Unauthenticated cluster node admission in Arc Enterprise allows a network attacker who can reach the coordinator TCP port to register a rogue node as a trusted cluster member when clustering is enabled without a configured shared secret. Once registered, the cluster router forwards legitimate end-user requests - including full HTTP headers such as Authorization and x-api-key - to attacker-controlled addresses, enabling credential interception. A detailed proof-of-concept is included in the advisory, and a vendor-released patch is available as of v26.06.2; no public exploit confirmed in CISA KEV at time of analysis.
Arbitrary file deletion via path traversal in the Shared Files and Shared Files Pro WordPress plugins (versions before 1.7.67 and 1.7.68 respectively) enables unauthenticated attackers to trigger deletion of critical server files such as wp-config.php, causing denial of service and potential site takeover. The plugin's single-pass traversal filter is bypassable during frontend file submission, allowing a crafted path pointing outside the uploads directory to be stored; when an administrator later permanently deletes the corresponding file entry, the resolved arbitrary file is removed. A publicly available proof-of-concept exists, though SSVC assessment rates exploitation as none at time of analysis, likely reflecting the two-stage attack dependency on administrator action.
Archive symlink traversal in aquaproj/aqua prior to v2.60.1 enables an attacker who controls a tool archive to write arbitrary files outside the extraction directory with the privileges of the user running aqua. The vulnerable combination in `pkg/unarchive/archives.go` - creating a symlink without destination validation, then following it with a regular file write - allows a malicious tar.gz to overwrite files such as shell startup scripts or PATH entries, resulting in user-level code execution. A working PoC is confirmed in GHSA-mf5c-hw34-4hpp; no CISA KEV listing is present and EPSS data is unavailable for this CVE.
SQL injection in MariaDB Connector/Node.js exposes applications to data exfiltration or modification when using non-default multi-byte character sets (big5, gbk, sjis, cp932, or gb18030) with attacker-controlled Buffer query parameters. Versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 contain a charset-unaware byte-wise escape routine that allows an attacker-supplied lead byte to absorb the connector-inserted backslash (0x5C) as a multi-byte trail byte, leaving the following quote (0x27) unescaped and terminating the SQL string literal. No public exploit code has been identified at time of analysis and this CVE is not in the CISA KEV catalog, but the root technique is well-documented in public security literature as the classic GBK/Big5 multi-byte escape bypass.
Unauthenticated BLE packet injection in BitChat for iOS v1.5.0 (reported in the CVE as v1.15.0) allows any device within Bluetooth adjacency range to inject crafted MESSAGE packets into the mesh gossip cache, causing denial of service for all mesh participants. The attack exploits a TTL=0 validation bypass in BLEService.swift that accepted packets as anonymous without full sender authentication. A public proof-of-concept is available at a named GitHub repository; no active exploitation has been confirmed by CISA KEV.
Charset-confusion in MariaDB Connector/J (all branches prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows a server-side character set change mid-session to silently decouple the driver's UTF-8 encoding assumption from the server's active encoding. Because the driver continues escaping SQL string literals as UTF-8 while the server parses incoming bytes under a different multi-byte encoding (e.g., GBK or BIG5), the mismatch can defeat byte-wise SQL quoting and enable SQL injection - a well-documented attack class for charset-confusion primitives. No public exploit has been identified and this CVE is not listed in CISA KEV at time of analysis.
PAM dialog authentication in MariaDB Connector/Node.js discloses account passwords in cleartext when connections use plain TCP, because the SendPamAuthPacketFactory handler omitted the secure-transport gate that was already applied to the sibling mysql_clear_password plugin. Applications connecting to MariaDB with default settings (sslMode=DISABLE, restrictedAuth=null) over untrusted network paths are exposed to credential theft by any on-path attacker or rogue server that issues an Authentication Switch Request for the dialog plugin. No active exploitation or public exploit code has been identified; vendor-released patches are available across all active 3.x branches.
MariaDB Connector/R2DBC prior to 1.4.1 hardcodes UTF-8 for all character encoding and decoding but fails to reject mid-session charset changes announced by the server via the OK-packet session-state-tracking mechanism. A hostile or man-in-the-middle server, or server-side constructs such as stored routines, triggers, or server configuration, can shift character_set_client to a non-UTF-8 encoding after connection initialization, causing the driver and server to interpret identical bytes under different encodings. This produces silent data corruption and a charset-confusion mismatch that can undermine byte-wise quoting and escaping, creating a pathway to SQL injection in applications that rely on driver-level escaping; no public exploit has been identified at time of analysis and the vendor-released patch is available in version 1.4.1.
Cleartext database password disclosure in MariaDB Connector/J (all versions before 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows an active network man-in-the-middle to capture a victim application's full database password during the initial TLS handshake. The connector's initial-handshake code path transmits a mysql_clear_password authentication response before validating the certificate fingerprint that is supposed to enforce server identity - a guard that the OK-packet and auth-switch paths correctly enforce but that HandshakeResponse.encode() bypasses entirely. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, though the vulnerability mechanism is fully documented in a vendor-published HackerOne report and GHSA advisory.
MariaDB Connector/J exposes database account passwords in cleartext to on-path attackers or hostile servers when PAM (dialog) authentication is used over plain TCP. The driver's PAM handler (SendPamAuthPacketFactory, plugin name 'dialog') failed to override the requireSsl() gate that correctly protects its sibling mysql_clear_password plugin, inheriting a default value of false and thus omitting the secure-transport requirement. Under the default connector configuration (sslMode=DISABLE, restrictedAuth=null), a man-in-the-middle or rogue server can issue an Authentication Switch Request for the dialog plugin and receive the account password in cleartext, granting full credential reuse against the real database. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the attack mechanics are straightforward for any on-path attacker against affected deployments.
Cleartext password disclosure in MariaDB Connector/R2DBC (org.mariadb:r2dbc-mariadb) prior to 1.4.1 allows a network-positioned attacker posing as a database server to harvest user credentials during authentication. The connector's AuthenticationPlugin interface lacked any requireSecure() gate, so plugins transmitting credentials in cleartext - mysql_clear_password and PAM/dialog - could be triggered by a forged AuthSwitchRequest over an unencrypted plain-TCP connection, causing the client to respond with the user's database password as raw bytes on the wire. No public exploit code has been identified and no KEV listing exists; the issue is fully patched in version 1.4.1.
Stored XSS in the silverstripe/versioned package allows a CMS user with content-creation rights to execute arbitrary JavaScript in an administrator's browser by embedding a malicious payload in a page title that is rendered without escaping during the ArchiveAdmin restore workflow. All versions prior to 3.2.1 are affected. No active exploitation or standalone public exploit has been identified, though the patch PR includes working test payloads confirming the mechanism.
Unauthorized token deletion in Graylog's REST API (versions 6.2.0 through 6.3.11, 7.0.0-7.0.6, and 7.1.0-7.1.1) allows any authenticated user to revoke access tokens belonging to other accounts - including administrators and service accounts - by exploiting a misplaced permission check in the token revocation endpoint. The flaw does not expose token secret values but can invalidate privileged credentials and disrupt automated integrations that rely on access tokens. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available in versions 6.3.12, 7.0.7, and 7.1.2.
Authorization bypass in Vikunja's project duplication API allows any authenticated user to inject an attacker-owned project into any other user's or team's project hierarchy without write access to the target parent. Affected versions span v0.21.0 through v2.3.0 - the entire post-namespace-migration release history - and exploitation requires only a single authenticated API call with no special configuration. No public exploit exists beyond the proof of concept published in the vendor advisory, and the CVE is not listed in the CISA KEV catalog; however, the trivial reproducibility and lack of rate-limiting or secondary authorization checks on the duplicate route make this a meaningful risk on any shared Vikunja instance.
Arbitrary file write in the Breeze Cache WordPress plugin (all versions before 2.5.13) allows unauthenticated remote attackers to place files at any server filesystem location by supplying unsanitized path values in HTTP requests. The plugin uses attacker-controlled input directly to construct cache file paths, enabling traversal outside the intended cache directory. A publicly available proof-of-concept exists; while SSVC confirms no exploitation at time of analysis, the automatable attack vector and CWE-434 classification raise concern that the primitive could be chained to remote code execution if attacker-controlled content reaches a web-accessible directory.
Unauthenticated mass PII enumeration in the User Frontend WordPress plugin (versions 4.3.0 through 4.3.10) exposes the email address and phone number of every registered user - including site administrators - via an unrestricted user directory search endpoint. The flaw requires no authentication, no special configuration, and is automatable per SSVC, making bulk harvesting trivial for any remote attacker. A publicly available proof-of-concept exploit exists, reported by WPScan, though active exploitation has not been confirmed by CISA KEV at time of analysis.
Missing authorization in WCFM Marketplace WordPress plugin before 3.8.2 allows unauthenticated users to submit refund requests against any guest checkout order without verifying order ownership. The flaw (CWE-862) targets the refund request endpoint, which performs no ownership check for guest orders, enabling arbitrary financial disruption to marketplace vendors. A publicly available proof-of-concept exists; however, SSVC data confirms no active exploitation detected at time of analysis, and the patch is available in version 3.8.2.
Unauthenticated file upload in the Shared Files (before 1.7.67) and Shared Files Pro (before 1.7.70) WordPress plugins exposes an upload handler that performs no capability check and relies on a nonce embedded in every public page - making the nonce an ineffective authorization barrier. Any unauthenticated visitor can upload files within WordPress's allowed MIME type list to a publicly accessible server directory, and the server's absolute filesystem path is returned in the response, aiding reconnaissance. Publicly available exploit code exists (confirmed by WPScan); however, active exploitation has not been confirmed and the CVE is not listed in CISA KEV.
Cross-tenant kanban bucket injection in Vikunja API (≤ 2.3.0) allows any authenticated user to relocate their own bucket into any other tenant's project view by supplying an arbitrary `project_view_id` in the JSON request body of the bucket update endpoint. The `Bucket.Update()` function in `pkg/models/kanban.go` mass-assigns `project_view_id` directly to the database row via xorm, while the `CanUpdate` authorization check only validates the URL path parameters - never the body field. A detailed curl-based proof-of-concept is publicly available in the GitHub security advisory GHSA-569v-q83c-3j3g, though no active exploitation has been confirmed (not in CISA KEV).
Open redirect in Pocket ID's OIDC /authorize page (versions 2.6.0-2.8.0) allows an unauthenticated network attacker to redirect any victim browser to an arbitrary external HTTPS URL by supplying a crafted authorization link with prompt=none and an unregistered redirect_uri. The SvelteKit frontend's onMount() handler issues window.location.href from the raw redirect_uri before the backend's allow-list validator is ever invoked, completely bypassing the per-client callback URL enforcement that protects the standard interactive flow. A public PoC is confirmed at code level (commit fc42f62) and the fix is released in v2.9.0; no active exploitation (CISA KEV) has been reported.
Missing authorization checks on three IAM REST API endpoints in Yamcs allow any authenticated low-privilege user to enumerate the server's complete privilege taxonomy and role-to-privilege mappings, directly enabling targeted privilege escalation reconnaissance. Affected are yamcs-core versions up to 5.12.7 and 5.13.0 through 5.13.1, used in production spacecraft operations and ground station environments. A proof-of-concept is confirmed in the GHSA advisory; no active exploitation (CISA KEV) has been identified, but the leaked data (including the ControlAccess and ChangeMissionDatabase privilege names) provides a precise roadmap for chained attacks including, per the advisory, algorithm-level remote code execution.
Stored XSS in PrivateBin versions up to 2.0.4 allows an anonymous attacker to attach a text/html file to a paste such that, when a victim opens the download link in a new tab, the attacker's inline JavaScript executes in the PrivateBin instance's web origin with full same-origin capability including localStorage access and same-origin fetch. This is an incomplete fix for CVE-2022-24833: the 2022 patch only sanitized the preview blob for SVG files but never updated the download link's blob, leaving all non-SVG active content types-including text/html-completely bypassing DOMPurify. A detailed proof-of-concept demonstrating exploitation with Playwright/Chromium automation is publicly available in GitHub Security Advisory GHSA-f2xf-7x3g-4272; no public exploit identified as confirmed actively exploited per CISA KEV.
Missing object-level authorization in the User Registration & Membership WordPress plugin (before 5.2.5) allows any authenticated Subscriber-level user to cancel a pending email change belonging to any other account - including site administrators. The flaw stems from the plugin's email-change cancellation handler accepting a user identifier supplied by the requester without verifying account ownership, a classic IDOR pattern. A publicly available exploit exists per WPScan; however, SSVC assessment lists exploitation as none and the attack is not automatable, indicating opportunistic rather than widespread active abuse.
Stack-based buffer overflow and null pointer dereference vulnerabilities in the PLANET GS-4210-16P2S managed PoE switch firmware (all versions before 3.441b260626) allow a remote authenticated attacker to crash the CGI-based web management service by submitting crafted POST requests to RADIUS server configuration handlers. The `web_radiusSrv*_post` handler family in `/cgi-bin/dispatcher.cgi` copies user-controlled parameters into fixed-size stack buffers without bounds checking and dereferences `radName`/`radIp` pointers without confirming their presence. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis; a vendor-released firmware patch is available.
Stack-based buffer overflows in PLANET GS-4210-16P2S managed switch firmware before 3.441b260626 allow a remote administrator to crash the web management interface by sending crafted HTTP POST requests to /cgi-bin/dispatcher.cgi. More than 30 named CGI handler functions - spanning VLAN, SNMP v3, ACL, AAA, DHCP, STP, PoE, and cable diagnostics subsystems - copy attacker-supplied POST parameters into fixed-size stack buffers without length validation. The confirmed impact is denial of service of the web management service; the vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis, though a vendor patch is available.
Stack-based buffer overflow vulnerabilities in the PLANET GS-4210-16P2S managed PoE switch web management interface allow a remote authenticated attacker to crash the CGI process and disrupt web-based device administration. Three separate POST parameter handlers in /cgi-bin/dispatcher.cgi - processing usrPass, enbPass, usrName, and usrPass - copy user-supplied input into fixed-size stack buffers without bounds validation, triggering CWE-121 conditions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; impact is confined to denial of service against the web management plane.
Null pointer dereference in PLANET GS-4210-16P2S managed switch firmware before 3.441b260626 allows remote authenticated attackers to crash the web management interface by sending a crafted request. The web_poe_alive_rmtip_post handler in /cgi-bin/dispatcher.cgi dereferences the rmtIP POST parameter without first validating its presence, meaning a missing parameter is dereferenced as NULL, faulting the CGI process and rendering the web management interface unavailable. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, though the trigger is trivially simple - a single omitted parameter - for any attacker already holding administrative credentials.
Unauthenticated access to Spring Boot Actuator management endpoints in Zipkin through 3.6.1 exposes sensitive operational data and configuration controls on the same port as the tracing API. Remote attackers with network reach to the Zipkin API port can read environment variables, bean configurations, and storage backend credentials via endpoints such as /actuator/env and /actuator/beans, or silently suppress security-relevant logging by modifying log levels via /actuator/loggers. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated remote exploitation; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Path traversal in SiYuan's asset.upload MCP tool before v3.8.1 allows an attacker to exfiltrate arbitrary host files - including SSH keys and credentials - by supplying absolute paths that bypass workspace boundary validation. The attack is delivered via prompt injection against an AI Agent connected to SiYuan's MCP server, meaning exploitation depends on an AI agent processing attacker-controlled content. No public exploit or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact (CVSS 4.0: 6.9) reflects the potential to read any file the SiYuan process can access.
Uncontrolled payload size acceptance in SvelteKit's remote form function handler allows unauthenticated remote attackers to crash the underlying Node.js process by submitting oversized POST payloads. All @sveltejs/kit versions prior to 2.69.1 are affected; no authentication or special configuration is required to trigger the crash. Repeated exploitation can sustain denial-of-service against the application process; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in MongoDB's MongoSQL Transition Readiness Tool allows any authenticated BI Connector query issuer to inject arbitrary HTML markup into operator-generated reports by embedding script payloads in query strings that the BI Connector logs verbatim. When an operator later generates an HTML report from affected logs and opens it in a browser, the injected markup executes, potentially disclosing other users' logged query text and usernames to attacker-controlled infrastructure or presenting spoofed content to the operator. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; the required two-step operator interaction substantially limits opportunistic exploitation.
Unauthenticated information disclosure in WWBN AVideo through version 30.0 exposes user registration statistics via two unprotected PHP endpoints. The report4.json.php and report4.1.json.php files return daily and cumulative user-registration counts to any remote requester without authentication or session validation. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; however, its trivial exploitation path and network accessibility make it easy for any actor who can reach the server to enumerate platform growth data.
Blind SQL injection in the DP Calendar Joomla extension (versions 5.5.0 through 10.11.2) enables authenticated users holding article update permissions to extract Joomla database contents by saving a crafted article when the DP Calendar content plugin is active. Reported by the Joomla security team and scored CVSS 4.0 6.9, the flaw yields high confidentiality impact but is constrained by a high-privilege prerequisite. No public exploit code or CISA KEV listing has been identified at time of analysis.
Secure boot bypass in IGEL OS 12 (before 12.9.0/12.8.3 LTS) and IGEL OS 11 (before 11.11.150) allows physically present attackers to obtain a root shell by exploiting GRUB's fail-open signature verification behavior. Placing an empty, unsigned file named igel.conf on any GRUB-accessible partition causes the bootloader to drop into an interactive GRUB prompt instead of halting, from which the attacker boots the device's own kernel with attacker-controlled command-line arguments, unlocking the disk. The attack leaves TPM PCR values unaltered - defeating attestation-based detection - and was publicly detailed at DEF CON 34; no active exploitation confirmed in CISA KEV at time of analysis.
Sensitive data exposure in Le-yan's Medical Practice Management System enables access to confidential medical or patient data through URL query string parameters that persist in browser history and server or proxy log files (CWE-598). The application transmits sensitive values via HTTP GET parameters rather than POST body or secure headers, causing this data to be recorded in multiple secondary storage locations outside the intended session scope. No public exploit code has been identified at the time of analysis, but the attack class requires minimal technical sophistication once access to affected log or history files is established; medical data sensitivity elevates real-world impact beyond what the base CVSS score alone suggests.
Spoofing via external file path control in Microsoft Edge (Chromium-based) enables a network-based, unauthenticated attacker to deceive users about the origin or content of resources rendered by the browser. The CVSS score of 6.5 (Medium) reflects a network-reachable attack requiring user interaction but no attacker privileges, with high confidentiality impact and no integrity or availability impact. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; a vendor patch is available through Microsoft MSRC.
Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5) allows any internet-accessible attacker to call arbitrary zero-argument PHP functions server-side via a missing-authorization AJAX handler combined with extract()-based variable injection into a template scope. The most critical demonstrated impact is persistent subscriber-level account creation through WordPress core's edit_user() function, which reads POST parameters directly, enabling unauthenticated user registration on any affected site. No CISA KEV listing has been identified at time of analysis, but Wordfence's detailed technical disclosure with specific file paths and line numbers substantially lowers the barrier for independent exploit development against the 6.5 CVSS-rated but trivially accessible unauthenticated attack surface.
Reflected XSS in Yamcs versions through 5.8.6 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a logged-in user's browser by delivering a specially crafted URL targeting the OAuth authorization endpoint. Exploitation exfiltrates the victim's session and refresh tokens to an attacker-controlled server, enabling complete account takeover. No public exploit identified at time of analysis independent of the advisory, though GHSA-rxpg-wjf8-qv9c includes a working reproduction payload with exact URL and netcat listener steps; vendor patch is available in 5.9.4 (CVSS 6.5, UI:R).
WebSocket subscription handlers in Yamcs bypass the object-level authorization checks enforced by their REST API counterparts, allowing any authenticated user to subscribe to the `packets`, `algorithm-status`, and `mdb-changes` topics and receive data their role explicitly restricts. Yamcs versions up to 5.12.7 and 5.13.0-5.13.1 are affected, exposing raw telemetry packets, algorithm execution status, and mission database changes to low-privilege principals. No public exploit code has been identified and no CISA KEV listing exists, but the exploit path is structurally trivial for any credentialed user given standard WebSocket client access.
Stack exhaustion via crafted compressed IMAP data in OX Dovecot Pro and OX Dovecot CE allows an authenticated remote attacker to crash the IMAP process, causing denial of service. The flaw (CWE-674, Uncontrolled Recursion) is triggered by sending specially constructed compressed payloads that exceed stack depth limits during decompression processing. No public exploit code exists, and exploitation requires valid IMAP credentials, meaningfully limiting the attacker pool.
IMAP compression in OX Dovecot Pro and OX Dovecot CE allows any authenticated user to exhaust the memory of the imap-login process by negotiating a memory-intensive decompression algorithm across multiple simultaneous connections. The process crashes after only a few such connections, terminating all sessions it manages and causing denial of service for all active IMAP users sharing that process. No public exploits are known and CISA KEV does not list this CVE, but the low prerequisite bar - any valid IMAP credential - makes it a meaningful risk in multi-tenant or hosted email environments.
StarRocks through version 4.0.13 exposes complete query history for all users to any authenticated low-privilege user via the unguarded query_detail REST endpoint. The endpoint returns full SQL text, execution plans, and profiling data without filtering by the requesting user's identity, meaning statements containing embedded credentials - connection strings, passwords passed as query parameters - are fully readable by any logged-in account. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low authentication bar (any valid account) and high confidentiality impact make this a meaningful lateral-movement and credential-harvesting risk in multi-tenant or shared StarRocks deployments.
OX Dovecot Pro and OX Dovecot CE are susceptible to a hash-collision denial-of-service attack where an attacker who can deliver mail to a target user can craft message headers engineered to collide in an internal hash table, causing the IMAP THREAD command to consume CPU disproportionate to message size. Any mail client issuing THREAD against the poisoned mailbox triggers sustained CPU exhaustion, degrading or denying IMAP service. This is a distinct issue from CVE-2026-40014 and is not resolved by that fix; no public exploit is identified at time of analysis.
CPU exhaustion in OX Dovecot's IMAP THREAD command allows a remote unauthenticated attacker to degrade or deny IMAP service by sending a specially crafted message header to any mailbox user. The vulnerability triggers when a mail client subsequently issues a THREAD command on the affected mailbox, causing disproportionate CPU consumption relative to message size. No public exploit code exists and the CVE has not been added to the CISA KEV catalog, but the low attack complexity and zero-authentication requirement make it operationally significant for any organization running OX Dovecot at scale.
Zephyr RTOS's WireGuard VPN receive handler in wg_process_data_message() commits permanent peer-state mutations - endpoint roaming update, liveness timer refresh, and keypair promotion - before validating the anti-replay counter, allowing an on-path attacker who captures a single valid encrypted datagram to replay it from a spoofed source address and hijack the tunnel endpoint. Because AEAD decryption succeeds for any authentic ciphertext regardless of freshness, the spoofed replay is processed as legitimate and irreversibly alters peer state before the replay check fires and returns -EINVAL. No public exploit has been identified at time of analysis; patch is available via upstream commit 260c32ef.
Cross-site scripting in Synology Chat Server's extract domain feature allows authenticated remote users to inject malicious scripts that execute upon victim UI interaction, with impact extending beyond the Chat application into the broader DSM (DiskStation Manager) environment. The scope change captured in the CVSS vector (S:C) is the key risk amplifier: successful exploitation can result in reading or writing restricted DSM files and conducting limited denial-of-service against DSM. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Broken object-level authorization in IBM Langflow OSS 1.0.0 through 1.11.1 allows any authenticated network user to read and execute private flows belonging to other users. The flaw (CWE-639) stems from the application accepting user-controlled flow identifiers in API requests without verifying that the requesting account owns the targeted resource - a classic horizontal privilege escalation path. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a vendor patch is available via IBM Security Advisory.
Nonce reuse in wolfEngine's AES-CCM implementation for TLS 1.2 and DTLS 1.2 allows a network-positioned adversary to recover plaintext across records and forge authentication tags within a session. The root defect is that wolfEngine reads the explicit CCM nonce from the uninitialized record input buffer rather than deriving it from the TLS sequence number in the Additional Authenticated Data, producing a constant nonce for every record under the same key. Exposure is sharply constrained: AES-CCM cipher suites must be explicitly selected (non-default), only wolfEngine is affected (wolfProvider is not), and TLS 1.3 is entirely outside scope. No public exploit or CISA KEV listing exists at time of analysis; the vendor-released fix is wolfEngine 1.4.1.
Cross-site scripting in Tangible Loops & Logic, a WordPress templating plugin by Tangible, allows network-accessible attackers to inject malicious scripts into web pages served to other users. The CVSS vector (PR:N/UI:N) suggests unauthenticated stored XSS where payloads execute without additional victim interaction beyond normal page visits, though this rating is atypical for XSS and warrants verification. No public exploit code and no CISA KEV listing were identified at time of analysis, but the low attack complexity and lack of authentication requirement make this straightforward to exploit once the injection vector is identified.
Cross-tenant authorization bypass in Hatchet's Dispatcher gRPC service (versions 0.40.0 through 0.91.1) permits any authenticated low-privilege tenant to overwrite worker affinity labels or force-disconnect workers belonging to other tenants on the same instance. The two affected RPCs - UpsertWorkerLabels and Unsubscribe - validate the caller's bearer token only for analytics and response shaping, never to authorize the worker_id supplied in the request body, constituting a classic IDOR (CWE-639) across tenant boundaries. A vendor-released patch is available in version 0.91.2; no public exploit or active exploitation has been identified at time of analysis.