Duplicate Post WordPress plugin before 1.5.6 exposes password-protected post content to authenticated users who lack read authorization on those posts. The plugin's duplication feature fails to verify whether the requesting user has permission to read the source post, allowing any user with a delegated duplication role to republish another author's password-protected content as publicly readable. A publicly available proof-of-concept exists; no active exploitation has been confirmed (not in CISA KEV). A vendor patch is available at version 1.5.6.
Financial ledger manipulation in the Dokan WooCommerce Multivendor Marketplace WordPress plugin (before 5.0.14) allows authenticated vendors to fraudulently clear commission debts by submitting arbitrary client-supplied payment amounts to the reverse-withdrawal endpoint without server-side balance validation. Any registered vendor on an affected marketplace can exploit this to zero out real outstanding commissions owed to the marketplace operator, constituting financial fraud against the site owner. A publicly available proof-of-concept exists; no active exploitation has been confirmed by CISA KEV, though the low attack complexity and accessible vendor registration on most marketplaces make this a meaningful business risk.
Symlink-following vulnerability in Runtipi 4.10.0 and earlier enables authenticated administrators to write arbitrary content to any filesystem path accessible by the Runtipi process. An attacker with admin credentials plants a symlink inside a crafted backup archive targeting an arbitrary path, restores the archive via the backup API, and then invokes the user-config write endpoint - causing FilesystemService.writeTextFile() to follow the planted link and write attacker-controlled content outside the intended directory boundary. No public exploit is identified at time of analysis; vendor-released patch v4.10.1 is available and the fix is confirmed by GitHub advisory GHSA-wcrf-g9p9-2wg7.
Unauthorized document access in Combodo iTop before version 3.2.3 allows any authenticated user to retrieve documents and attachments belonging to organizations or objects they lack permission to view. The root cause is a logic inversion in the PHP DownloadDocument method: a host-object rights check could silently pass due to incorrect boolean handling, bypassing the intended access control gate entirely. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS PR:L vector confirms exploitation requires only a valid low-privileged account.
Out-of-bounds read in iccDEV (all versions prior to 2.3.2.1) crashes the ICC profile parser via a size_t integer underflow in CIccEmbedIO::Read8() when processing embedded ICC v5 profiles. Unauthenticated remote attackers can trigger the denial-of-service condition by delivering a maliciously crafted ICC profile that requires user interaction to parse (e.g., opening a file in an application backed by this library). No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch version 2.3.2.1 is available.
Unauthenticated deletion of the iTop `.readonly` write-protection file is possible in Combodo iTop prior to version 3.2.3, allowing any remote attacker to remove a critical filesystem-based access control mechanism. The `.readonly` file is created during the setup process specifically to block write operations on the iTop instance; its deletion effectively disables that safeguard without any credentials. No active exploitation has been confirmed (not in CISA KEV), but the low attack complexity and zero authentication requirement make this a straightforward attack against any exposed iTop instance. The issue is fixed in version 3.2.3 per the GitHub security advisory GHSA-2xh3-r27f-3pr5.
Incorrect authorization in Spring AI's tool calling subsystem allows the per-request tool allowlist to be bypassed at dispatch time, enabling invocation of tools not made available to the current request. Affected are Spring AI versions 1.0.0-1.0.9, 1.1.0-1.1.8, and 2.0.0. An authenticated low-privileged attacker who can influence model interactions may exploit this to invoke privileged tools outside their authorization scope, resulting in privilege escalation and potential confidentiality breach. No public exploit or CISA KEV listing has been identified at time of analysis.
Parser state isolation failure in misp-stix corrupts MISP event generation when the same parser instance is reused across independent STIX 1 and STIX 2 document conversions, causing retained artifacts - including galaxy clusters, passive DNS records, package titles, dates, and timestamps - from a prior document to contaminate subsequently generated MISP events. Applications directly consuming the misp-stix API with long-lived parser instances are at risk; the standard entry points that instantiate a fresh parser per file are not affected. No public exploit has been identified at time of analysis, and the CVSS 4.0 AT:P precondition metric confirms exploitation depends on a non-default deployment pattern compounded by attacker influence over document processing order.
Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) allows an authenticated attacker to supply an arbitrary order_id and copy another customer's cart contents and shipping address data directly into the attacker's own session. The root cause is absent ownership validation on the order copy function - CSRF tokens are checked, preventing cross-site request forgery, but the back-end never verifies that the order_id belongs to the requesting user. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored cross-site scripting in the OpenSearch Dashboards dashboards-observability plugin allows a remote authenticated user with write permissions to saved objects to inject arbitrary JavaScript that executes in other users' browser sessions. Affected deployments include both self-hosted OpenSearch Dashboards and Amazon OpenSearch Service (managed). The scope change (S:C) and high confidentiality/integrity impact make this particularly dangerous in multi-tenant environments where admin accounts may view attacker-controlled saved assets. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patches are available in versions 3.4.0 and 2.19.0.
Key derivation in VeraCrypt's non-default wolfCrypt backend silently substituted HKDF for PBKDF2-HMAC in SHA-256 and SHA-512 volume-header derivation, discarding the configured iteration count entirely - meaning any PIM or iteration tuning applied by users of affected builds provided zero additional brute-force resistance. Any attacker who obtains a volume file produced by a WOLFCRYPT=1 source build can attempt password recovery at HKDF speeds rather than PBKDF2-iterated cost, dramatically reducing the work factor. Official precompiled VeraCrypt binaries and standard distribution packages are entirely unaffected; no public exploit has been identified and this vulnerability is not listed in CISA KEV.
Unrestricted file upload in CodeAstro Online Job Portal 1.0 allows authenticated remote attackers to upload arbitrary files via the Name argument in /users/update-profile.php. Exploitation requires a valid user account, after which an attacker can bypass file type restrictions on profile update functionality. A publicly available proof-of-concept exists per the GitHub reference, though no active exploitation has been confirmed by CISA KEV. The unusually low official CVSS 4.0 score of 2.1 (VC:L/VI:L/VA:L) appears inconsistent with CWE-434 in a PHP application, where unrestricted upload frequently enables server-side code execution - security teams should independently verify the actual upload destination and execution context.
SQL injection in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 exposes the saveUser function at /public/submit.php to database manipulation through the unsanitized Researcher parameter. The CVSS 4.0 score of 5.3 with PR:L indicates low-privileged authentication is required, limiting but not eliminating risk. A public proof-of-concept exploit is available via a referenced GitHub gist, and no vendor-released patch has been identified at time of analysis.
Reflected cross-site scripting in Esri Portal for ArcGIS versions 11.5 and prior allows a remote, unauthenticated attacker to craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser. The CVSS Scope:Changed metric indicates that injected scripts may affect components beyond the vulnerable Portal itself, such as session tokens shared across an ArcGIS Enterprise deployment. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA KEV.
Cross-Site Request Forgery in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 allows remote attackers to perform unauthorized state-changing actions on behalf of authenticated users without their knowledge. The attack requires passive victim interaction (UI:P per CVSS 4.0) - a logged-in user must be lured to a malicious page that silently submits forged requests to the application. A public proof-of-concept exploit is available on GitHub, lowering the technical barrier for abuse; however, no CISA KEV listing exists and impact is constrained to low integrity degradation with no confidentiality or availability consequence.
Stored XSS in Esri Portal for ArcGIS versions 11.5 and prior allows a remote attacker to inject persistent malicious scripts that execute in a victim's browser upon visiting affected portal content. Successful exploitation can yield session hijacking, credential theft, and unauthorized actions performed within a victim's authenticated portal session. No public exploit has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.
Stored cross-site scripting in Esri Portal for ArcGIS versions 11.1 through 12.1 enables a remote, privileged attacker to persist malicious JavaScript in the portal, which then executes in the browsers of users who subsequently view the affected content. The vulnerability carries a CVSS 3.1 score of 6.1 (Medium) with scope change (S:C), meaning successful exploitation crosses trust boundaries into victims' browser sessions. No public exploit code or CISA KEV listing has been identified at time of analysis, and Esri has released patches via their August 2026 ArcGIS Security Bulletin.
Infracost's template engine prior to v0.10.45 allows repository-controlled symlinks to escape the checkout directory, enabling any contributor with repository write access to read files accessible to the CI/CD runner. The vulnerable template functions - readFile, pathExists, isDir, and matchPaths in internal/config/template/parser.go - relied on lexical filepath.Abs normalization and leaf-only os.Lstat checks that failed to resolve intermediate directory symlinks, so a path like evil/secret passes validation while physically exiting the repository root. Captured file contents are rendered into Infracost configuration output and surfaced via the Infracost dashboard or pull request comments; no public exploit identified at time of analysis, and vendor-released patch is confirmed in v0.10.45.
Line-protocol injection and log spoofing in Spring Micrometer's StatsD and LoggingMeterRegistry components allow network-reachable attackers to forge arbitrary metrics and log entries by embedding newline characters into user-supplied strings that flow unvalidated into meter names, tag keys, or tag values. Affected deployments span the 1.9.x through 1.17.x release lines of io.micrometer:micrometer-registry-statsd and io.micrometer:micrometer-core when the Datadog or Etsy StatsD flavor is active, or when LoggingMeterRegistry is in use. No public exploit has been identified at time of analysis, though the integrity-focused impact carries real risk for organizations whose incident-response workflows depend on Micrometer-sourced telemetry.
Token exfiltration in Infracost prior to 0.10.45 allows an attacker who controls scanned Terraform source to redirect a configured Terraform Cloud or registry credential to an arbitrary attacker-controlled host. The vulnerable code path in internal/hcl/remote_variables_loader.go derived the destination hostname from untrusted Terraform cloud/backend block attributes without validating it against the operator-configured trusted host. CI pipelines using pull_request_target or same-repository pull request workflows that expose a TFC token to Infracost scans are affected; standard fork pull_request workflows without secrets are explicitly not vulnerable. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
CRLF injection in @fastify/busboy's multipart part-header parser allows unauthenticated remote attackers to embed bare carriage return or line feed characters into parsed Content-Disposition filenames and field names, which are then handed to applications as if they were clean values. All versions through 3.2.1 are affected; the fix is in 3.2.2. When applications forward these tainted values to CR/LF-sensitive sinks - HTTP response headers, log systems, or filesystem paths - attackers can achieve log forging, HTTP header injection, or filesystem filename pollution. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in Esri Portal for ArcGIS versions 11.5 and prior enables a remotely authenticated administrator to inject persistent malicious JavaScript that executes in other users' browsers upon page load. The scope change (S:C) in the CVSS vector confirms the attacker's injected payload crosses from the server context into victims' browser sessions, enabling session hijacking, credential theft, or DOM manipulation. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present; Esri has issued a patch via the August 2026 ArcGIS security bulletin.
Stored cross-site scripting in Esri Portal for ArcGIS versions 11.1 through 11.5 permits a remote attacker holding high portal privileges to persist malicious JavaScript payloads in portal content. When any other authenticated user browses the affected item, the injected script executes in their browser, enabling session hijacking, credential exfiltration, or portal actions performed on the victim's behalf. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis; however, the CVSS scope-change metric (S:C) signals that impact crosses the security boundary of the vulnerable component and extends to victims' browser sessions.
Stored cross-site scripting in Esri Portal for ArcGIS versions 11.1 through 11.5 allows a remote, privileged attacker to persist malicious JavaScript within the portal, which subsequently executes in the browsers of any user who views the affected content. The vulnerability carries a CVSS 3.1 score of 5.5 with scope change (S:C), reflecting that exploitation crosses from the portal server into victim browser sessions, enabling session hijacking, credential harvesting, or unauthorized portal actions on behalf of victims. No public exploit code or CISA KEV listing has been identified at time of analysis, but Esri has released patches for affected enterprise versions and advises upgrading to the latest long-term support release.
Kernel heap corruption and GPU memory leaks in Imagination Technologies Graphics DDK expose systems to local denial-of-service from non-privileged users. A double-free defect in the GPU memory free paths - triggered via user-initiated GPU system calls - can corrupt kernel heap state or cause memory leaks, with potential availability impact at the kernel level. No active exploitation is confirmed (EPSS 0.15%, no CISA KEV listing), but a vendor patch is available and a ChromeOS stable channel advisory confirms real-world distribution reach.
Stack exhaustion in the Picotls minicrypto backend's custom ASN.1 validator allows an attacker who can supply crafted private-key material to crash any application that calls ptls_minicrypto_load_private_key() or the public ptls_asn1_validation() API on untrusted DER input. All Picotls versions prior to upstream commit c14231d80 are affected when the minicrypto backend is in use; applications using the libcrypto (OpenSSL) backend are immune because OpenSSL performs its own bounded DER parsing. No public exploit has been identified and no CISA KEV listing exists; CVSS 5.5 reflects a local, user-interaction-dependent denial-of-service with no code execution potential.
HTML injection in Esri Portal for ArcGIS versions 11.1 through 12.0 enables a remote authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application, potentially exposing other portal users to malicious content. The flaw is tagged as XSS and classified under CWE-79, meaning unsanitized attacker-controlled input is rendered in the browser context of other users visiting the Home application. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified, though the relatively low privilege requirement (authenticated, low-privilege user) broadens the potential attacker pool within any ArcGIS Enterprise deployment.
Improper access control in Apache CloudStack's annotation APIs (addAnnotation and listAnnotation) allows any authenticated user to read and write annotations on entities they do not own. The APIs perform an ownership check when an entity UUID is supplied but fail to enforce the result of that check, reducing authorization to a formality that any authenticated user can bypass. No public exploit has been identified at time of analysis; no EPSS or CISA KEV data is available, but the bug affects all CloudStack deployments from 4.15.0.0 onward until the patched releases.
Denial of service in Micrometer Tracing's Brave bridge allows remote unauthenticated attackers to crash Spring Boot 3.x+ applications by sending HTTP requests with artificially inflated W3C baggage headers. The parser allocates one BaggageField object per baggage key-value pair without enforcing any limit, violating the W3C Baggage specification's own security guidance, leading to garbage collection saturation, CPU spike, and eventual OutOfMemoryError. No public exploit code has been identified at time of analysis, but the attack is trivially constructible given the documented mechanism.
Missing authentication in Esri Portal for ArcGIS versions 11.1 through 12.0 permits a remote unauthenticated attacker to read a specific internal resource intended to be access-controlled. The flaw (CWE-306) means one or more endpoints fail to enforce authentication before returning protected content, though the exposed resource is explicitly scoped to non-user data. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 5.3 Medium rating reflects the bounded confidentiality-only impact.
Missing authentication for a critical function in IKAS Technology Inc. Rush (versions through 21082026) permits unauthenticated remote attackers to forge the apparent source of data submitted to the system. Disclosed by Turkey's national CERT (USOM) under advisory TR-26-0883, this CWE-306 flaw carries a CVSS 5.3 Medium rating with network-level reach and no authentication barrier. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Tenant data boundary failure in Roskus Prospero Flow CRM 4.9.1-5.14.0 allows authenticated users holding transaction and accounting creation permissions to read another co-tenant company's bank account name, institution name, and card last four digits by supplying a foreign bank_account_id or bank_card_id in POST /transaction/save. The root cause (CWE-639, IDOR) is the complete absence of company-ownership validation on user-controlled integer foreign keys before they are persisted and rendered - the controller correctly scoped the new transaction's company_id but applied no such scoping to associated reference IDs. No active exploitation or public POC has been identified at time of analysis; a vendor fix is available upstream via GitHub commit 5fd1fe8 and PR #261.
Version disclosure in Combodo iTop's login page exposes the complete application version string in the HTML title attribute of the logo element to unauthenticated remote users. All iTop releases prior to 3.2.3 are affected; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication or user interaction against any network-accessible login page. No active exploitation has been confirmed (not in CISA KEV) and no public POC has been identified; this vulnerability primarily enables reconnaissance that can be chained into version-targeted follow-on attacks.
Reflected XSS and open redirect in yootheme.com's Zoo extension for Joomla (versions prior to 4.1.66) allow remote attackers to inject arbitrary JavaScript into a victim's browser session or redirect users to attacker-controlled URLs by crafting a malicious link containing an unsanitized submission redirect parameter. Exploitation requires a user to follow the crafted link, limiting automated mass exploitation. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis.
Unauthenticated information disclosure in CrossWatch prior to v0.9.21 allows any network-accessible attacker to enumerate active session metadata via GET /api/app-auth/status, including originating IP addresses, User-Agent strings, internal session IDs, and creation/expiry timestamps. All CrossWatch deployments running versions before 0.9.21 with a network-accessible API are affected. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though exploitation requires only a standard HTTP client with no credentials.
Improper authorization (broken access control) in Dromara RuoYi-Vue-Plus versions 5.6.0 through 5.6.2 allows authenticated low-privilege users to interact with protected Workflow module endpoints - FlwInstanceController, FlwDefinitionController, FlwCategoryController, FlwSpelController, and TestLeaveController - without the required authorization level. The vulnerability is remotely exploitable with no user interaction needed beyond holding a low-privilege account. No public exploit has been independently confirmed at time of analysis, though a researcher-submitted GitHub issue references the flaw; no active exploitation is recorded in CISA KEV.
Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment download limit counters on digital product orders they do not own, undermining purchased access controls for other customers. The flaw is an Insecure Direct Object Reference (IDOR) in the download counter endpoint, which accepts a user-supplied order record identifier without verifying ownership against the authenticated session's order token; the same endpoint also lacks CSRF token validation, widening the attack surface. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Element Web's EmbeddedPage component rendered homeserver-supplied homepage HTML directly into the DOM via React's dangerouslySetInnerHTML without first passing it through the application's sanitizedHtmlNode utility, enabling any malicious or compromised Matrix homeserver to inject arbitrary HTML into the client homepage of connecting users prior to version 1.12.22. The Content Security Policy blocks JavaScript execution, constraining impact to HTML-based phishing - fake login forms, spoofed UI overlays - rather than remote code execution. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Open redirect in the J2Store Joomla e-commerce extension (versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) enables unauthenticated remote attackers to craft phishing URLs that abuse the trusted domain of a legitimate shop. Four cart controller task handlers decode a base64-encoded URL from user-supplied input and redirect without validating the destination hostname, allowing attackers to route victims to arbitrary external sites while the URL appears to originate from the merchant's real domain. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, but the unauthenticated network access path and low attack complexity make this straightforward to leverage in targeted phishing campaigns against shop customers.
Cross-site scripting in the Miraikan Assist App (Android < 1.1.7, iOS < 1.0.7) enables remote attackers to inject and execute arbitrary JavaScript within the app's embedded WebView component when a user interacts with attacker-controlled content. The scope change in the CVSS vector (S:C) reflects that execution occurs across origin boundaries within the WebView context, enabling content manipulation beyond the app's own domain. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; patch is confirmed available from the vendor.
ReDoS (catastrophic regex backtracking) in Checkmate monitoring platform versions 3.5.1 through 3.9.1 allows an authenticated admin or superadmin to freeze the entire Node.js application for all users by supplying a malicious regular expression in an HTTP monitor's expectedValue field. The vulnerable code in AdvancedMatcher.ts evaluates the regex synchronously on the Node.js main event loop against an attacker-supplied HTTP response body with no timeout or worker isolation, causing complete availability loss. Fixed in v3.9.2 by replacing JavaScript's native RegExp with the RE2 library, which guarantees linear-time complexity. No public exploit or CISA KEV listing identified at time of analysis.
Stored cross-site scripting in LeafWiki's search API allows an authenticated editor or administrator to plant a JavaScript payload in a page title, which executes in any victim's browser when they view search results containing that title. No public exploit identified at time of analysis. The attack surface widens significantly when the `--public-access` flag is enabled, making unauthenticated visitors viable targets; in default authenticated-only deployments, the blast radius is limited to logged-in users. A vendor-released patch is available in version 0.10.2.
HTML injection in Esri Portal for ArcGIS versions 11.1 through 11.3 enables a remote attacker holding administrative credentials to insert arbitrary HTML into an administrative API endpoint, with potential to mislead or deceive other administrators viewing the rendered output. The CVSS score of 3.8 (Low) reflects the high privilege prerequisite (PR:H), which confines realistic exploitation to scenarios involving compromised admin accounts, rogue insiders, or privilege escalation chains. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Stored cross-site scripting in Esri Portal for ArcGIS versions 11.5 and prior allows a remote attacker holding administrative credentials to persistently inject malicious JavaScript that executes in the browsers of other portal users. The CVSS scope change (S:C) confirms the payload escapes the application's trust boundary and can affect lower-privileged users who simply load poisoned portal pages. No public exploit code or active exploitation has been identified at time of analysis; Esri has released guidance directing affected users to patch via the August 2026 ArcGIS Security Bulletin.
HTML injection in Esri Portal for ArcGIS versions 11.1 through 11.5 permits a remote, highly privileged attacker to insert arbitrary HTML into the Portal Home application, potentially delivering spoofed UI content or phishing material to other authenticated users. The CVSS vector (PR:H, UI:R, S:U) substantially constrains real-world impact: exploitation demands administrative-level credentials and victim interaction, with no availability impact and limited confidentiality or integrity effect. No public exploit code or active exploitation has been identified at time of analysis.
Improper output encoding in Apache CloudStack's management UI exposes administrators to cross-site scripting (XSS) when using the Lock User functionality across versions 4.20.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0. A low-privilege user can embed a malicious script payload in a user-controlled field; when an administrator invokes the Lock User workflow, the CloudStack UI renders the payload without proper HTML or JavaScript escaping, executing it in the admin's browser session. No public exploit or CISA KEV listing has been identified at time of analysis, but the potential for admin session hijacking makes this a meaningful risk in multi-tenant environments.
Local named-pipe privilege escalation in Yamaha VOCALOID6 exposes privileged Editor functions to any co-resident process running under the same local user account, requiring no additional authentication. The flaw (CWE-306, Missing Authentication for Critical Function) stems from the VOCALOID6 Editor's local named pipe lacking access controls, allowing a low-privileged process owned by the same OS user to communicate with it directly. No public exploit or CISA KEV listing is identified at time of analysis; the EPSS signal is unavailable, but the CVSS score of 3.3 and local-only attack vector constrain real-world impact to same-account, same-machine scenarios.
Stored HTML attribute injection in Typemill versions prior to 2.23.0 allows authenticated content editors to embed arbitrary HTML attributes into generated og:title and og:description meta tags due to absent output encoding. Under applicable browser or DOM interaction conditions, this escalates to stored cross-site scripting (XSS) against any visitor loading the affected page. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; version 2.23.0 patches the issue and is confirmed by the official release notes.
CSRF protection is absent on front-end state-changing operations in YOOtheme's Zoo Joomla extension before version 4.1.66, enabling an attacker to forge requests that alter application state on behalf of a high-privileged authenticated user. Exploitation requires luring a logged-in administrator or privileged Zoo user to interact with a malicious page while their session is active. The integrity impact is limited to the vulnerable system, and no public exploit code or active exploitation has been identified at time of analysis.
Hidden volume creation in VeraCrypt 1.26.6 through 1.26.28 leaves forensically detectable plaintext markers inside file-hosted hidden volume containers, directly undermining plausible deniability guarantees. The FormatNoFs and FormatFat functions apply a quick-format optimization that writes zeroed sectors at predictable 128 MiB intervals via WriteFile, bypassing the EncryptDataUnits path that would fill the area with indistinguishable ciphertext; a forensic examiner with access to the container can identify these anomalous plaintext artifacts and infer hidden volume presence. Encryption strength and hidden-volume contents are not compromised - impact is confined to deniability failure. No public exploit has been identified and this vulnerability is not listed in CISA KEV.