Object locking in Combodo iTop prior to version 3.2.3 can be triggered by any authenticated user regardless of assigned write permissions, enabling targeted denial-of-service against legitimate editors. The missing authorization check in the lock acquisition endpoint (ajax.render.php) allows low-privilege users to lock objects they have no right to modify, blocking users who do hold write permissions from editing those objects. No active exploitation has been confirmed and no public exploit code exists; vendor-released patch is available in version 3.2.3.
Unexpected application termination in Apple macOS arises when processing a maliciously crafted file, triggering an out-of-bounds read (CWE-125) that crashes the handling application. Affected versions span all three active macOS release trains: Sonoma prior to 14.8.5, Sequoia prior to 15.7.5, and Tahoe prior to 26.4. No public exploit code has been identified and EPSS sits at the 5th percentile (0.15%), indicating low real-world exploitation probability; vendor-released patches are available for all three tracks.
Private thread content disclosure in Rocket.Chat exposes all private thread parents and their full reply content to any low-privilege authenticated user on instances running versions prior to 8.8.0 across multiple maintained release branches. By substituting a MongoDB operator object (e.g., {"$gt": ""}) for the expected string room-id or thread message-id in the Meteor DDP methods getThreadsList and getThreadMessages, an attacker with any valid account can cause downstream MongoDB queries to fan out across all rooms while the authorization check resolves only to a room the attacker legitimately accesses. No public exploit has been identified at time of analysis, but the technique is straightforward for any developer familiar with DDP WebSocket debugging, and the fix pattern is visible in the public GitHub pull request.
Sensitive information exposure in Apache CloudStack's Webhook module allows unauthorized actors to view data they should not have access to during webhook delivery listing and deletion operations. Affected deployments span versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0, covering two active release trains. No public exploit or active exploitation has been identified at time of analysis; vendor-released patches are available.
Pre-validation SSRF in Apache CloudStack's template and ISO registration allows authenticated users to trigger HTTP HEAD/GET requests to arbitrary URLs - including internal network resources - before URL validation is applied. Affected versions are 4.20.3.0 and 4.21.0.0 through 4.22.1.0; vendor-released patches exist in 4.20.3.1 and 4.22.1.1. No public exploit code or active exploitation has been identified at time of analysis, and exploitation requires valid CloudStack credentials with template-registration privileges.
Spring AI 2.0.0's Semantic Cache feature leaks cached LLM responses across unrelated system prompt contexts due to insufficient isolation in the context hashing mechanism. Applications using semantic caching across multiple tenants or security domains - where different system prompts define distinct access boundaries - are at risk of cross-context information disclosure and response tampering. Exploitation requires authenticated access and high attack complexity (AC:H, PR:L); no public exploit code and no CISA KEV listing exist at time of analysis.
Command injection in Apache CloudStack's diagnostics APIs allows Admin-role authenticated users to execute arbitrary commands as root on system VMs and Virtual Routers, constituting a full compromise of those instances across versions 4.20.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0. The getDiagnosticsData and runDiagnostics API endpoints fail to properly neutralize special shell characters in user-supplied input before passing it to underlying diagnostic processes on the target VMs. No public exploit code or CISA KEV listing has been identified at time of analysis, but successful exploitation of a Virtual Router can expose all guest network traffic routed through that instance and provide a lateral movement foothold within the CloudStack-managed infrastructure.
Stored XSS in DiscordChatExporter's HTML export engine allows script injection via maliciously crafted emoji metadata in chat logs prior to version 2.47.2. The VisitEmojiAsync method in HtmlMarkdownVisitor.cs interpolates emoji.Name into HTML alt attributes and emoji.Code into title attributes without HTML entity encoding, creating an injection point that executes in the victim's browser when they open the exported HTML file. Exploitation requires tampered offline input or a future relaxation of Discord's server-side emoji name validation; no public exploit or active exploitation has been identified at time of analysis.
OS command injection in Apache CloudStack's NAS backup provider plugin enables an authenticated operator account to execute arbitrary commands on KVM hypervisor hosts by supplying unsanitized shell metacharacters to the addBackupRepository or updateBackupRepository management APIs. Affected deployments span versions 4.20.0.0 through 4.22.1.0 when the NAS backup provider plugin is in use; exploitation is deferred and triggered when any downstream account performs a backup restore. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as 'none,' though technical impact is rated 'total' given hypervisor-level code execution.
Unauthorized LDAP configuration disclosure in Apache CloudStack exposes LDAP server details - including bind credentials and hostnames - to any authenticated user via the listLdapConfigurations API, which is accessible to all default CloudStack roles. Affected versions span 4.2.0.0 through 4.22.1.0, a broad range suggesting long-standing exposure in enterprise and cloud provider deployments. No public exploit code has been identified at time of analysis, but the low barrier of a valid account and the downstream risk of harvested LDAP bind credentials elevate practical severity beyond the EPSS score suggests.
Improper output encoding in the Apache CloudStack management UI's Instance Reset Password feature allows injection of unescaped output that can expose sensitive data or manipulate the interface. It affects Apache CloudStack 4.15.1.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0, an open-source IaaS cloud orchestration platform. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile); vendor-released patches exist in 4.20.3.1 and 4.22.1.1.
Cleartext storage of sensitive information in Apache CloudStack's AsyncJob database records exposes credentials and operation-sensitive data to any party with read access to the underlying database. All CloudStack deployments from version 4.0.0 through 4.22.1.0 are affected across both the 4.x stable and 4.21/4.22 release lines. No public exploit code has been identified and EPSS sits at the 1st percentile, but the NVD-assigned confidentiality impact of HIGH reflects that AsyncJob records may capture sensitive payloads - such as API secrets or passwords - passed through asynchronous operations, stored durably in cleartext rather than encrypted at rest.
Sensitive information disclosure in Combodo iTop prior to version 3.2.3 leaks raw exception messages to authenticated users through the application's AJAX rendering layer. In ajax.render.php, caught exceptions were echoed back to the browser via $e->GetMessage() (HTML-escaped to prevent XSS, but not content-filtered), potentially exposing internal file paths, database schema details, stack context, or configuration fragments. No public exploit has been identified at time of analysis, and the low CVSS score of 3.5 reflects limited practical impact; however, the disclosed internals can meaningfully assist further reconnaissance.
Missing authorization in Apache CloudStack's listHostTags API allows domain administrators to enumerate host tags across all domains in a multi-tenant deployment, violating tenant isolation boundaries established by the domain hierarchy. Affected versions span 4.12.0.0 through 4.22.1.0 across two release trains, with vendor-released patches in 4.20.3.1 and 4.22.1.1 confirmed by the Apache security advisory. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the risk is meaningful in shared, multi-tenant CloudStack environments where cross-domain host tag visibility undermines infrastructure confidentiality guarantees between tenants.
Improper access control in Apple watchOS prior to 26.4 allows a person with physical possession of a locked Apple Watch to view the device owner's contacts without authentication. The flaw, classified as CWE-284 (Improper Access Control), stems from insufficient permissions checking on a code path accessible from the lock screen. Apple has confirmed the fix in watchOS 26.4; no active exploitation has been identified per CISA SSVC assessment.
Improper authorization in Dolibarr's user account management component (htdocs/user/card.php) through version 23.0.4 permits authenticated non-admin users to delete administrator accounts by supplying an arbitrary user ID to the Account Handler. The commit diff confirms the root cause: the deletion code path executed without verifying whether the target account held admin privileges or whether the requesting user was an administrator. A public exploit exists (CVSS 4.0 supplemental E:P); no active exploitation has been confirmed via CISA KEV.
XML injection in joshnuss xml_builder (Elixir) allows an attacker who can influence element names, attribute names, or doctype identifiers to inject arbitrary XML markup - including extra elements, comments, and event-handler attributes - into the serialized document output. All library releases from 0.0.1 through 2.4.0 are affected; the vulnerability resides in the core XmlBuilder.element and XmlBuilder.generate API surface. No active exploitation has been confirmed (CVE is not in CISA KEV), and no standalone public exploit code has been identified, though the GitHub security advisory includes demonstrative test cases.
XML injection in joshnuss xml_builder (versions 0.0.7 through before 2.4.1) enables content spoofing and XML structure manipulation when attacker-controlled data reaches CDATA sections generated by the library. The escape/1 function concatenates CDATA content verbatim without splitting on the ]]> delimiter sequence, allowing premature closure of the CDATA section and injection of arbitrary XML markup into the output document. A vendor patch is available in version 2.4.1; no public exploit code and no CISA KEV listing have been identified.
Incorrect entity-passthrough logic in joshnuss xml_builder (Elixir) versions 0.0.6 through 2.4.0 allows attacker-supplied text containing pre-encoded entity sequences such as <script> to be emitted verbatim into serialized XML, rather than being double-encoded to &lt;script&gt;. When a downstream parser decodes the output and renders it in a markup-sensitive context - HTML, SVG, or RSS/Atom feeds - the entity sequences resolve into live markup, enabling content spoofing and cross-site scripting while bypassing upstream filters that block raw angle-bracket characters. No public exploit is identified at time of analysis, and no CISA KEV listing exists.