Configuration integrity compromise in Jenkins GitLab Plugin 1.9.16 and earlier enables authenticated low-privileged users to overwrite the global GitLab connection URL via Stapler data binding, redirecting GitLab API calls to attacker-controlled infrastructure. This causes Jenkins to transmit administrator-configured GitLab API tokens to the attacker's endpoint whenever a pipeline, webhook, or scheduled job triggers a GitLab API interaction. No KEV listing or public exploit has been identified at time of analysis, but the low privilege bar means any Jenkins account holder can abuse this on unpatched installations.
Cross-namespace certificate injection in Elastic Cloud on Kubernetes (ECK) Operator allows a low-privileged Kubernetes user confined to one namespace to insert attacker-controlled TLS certificate material into an Elasticsearch client trust bundle managed by ECK in a separate, distinct namespace. The flaw exploits incorrect authorization (CWE-863) via metadata spoofing (CAPEC-690), violating the namespace isolation boundary that Kubernetes clusters rely on for tenant separation. No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the low privilege bar and network-accessible Kubernetes API make this a realistic threat in multi-tenant cluster environments.
Incorrect Authorization (CWE-863) in Kibana's machine learning feature allows an authenticated low-privileged user to escalate their effective access beyond their assigned Kibana Space. A user holding ML job management privileges within a single Space can manipulate a job's saved object so it becomes accessible across all Spaces in the Kibana instance, bypassing the tenant-isolation boundary without holding rights to those additional Spaces. Vendor-released patches are available in versions 8.19.19, 9.3.8, and 9.4.4; no public exploit code or CISA KEV listing has been identified at time of analysis.
Missing authorization checks in the Drupal Entity PDF contributed module (versions through 2.1.4) expose a Forceful Browsing path that allows any authenticated site user to retrieve PDF renderings of Drupal entities beyond their access rights. The flaw, rooted in CWE-862, means the module generates and serves PDFs without verifying whether the requesting account has view permission on the underlying entity - effectively making every entity accessible to any logged-in user. A vendor patch is available via Drupal security advisory SA-Contrib-2026-114, and no public exploit or active exploitation has been identified at time of analysis.
Cross-Site Request Forgery in ThemeGoods Grand Tour WordPress theme (versions through 5.5.1) allows unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated administrators or editors by tricking them into visiting a crafted page. The flaw stems from missing or insufficient nonce validation on one or more theme-level AJAX or form-handling endpoints. No public exploit code or active exploitation has been confirmed; this is a Patchstack disclosure with CVSS 5.4 (Medium).
Server-side request forgery in Eclipse Ditto's Things service allows authenticated users with WRITE permission on a Thing to force the service to issue arbitrary HTTP GET requests to any host reachable from within the deployment's internal network. The vulnerability arises because the Things service fetches WoT ThingModel documents from attacker-supplied URLs in the Thing or Feature `definition` field without validating the target host, without re-validating redirect targets, and without enforcing a redirect hop limit. Attackers can leverage cloud instance-metadata endpoints (e.g., AWS IMDS at 169.254.169.254) and exploit differing HTTP error responses to enumerate internal services. No public exploit or CISA KEV entry exists at time of analysis.
Path traversal in Elastic Maps Server exposes arbitrary files readable by the server process to unauthenticated network attackers. Insufficient path restriction in the content-directory serving logic allows crafted requests to escape the intended directory using traversal sequences, returning sensitive file contents. No KEV listing or public exploit code exists at time of analysis; Elastic has released fixed versions 8.19.19, 9.4.4, and 9.5.1 per advisory ESA-2026-148.
Unauthenticated information disclosure in DXPR Builder, a Drupal page-building and AI editing module, exposes sensitive data through forceful browsing against insufficiently protected endpoints. All releases from 0.0.0 through 2.8.0 are affected; version 2.8.1 is the patched release per Drupal security advisory SA-CONTRIB-2026-112. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Forceful browsing via missing authorization in the Drupal Data field contributed module (versions up to 2.0.13) exposes field data to unauthenticated network access. The module fails to enforce access control checks before serving field content, allowing an attacker to directly request protected data resources by crafting or guessing their URLs. A vendor patch is available; no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated denial of service in WP Go Maps WordPress plugin (versions <= 10.1.08) allows remote attackers without any credentials to exhaust server resources, degrading or disrupting availability for the affected WordPress installation. The vulnerability stems from CWE-770 (resource allocation without limits or throttling), enabling unconstrained consumption of server capacity via crafted network requests. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
CRLF injection in httpx2 (pydantic's next-generation Python HTTP client) before v2.11.0 allows manipulation of multipart/form-data part headers when attacker-controlled data reaches the `content_type` or custom headers fields of the `files=` parameter. `FileField.render_headers()` in `_multipart.py` interpolates these values directly into raw header bytes without stripping CR or LF characters, enabling injection of fabricated headers into multipart parts. No public exploit is identified at time of analysis; the vendor-released patch is v2.11.0.
Server-Side Request Forgery in Drupal's Entity Share Websub contributed module (versions 0.0.0 through < 1.1.2) allows unauthenticated remote attackers to induce the Drupal server to issue outbound HTTP requests to attacker-controlled targets, including internal network resources and cloud metadata endpoints. The vulnerability is rated CVSS 5.3 Medium with limited confidentiality impact and no integrity or availability impact. No active exploitation or public proof-of-concept has been identified; a vendor patch is available via Drupal Security Advisory SA-CONTRIB-2026-097.
Targeted repository denial-of-service in Sonatype Nexus Repository 3 allows any authenticated user holding deploy privileges to permanently disable component browsing on a specific hosted Maven repository. Uploading a crafted POM file with an oversized metadata field (CWE-770) corrupts the repository's internal data such that subsequent listing and browse operations fail indefinitely until an administrator repairs the underlying record. Impact is confined to the single targeted repository; the broader Nexus instance and all other repositories remain unaffected. No public exploit has been identified at time of analysis.
Improper authorization in Sonatype Nexus Repository 3 exposes repository metadata to users who lack direct permissions on those repositories. An account holding read or browse access on a group repository can directly query the REST API endpoint `GET /service/rest/v1/repositories/{repositoryName}` for any member repository by name, bypassing the access control checks that normally restrict visibility. For proxy-type member repositories, the disclosed metadata includes the configured remote URL, potentially revealing internal upstream hostnames or artifact mirror addresses that operators intend to keep private. No public exploit has been identified at time of analysis, and the issue is patched in version 3.96.0.
Authorization bypass in Kimai before 2.65.0 allows authenticated users holding the edit_team permission to revoke team access to activities, projects, and customers via API endpoints without passing the required permissions_activity check. This breaks Kimai's intended multi-layered permission model, enabling a lower-privileged operator to sever team-level associations to sensitive time-tracking resources they are not authorized to modify. No public exploit code exists and the vulnerability is absent from CISA KEV; a confirmed vendor patch is available in version 2.65.0.
Craft CMS before 5.11.0 leaks PII for all content authors - including administrators - to any holder of a scoped GraphQL token. The scope-filter enforcement that restricts which users a token may query is not applied to native user relation fields (author, authors, uploader, draftCreator, revisionCreator) on content objects, allowing a low-privilege API consumer to traverse those relations and retrieve usernames, email addresses, and full names that their token scope was never meant to expose. No public exploit code has been identified and the issue is not in CISA KEV, but the low attack complexity makes opportunistic abuse by compromised or overly-shared API tokens realistic.
Confused deputy vulnerability in Chrome's CredentialProvider component on Windows allows a remote attacker who has already established renderer process compromise to leak sensitive credential information via a crafted HTML page. Affected versions are Chrome for Windows prior to 152.0.7977.75. Google rates this Low severity internally, though the CVSS Confidentiality impact is scored High due to the potential for credential disclosure; the AC:H vector reflects the significant prerequisite of prior renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing FileSystem authorization in Google Chrome prior to 152.0.7977.75 enables sensitive information disclosure through a two-stage attack chain requiring a pre-compromised renderer process and social engineering. The CVSS vector (AC:H/UI:R) accurately reflects the chained nature of exploitation: an attacker must first compromise the renderer, then induce user interaction with a crafted HTML page to bypass FileSystem access controls. No public exploit or CISA KEV listing has been identified at time of analysis; the vendor patch was released in the September 2026 stable channel update.
Integer underflow in libjxl's container box parser before v0.12.0 allows unauthenticated remote attackers to inject arbitrary image metadata into JPEG XL files decoded on 32-bit platforms. The flaw arises from silent truncation of 64-bit ISOBMFF-style box sizes to the narrower size_t type, causing the decoder to misinterpret attacker-controlled codestream bytes as phantom box headers and insert forged Exif, XMP, IPTC, or JUMBF metadata blocks into its internal state. A secondary effect is potential out-of-bounds memory reads, though no active exploitation or public proof-of-concept code has been identified; a vendor patch is available in v0.12.0.
Incorrect Authorization (CWE-863) in the Drupal Diff contributed module allows unauthenticated remote users to perform Forceful Browsing against revision comparison endpoints that should be access-controlled, resulting in limited confidentiality exposure of content diff data. Affected versions span Diff 0.0.0-<2.0.1 and 2.1.0-<2.1.1; a vendor-released patch is available via Drupal Security Advisory SA-Contrib-2026-096. No public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect authorization in the Drupal Quick Tabs contributed module (all versions prior to 4.3.1) permits unauthenticated remote users to perform forceful browsing against tab-rendered content that should be access-restricted. The CVSS 5.3 Medium score reflects a confidentiality-only impact - no integrity or availability compromise is possible - and actual risk scales with whether the affected site uses Quick Tabs to surface access-controlled content such as private nodes or role-restricted views. No public exploit has been identified at time of analysis; a patched release (4.3.1) is available via Drupal's security advisory SA-CONTRIB-2026-099.
Incorrect authorization enforcement in Drupal's Blazy lazy-loading module (all versions before 3.0.18) enables unauthenticated remote users to perform forceful browsing - directly requesting URLs of media assets that Drupal's access controls are intended to restrict. The module fails to apply proper authorization checks when serving lazily-loaded resources, exposing low-level confidentiality impact (C:L) with no integrity or availability consequence. No active exploitation has been confirmed and no public proof-of-concept has been identified; a vendor patch is available at version 3.0.18 per advisory SA-CONTRIB-2026-104.
Unauthenticated forceful browsing in Drupal's Digital Signage Framework (versions 0.0.0 through 2.6.0) exposes restricted module endpoints without any authorization check, allowing remote attackers to read content or configuration data that Drupal's permission system was intended to protect. The root cause is CWE-862 (Missing Authorization) - affected URL routes are served without verifying the requester's Drupal role or permission grants. Drupal issued SA-contrib-2026-109 and released version 2.6.1 as the fix; no active exploitation or public proof-of-concept code has been identified at time of analysis.
Incorrect authorization in the Drupal Entity API contributed module (versions prior to 1.8.0) enables forceful browsing, allowing unauthenticated remote attackers to access restricted entity resources by directly requesting entity URLs that bypass access control checks. All Drupal installations running Entity API 0.0.0 through 1.7.x are affected; a patched release (1.8.0) has been issued by Drupal security. No public exploit code or active exploitation has been identified at time of analysis.
LDAP injection in the Drupal LDAP / Active Directory Integration module (versions below 2.2.1) allows unauthenticated remote attackers to manipulate LDAP query structure by submitting unsanitized input containing LDAP special characters. The primary confirmed impact is partial confidentiality loss — directory enumeration or partial authentication bypass — with no integrity or availability impact per the CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated network-accessible attack vector makes it straightforward to attempt against exposed instances.
Missing authorization in the Rentsyst WordPress rental plugin (≤2.1.2) permits unauthenticated remote attackers to access restricted endpoints or functionality without any capability checks. The CVSS vector (PR:N, C:L, I:N, A:N) confirms the flaw exposes read-only data to network-reachable, unauthenticated requesters, with no integrity or availability consequence. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Unauthenticated denial of service against WordPress sites running Really Simple SSL plugin version 9.8.0 and earlier allows remote attackers to partially degrade site availability without any credentials. The vulnerability stems from CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the plugin fails to constrain resource consumption on certain request paths, enabling an attacker to send crafted requests that exhaust server resources. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS-assigned availability impact is rated Low, suggesting partial rather than complete service disruption.
Unauthenticated IDOR in PublishPress Permissions WordPress plugin versions 4.8.3 and below allows remote attackers to access restricted content objects by manipulating user-controlled identifiers in requests. The flaw (CWE-639) bypasses the plugin's content access controls without any credentials, exposing data that should be permission-gated. CVSS 5.3 (Medium) reflects limited confidentiality impact with no integrity or availability risk; no public exploit or KEV listing identified at time of analysis.
Unauthenticated broken access control in the Ultimate Gift Cards for WooCommerce WordPress plugin (all versions through 3.2.9) permits any remote unauthenticated user to reach one or more restricted plugin endpoints, yielding limited information disclosure. The root cause is missing authorization checks (CWE-862) rather than a bypass of the authentication mechanism itself. No public exploit code or active exploitation has been confirmed at time of analysis; the Patchstack advisory is the sole reporting source.
Authorization bypass in Kimai's REST API timesheet collection endpoint exposes restricted timesheet data to authenticated users lacking team membership. In versions before 2.65.0, users holding the `view_other_timesheet` permission can query the `/api/timesheets` endpoint and retrieve timesheets tied to team-restricted activities, circumventing the intended per-team data isolation model. No public exploit code has been identified and no active exploitation is confirmed, but the flaw is straightforwardly triggered by any authenticated user with the noted permission.
Privilege escalation in Kimai time-tracking (through 2.65.0) allows authenticated users with project permission-management privileges to seize team-lead rights over arbitrary existing teams they do not control. The three team-assignment REST API endpoints (POST /api/customers/{id}/team, POST /api/projects/{id}/team, POST /api/activities/{id}/team) silently reuse any existing team whose name matches the resource being configured, then promote the caller to teamlead without verifying they hold authorization over that team - effectively granting them administrative control. Fixed in 2.65.0; no public exploit or CISA KEV listing identified at time of analysis.
Improper authorization in Kimai before 2.63.0 allows authenticated users holding team-edit permissions combined with read-only entity access to modify access control lists for customers, projects, or activities they should not control. The flaw resides in team access endpoints that validate team-edit role but omit a secondary entity-level write authorization check, enabling privilege escalation within the ACL layer via crafted POST requests. The vendor released a fix in version 2.63.0; no public exploit code or active exploitation has been identified at time of analysis.
Insufficient authorization in Kimai's REST API allows authenticated low-privilege users to modify admin-only work-contract preferences on their own account. The WorkContractPreferenceSubscriber, introduced in version 2.61.0, registers employment-contract fields as writable via PATCH /api/users/{id}/preferences without enforcing the contract_other_profile permission check that protects equivalent fields in the web UI. Any authenticated Kimai user on versions 2.61.0 through 2.62.x can tamper with their own work-contract data - a capability reserved for administrators - by calling the API directly. No public exploit has been identified at time of analysis.
Missing authorization enforcement in Craft CMS versions 5.7.0 through 5.10.12 allows authenticated control panel users to query volume metadata for asset repositories they are not permitted to access. The AssetsController::actionMoveInfo method accepts POST requests with arbitrary folderIds and returns asset count and total storage size without verifying the requesting user's volume permissions, violating the principle of least privilege within Craft's multi-volume access model. No public exploit code exists at time of analysis and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 5.3 with PR:L accurately reflects that an authenticated session is required.
Authorization bypass in Craft CMS before version 5.10.11 allows authenticated low-privilege users to delete other users' provisional (unsaved) drafts by exploiting a missing ownership check on the deleteProvisionalDraft parameter in ElementsController::actionDuplicate(). The flaw is exploitable by any account holding the createEntries permission, and can silently destroy another author's in-progress content without their knowledge. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in Craft CMS before 5.10.11 permits authenticated control panel users with restricted section permissions to move or publish entries into sections they are not authorized to edit. The `element-indexes/save-elements` endpoint validates only the originating section permissions during the initial authorization check, but fails to re-enforce permissions against the destination section when the `sectionId` attribute is overwritten in the request body - a classic check-then-act authorization gap (CWE-862). No public exploit code has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Stored cross-site scripting in NocoBase's rich text field read renderer allows any authenticated user with record-creation permissions to inject persistent malicious HTML into the application's collection API, executing arbitrary JavaScript in the browsers of all users who subsequently view the affected record. The vulnerable component is the ReadPretty renderer (packages/core/client/src/schema-component/antd/input/ReadPretty.tsx), which fails to sanitize event handlers from stored rich text values before rendering them. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Persistent denial of service in Elastic APM Server allows an authenticated user with write access to source map content to upload specially crafted, highly compressed payloads that exhaust server memory upon processing. The condition (CWE-409, CAPEC-130) is self-reinforcing: every restart triggers re-processing of the stored content and re-crashes the server, making recovery impossible without manual removal of the malicious content. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the persistence characteristic significantly elevates operational impact compared to a transient DoS.
Cross-site scripting in the Drupal Address Suggestion contributed module allows an authenticated administrator to inject persistent malicious JavaScript into pages served to other users. Affected versions span all releases from 0.0.0 through 1.0.24; version 1.0.25 resolves the issue per Drupal security advisory SA-CONTRIB-2026-103. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high-privilege requirement substantially limits the realistic attacker pool.
Stored cross-site scripting in the Drupal Entity Browser contributed module (versions prior to 2.16.0) allows a high-privileged authenticated attacker to inject persistent malicious script payloads that execute in victims' browsers when affected pages are loaded. The scope change (S:C in the CVSS vector) confirms the injected script crosses into the victim's browser context, enabling session hijacking or credential theft against users who view affected content. No public exploit code or active exploitation has been identified; the vendor (Drupal Security Team) has released a patched version and published advisory SA-CONTRIB-2026-094.
Stored XSS in Craft CMS 5.0.0-RC1 through 5.10.10 allows a malicious administrator to inject arbitrary JavaScript into the site name field, which executes in the browsers of other users who subsequently view control panel settings pages. The attack requires existing administrator-level credentials (PR:H per CVSS 4.0 vector) and passive user interaction to trigger, making it primarily a threat in multi-administrator deployments where one privileged account may be compromised or untrustworthy. Vendor-released patch is available at version 5.10.11; no public exploit or CISA KEV listing identified at time of analysis.
OAuth nonce replay attacks against Open edX LMS's LTI 1.1 Provider endpoint allow an attacker who intercepts a valid LTI launch request to resubmit it an unlimited number of times, gaining unauthorized access to course content or LTI tool sessions as the original user. Prior to commit 3a5ac85, the validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py returned True unconditionally, performing neither timestamp window checks nor nonce deduplication, rendering the entire OAuth 1.0a replay-protection layer inert. The issue has been patched via three commits introducing atomic nonce storage through Django's shared cache backend, with no public exploit code identified at time of analysis.
XML deserialization in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows any authenticated user holding the minimal Overall/Read permission to inject crafted XML that causes the server to instantiate user objects as nested field values within other deserialized structures, producing unauthorized modifications to the Jenkins user database. The root cause is CWE-502 - insufficient type filtering during XML deserialization - which permits user-typed objects to be materialized outside normal user-creation workflows. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified; patched releases (2.580 weekly, 2.568.3 LTS) are available per the Jenkins security advisory.
Incorrect Authorization (CWE-863) in Kibana's machine learning feature allows authenticated users to invoke ML functionality beyond their assigned authorization scope, consuming Elasticsearch cluster resources they are not permitted to access. Affected across all Kibana versions prior to the 8.19.21, 9.4.6, and 9.5.2 releases patched under Elastic advisory ESA-2026-169. No confidentiality or integrity impact is present; exploitation is bounded to cluster resource exhaustion, with CVSS 4.3 (Medium) reflecting the limited blast radius and authentication prerequisite.
Jenkins REST API in versions 2.579 and earlier (LTS 2.568.2 and earlier) fails to escape map keys during JSON and Python serialization, enabling authenticated users who can control map property names to inject arbitrary fields into API responses consumed by downstream tooling or users. The flaw (CWE-116, improper output encoding) is rated CVSS 4.3 Medium with integrity-only impact and requires low-privilege authenticated access. No public exploit code or CISA KEV listing has been identified; vendor patches 2.580 and LTS 2.568.3 were released on 2026-09-02.
Improper use of the @DataBoundConstructor annotation in Jenkins Script Security Plugin versions ≤1412.v7737b_3405f86 enables low-privileged authenticated users to read the plugin's script approval configuration by submitting certain Jenkins forms. The flaw allows enumeration of which Groovy scripts, methods, and signatures have been approved for execution - information that could assist an attacker in mapping permitted scripted operations within the Jenkins environment. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at the time of analysis.
Missing authorization (CWE-862) in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) permits any authenticated user holding Item/Read on at least one job to read build parameter names and values from jobs they are not authorized to access. The CVSS vector (PR:L, AV:N, AC:L) confirms low-complexity, network-accessible exploitation requiring only a minimal authenticated foothold. Patched releases (2.580 weekly, LTS 2.568.3) are available per the official vendor advisory; no public exploit or CISA KEV listing has been identified at time of analysis.
Open redirect in the password-reset workflow of an unidentified Red Hat product allows unauthenticated attackers to redirect users to arbitrary external sites after completing a legitimate password reset. The vulnerability exists because reset_password.html reads a url query-string parameter and assigns it directly to window.location without any validation or allowlisting, optionally after a configurable delay. No public exploit has been identified at time of analysis, and EPSS/KEV data are absent from the provided intelligence.
Server-side request forgery in Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows low-privileged authenticated attackers to cause the Jenkins server to initiate connections to arbitrary, attacker-specified URLs via unsanitized Stapler data binding on the LDAP configuration endpoint. This enables internal network probing or interaction with attacker-controlled infrastructure from the Jenkins server's network perspective. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier allows any low-privileged authenticated Jenkins user to disable the 'Force the use of the sandbox globally in the system' security control via a missing permission check exposed through Stapler data binding. The CVSS score of 4.3 reflects only the direct act of altering a setting, but the chained real-world risk is substantially higher: disabling global sandbox enforcement removes the primary defense against unrestricted Groovy execution, enabling subsequent RCE by any user with script authorship rights. No public exploit has been identified at time of analysis, and exploitation has not been confirmed by CISA KEV.