Reflected XSS in Combodo iTop's universal search feature (all versions prior to 3.2.3) allows an authenticated attacker to inject arbitrary JavaScript via the OQL filter parameter, which executes in a victim's browser upon visiting a crafted URL. The root cause is direct HTML output of the user-supplied OQL query string in UniversalSearch.php without sanitization, confirmed by the patch commit adding utils::EscapeHtml(). No CISA KEV listing or confirmed public exploit exists at time of analysis; exploitation requires attacker-supplied credentials and victim interaction, limiting opportunistic risk despite the CVSS 8.0 rating.
Reflected Cross-Site Scripting in Combodo iTop's tagadmin.php page allows an authenticated attacker to craft a malicious URL that, when visited by another authenticated user, executes arbitrary JavaScript in their browser session. All iTop installations prior to version 3.2.3 are affected, with the vulnerability root-caused to the $sFilter request parameter being reflected into HTML output without sanitization. No public exploit or active exploitation has been identified at time of analysis, but the high CVSS impact scores reflect the realistic potential for session hijacking or privilege escalation within the iTop management interface.
Reflected XSS in Combodo iTop's synchro import script prior to version 3.2.3 enables attackers to inject and execute arbitrary JavaScript in the browsers of authenticated users who click a crafted link. The vulnerable parameter `data_source_id` in `synchro/synchro_import.php` was processed without output encoding, as confirmed by the vendor fix commit. No active exploitation has been identified at time of analysis, and no public exploit code has been disclosed.
Reflected XSS in Combodo iTop's OQL query testing interface (run_query.php) allows authenticated attackers to inject and execute arbitrary JavaScript in the browser sessions of other authenticated users. All iTop versions prior to 3.2.3 are affected; the vendor has released a patch in 3.2.3 confirmed by a public GitHub advisory and commit. No public exploit code or active exploitation has been identified at time of analysis.
Arbitrary code execution in Facebook Research Hydra prior to version 1.3.4 allows any party who can supply untrusted configuration - including YAML config files, CLI overrides, or ML model metadata - to invoke dangerous Python callables through hydra.utils.instantiate(). The vulnerability stems from _resolve_target() accepting any Python callable path without restriction, enabling an attacker to trigger functions such as os.system, subprocess.Popen, or builtins.exec inside the consuming application's process. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the upstream fix is confirmed shipped in v1.3.4.
Command injection in Cloud Foundry's BOSH CLI on Windows enables an adjacent-network attacker to execute arbitrary shell commands - specifically via PowerShell injection - without requiring authentication. The vulnerability affects all tracked versions of the BOSH CLI (cpe:2.3:a:cloud_foundry_foundation:bosh_cli) when deployed on Windows hosts, resulting in full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-impact CVSS vector (7.5) and the specificity of the PowerShell injection vector indicate meaningful risk for Cloud Foundry operators running BOSH on Windows.
Use-after-free in the Linux kernel's route4 (cls_route) traffic classifier fastmap cache allows a local attacker with CAP_NET_ADMIN to read freed kernel heap memory by racing filter deletion against fastmap cache population, potentially escalating to full kernel compromise. Affected versions span Linux 3.18 through current stable branches; the kernel security team backported fixes to eight LTS/stable lines (5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2). No public exploit identified at time of analysis; EPSS of 0.17% (6th percentile) reflects minimal current exploitation activity, though the theoretical impact is severe given the kernel-level UAF primitive.
Out-of-bounds kernel memory write in the Linux kernel packet socket implementation allows a local low-privilege attacker to corrupt kernel memory by exploiting a race condition between `packet_snd()` reads of `dev->hard_header_len` and concurrent device reconfiguration. When the race is won - for example during a bonding device type change - `skb->data` is positioned before `skb->head`, and the subsequent userspace copy writes beyond the allocated socket buffer, creating a kernel memory corruption primitive suitable for local privilege escalation. No public exploit or CISA KEV listing exists at time of analysis; EPSS of 0.16% reflects very low current exploitation probability, though the primitive is powerful and patch availability across multiple stable branches makes remediation straightforward.
Out-of-bounds kernel memory read and write in Imagination Technologies Graphics DDK exposes systems with PowerVR/Rogue GPUs to full local privilege escalation from any non-privileged user process. Affected versions include Graphics DDK 24.2 RTM2, 25.1 RTM2 through 25.3 RTM, and 26.1 RTM1 - spanning multiple release trains. No public exploit or CISA KEV listing exists at time of analysis; EPSS sits at 0.15% (5th percentile), reflecting low current exploitation momentum despite a CVSS 7.8 local-privilege-escalation profile with High impact across confidentiality, integrity, and availability.
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands to GPU Firmware, triggering writes outside the guest's virtualized GPU memory boundary (CWE-823). Affected are multiple DDK release trains including versions 25.1 RTM2 through 25.3 RTM, 24.2 RTM2, 23.2 RTM2, and 1.18 RTM2. No public exploit code exists and CISA has not added this to KEV; however, SSVC assesses total technical impact given successful exploitation yields full C/I/A compromise of the guest environment.
Server-side request forgery in Headroom LLM proxy (versions before 0.36.1) allows unauthenticated remote attackers to redirect proxy upstream requests to arbitrary internal, loopback, link-local, or RFC 1918 destinations - including cloud instance metadata endpoints such as 169.254.169.254 - by supplying a crafted x-headroom-base-url request header. The proxy returns upstream responses verbatim to the caller, disclosing internal service content; critically, it also forwards the original Authorization header to the attacker-designated host, enabling credential harvesting. Exploitation is trivially achievable against deployments using the vendor-shipped docker-compose.yml, which binds 0.0.0.0 and enforces no HEADROOM_PROXY_TOKEN by default - a configuration weakness the server itself warns about at startup. No public exploit or KEV listing is identified at time of analysis; a vendor patch is available in v0.36.1.
Unauthorized ManagedCluster deletion in Red Hat Multicluster Engine (MCE) allows any tenant with standard ClusterClaim permissions to destroy clusters belonging to other tenants or the hub itself, including the hub's local-cluster. The clusterclaims-controller fails to verify ownership before acting on the spec.namespace field, meaning a low-privileged tenant can target arbitrary ManagedClusters by crafting that field and then deleting the ClusterClaim. No public exploit or CISA KEV listing exists at time of analysis, but the attack requires only standard tenant credentials and no special configuration, making it a realistic insider or compromised-tenant threat.
Access control bypass in Combodo iTop prior to 3.2.3 allows authenticated low-privileged users to read data outside their assigned silos via crafted OQL queries. The iTop silo isolation mechanism - which restricts users to specific data partitions - fails to apply visibility filters to classes joined in OQL but not explicitly listed in the SELECT clause, enabling cross-silo confidential data disclosure. No public exploit code or CISA KEV listing exists at time of analysis; the vendor has released a confirmed fix in version 3.2.3.
Remote memory exhaustion in Bluewave Labs Checkmate prior to version 3.9.1 allows unauthenticated network attackers to crash or destabilize the Node.js backend by submitting concurrent oversized multipart uploads to the public POST /api/v1/auth/register endpoint. The in-memory Multer parser buffers uploaded files before registration validation executes, meaning no file-size, file-count, or MIME-type boundary is enforced prior to business-logic rejection - allowing attacker-controlled allocations to exhaust server RAM. No public exploit has been identified at time of analysis, though the attack requires no credentials, no special tooling, and is easily automatable against any internet-exposed deployment.
Out-of-bounds read and one-byte out-of-bounds write in mod_auth_openidc's state-cookie parser (all versions prior to 2.4.19.4) allow unauthenticated remote attackers to crash Apache worker processes by sending a malformed Cookie header. The root cause is a loop termination condition in src/state.c that checked whether a pointer was NULL — a condition that could never fire since the pointer is only ever incremented — rather than checking for the string terminator, causing state-prefixed cookie tokens lacking '=' to scan and write past the end of the token buffer. No CISA KEV listing or confirmed public exploit exists at time of analysis, but the CVSS AV:N/AC:L/PR:N profile and the fully transparent fix commit make this trivially automatable for denial-of-service once widely known.
Unbounded session accumulation in Spring AI 2.0.0's MCP Streamable HTTP server transport enables remote unauthenticated attackers to exhaust server memory, ultimately causing a Denial of Service that disrupts all legitimate clients. Both WebFlux and WebMvc transport variants are affected because neither enforces a session cap nor mandates client authentication by default. No public exploit code has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects trivially simple exploitation from any network with access to the MCP endpoint.
Execution After Redirect (EAR) in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel enables unauthenticated network attackers to bypass authentication controls and access protected administrative content through version 28072026. The flaw exploits a server-side logic error where HTTP redirect responses intended to gate access to the login page continue executing and rendering protected page content, which an attacker can read before following the redirect. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the risk is primarily elevated by the unauthenticated, low-complexity network vector.
Information disclosure in Esri Portal for ArcGIS versions 11.5 through 12.0 allows remote unauthenticated attackers to extract sensitive data reflected in HTTP response bodies via crafted requests. The vulnerability (CWE-200) requires no authentication or user interaction per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, meaning any internet-exposed Portal instance in the affected version range is potentially reachable without credentials. No public exploit or KEV listing exists at time of analysis, and SSVC classifies exploitation as none with partial technical impact, indicating limited observed threat activity despite the high confidentiality impact scored by NVD.
Sensitive information reflection in Esri Portal for ArcGIS versions 11.1 through 12.0 exposes confidential content in HTTP response bodies to remote, unauthenticated attackers under specific, difficult-to-reproduce conditions. The vulnerability stems from improper information exposure (CWE-200), where a crafted request can cause the server to echo sensitive data back in its response. No active exploitation has been confirmed, and EPSS probability is low at 0.33%, though CVSS rates confidentiality impact as high given the potential sensitivity of reflected data.
Unauthenticated access to inline images in Combodo iTop prior to version 3.2.3 is protected by a 24-bit secret generated with PHP's non-cryptographic mt_rand(), yielding only ~16.7 million possible values and making brute-force enumeration feasible for any network-reachable attacker. The commit diff confirms the secret was stored as a 6-character hex string (sprintf('%06x', mt_rand(0, 0xFFFFFF))), and a secondary timing side-channel existed because the comparison used != instead of constant-time hash_equals(). No active exploitation is confirmed in CISA KEV, and no public POC has been identified at time of analysis.
User enumeration in Combodo iTop prior to version 3.2.3 allows remote unauthenticated attackers to identify valid accounts by observing distinct error responses in the forgot-password mechanism. The application returned different messages depending on account state - external authentication, fixed password, missing email - making it possible to distinguish valid usernames from invalid ones without any credentials. No public exploit code has been identified at time of analysis, and the issue is resolved in iTop 3.2.3 per the vendor's GitHub Security Advisory GHSA-888g-gv33-xwwx.
Unauthenticated remote access to uploaded documents is possible in Combodo iTop versions prior to 3.2.3 due to a missing authentication check in the ajax.document.php endpoint. The commit diff confirms that LoginWebPage::DoLoginEx() was absent from critical code paths that serve uploaded files, allowing any network-reachable user who obtains a valid document URL to download sensitive content without credentials. No public exploit code has been identified at time of analysis, but the attack is technically trivial given the low-complexity, unauthenticated CVSS vector.
Denial-of-service in Tie::Hash::Regex before 2.0.0 for Perl allows unauthenticated remote attackers to crash any application that performs hash lookups with externally supplied strings. The FETCH, EXISTS, and DELETE methods compiled caller-provided keys as bare regex patterns without an eval guard, causing the Perl process to die on any syntactically invalid pattern such as an unmatched bracket. No public exploit code has been identified, and EPSS sits at just 0.24% (15th percentile), consistent with a niche library with narrow deployment; however, the impact on any affected application is immediate process termination.
Stored HTML injection in Rocket.Chat's Omnichannel Queue panel allows unauthenticated external attackers to render arbitrary, clickable phishing links in the browsers of support agents viewing the queue. All Rocket.Chat deployments with Livechat/Omnichannel enabled and running versions prior to 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, or 7.10.15 are affected. An attacker submitting a crafted visitor name via the unauthenticated POST /api/v1/livechat/visitor REST endpoint can inject arbitrary HTML into the agent-facing side panel UI, enabling targeted social-engineering attacks against customer support staff; no public exploit has been identified at time of analysis, and the EPSS score of 0.18% indicates minimal opportunistic interest.
Sensitive OAuth configuration data is exposed to unauthenticated remote actors in Apache CloudStack's OAuth authentication plugin when the OAuth provider listing endpoint is queried. Affected versions span two release branches: 4.19.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0. Despite a CVSS score of 7.5 reflecting unauthenticated network access and high confidentiality impact, EPSS sits at just 0.17% (7th percentile), and no public exploit code or CISA KEV listing has been identified at time of analysis, suggesting limited active exploitation to date.
Sensitive information exposure in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration allows unauthenticated remote attackers to access high-confidentiality data across two affected version ranges. The flaw is network-reachable with no authentication or user interaction required (CVSS AV:N/AC:L/PR:N/UI:N), making it a genuine High-severity finding for any CloudStack deployment with OAuth2 or Google OAuth enabled. EPSS sits at 0.17% (7th percentile) and no CISA KEV listing exists, suggesting no public exploitation activity at time of analysis; however, the low attack complexity and zero privilege requirement keep real-world risk elevated for affected configurations.
Missing authorization controls across multiple Userdata-related APIs in Apache CloudStack expose cross-tenant data to any authenticated CloudStack user. Affected APIs - deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, updateVirtualMachine, and (from 4.21.0.0) deleteCniConfiguration - fail to validate that the requesting account owns the target userdata resource, enabling one tenant to read, delete, or manipulate another tenant's userdata. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS of 0.13% at the 3rd percentile indicates low automated exploitation activity to date, though the multi-tenant cloud infrastructure context makes successful exploitation high-impact for affected operators.
NTLM credential exposure in Git for Windows before 2.55.0.windows.4 allows a malicious remote Git server to capture Windows authentication material by advertising a crafted bundle URI during clone or fetch operations. When transfer.bundleuri is enabled, non-HTTP(S) URIs including bare UNC paths are treated as local filesystem paths, causing Windows to initiate an outbound SMB connection to an attacker-controlled host and expose NTLM hashes. No public exploit code has been identified at time of analysis and no CISA KEV listing is present, but the technique maps directly onto well-documented NTLM capture and relay attack patterns.
Credential leakage in Bluewave Labs Checkmate versions 3.3.0 through 3.9.1 exposes HTTP Authorization secrets to unauthenticated remote visitors when the global showURL setting is enabled. The unauthenticated GET /api/v1/status-page/:url endpoint returns complete monitor objects from statusPageController.ts, including the secret field consumed by HttpProvider.ts as a bearer or basic-auth credential against monitored upstream services. Although the frontend component BaseStatusPage.tsx intentionally omits this value from the UI, the raw JSON API response delivers it in full, allowing any visitor to harvest credentials and pivot attacks against monitored infrastructure. No public exploit code has been identified at time of analysis, and the issue is fixed in v3.9.2.
Reflected XSS in Combodo iTop prior to version 3.2.3 allows an authenticated low-privilege attacker to inject arbitrary JavaScript via the unsanitized `dashboard_id` parameter in the dashboard revert endpoint `/pages/ajax.render.php`. When a crafted URL is opened by a higher-privileged victim, the payload executes in their browser context, enabling session hijacking or unauthorized actions performed under the victim's identity. No CISA KEV listing or public proof-of-concept exploit has been identified at time of analysis.
DLL hijacking in Remote Utilities Host ≤7.7.3.0 allows any local, unprivileged Windows user to achieve NT AUTHORITY\SYSTEM-level code execution by replacing service DLLs during a race window. The installer incorrectly grants BUILTIN\Everyone FULL CONTROL over all DLL files in the installation directory - including libasset32.dll and seven additional codec and multimedia libraries - enabling overwrite by any local account. No public exploit is identified at time of analysis, but the technique is well-established and the race window reliably materializes during software updates, service crashes, or manual restarts.
Stored Cross-Site Scripting in WPForms Pro for WordPress (all versions through 2.0.0.2) allows unauthenticated remote attackers to inject persistent malicious scripts via form text fields, which execute in the browser of any user who views the stored form entry. The vulnerability exploits a subtle interaction between the plugin's custom kses allowlist expansion - permitting iframes with a data-src attribute - and the WordPress core URI sanitizer's blindspot for that attribute, compounded by the plugin's own admin script promoting data-src to a live src. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis, though the unauthenticated attack surface and administrative execution context make this a credible priority for WordPress site operators.
Cross-origin RRDP URL confusion in FORT Validator through 1.6.7 allows a delegated Certificate Authority sharing the same Trust Anchor Locator to silently poison the validator's download cache, causing the victim CA's Validated ROA Payloads and signed objects to be purged from FORT's routing origin validation output. The resulting VRP gaps - triggered passively by the victim's own routine publication cycle - can enable BGP route hijacking or loss of network reachability for the affected IP prefixes. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 7.2 with high integrity impact on subsequent routing infrastructure reflects serious operational risk for networks relying on FORT for RPKI-based origin validation.
Broken object-level authorization in Apache CloudStack exposes project role management APIs to Domain Admins operating outside their assigned domain scope. Authenticated Domain Admins can create, update, delete, and enumerate project roles and role permissions for projects belonging to entirely unrelated domains, because the authorization check validates only that the caller holds the Domain Admin role without confirming the target project falls within their domain or any subdomain hierarchy. Affected versions span 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0; no public exploit has been identified at time of analysis and EPSS probability is very low at 0.13%.
Shell-command parser bypass in Omnigent's policy layer allows an authenticated or prompt-injected agent to push code to unauthorized GitHub repositories or escape workspace confinement in all versions prior to 0.3.0. The parser in omnigent/policies/builtins/_shell.py fails to extract the real command when it is wrapped with process utilities (timeout, nice, setsid, stdbuf), combined interpreter flags (bash -lc), command substitutions ($(...) or backticks), or the background operator - returning no recognized tokens, causing both the github.py repository/branch allowlist and working_dir.py workspace confinement policies to abstain and implicitly permit the command. No public exploit code has been identified and no CISA KEV listing exists, but the bypass technique is directly derivable from the published advisory and PR diff.
NULL pointer dereference in TP-Link TL-MR6400 v7's HTTP request parsing crashes the management daemon when an unauthenticated adjacent-network attacker sends a specially crafted request containing a malformed session cookie header. Successful exploitation results in a denial-of-service condition, disabling the web management interface and CGI functionality until service recovery - no confidentiality or integrity compromise is possible. No active exploitation has been confirmed (not in CISA KEV), no public proof-of-concept code has been reported, and a vendor patch is available.
Cross-organization report data exposure in OpenPanel allows any authenticated user to read all analytics reports belonging to another organization's dashboard by supplying a mismatched projectId and dashboardId pair to the report.list tRPC procedure. The enforceAccess middleware validated only project membership, not dashboard ownership, while the underlying getReportsByDashboardId query applied no project-scoping filter - enabling a classic IDOR across tenant boundaries. No public exploit has been identified and no CISA KEV listing exists, but the attack requires only a valid session and knowledge of a foreign dashboardId, making it low-friction in multi-tenant deployments.
Cross-tenant document content corruption in PDFio before 1.6.5 allows low-privileged network attackers to silently overwrite one caller's PDF dictionary string values with another caller's data in multi-threaded or pooled-request environments. The defect is in `pdfioDictSetStringf`, which stored a raw pointer to a stack-local formatted string buffer in the document dictionary rather than heap-allocating a copy, leaving the dictionary referencing reclaimed stack memory after the function returned. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patch v1.6.5 is confirmed available.
Reflected XSS in Combodo iTop's dashboard save functionality, present in all releases prior to 3.2.3, allows remote unauthenticated attackers to execute arbitrary JavaScript in the browser of an authenticated iTop user. The vulnerability originates in ajax.render.php, where dashboard_id and reload_url parameters were interpolated directly into inline JavaScript without escaping. With a CVSS Scope Changed classification (S:C), successful exploitation can affect resources beyond the iTop origin. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based out-of-bounds write in the TP-Link TL-MR6400 v7 administrative web interface login handler allows an unauthenticated attacker with adjacent network access to crash the web management service by sending a specially crafted malformed HTTP request. The vulnerability (CWE-787) is confined to the login request parsing path and requires no authentication or user interaction, though exploitation is bounded by the adjacent network attack vector. Impact is limited to a denial-of-service condition - temporary loss of management interface access - with no confirmed confidentiality or integrity impact; no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Insecure direct object reference in OpenPanel's tRPC report.get procedure exposes any saved report's full configuration to any authenticated instance user. The enforceAccess middleware in packages/trpc/src/trpc.ts conditionally evaluates project membership only when the input carries a projectId or organizationId key; since report.get accepted only a reportId, it bypassed all authorization checks, and the underlying getReportById query performed no project-level scoping. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the attack pattern is trivially reproducible by any authenticated developer familiar with tRPC.
Path traversal in JuiceFS filestore backend (pkg/object/file.go) enables arbitrary file writes outside the configured storage root during sync operations. The path() helper joined incoming object keys onto the storage root via filepath.Join or filepath.Clean without verifying the resolved result remained within that root, affecting Put, Get, Head, Delete, Chmod, Chown, Symlink, and Readlink. An attacker who can plant object keys containing traversal sequences such as ../../etc/cron.d/backdoor into a source bucket - a shared, public, or compromised bucket - causes a juicefs sync to write attacker-supplied content to arbitrary filesystem paths on the operator's host. No public exploit identified at time of analysis; an upstream fix is available via commit 0bcd70b3d and pull request #7425.
Arbitrary file read in YOOtheme Pro (Joomla extension) versions 2.3.0 through 5.0.40 allows privileged authenticated users to access files outside the intended directory by exploiting glob-based pattern injection in the Filesystem source's path filter. The vulnerability requires high-privilege credentials on the Joomla backend, limiting the attack surface to trusted but potentially malicious insiders or compromised administrator accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 7.0 reflects the high confidentiality impact from unrestricted file reads.
Command injection in Apache CloudStack's diagnostics APIs allows Admin-role authenticated users to execute arbitrary commands as root on system VMs and Virtual Routers, constituting a full compromise of those instances across versions 4.20.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0. The getDiagnosticsData and runDiagnostics API endpoints fail to properly neutralize special shell characters in user-supplied input before passing it to underlying diagnostic processes on the target VMs. No public exploit code or CISA KEV listing has been identified at time of analysis, but successful exploitation of a Virtual Router can expose all guest network traffic routed through that instance and provide a lateral movement foothold within the CloudStack-managed infrastructure.
OS command injection in Apache CloudStack's NAS backup provider plugin enables an authenticated operator account to execute arbitrary commands on KVM hypervisor hosts by supplying unsanitized shell metacharacters to the addBackupRepository or updateBackupRepository management APIs. Affected deployments span versions 4.20.0.0 through 4.22.1.0 when the NAS backup provider plugin is in use; exploitation is deferred and triggered when any downstream account performs a backup restore. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as 'none,' though technical impact is rated 'total' given hypervisor-level code execution.
Unauthorized LDAP configuration disclosure in Apache CloudStack exposes LDAP server details - including bind credentials and hostnames - to any authenticated user via the listLdapConfigurations API, which is accessible to all default CloudStack roles. Affected versions span 4.2.0.0 through 4.22.1.0, a broad range suggesting long-standing exposure in enterprise and cloud provider deployments. No public exploit code has been identified at time of analysis, but the low barrier of a valid account and the downstream risk of harvested LDAP bind credentials elevate practical severity beyond the EPSS score suggests.
Cleartext storage of sensitive information in Apache CloudStack's AsyncJob database records exposes credentials and operation-sensitive data to any party with read access to the underlying database. All CloudStack deployments from version 4.0.0 through 4.22.1.0 are affected across both the 4.x stable and 4.21/4.22 release lines. No public exploit code has been identified and EPSS sits at the 1st percentile, but the NVD-assigned confidentiality impact of HIGH reflects that AsyncJob records may capture sensitive payloads - such as API secrets or passwords - passed through asynchronous operations, stored durably in cleartext rather than encrypted at rest.