SQL injection in the LearnPress WordPress LMS plugin (versions ≤ 4.4.4) allows authenticated administrators to extract arbitrary data from the WordPress database by injecting into the ORDER BY clause of the export_order_csv AJAX action. The flaw exists because the 'orderby' parameter is only partially normalized - only the literal strings 'date' and 'title' are whitelisted - and all other attacker-controlled values are concatenated directly into a raw SQL query inside DataBase::execute() without $wpdb->prepare() or an identifier allowlist. No public exploit has been identified at time of analysis, and the CVSS score of 4.9 (Medium) reflects the high privilege barrier as the primary risk limiter.
SQL injection in Photo Gallery by Ays - Responsive Image Gallery (all versions through 6.8.2) allows authenticated administrators to extract arbitrary data from the WordPress database by appending malicious SQL to the 's' search parameter. The vulnerability spans two distinct code paths in the plugin's category list table class - record_count() via $wpdb->get_var() and prepare_items()/get_image_categories() via $wpdb->get_results() - supporting both blind and UNION-based exfiltration techniques. No public exploit has been identified at time of analysis; the high privilege requirement significantly constrains realistic attack scenarios.
Denial of service in Elasticsearch allows an authenticated user with elevated cluster privileges to submit a specially crafted API request that causes unbounded memory consumption, potentially crashing the targeted node and disrupting cluster availability. The flaw is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) with CAPEC-130 attack pattern, and is confirmed by Elastic via advisory ESA-2026-47. No public exploit code or CISA KEV listing has been identified at time of analysis; the elevated-privilege requirement (PR:H) meaningfully constrains realistic attackers to insiders or compromised admin accounts.
Second-order SQL injection in the WP EasyCart (Shopping Cart & eCommerce Store) WordPress plugin through version 5.9.2 allows authenticated administrators to extract arbitrary data from the WordPress database. The attack is a two-stage operation: a malicious payload is first written to the ec_pageoption table via the ec_ajax_save_page_options handler without any sanitization, then on subsequent store page renders the value is retrieved and processed through stripslashes() - which strips WordPress's magic-quote escaping - before being concatenated directly into a live SQL query in ec_filter.php. No public exploit has been identified at time of analysis, and the PR:H requirement substantially constrains the realistic attacker population.
Stack overflow vulnerabilities in an HPE AOS-CX API endpoint allow an authenticated, high-privileged attacker to crash the affected system via a crafted request, resulting in a denial-of-service condition. The vulnerability is network-exploitable but requires prior administrative authentication, substantially limiting the attacker pool. This CVE is part of the same HPE advisory (hpesbnw05134) covering multiple AOS-CX weaknesses, including higher-severity unauthenticated and adjacent-network issues; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in LibreNMS 26.4.0 and below allows an authenticated administrator to inject arbitrary HTML/JavaScript into graph description configuration keys, which then execute in the browsers of every authenticated user who views the affected graph type. The vulnerable sink is `includes/html/pages/graphs.inc.php:194`, where `LibrenmsConfig::get()` output is echoed without `htmlspecialchars()`. A public proof-of-concept is documented in the GHSA advisory; no active exploitation is confirmed via CISA KEV. The vendor released a fix in version 26.7.0.
Path traversal in HPE Networking Fabric Composer's API endpoint allows an unauthenticated adjacent attacker to manipulate user-generated files and potentially alter critical system configurations. Exploitation is constrained by the AV:A vector (attacker must be on the same network segment), high attack complexity requiring preconditions outside the attacker's control, and mandatory user interaction - factors that collectively reduce the practical risk below the I:H integrity impact might suggest. No public exploit code has been identified and the vulnerability is not listed in CISA KEV. The CVSS base score of 4.8 reflects these limiting conditions accurately.
Exponential traversal denial-of-service in pypdf before 6.16.1 allows an attacker who can supply a crafted PDF to cause severe CPU stalls and memory exhaustion in any application invoking `PageObject._extract_text` or `PageObject.extract_xform_text`. The text extraction routines previously detected only direct cycles via a `known_ids` set, but failed to bound the total number of XForm invocations across a directed acyclic graph where each parent node reuses the same child XObject multiple times, producing O(2^n) traversal paths for n levels. No active exploitation or public exploit code has been identified; the fix is confirmed available in version 6.16.1.
Denial-of-service vulnerability in Rockwell Automation FactoryTalk® Historian Machine Edition allows a network-adjacent, high-privilege authenticated attacker to crash the device by sending crafted requests to its web interface, triggering a stack-based buffer overflow (CWE-121) that renders the historian unresponsive. All versions appear affected per the CPE wildcard, and the impact is limited to availability - no confidentiality or integrity compromise is possible. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Local information disclosure in HPE Networking Fabric Composer allows an authenticated low-privileged operator user with local system access to read sensitive OS-level data, potentially enabling privilege escalation on the affected host. The vulnerability resides in the underlying operating system layer exposed through Fabric Composer's operator access model, and is constrained by both a local attack vector and high complexity requirement. No public exploit code has been identified and this entry does not appear in the CISA KEV catalog.
Cleartext exposure of sensitive information in the HPE Networking Fabric Composer API allows a local attacker holding administrative credentials to retrieve secrets that the system is expected to protect in encrypted form. The vulnerability is constrained to local access with high privileges already obtained, yielding a CVSS 3.1 score of 4.4 (Medium). No public exploit code or active exploitation has been identified at time of analysis; the advisory originates from HPE itself, suggesting proactive disclosure rather than incident response.
Local privilege escalation in HPE Networking Fabric Composer enables an authenticated, highly privileged operator on the underlying host to elevate their role within the Fabric Composer management hierarchy, gaining access to higher-privileged administrative functions. The impact is bounded to integrity - specifically the ability to alter certain system configuration settings - with no confidentiality or availability consequence reported. No public exploit code and no CISA KEV listing exist at time of analysis, consistent with the low CVSS score of 4.4 and the stringent local, high-privilege prerequisite.
Incorrect boundary conditions in Firefox's CSS Grid layout engine expose limited browser process memory to remote attackers who deliver crafted web content. All Firefox versions prior to 155 are affected; exploitation requires a victim to visit or render attacker-controlled content, producing low-level confidentiality disclosure with no integrity or availability impact. Mozilla issued the fix in Firefox 155 via MFSA2026-82; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Incorrect Authorization (CWE-863) in Kibana's Entity Analytics module allows an authenticated low-privilege user to silently halt the Privilege Monitoring engine for an entire Kibana space. A user holding only read-level Security feature access - and no Elasticsearch privileges - can invoke the task-stop action, causing privileged user activity tracking to cease while the engine continues to falsely report a healthy operational state to administrators. No public exploit has been identified at time of analysis, but the deceptive healthy-status behavior creates a detection blind spot directly useful for insider threat operations or post-compromise privilege escalation concealment. Fixed in Kibana 9.4.6 and 9.5.2 per Elastic advisory ESA-2026-130.
Kibana's Entity Store feature permits a low-privilege authenticated Security user to invoke an administrative initialization operation that creates and persists Elasticsearch API keys without holding the elevated cluster and Kibana privileges the documented setup flow mandates. The root cause is CWE-862 Missing Authorization - the endpoint does not verify the caller meets the required permission tier before executing the privileged action. Elastic has released fixes in versions 8.19.21 and 9.4.6 per ESA-2026-155; no public exploit has been identified at time of analysis.
Kibana's missing server-side authorization check (CWE-862) allows any authenticated user holding only minimal Elasticsearch privileges to bypass Kibana feature authorization and Space access controls, reading Fleet deployment metadata from the default Kibana space without having been granted that permission. The flaw is rooted in an absent authorization gate on Fleet API paths rather than a misconfiguration, meaning the control is simply not enforced rather than configured incorrectly. Elastic has self-reported the issue and released fixes in versions 9.4.6 and 9.5.1 per advisory ESA-2026-149; no public exploit code or active exploitation (CISA KEV) has been identified.
Authenticated low-privilege information disclosure in HPE Networking Fabric Composer's API permits operator-level users to read system files outside their authorized scope. The CVSS 4.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a bounded, post-authentication flaw with limited confidentiality impact. No public exploit code exists and the vulnerability is not listed in CISA KEV, placing real-world risk at low priority absent privileged insider threat scenarios.
Information disclosure in Firefox for Android's WebExtensions component exposes sensitive browser or cross-origin data to remote attackers who can induce user interaction. Affecting all Firefox for Android versions prior to 155, the flaw is accessible over the network with low complexity but requires a user to interact with attacker-controlled content, gating mass exploitation. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Source address spoofing in HPE Networking Fabric Composer allows an authenticated low-privilege operator to forge the origin address recorded for their API requests, corrupting the audit trail for affected system actions. The attacker cannot read sensitive data or disrupt availability; the sole impact is integrity of attribution records, confirmed by the CVSS vector (C:N/I:L/A:N). No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.
Spoofing via origin validation failure in Firefox's DOM Core & HTML component allows a remote unauthenticated attacker to misrepresent content origin within the browser, achieving low-integrity impact against users of all Firefox versions before 155 and Firefox ESR before 153.2. The vulnerability class (CWE-346, Origin Validation Error) indicates the browser fails to correctly enforce the origin of DOM operations or HTML content, enabling cross-origin content spoofing. Multiple Mozilla Security Advisories (mfsa2026-82, -85, -86, -88) confirm the fix; EPSS of 0.14% (4th percentile) and absence from CISA KEV indicate no active exploitation at this time.
Crash of the gvfsd-mtp daemon in gvfs is achievable by anyone who can connect a malicious USB MTP device to a target Linux system. The do_read() function in gvfsbackendmtp.c accepts the byte-count reported by the device at face value and passes it uncapped to memcpy(), causing an out-of-bounds read that triggers a segmentation fault when the device deliberately over-reports its response length. The vulnerability affects gvfs as packaged across Red Hat Enterprise Linux 6 through 10; no public exploit has been identified and exploitation is constrained by physical proximity.
Uninitialized heap memory disclosure in gvfs's SFTP backend enables a malicious SFTP server to deterministically defeat ASLR on client systems running RHEL 6 through 10. When a user mounts a crafted SFTP share, the read_string() parser allocates a buffer for the FXP_HANDLE response but does not verify that the buffer is fully populated; the client subsequently echoes the uninitialized remainder - containing heap base pointers and the libgio load address - back to the attacker on every subsequent file-handle request. No public exploit has been identified at time of analysis, and the issue does not appear in CISA KEV, but the ASLR bypass it achieves is a high-value precursor for chained memory-corruption attacks against gvfsd-sftp.
Incorrect Authorization in Kibana's Elastic AI Assistant Knowledge Base allows an authenticated user to read, modify, and delete private Knowledge Base entries belonging to a different user when both principals share an identical username value but originate from distinct authentication realms. Elastic advisory ESA-2026-142 confirms the flaw across multiple 8.x and 9.x release lines, with fixed versions 8.19.21, 9.4.6, and 9.5.2 released. No public exploit code has been identified and the vulnerability does not appear in CISA KEV; exploitation is gated by a high-complexity prerequisite - a username collision across separately configured authentication realms - which significantly limits the exposed population.
Limited prototype pollution in joi's object().rename() allows unauthenticated remote attackers to set the prototype of the object returned by validate(), but does not affect global Object.prototype. When a schema combines a regex rename source, a Joi.x() or Joi.expression() interpolating template target, and { multiple: true }, an input key such as x-__proto__ causes the rename target to resolve to __proto__, which JavaScript interprets as a prototype assignment rather than own-property creation. The scope is strictly confined to the single validation call result - downstream code that reads prototype-inherited properties on that object could observe attacker-injected values, enabling potential within-request privilege escalation. No public exploit or CISA KEV listing exists at time of analysis; CVSS 3.7 (AC:H) accurately reflects the tight, non-default schema configuration required.
Prototype pollution in joi, one of the most widely used JavaScript schema-validation libraries (versions 16.0.0 through <17.13.6 and <18.2.5, and @hapi/joi through 17.1.1), allows an attacker who can supply attacker-controlled language keys to joi's schema-construction message API to write arbitrary properties onto Object.prototype or the Object constructor's static properties. A language key named __proto__ contaminates the global prototype, causing every subsequent property-existence check on any plain object in the process to return an unexpected value, silently flipping conditional logic. No public exploit has been identified at time of analysis, exploitation conditions are restrictive, and the vendor has released fixed versions 17.13.6 and 18.2.5.
HTTP request smuggling in Node.js's HTTP client module enables forwarding proxies to desynchronize backend connections when request headers exceed the maxHeadersCount or maxHeaderPairs thresholds. When a Node.js-based proxy rebuilds outbound request headers from the visible IncomingMessage properties and pipes the original body over a reused backend connection, framing-critical headers such as Content-Length are silently omitted from the proxy's outbound request while still governing body delivery internally - causing the backend to misparse the request stream. No public exploit has been identified at time of analysis, and exploitation is constrained to specific proxy architectures, which is reflected in the CVSS 3.7 Low score.
Unauthenticated remote information disclosure in HPE Networking Fabric Composer exposes cleartext data through the web-based management interface to network-positioned attackers. Exploitation demands high attack complexity (CVSS AC:H), constraining real-world risk despite the network-accessible, no-authentication vector. The vendor advisory identifies remediation; no public exploit code or CISA KEV listing has been identified, though the disclosed data could enable secondary compromise of dependent network infrastructure.
Authorization bypass in the runZero Platform MCP service allows an authenticated network attacker to read findings summaries belonging to other users or organizations by manipulating a user-controlled key in API requests. Affected versions of the platform prior to 5.1.260826.0 are exposed; the vendor has resolved the issue in that release. No public exploit code or active exploitation has been identified; exploitation is rated CVSS Low (3.5) due to high attack complexity and limited confidentiality impact.
Denial of service in HPE Networking Fabric Composer's web-based management interface can be triggered by an authenticated low-privilege operator, disrupting the availability of the management UI. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) reflects a low-severity, network-accessible flaw requiring valid credentials and user interaction, yielding only limited availability impact. No exploitation has been publicly demonstrated, and the vulnerability does not affect the underlying fabric infrastructure - only the management interface itself.
Unauthenticated information disclosure in HPE Networking Fabric Composer's API endpoint exposes internal service and workflow details to remote attackers under high-complexity conditions. The vulnerability requires user interaction per the CVSS vector (UI:R), which is atypical for an API endpoint flaw, suggesting a specific trigger mechanism or chained condition not fully described in the advisory. Impact is limited to low confidentiality exposure, though HPE's own advisory frames it as a stepping stone that increases risk when chained with other vulnerabilities. No public exploit or KEV listing identified at time of analysis.
Denial-of-service in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator to interrupt service availability. The flaw requires high-complexity conditions (AV:N/AC:H/PR:L) and produces only limited availability impact, placing it at CVSS 3.1. No public exploit code or CISA KEV listing has been identified at time of analysis.
Buffer overflow in FFmpeg v.7.0 and later within the libavformat/iamf_writer.c component allows an attacker to crash the process by supplying a crafted IAMF (Immersive Audio Model and Formats) file, resulting in a denial of service. The flaw, rooted in improper bounds checking during extradata padding operations (CWE-120), affects the IAMF audio encoder/writer path introduced alongside IAMF support in FFmpeg 7.0. A patch commit (8439e020) and upstream pull request #22988 are available, though a tagged release incorporating the fix has not been independently confirmed. No public exploit code has been identified and EPSS of 0.17% (7th percentile) reflects low exploitation probability at this time.
Heap metadata corruption in the popt command-line parsing library's `poptConfigFileToString` function can be triggered by a local, low-privileged attacker who supplies specially crafted configuration file content to an affected host. Successful exploitation causes the consuming process to crash, resulting in denial of service. CVSS 2.5 (Low) reflects the strictly local, high-complexity exploitation path with no confidentiality or integrity impact; no public exploit code or active exploitation (CISA KEV) is known at time of analysis.
Local privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator with physical or shell access to elevate user privileges and make limited modifications to the affected system. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires both local system access and a low-privilege operator account, and the high attack complexity suggests non-trivial preconditions must be met. Impact is strictly bounded: the CVSS registers no confidentiality or availability impact, only limited integrity modification (I:L), meaning full administrative compromise is not achieved. No public exploit code or CISA KEV listing has been identified at time of analysis.
Open redirect in ash_typescript's TypeScript client code generator allows an attacker who controls a path-parameter value to cause a generated client to forward its request - including any credentials configured in TypedControllerConfig - to an attacker-controlled host. Affected are applications using ash_typescript 0.15.0 through 0.17.x that expose generated TypeScript clients where path parameters are user-influenced. No public exploit or CISA KEV listing is present, and the EPSS signal is correspondingly low given the niche footprint of the library.
Cleartext exposure of sensitive information in HPE Networking Fabric Composer's management interface can be triggered by an authenticated administrator, potentially revealing credentials or configuration data for downstream network services. The vulnerability requires both administrative privileges and high attack complexity (CVSS 2.2, AV:N/AC:H/PR:H), meaning realistic exploitability is limited to insiders or attackers who have already fully compromised an admin account. Successful exploitation could enable lateral movement into network services managed by Fabric Composer. No public exploit code or CISA KEV listing has been identified.
Denial of service in NousResearch hermes-agent 0.18.0 allows authenticated remote attackers to crash or degrade the Session Chat Interface by exploiting improper resource shutdown or release (CWE-404) in gateway/platforms/api_server.py. The CVSS 4.0 score of 2.1 with VA:L reflects a low-impact, low-privilege DoS against the vulnerable system only - no confidentiality or integrity impact is present. No public exploit identified at time of analysis is inaccurate here: a PoC has been published on GitHub (E:P), and the vendor has not acknowledged or responded to the disclosure.
Constraint bypass in Ash Framework's CiString type allows storing string values that violate configured length or match constraints after case-folding. Any application built on ash versions 1.29.0-rc0 through 3.32.2 that defines a CiString attribute with both a casing option (:lower or :upper) and a max_length, min_length, or match constraint is affected. An attacker who can submit input to such a field can craft a value whose pre-fold form satisfies constraints but whose stored, case-folded form violates them - silently defeating application-defined data integrity rules. No public exploit code exists and no CISA KEV listing is present; the CVSS 4.0 score of 2.1 reflects the narrow, low-severity nature of the flaw.
Ash.Reactor's ChangeStep component in the Elixir Ash framework silently bypasses security-relevant change operations when a `where` guard raises an exception, instead of halting the step with an error. Applications built on ash versions 3.0.0-rc.17 through 3.32.1 that use Ash.Reactor pipelines with `where`-gated changes are affected. An attacker who can supply crafted input triggering a guard exception may cause the guarded change to be silently skipped, potentially circumventing authentication, authorization, or mandatory data transformations depending on what that change enforces. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Type confusion in Ash Framework's union type storage allows attackers to persist a crafted map value whose data belongs to one union member but whose tag names a different member, bypassing that member's constraints and any tag-based authorization policies. Affected versions span ash 2.14.18 through 3.32.2 (exclusive). This exploits `Ash.Type.Union.dump_to_native/2` only when union fields are configured with `storage: :map_with_tag`, a non-default specialization. No public exploit is identified and the issue carries a very low CVSS 4.0 base score of 2.1, but the authentication bypass impact is notable in policy-sensitive applications.
Constraint validation bypass in Ash Framework's decimal type (versions 1.28.0 through 3.32.1) allows any actor capable of submitting input to an Ash action with a decimal field to persist non-finite IEEE 754 values such as Infinity or NaN, silently bypassing configured min/max bounds. Because NaN returns false in all numeric comparisons, constraint checks pass without error; the persisted value then causes arithmetic failures or data-layer rejections in subsequent operations, degrading application integrity and availability. No active exploitation is confirmed (not in CISA KEV) and no public exploit code exists; vendor patch is available in version 3.32.2.
Scheduler exhaustion in ash Framework (Elixir) versions 2.19.0 through 3.32.2 allows any workload triggering concurrent slow async read operations to pin BEAM scheduler threads at 100% CPU. The root cause is a busy-polling loop in Ash.Actions.Read.AsyncLimiter.await_at_least_one/1 that called Task.yield(task, 0) repeatedly with zero timeout rather than sleeping until a task completed, keeping the calling scheduler thread active throughout the wait. Multiple concurrent slow related-data loads or calculations compound the impact by saturating additional scheduler threads, potentially degrading or denying service to the entire Elixir node. No public exploit identified at time of analysis; vendor-released patch ash 3.32.2 resolves the issue.
Outer array constraint bypass in ash-project Ash (versions 2.16.1 through <3.32.2) allows input that violates declared outer-array constraints on doubly-nested {:array, {:array, type}} attributes to be accepted and persisted without error. The defect in Ash.Type.apply_constraints/3 propagated only inner-array constraints during nested array validation, leaving outer constraints such as max_length, min_length, and nil_items? unenforced. No active exploitation has been confirmed and no public exploit code is known at time of analysis; a vendor-released patch is available in version 3.32.2.
Sensitive field value disclosure in Ash Framework's atomic confirmation validator allows any caller of a vulnerable action to extract a stored sensitive attribute by intentionally submitting a wrong confirmation argument. Versions 2.17.20 through before 3.32.2 of ash-project/ash are affected: when an actor supplies only the confirmation argument and omits the field itself, the atomic `Confirm` validator resolves the mismatch error's `value` through `atomic_ref/2` to the field's current stored database value and returns it in the error payload. No public exploit exists beyond the regression test shipped with the fix commit, and this vulnerability does not appear in the CISA KEV catalog.
Incorrect authorization in the Ash Elixir framework (versions 3.5.13 through 3.32.2) allows aggregate queries to execute under a more permissive read action than the one used during the authorization check, disclosing aggregate-level statistics about records the actor is not permitted to access. The flaw lives in Ash.Actions.Aggregate, where the data-query builder honored an opts[:action] override that diverged from the read_action used to compute policy groups. No public exploit is identified at time of analysis, and a vendor-released patch is available in version 3.32.2.
SAML Authentication bypass in Cleo Harmony versions up to 5.8.1.10 allows remote attackers with low-privilege access to manipulate the Email argument within the LocalUserUtil.getNativeUserByAssertions function, circumventing authentication controls and potentially impersonating other users. The flaw is classified as CWE-287 (Improper Authentication) and a public proof-of-concept has been disclosed. Vendor-released patch version 5.8.1.11 is available and upgrade is recommended.