Tenant data boundary failure in Roskus Prospero Flow CRM 4.9.1-5.14.0 allows authenticated users holding transaction and accounting creation permissions to read another co-tenant company's bank account name, institution name, and card last four digits by supplying a foreign bank_account_id or bank_card_id in POST /transaction/save. The root cause (CWE-639, IDOR) is the complete absence of company-ownership validation on user-controlled integer foreign keys before they are persisted and rendered - the controller correctly scoped the new transaction's company_id but applied no such scoping to associated reference IDs. No active exploitation or public POC has been identified at time of analysis; a vendor fix is available upstream via GitHub commit 5fd1fe8 and PR #261.
Version disclosure in Combodo iTop's login page exposes the complete application version string in the HTML title attribute of the logo element to unauthenticated remote users. All iTop releases prior to 3.2.3 are affected; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication or user interaction against any network-accessible login page. No active exploitation has been confirmed (not in CISA KEV) and no public POC has been identified; this vulnerability primarily enables reconnaissance that can be chained into version-targeted follow-on attacks.
Reflected XSS and open redirect in yootheme.com's Zoo extension for Joomla (versions prior to 4.1.66) allow remote attackers to inject arbitrary JavaScript into a victim's browser session or redirect users to attacker-controlled URLs by crafting a malicious link containing an unsanitized submission redirect parameter. Exploitation requires a user to follow the crafted link, limiting automated mass exploitation. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis.
Unauthenticated information disclosure in CrossWatch prior to v0.9.21 allows any network-accessible attacker to enumerate active session metadata via GET /api/app-auth/status, including originating IP addresses, User-Agent strings, internal session IDs, and creation/expiry timestamps. All CrossWatch deployments running versions before 0.9.21 with a network-accessible API are affected. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though exploitation requires only a standard HTTP client with no credentials.
Improper authorization (broken access control) in Dromara RuoYi-Vue-Plus versions 5.6.0 through 5.6.2 allows authenticated low-privilege users to interact with protected Workflow module endpoints - FlwInstanceController, FlwDefinitionController, FlwCategoryController, FlwSpelController, and TestLeaveController - without the required authorization level. The vulnerability is remotely exploitable with no user interaction needed beyond holding a low-privilege account. No public exploit has been independently confirmed at time of analysis, though a researcher-submitted GitHub issue references the flaw; no active exploitation is recorded in CISA KEV.
Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment download limit counters on digital product orders they do not own, undermining purchased access controls for other customers. The flaw is an Insecure Direct Object Reference (IDOR) in the download counter endpoint, which accepts a user-supplied order record identifier without verifying ownership against the authenticated session's order token; the same endpoint also lacks CSRF token validation, widening the attack surface. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Element Web's EmbeddedPage component rendered homeserver-supplied homepage HTML directly into the DOM via React's dangerouslySetInnerHTML without first passing it through the application's sanitizedHtmlNode utility, enabling any malicious or compromised Matrix homeserver to inject arbitrary HTML into the client homepage of connecting users prior to version 1.12.22. The Content Security Policy blocks JavaScript execution, constraining impact to HTML-based phishing - fake login forms, spoofed UI overlays - rather than remote code execution. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Open redirect in the J2Store Joomla e-commerce extension (versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) enables unauthenticated remote attackers to craft phishing URLs that abuse the trusted domain of a legitimate shop. Four cart controller task handlers decode a base64-encoded URL from user-supplied input and redirect without validating the destination hostname, allowing attackers to route victims to arbitrary external sites while the URL appears to originate from the merchant's real domain. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, but the unauthenticated network access path and low attack complexity make this straightforward to leverage in targeted phishing campaigns against shop customers.
Cross-site scripting in the Miraikan Assist App (Android < 1.1.7, iOS < 1.0.7) enables remote attackers to inject and execute arbitrary JavaScript within the app's embedded WebView component when a user interacts with attacker-controlled content. The scope change in the CVSS vector (S:C) reflects that execution occurs across origin boundaries within the WebView context, enabling content manipulation beyond the app's own domain. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; patch is confirmed available from the vendor.
ReDoS (catastrophic regex backtracking) in Checkmate monitoring platform versions 3.5.1 through 3.9.1 allows an authenticated admin or superadmin to freeze the entire Node.js application for all users by supplying a malicious regular expression in an HTTP monitor's expectedValue field. The vulnerable code in AdvancedMatcher.ts evaluates the regex synchronously on the Node.js main event loop against an attacker-supplied HTTP response body with no timeout or worker isolation, causing complete availability loss. Fixed in v3.9.2 by replacing JavaScript's native RegExp with the RE2 library, which guarantees linear-time complexity. No public exploit or CISA KEV listing identified at time of analysis.
Stored cross-site scripting in LeafWiki's search API allows an authenticated editor or administrator to plant a JavaScript payload in a page title, which executes in any victim's browser when they view search results containing that title. No public exploit identified at time of analysis. The attack surface widens significantly when the `--public-access` flag is enabled, making unauthenticated visitors viable targets; in default authenticated-only deployments, the blast radius is limited to logged-in users. A vendor-released patch is available in version 0.10.2.
HTML injection in Esri Portal for ArcGIS versions 11.1 through 11.3 enables a remote attacker holding administrative credentials to insert arbitrary HTML into an administrative API endpoint, with potential to mislead or deceive other administrators viewing the rendered output. The CVSS score of 3.8 (Low) reflects the high privilege prerequisite (PR:H), which confines realistic exploitation to scenarios involving compromised admin accounts, rogue insiders, or privilege escalation chains. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Stored cross-site scripting in Esri Portal for ArcGIS versions 11.5 and prior allows a remote attacker holding administrative credentials to persistently inject malicious JavaScript that executes in the browsers of other portal users. The CVSS scope change (S:C) confirms the payload escapes the application's trust boundary and can affect lower-privileged users who simply load poisoned portal pages. No public exploit code or active exploitation has been identified at time of analysis; Esri has released guidance directing affected users to patch via the August 2026 ArcGIS Security Bulletin.
HTML injection in Esri Portal for ArcGIS versions 11.1 through 11.5 permits a remote, highly privileged attacker to insert arbitrary HTML into the Portal Home application, potentially delivering spoofed UI content or phishing material to other authenticated users. The CVSS vector (PR:H, UI:R, S:U) substantially constrains real-world impact: exploitation demands administrative-level credentials and victim interaction, with no availability impact and limited confidentiality or integrity effect. No public exploit code or active exploitation has been identified at time of analysis.
Improper output encoding in Apache CloudStack's management UI exposes administrators to cross-site scripting (XSS) when using the Lock User functionality across versions 4.20.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0. A low-privilege user can embed a malicious script payload in a user-controlled field; when an administrator invokes the Lock User workflow, the CloudStack UI renders the payload without proper HTML or JavaScript escaping, executing it in the admin's browser session. No public exploit or CISA KEV listing has been identified at time of analysis, but the potential for admin session hijacking makes this a meaningful risk in multi-tenant environments.
Local named-pipe privilege escalation in Yamaha VOCALOID6 exposes privileged Editor functions to any co-resident process running under the same local user account, requiring no additional authentication. The flaw (CWE-306, Missing Authentication for Critical Function) stems from the VOCALOID6 Editor's local named pipe lacking access controls, allowing a low-privileged process owned by the same OS user to communicate with it directly. No public exploit or CISA KEV listing is identified at time of analysis; the EPSS signal is unavailable, but the CVSS score of 3.3 and local-only attack vector constrain real-world impact to same-account, same-machine scenarios.
Stored HTML attribute injection in Typemill versions prior to 2.23.0 allows authenticated content editors to embed arbitrary HTML attributes into generated og:title and og:description meta tags due to absent output encoding. Under applicable browser or DOM interaction conditions, this escalates to stored cross-site scripting (XSS) against any visitor loading the affected page. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; version 2.23.0 patches the issue and is confirmed by the official release notes.
CSRF protection is absent on front-end state-changing operations in YOOtheme's Zoo Joomla extension before version 4.1.66, enabling an attacker to forge requests that alter application state on behalf of a high-privileged authenticated user. Exploitation requires luring a logged-in administrator or privileged Zoo user to interact with a malicious page while their session is active. The integrity impact is limited to the vulnerable system, and no public exploit code or active exploitation has been identified at time of analysis.
Hidden volume creation in VeraCrypt 1.26.6 through 1.26.28 leaves forensically detectable plaintext markers inside file-hosted hidden volume containers, directly undermining plausible deniability guarantees. The FormatNoFs and FormatFat functions apply a quick-format optimization that writes zeroed sectors at predictable 128 MiB intervals via WriteFile, bypassing the EncryptDataUnits path that would fill the area with indistinguishable ciphertext; a forensic examiner with access to the container can identify these anomalous plaintext artifacts and infer hidden volume presence. Encryption strength and hidden-volume contents are not compromised - impact is confined to deniability failure. No public exploit has been identified and this vulnerability is not listed in CISA KEV.
Object locking in Combodo iTop prior to version 3.2.3 can be triggered by any authenticated user regardless of assigned write permissions, enabling targeted denial-of-service against legitimate editors. The missing authorization check in the lock acquisition endpoint (ajax.render.php) allows low-privilege users to lock objects they have no right to modify, blocking users who do hold write permissions from editing those objects. No active exploitation has been confirmed and no public exploit code exists; vendor-released patch is available in version 3.2.3.
Unexpected application termination in Apple macOS arises when processing a maliciously crafted file, triggering an out-of-bounds read (CWE-125) that crashes the handling application. Affected versions span all three active macOS release trains: Sonoma prior to 14.8.5, Sequoia prior to 15.7.5, and Tahoe prior to 26.4. No public exploit code has been identified and EPSS sits at the 5th percentile (0.15%), indicating low real-world exploitation probability; vendor-released patches are available for all three tracks.
Private thread content disclosure in Rocket.Chat exposes all private thread parents and their full reply content to any low-privilege authenticated user on instances running versions prior to 8.8.0 across multiple maintained release branches. By substituting a MongoDB operator object (e.g., {"$gt": ""}) for the expected string room-id or thread message-id in the Meteor DDP methods getThreadsList and getThreadMessages, an attacker with any valid account can cause downstream MongoDB queries to fan out across all rooms while the authorization check resolves only to a room the attacker legitimately accesses. No public exploit has been identified at time of analysis, but the technique is straightforward for any developer familiar with DDP WebSocket debugging, and the fix pattern is visible in the public GitHub pull request.
Sensitive information exposure in Apache CloudStack's Webhook module allows unauthorized actors to view data they should not have access to during webhook delivery listing and deletion operations. Affected deployments span versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0, covering two active release trains. No public exploit or active exploitation has been identified at time of analysis; vendor-released patches are available.
Pre-validation SSRF in Apache CloudStack's template and ISO registration allows authenticated users to trigger HTTP HEAD/GET requests to arbitrary URLs - including internal network resources - before URL validation is applied. Affected versions are 4.20.3.0 and 4.21.0.0 through 4.22.1.0; vendor-released patches exist in 4.20.3.1 and 4.22.1.1. No public exploit code or active exploitation has been identified at time of analysis, and exploitation requires valid CloudStack credentials with template-registration privileges.
Spring AI 2.0.0's Semantic Cache feature leaks cached LLM responses across unrelated system prompt contexts due to insufficient isolation in the context hashing mechanism. Applications using semantic caching across multiple tenants or security domains - where different system prompts define distinct access boundaries - are at risk of cross-context information disclosure and response tampering. Exploitation requires authenticated access and high attack complexity (AC:H, PR:L); no public exploit code and no CISA KEV listing exist at time of analysis.
Stored XSS in DiscordChatExporter's HTML export engine allows script injection via maliciously crafted emoji metadata in chat logs prior to version 2.47.2. The VisitEmojiAsync method in HtmlMarkdownVisitor.cs interpolates emoji.Name into HTML alt attributes and emoji.Code into title attributes without HTML entity encoding, creating an injection point that executes in the victim's browser when they open the exported HTML file. Exploitation requires tampered offline input or a future relaxation of Discord's server-side emoji name validation; no public exploit or active exploitation has been identified at time of analysis.