the function to return a success-indicating length value after silently discarding an oversized TCP payload, prompting the caller to parse an already-discarded buffer and triggering the out-of-bounds read. No public exploit identified at time of analysis per KEV, though publicly available exploit code exists per CVSS 4.0 E:P supplemental metric and VulDB disclosure.
Windows Remote Help versions 5.0.0.0 through below 5.2.1040.0 exposes an uncontrolled search path element (CWE-427) that enables an authorized local attacker with standard user privileges to deny service against the Remote Help application. The flaw stems from the application resolving executable dependencies or resources through a controllable or insufficiently constrained search path, allowing a low-privilege local user to interfere with path resolution and crash the process. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released a remediation in version 5.2.1040.0.
Out-of-bounds read in CIPster (liftoff-sr, commit 1802525be27d) allows remote unauthenticated attackers to crash the EtherNet/IP stack by sending a crafted ForwardOpen request with a manipulated product_code_ argument to the CipConnMgrClass::forward_open handler in cipconnectionmanager.cc. The underlying defect is a missing class-type validation in ConnectionData::ResolveInstances, which permits crafted connection paths to reference instances of unexpected CIP object classes, triggering memory access beyond valid bounds. A public proof-of-concept exploit exists per the CVSS 4.0 E:P supplemental metric and VulDB disclosure; the vulnerability is not listed in the CISA KEV catalog at the time of analysis.
SQL injection in code-projects Assessment Management 1.0 exposes the `/welcome.php` endpoint to remote unauthenticated database manipulation via the `userid` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is required, and a public exploit is documented (E:P, GitHub PoC at github.com/niaoniaollll/cve/issues/8). Impact is rated Low across confidentiality, integrity, and availability, but the zero-barrier exploitation path and available PoC make this immediately actionable for any operator running this software.
Kernel memory disclosure in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a local attacker with standard user privileges to read sensitive out-of-bounds kernel memory via an unspecified vulnerability. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a local shell account with no elevated rights, making it viable for any authenticated local user or a compromised service account. No public exploit code has been identified at time of analysis, and IBM has released a patch via the vendor advisory.
Uncontrolled resource consumption in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local high-privileged attacker to cause a denial of service by supplying crafted directory records to the vulnerable parsing component. The CVSS vector (AV:L/PR:H) confirms that exploitation is constrained to authenticated local actors with elevated privileges, limiting the realistic threat pool considerably. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Uncontrolled resource consumption in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, enables a local low-privileged attacker to exhaust system resources and trigger a denial of service condition. The vulnerability is classified under CWE-400 and carries a CVSS 3.1 base score of 5.5 with a local attack vector requiring low privileges. IBM has released a patch via advisory 7283858; no active exploitation or public proof-of-concept code has been identified at time of analysis.
Symlink following vulnerability in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to cause a denial of service - and potentially file corruption - through improper symbolic link validation (CWE-59). The CVSS vector (AV:L/AC:H/PR:L/I:H/A:H) indicates exploitation requires local access, a race-condition timing window, and results in both high integrity and availability impact despite the DoS classification. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; IBM has released a patch.
NULL pointer dereference in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to crash the system, causing a denial of service. Exploitation requires high attack complexity, suggesting a race condition or specific system state must be induced. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; a vendor patch is available via IBM support.
Reflected cross-site scripting in Cesanta Mongoose (all versions prior to 7.22) allows a remote unauthenticated attacker to inject arbitrary JavaScript into a victim's browser by crafting a percent-encoded URL path targeting the directory listing handler. The `mg_http_serve_dir()` and `listdir()` functions in `src/http.c` insert the decoded request URI directly into `<title>` and `<h1>` HTML elements without HTML entity escaping, and the resulting script executes in the Mongoose origin. Exploitation requires both that the server was compiled with `MG_ENABLE_DIRLIST` enabled and that a victim user is persuaded to visit the malicious link; no public exploit or CISA KEV listing is identified at time of analysis.
Stored cross-site scripting in Cesanta Mongoose's directory listing feature allows an attacker with filesystem write access to a served directory to plant a file whose name contains HTML or JavaScript markup; when any user browses that directory, the raw filename is reflected into the HTML page without escaping, executing arbitrary script in the Mongoose origin. All Mongoose versions prior to 7.22 with MG_ENABLE_DIRLIST enabled are affected. No public exploit or CISA KEV listing is confirmed at time of analysis; the vendor-released fix is available in Mongoose 7.22.
Server-Side Request Forgery in Apache InLong Manager (versions 2.0.0-2.3.x) allows any authenticated user - no administrative role required - to coerce the Manager service into issuing outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This effectively turns the InLong Manager into an open proxy for internal network reconnaissance, enabling access to otherwise firewalled services such as cloud instance metadata endpoints, internal APIs, or database management interfaces. No public exploit has been identified at time of analysis, but the low privilege bar makes this broadly reachable within any deployment that permits shared user access.
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows authenticated network users to probe privilege boundaries and conduct reconnaissance without generating detectable log entries. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms any low-privileged authenticated user can exploit this over the network with no complexity barrier. No public exploit code or active exploitation has been identified; this is a vendor-self-reported issue with no EPSS data or KEV listing.
Cross-cluster MITM attacks are enabled in Red Hat Advanced Cluster Management for Kubernetes 2.x via the lighthouse service discovery component, which fails to validate IP addresses advertised in EndpointSlice objects. An attacker controlling a compromised spoke cluster can inject arbitrary IP addresses into EndpointSlices, causing lighthouse DNS resolution across all connected clusters to redirect legitimate cross-cluster service traffic to attacker-controlled endpoints. The CVSS Scope:Changed metric confirms that impact propagates beyond the compromised spoke cluster to the hub and peer clusters, enabling unauthorized interception and manipulation of inter-cluster communications. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in BigBlueButton's screenshare recording playback allows an authenticated low-privileged user to inject arbitrary script via a crafted meeting name, which executes in any other user's browser upon viewing the screenshare recording. Affected versions are all BigBlueButton releases prior to 3.0.29; the vulnerability is rooted in unescaped ERB interpolation of meetingName into both the page title and heading of index.html.erb. No public exploit or CISA KEV listing has been identified at time of analysis, though the publicly available commit diff could guide exploit development.
Authenticated IDOR in the Winter CMS backend FileUpload widget (versions through 1.2.12) allows any backend user - including those with no role beyond default My Account access - to manipulate attachment metadata and sort ordering across the entire application by submitting an attacker-controlled file_id POST parameter. Because the system_files table uses sequential integer primary keys, any authenticated attacker can enumerate and target arbitrary System\Models\File records belonging to unrelated users or models, overwriting title, description, and sort_order, and potentially triggering onRemoveAttachment against unrelated records through the same unscoped lookup. No public exploit has been identified at time of analysis, and no CISA KEV entry exists.
Stored XSS in Laravel Backpack CRUD's color column Blade template allows any authenticated user with write access to a color-typed field to inject arbitrary JavaScript that executes in the browsers of other users - including administrators - who view the affected list page. The root cause is an inversion of the escaped/unescaped rendering branches in `color.blade.php`: because `$column['escaped']` defaults to `true`, the template renders values raw via `{!! $column['text'] !!}` instead of HTML-escaped, the exact opposite of every other column template in the library. No public exploit has been identified at time of analysis, but the CVSS scope-change indicator (S:C) reflects real cross-user impact including potential session cookie and CSRF token theft from administrators.
Memory exhaustion in Mailpit's SMTP server (versions 1.30.0 through 1.30.4) allows unauthenticated remote SMTP clients to force heap allocation beyond the configured MaxMessageSize limit by transmitting a single DATA line exceeding the cap - because `bufio.Reader.ReadBytes('\n')` buffers the entire line into memory before the size check is applied. This is a post-fix incomplete remediation of an earlier SMTP body-size advisory: multi-line DATA accumulation was bounded, but single-line pre-read was not, leaving a residual gap in versions 1.30.0-1.30.4. A proof-of-concept demonstrating a 64 MiB single-line RSS spike is included in the GitHub security advisory; no active exploitation has been confirmed (not listed in CISA KEV).
Uncontrolled resource consumption in Mailpit's thumbnail generation endpoint allows unauthenticated network clients to exhaust server memory and CPU by submitting email attachments containing image decompression bombs. The affected code path in server/apiv1/thumbnails.go calls imaging.Decode() with AutoOrientation before performing any dimension, pixel-count, or memory validation, meaning a compact on-disk image declaring enormous pixel dimensions triggers full raster allocation prior to the 180×120 scaling step. No public exploit code has been identified and the vulnerability is absent from CISA KEV; the vendor-confirmed fix is Mailpit 1.30.4.
Uncontrolled memory allocation in Mailpit's SMTP command reader allows unauthenticated remote clients to exhaust server memory by sending oversized pre-DATA command lines. Versions prior to 1.30.4 use Go's unbounded `bufio.Reader.ReadString` in `internal/smtpd/smtpd.go`, which allocates the full attacker-controlled input before any syntax rejection or RFC 5321 line-length enforcement occurs. The same vulnerable code path handles AUTH continuation lines (LOGIN, PLAIN, CRAM-MD5), so concurrent oversized inputs compound memory pressure and can reduce service availability. No public exploit identified at time of analysis; a vendor-released patch is available in v1.30.4.
Missing authorization on the toggle_like and mark_as_seen endpoints in Frappe Framework 16.31.0 and earlier allows authenticated users to interact with documents and notes they lack read access to. Any valid session holder can call these whitelisted endpoints with arbitrary doctype and document name parameters, confirming resource existence and modifying _liked_by metadata or note-seen state without a permission check. No public exploit has been identified at time of analysis, but an upstream fix exists in pull request #39760 with no released patched version confirmed.
Server-Side Request Forgery in TREK, a collaborative travel planner, allows any authenticated user to pivot the server into making blind GET requests against loopback addresses, RFC 1918 internal networks, or cloud instance metadata endpoints (e.g., 169.254.169.254). The root cause is that importGoogleList(), importNaverList(), and resolveGoogleMapsUrl() validate only the initial submitted URL via checkSsrf() but then call native fetch() with redirect:'follow', bypassing DNS-pinned safeFetch() on redirect hops. No public exploit code or CISA KEV entry has been identified at time of analysis; the CVSS 4.0 score of 5.3 reflects the authenticated prerequisite and blind (non-reflective) nature of the SSRF.
Cross-project credential reference injection in n8n before 2.34.1 allows low-privileged attackers holding a valid MCP Bearer API key to bypass authorization controls in the create_workflow_from_code MCP tool and embed references to credentials belonging to other projects into workflows they should not control. The bypass is conditional on the credential authentication type being set to 'expression', at which point n8n fails to enforce project-scoped authorization on credential objects. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 5.3 reflects a realistic, low-complexity network attack by authenticated users.
Uncontrolled Resource Consumption (CWE-400) in Apache InLong versions 2.0.0 through 2.3.x exposes two related attack surfaces: authenticated users can trigger excessive resource consumption to degrade service availability, and the same pathway permits upload of non-official packages, introducing a package-integrity risk alongside the denial-of-service vector. Affected deployments running any release in the 2.0.0-2.3.x range should treat this as a priority upgrade given the dual nature of the flaw. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Information disclosure in OpenProject 17.5.1 and earlier allows authenticated non-admin project members to read hidden admin-only custom field comment text by directly requesting the inplace-edit dialog endpoint with a raw custom_field_ identifier. The dialog resolves the field without enforcing the admin_only visibility scope, exposing stored comment content in read-only mode; the custom field value itself and all write operations remain inaccessible. No active exploitation is confirmed and no public exploit has been identified; a vendor patch is available in version 17.6.0.
ReDoS in n8n's Filter and Switch nodes allows an authenticated workflow author to monopolize a worker thread indefinitely by supplying a catastrophic backtracking regex compiled via `new RegExp()` without complexity validation or execution timeout. Affected are n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1; per-item execution amplifies the impact proportionally to dataset size, stalling all concurrent workflows on the same worker. No public exploit code or CISA KEV listing has been identified at time of analysis.
NIOWebSocket in swift-nio (all versions before 2.101.0) crashes the hosting process when any unauthenticated remote peer sends a single crafted 11-byte WebSocket frame following a completed handshake, terminating all active connections until the service restarts. Frameworks built on swift-nio - including Vapor and Hummingbird - inherit this exposure whenever they accept WebSocket connections. No public exploit code has been identified, but SSVC classifies the attack as automatable, lowering the bar for repeated or scripted denial-of-service.
ATutor 2.2.4, an end-of-life open-source e-learning platform, allows any low-privileged authenticated user enrolled in a course to bypass authorization controls on the test and question import backend endpoints, enabling unauthorized content manipulation within the course. By directly targeting import endpoints that lack proper authorization checks, a student-level account can import tests and questions they should have no permission to manage. No patch is available and none will be issued, as the product is no longer actively maintained.
File enumeration in vsDesk service desk software allows remote authenticated attackers to predict and retrieve uploaded files by brute-forcing timestamp-derived filenames within a narrow time window. Affected instances running versions prior to 14.0101 expose any uploaded document to unauthorized access by any logged-in user, enabling secondary attacks through sensitive file exfiltration. No public exploit code has been identified at the time of analysis, and no CISA KEV listing exists.
Unauthorized file upload in the AI Agent by SiteGround WordPress plugin (all versions through 1.2.7) allows attackers to inject arbitrary images into the WordPress media library by exploiting a missing upload_files capability check in the plugin's REST API endpoint. The endpoint's nonce (sg_ai_studio_gutenberg_nonce) is broadcast to all users with block editor access - including Contributors - making the absent capability check the sole enforcement barrier. No public exploit has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited integrity impact with no confidentiality or availability consequence.
Insecure Direct Object Reference in ATutor 2.2.4 allows any authenticated user - including students with the lowest privilege level - to permanently delete profile pictures belonging to any other user, including instructors and administrators, by supplying an arbitrary member_id in a POST request to the profile album endpoint. The product is end-of-life with no patch forthcoming, making this a permanent unresolved exposure for any remaining deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, though the exploitation barrier is minimal given only a valid student account is required.
Server-Side Request Forgery in Lightdash's scheduled delivery webhook feature allows authenticated users to direct the backend server to issue POST requests to private, loopback, and link-local addresses - including cloud instance metadata endpoints. All deployments running versions prior to 1.146.4 are affected; both the Google Chat and Microsoft Teams webhook delivery paths bypass the existing validatePublicHttpUrl sanitization that is correctly applied elsewhere in the codebase. While the upstream response is never relayed to the attacker, the error-vs-success distinction enables internal network probing and, in cloud-hosted deployments, potential access to instance metadata services. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Reflected XSS in the Phoca Download Extension for Joomla (versions 5.0.0 through 6.1.4) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL containing a payload in the 'search' GET parameter. Exploitation requires social engineering to lure a victim into clicking the crafted link, after which the attacker can steal session tokens, perform actions on behalf of the victim, or redirect to malicious sites. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Reflected cross-site scripting in Phoca Cart, a Joomla e-commerce extension by phoca.cz, affects versions 5.0.0 through 6.1.7 via the price_from and price_to URL filter parameters. An unauthenticated remote attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser session. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Improper authorization in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows authenticated remote attackers to perform unauthorized grade operations against arbitrary student records by manipulating the student_id parameter in the add_grade function at /index.php. This is a horizontal privilege escalation flaw - an authenticated user (e.g., a student) can affect records they do not own, compromising both confidentiality and integrity of academic grade data. No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis, and the CVSS 4.0 score of 5.3 reflects medium severity with limited but real impact.
Compression bomb detection bypass in Tor before 0.4.9.9 enables remote unauthenticated attackers to deliver resource-exhausting payloads that evade the node's per-stream decompression safeguards. By concatenating multiple gzip or zlib sub-streams - each individually sized just below Tor's detection threshold - an attacker circumvents the aggregate bomb check entirely, potentially degrading availability of Tor nodes or relays. Tracked as TROVE-2026-022; no public exploit code or active exploitation (CISA KEV) has been identified; the CVSS 5.3 Medium score reflects the limited but real availability impact.
Integer truncation in libsoup's SoupServer Range-header comparator silently drops byte ranges from HTTP 206 Partial Content responses when the target resource exceeds approximately 2 GB. The sort_ranges() function in soup-message-headers.c narrows a 64-bit offset subtraction to a 32-bit int return value, inverting the comparator sign whenever offsets differ by more than INT_MAX, causing incorrect range sorting and silent omission of content. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires network access to a SoupServer instance serving files larger than ~2 GB.
Injection in PentestGPT's Web-Page Crawling component (versions up to 1.0.0) allows remote attackers to manipulate the Traceback argument during crawling operations, producing limited confidentiality, integrity, and availability impact against the vulnerable instance. The CVSS 4.0 score of 2.3 reflects a genuinely low-severity finding - high attack complexity and required passive user interaction constrain real-world exploitation to difficult, targeted scenarios. A public proof-of-concept exists, but the upstream maintainer closed the associated GitHub issue as 'not planned', leaving the flaw unpatched with no remediation in sight.
Infinite loop denial-of-service in Tor before 0.4.9.9 allows a remote, unauthenticated attacker to cause sustained CPU exhaustion on a vulnerable node by delivering a crafted truncated zlib/gzip compressed stream. The root cause is in buf_add_compress(), which misinterpreted zlib's Z_BUF_ERROR return (no remaining input) as a full output buffer requiring retry, looping forever without progress. No public exploit has been identified at time of analysis, and the CVSS score of 3.7 with high attack complexity (AC:H) limits practical exploitation to adversaries capable of precisely crafting malformed compressed payloads reachable by a Tor node.
Server-side request forgery in Omnivore's scanFeedsResolver GraphQL endpoint allows authenticated users to direct the API server to fetch arbitrary internal URLs, bypassing the validateUrl() guard consistently applied elsewhere in the same codebase. Reachable internal endpoints return partial feed metadata (URL, title, description, type) and advertised RSS/Atom link elements; unreachable ports are distinguishable through error differentiation, enabling internal network enumeration. No public exploit has been identified and this vulnerability is not listed in CISA KEV; an upstream patch has been merged as commit c4d7d8562.
User enumeration in the Frauscher FDS 102 railway diagnostic system allows low-privileged remote attackers to retrieve the complete list of configured accounts and identify which hold elevated privileges via the unprotected PHP endpoint /api/user/fetch-all.php. The CPE confirms all tracked versions of the FDS 102 are affected, and the CVSS 4.0 vector (PR:L) indicates exploitation requires an existing low-privilege credential but no user interaction. No public exploit code and no active exploitation have been identified at time of analysis; this is reported by CERTVDE under advisory VDE-2026-078.
Missing Authorization in myCred's New User Approve WordPress plugin through version 3.2.8 permits unauthenticated remote attackers to exploit incorrectly configured access control security levels, resulting in unauthorized integrity modifications - most likely manipulation of user registration approval states. Reported by Patchstack and assigned a CVSS 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, the flaw is exploitable without credentials or user interaction against any WordPress site running the affected plugin. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Binary HTTP parser in Netty's `netty-incubator-codec-bhttp` (all versions through 0.0.22.Final) crashes with an unchecked `ArrayIndexOutOfBoundsException` when processing a 15-byte crafted payload, enabling remote unauthenticated denial of service. The parser accumulates attacker-controlled varint field lengths - read correctly as `long` - into `int` offset counters; a value of 2^31 silently wraps the accumulator negative via Java's compound-assignment narrowing, bypassing the readable-bytes guard and reaching unchecked buffer index arithmetic. Publicly available exploit code exists per the GitHub advisory GHSA-pgrf-4654-3gq8; no active exploitation is confirmed in CISA KEV.
Blind Server-Side Request Forgery in Omnivore's webhook registration flow allows any authenticated user to coerce the application server into issuing repeated HTTP requests to arbitrary internal endpoints, including cloud instance metadata services. The flaw affects all Omnivore API server deployments (CPE: cpe:2.3:a:omnivore-app:omnivore:*:*:*:*:*:*:*:*) and is rooted in setWebhookResolver accepting and persisting caller-supplied URLs with no address validation before callWebhook later executes them via axios. No public exploit identified at time of analysis, and no CISA KEV listing exists; a patch commit is available upstream.
Stored cross-site scripting in ATutor 2.2.4 allows unauthenticated attackers to register an account and inject a JavaScript payload into the phone number field, which executes in the browser of any authenticated user who subsequently visits the attacker's public profile. The immediate impact is session cookie theft, enabling account takeover of the victim without further interaction. No patch will be issued as ATutor is end-of-life; no public exploit code or CISA KEV listing has been identified at time of analysis.