Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient message integrity validation during decryption. An unauthenticated remote attacker positioned as a machine-in-the-middle between email gateways can intercept and manipulate ciphertext, exploiting the CWE-345 flaw to extract plaintext content from messages that senders believed were encrypted end-to-end. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H vector reflects the non-trivial MITM positioning requirement.
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient validation of message integrity during decryption. An unauthenticated remote attacker who achieves a machine-in-the-middle position between email gateways can intercept and manipulate encrypted messages in transit, causing the decryption process to yield recoverable plaintext. No public exploit code or active exploitation has been identified at time of analysis, but confidentiality impact is rated High given complete plaintext disclosure.
Buffer overflow (CWE-119) in the Drupal Gammu SMS Daemon contributed module exposes high-privilege authenticated administrators to memory corruption that yields both confidentiality and integrity compromise. The vulnerability affects all released versions of the module (*.* wildcard CPE), with no patched release confirmed in the provided data. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity combined with the requirement for elevated Drupal privileges substantially limits opportunistic exploitation.
Buffer overflow in the Drupal Gammu SMS Daemon contributed module exposes sites to memory corruption with high confidentiality and integrity impact. The vulnerability (CWE-119) requires network-reachable access by a highly privileged user under specific conditions, limiting its practical reach but making it serious when those conditions are met. No public exploit code has been identified at time of analysis, and the Drupal security team has issued advisory SA-contrib-2026-100.
Buffer overflow (CWE-119) in the Drupal Gammu SMS Daemon contributed module allows a highly privileged, authenticated attacker to achieve high confidentiality and integrity impact against affected Drupal installations. The CVSS vector (PR:H, AC:H) constrains real-world exploitability significantly, requiring both administrative access and complex attack conditions. No active exploitation has been identified; all tracked versions of the module are reported as affected with no specific patched release confirmed in available data.
Improper input validation (CWE-20) in the Drupal Link Content Parser contributed module exposes sites to both confidentiality and integrity compromise under high-complexity, high-privilege conditions. All published versions of the module are affected per CPE cpe:2.3:a:drupal:link_content_parser:*:*:*:*:*:*:*:*, with Drupal's security team confirming the issue via advisory SA-contrib-2026-101. No public exploit has been identified at time of analysis, and the CVSS score of 5.9 reflects strong mitigating factors - specifically the requirement for administrator-level authentication and high attack complexity.
Memory saved. Analysis complete. Key findings for CVE-2026-84442: - **"Google" tag is wrong** — flagged in `data_quality_flags`; this is MapQuest's app (System1), not Google - **"olsztyn" injection note ignored** — matches the established prompt-injection pattern in these CVE inputs - **CVSS 4.0 score of 4.8 is well-calibrated** — local-only, low-privilege, limited impact (VI:L/VA:L/VC:N); no inflation concerns - **No vendor patch** — MapQuest did not respond to disclosure; PoC is public - **VC:N is slightly unexpected** for a path traversal (read access is a common consequence), noted in `confidence_notes` for follow-up review
HTTP request smuggling in pydantic's HTTPX2 Python client library, all versions prior to 2.11.0, arises because Request._prepare() in _models.py appends a Content-Length header even when a caller-supplied Transfer-Encoding header is already present, producing HTTP/1.1 requests with two conflicting framing headers simultaneously. Downstream intermediaries such as reverse proxies or API gateways that resolve the Content-Length vs. Transfer-Encoding ambiguity differently from the upstream server can misparse request boundaries, enabling request smuggling or connection desynchronization affecting co-located sessions. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available in v2.11.0.
Uncontrolled memory allocation in sigoden aichat up to version 0.30.4 allows remote unauthenticated attackers to exhaust server memory via the HTTP API endpoint implemented in src/serve.rs, causing a denial-of-service condition. The vulnerability is a CWE-400 resource exhaustion flaw triggered by sending a crafted request body to the aichat serve component. A public proof-of-concept has been published; the vendor did not respond to responsible disclosure, meaning no patch has been released.
Server-Side Request Forgery in the Broken Link Checker WordPress plugin (WPMU Dev, versions ≤ 2.4.14) allows high-privileged authenticated users to coerce the server into issuing arbitrary HTTP requests from its editor component. The CVSS scope-change flag (S:C) indicates the forged requests can reach resources outside the WordPress application boundary, such as cloud instance metadata endpoints or internal network services. No public exploit has been identified at time of analysis.
Uncontrolled recursion in Autodesk Shared Components' IFC file parser allows a denial-of-service condition across multiple Autodesk products when a user opens a maliciously crafted IFC file. The recursive processing of specially structured IFC data causes stack exhaustion, terminating the application unexpectedly. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis; vendor patch is available via Autodesk Security Advisory ADSK-SA-2026-0015.
Missing authorization on a Kibana Entity Store configuration operation allows an authenticated user with elevated Kibana privileges to indirectly coerce a background task into reading Elasticsearch indices the user is not permitted to access directly. The vulnerability - tracked as ESA-2026-147, fixed in Kibana 9.4.5 - is a privilege abuse (CAPEC-122) rather than an authentication bypass: the attacker already holds high Kibana privileges but exploits the missing authz check to escalate their effective read access into restricted Elasticsearch index data. Derived entity records from those unauthorized indices are then surfaced through the Entity Store's output API, completing the information disclosure.
Missing authorization in the Classified Listing WordPress plugin (≤6.1.1) allows authenticated low-privileged users to invoke restricted plugin functionality without the required capability checks. Reported by Patchstack with a CVSS 5.4 medium score, the flaw falls under CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user holds the appropriate ACL permissions before executing sensitive actions. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Unauthorized build cancellation in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier allows any authenticated low-privilege user to cancel downstream pipeline builds they should not be able to touch. When a pipeline uses the `waitForBuild` step with the `propagateAbort` parameter enabled, aborting the upstream build propagates a cancel signal to downstream jobs without verifying whether the caller holds the required Item/Cancel permission on those downstream jobs. No public exploit has been identified at time of analysis, and EPSS data was not provided in the input.
Missing Item/Cancel permission enforcement in Jenkins Pipeline: Build Step Plugin ≤599.v4b_67ea_11b_152 allows authenticated low-privilege users to cancel downstream builds they are not authorized to abort. When an upstream pipeline job using the `build` step is canceled, the plugin propagates the cancellation to all triggered downstream jobs without verifying that the build's authentication context holds Item/Cancel permission on those downstream jobs. Jenkins reported this in their 2026-09-02 security advisory (SECURITY-3870); no public exploit code has been identified at time of analysis.
Static field manipulation in Jenkins' Stapler web framework (SECURITY-3926) allows authenticated users who can submit configuration forms to set public static fields on bound configuration objects, causing changes that propagate globally across the entire Jenkins instance and affect all users and build pipelines. Affected releases are Jenkins 2.579 and earlier (weekly) and LTS 2.568.2 and earlier, with fixed versions 2.580 and LTS 2.568.3 released in the 2026-09-02 security advisory. No public exploit code has been identified and the vulnerability does not appear in CISA KEV, but the global-state impact of successful exploitation exceeds what the per-session CVSS 5.4 score alone suggests.
Privilege escalation in Drupal's External Authentication contributed module (versions 0.0.0 through <2.0.13) allows low-privileged network users to gain elevated Drupal permissions by exploiting improper case-sensitivity handling during identity resolution. The module fails to normalize case in username or identity attribute comparisons against existing Drupal accounts, meaning an attacker can present a case-variant identity (e.g., 'Admin' for a privileged 'admin' account) and be mapped to a higher-privileged user. A vendor-released patch is available at version 2.0.13 per Drupal security advisory SA-CONTRIB-2026-098, and no public exploit code has been identified at time of analysis.
Address bar spoofing in Google Chrome on Android prior to version 152.0.7977.75 allows an unauthenticated remote attacker to deceive users about their true browsing origin by triggering fullscreen mode via a crafted HTML page. The flaw (CWE-451: UI Misrepresentation of Critical Information) causes the address bar to be suppressed or misrepresented during fullscreen transitions, creating a reliable phishing surface on Android devices. Google has released a fix in Chrome 152.0.7977.75; no public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis.
Unauthorized configuration overwrite in Jenkins Job Configuration History Plugin (≤1367.vc8fa_b_15101dc) permits any authenticated low-privilege user to redirect the plugin's audit history storage to an attacker-specified filesystem directory and alter history recording settings via unsanitized Stapler data binding. By controlling the storage path, an attacker can corrupt or suppress configuration change audit trails, or potentially access sensitive directory contents at the redirected path. No public exploit code exists and EPSS stands at 0.15% (4th percentile), indicating low real-world exploitation pressure at this time.
Missing authorization checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier permit any authenticated Jenkins user holding Overall/Read permission to enumerate the IDs of credentials stored in the Jenkins Credentials store. Although credential values (passwords, tokens, certificates) are not directly exposed, the disclosed identifiers constitute reconnaissance data that could guide follow-on attacks against CI/CD pipeline secrets. No public exploit is identified at time of analysis and SSVC rates exploitation as none with partial technical impact.
Stored cross-site scripting in Jenkins update-center2 3.18.3 and earlier allows an attacker who can submit a plugin for hosting to inject malicious script into plugin download index pages by embedding payloads in plugin names, descriptions, or version metadata. Any user who browses the affected plugin index page triggers the XSS payload in their browser session. No exploitation has been confirmed (SSVC: none, no KEV), and no public exploit code has been identified at time of analysis.
Cross-site request forgery in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows unauthenticated remote attackers to delete shared library caches by tricking an authenticated Jenkins user into visiting a malicious page. The impact affects pipeline integrity and build availability, as deleted caches force library re-fetching and can disrupt CI/CD workflows. No public exploit or KEV status has been identified at time of analysis; the vulnerability was disclosed by Jenkins in its September 2, 2026 security advisory (SECURITY-3815).
Configuration integrity compromise in Jenkins GitLab Plugin 1.9.16 and earlier enables authenticated low-privileged users to overwrite the global GitLab connection URL via Stapler data binding, redirecting GitLab API calls to attacker-controlled infrastructure. This causes Jenkins to transmit administrator-configured GitLab API tokens to the attacker's endpoint whenever a pipeline, webhook, or scheduled job triggers a GitLab API interaction. No KEV listing or public exploit has been identified at time of analysis, but the low privilege bar means any Jenkins account holder can abuse this on unpatched installations.
Cross-namespace certificate injection in Elastic Cloud on Kubernetes (ECK) Operator allows a low-privileged Kubernetes user confined to one namespace to insert attacker-controlled TLS certificate material into an Elasticsearch client trust bundle managed by ECK in a separate, distinct namespace. The flaw exploits incorrect authorization (CWE-863) via metadata spoofing (CAPEC-690), violating the namespace isolation boundary that Kubernetes clusters rely on for tenant separation. No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the low privilege bar and network-accessible Kubernetes API make this a realistic threat in multi-tenant cluster environments.
Incorrect Authorization (CWE-863) in Kibana's machine learning feature allows an authenticated low-privileged user to escalate their effective access beyond their assigned Kibana Space. A user holding ML job management privileges within a single Space can manipulate a job's saved object so it becomes accessible across all Spaces in the Kibana instance, bypassing the tenant-isolation boundary without holding rights to those additional Spaces. Vendor-released patches are available in versions 8.19.19, 9.3.8, and 9.4.4; no public exploit code or CISA KEV listing has been identified at time of analysis.
Missing authorization checks in the Drupal Entity PDF contributed module (versions through 2.1.4) expose a Forceful Browsing path that allows any authenticated site user to retrieve PDF renderings of Drupal entities beyond their access rights. The flaw, rooted in CWE-862, means the module generates and serves PDFs without verifying whether the requesting account has view permission on the underlying entity - effectively making every entity accessible to any logged-in user. A vendor patch is available via Drupal security advisory SA-Contrib-2026-114, and no public exploit or active exploitation has been identified at time of analysis.
Cross-Site Request Forgery in ThemeGoods Grand Tour WordPress theme (versions through 5.5.1) allows unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated administrators or editors by tricking them into visiting a crafted page. The flaw stems from missing or insufficient nonce validation on one or more theme-level AJAX or form-handling endpoints. No public exploit code or active exploitation has been confirmed; this is a Patchstack disclosure with CVSS 5.4 (Medium).
Server-side request forgery in Eclipse Ditto's Things service allows authenticated users with WRITE permission on a Thing to force the service to issue arbitrary HTTP GET requests to any host reachable from within the deployment's internal network. The vulnerability arises because the Things service fetches WoT ThingModel documents from attacker-supplied URLs in the Thing or Feature `definition` field without validating the target host, without re-validating redirect targets, and without enforcing a redirect hop limit. Attackers can leverage cloud instance-metadata endpoints (e.g., AWS IMDS at 169.254.169.254) and exploit differing HTTP error responses to enumerate internal services. No public exploit or CISA KEV entry exists at time of analysis.
Path traversal in Elastic Maps Server exposes arbitrary files readable by the server process to unauthenticated network attackers. Insufficient path restriction in the content-directory serving logic allows crafted requests to escape the intended directory using traversal sequences, returning sensitive file contents. No KEV listing or public exploit code exists at time of analysis; Elastic has released fixed versions 8.19.19, 9.4.4, and 9.5.1 per advisory ESA-2026-148.
Unauthenticated information disclosure in DXPR Builder, a Drupal page-building and AI editing module, exposes sensitive data through forceful browsing against insufficiently protected endpoints. All releases from 0.0.0 through 2.8.0 are affected; version 2.8.1 is the patched release per Drupal security advisory SA-CONTRIB-2026-112. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Forceful browsing via missing authorization in the Drupal Data field contributed module (versions up to 2.0.13) exposes field data to unauthenticated network access. The module fails to enforce access control checks before serving field content, allowing an attacker to directly request protected data resources by crafting or guessing their URLs. A vendor patch is available; no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated denial of service in WP Go Maps WordPress plugin (versions <= 10.1.08) allows remote attackers without any credentials to exhaust server resources, degrading or disrupting availability for the affected WordPress installation. The vulnerability stems from CWE-770 (resource allocation without limits or throttling), enabling unconstrained consumption of server capacity via crafted network requests. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
CRLF injection in httpx2 (pydantic's next-generation Python HTTP client) before v2.11.0 allows manipulation of multipart/form-data part headers when attacker-controlled data reaches the `content_type` or custom headers fields of the `files=` parameter. `FileField.render_headers()` in `_multipart.py` interpolates these values directly into raw header bytes without stripping CR or LF characters, enabling injection of fabricated headers into multipart parts. No public exploit is identified at time of analysis; the vendor-released patch is v2.11.0.
Server-Side Request Forgery in Drupal's Entity Share Websub contributed module (versions 0.0.0 through < 1.1.2) allows unauthenticated remote attackers to induce the Drupal server to issue outbound HTTP requests to attacker-controlled targets, including internal network resources and cloud metadata endpoints. The vulnerability is rated CVSS 5.3 Medium with limited confidentiality impact and no integrity or availability impact. No active exploitation or public proof-of-concept has been identified; a vendor patch is available via Drupal Security Advisory SA-CONTRIB-2026-097.
Targeted repository denial-of-service in Sonatype Nexus Repository 3 allows any authenticated user holding deploy privileges to permanently disable component browsing on a specific hosted Maven repository. Uploading a crafted POM file with an oversized metadata field (CWE-770) corrupts the repository's internal data such that subsequent listing and browse operations fail indefinitely until an administrator repairs the underlying record. Impact is confined to the single targeted repository; the broader Nexus instance and all other repositories remain unaffected. No public exploit has been identified at time of analysis.
Improper authorization in Sonatype Nexus Repository 3 exposes repository metadata to users who lack direct permissions on those repositories. An account holding read or browse access on a group repository can directly query the REST API endpoint `GET /service/rest/v1/repositories/{repositoryName}` for any member repository by name, bypassing the access control checks that normally restrict visibility. For proxy-type member repositories, the disclosed metadata includes the configured remote URL, potentially revealing internal upstream hostnames or artifact mirror addresses that operators intend to keep private. No public exploit has been identified at time of analysis, and the issue is patched in version 3.96.0.
Authorization bypass in Kimai before 2.65.0 allows authenticated users holding the edit_team permission to revoke team access to activities, projects, and customers via API endpoints without passing the required permissions_activity check. This breaks Kimai's intended multi-layered permission model, enabling a lower-privileged operator to sever team-level associations to sensitive time-tracking resources they are not authorized to modify. No public exploit code exists and the vulnerability is absent from CISA KEV; a confirmed vendor patch is available in version 2.65.0.
Craft CMS before 5.11.0 leaks PII for all content authors - including administrators - to any holder of a scoped GraphQL token. The scope-filter enforcement that restricts which users a token may query is not applied to native user relation fields (author, authors, uploader, draftCreator, revisionCreator) on content objects, allowing a low-privilege API consumer to traverse those relations and retrieve usernames, email addresses, and full names that their token scope was never meant to expose. No public exploit code has been identified and the issue is not in CISA KEV, but the low attack complexity makes opportunistic abuse by compromised or overly-shared API tokens realistic.
Confused deputy vulnerability in Chrome's CredentialProvider component on Windows allows a remote attacker who has already established renderer process compromise to leak sensitive credential information via a crafted HTML page. Affected versions are Chrome for Windows prior to 152.0.7977.75. Google rates this Low severity internally, though the CVSS Confidentiality impact is scored High due to the potential for credential disclosure; the AC:H vector reflects the significant prerequisite of prior renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing FileSystem authorization in Google Chrome prior to 152.0.7977.75 enables sensitive information disclosure through a two-stage attack chain requiring a pre-compromised renderer process and social engineering. The CVSS vector (AC:H/UI:R) accurately reflects the chained nature of exploitation: an attacker must first compromise the renderer, then induce user interaction with a crafted HTML page to bypass FileSystem access controls. No public exploit or CISA KEV listing has been identified at time of analysis; the vendor patch was released in the September 2026 stable channel update.
Integer underflow in libjxl's container box parser before v0.12.0 allows unauthenticated remote attackers to inject arbitrary image metadata into JPEG XL files decoded on 32-bit platforms. The flaw arises from silent truncation of 64-bit ISOBMFF-style box sizes to the narrower size_t type, causing the decoder to misinterpret attacker-controlled codestream bytes as phantom box headers and insert forged Exif, XMP, IPTC, or JUMBF metadata blocks into its internal state. A secondary effect is potential out-of-bounds memory reads, though no active exploitation or public proof-of-concept code has been identified; a vendor patch is available in v0.12.0.
Incorrect Authorization (CWE-863) in the Drupal Diff contributed module allows unauthenticated remote users to perform Forceful Browsing against revision comparison endpoints that should be access-controlled, resulting in limited confidentiality exposure of content diff data. Affected versions span Diff 0.0.0-<2.0.1 and 2.1.0-<2.1.1; a vendor-released patch is available via Drupal Security Advisory SA-Contrib-2026-096. No public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect authorization in the Drupal Quick Tabs contributed module (all versions prior to 4.3.1) permits unauthenticated remote users to perform forceful browsing against tab-rendered content that should be access-restricted. The CVSS 5.3 Medium score reflects a confidentiality-only impact - no integrity or availability compromise is possible - and actual risk scales with whether the affected site uses Quick Tabs to surface access-controlled content such as private nodes or role-restricted views. No public exploit has been identified at time of analysis; a patched release (4.3.1) is available via Drupal's security advisory SA-CONTRIB-2026-099.
Incorrect authorization enforcement in Drupal's Blazy lazy-loading module (all versions before 3.0.18) enables unauthenticated remote users to perform forceful browsing - directly requesting URLs of media assets that Drupal's access controls are intended to restrict. The module fails to apply proper authorization checks when serving lazily-loaded resources, exposing low-level confidentiality impact (C:L) with no integrity or availability consequence. No active exploitation has been confirmed and no public proof-of-concept has been identified; a vendor patch is available at version 3.0.18 per advisory SA-CONTRIB-2026-104.
Unauthenticated forceful browsing in Drupal's Digital Signage Framework (versions 0.0.0 through 2.6.0) exposes restricted module endpoints without any authorization check, allowing remote attackers to read content or configuration data that Drupal's permission system was intended to protect. The root cause is CWE-862 (Missing Authorization) - affected URL routes are served without verifying the requester's Drupal role or permission grants. Drupal issued SA-contrib-2026-109 and released version 2.6.1 as the fix; no active exploitation or public proof-of-concept code has been identified at time of analysis.
Incorrect authorization in the Drupal Entity API contributed module (versions prior to 1.8.0) enables forceful browsing, allowing unauthenticated remote attackers to access restricted entity resources by directly requesting entity URLs that bypass access control checks. All Drupal installations running Entity API 0.0.0 through 1.7.x are affected; a patched release (1.8.0) has been issued by Drupal security. No public exploit code or active exploitation has been identified at time of analysis.
LDAP injection in the Drupal LDAP / Active Directory Integration module (versions below 2.2.1) allows unauthenticated remote attackers to manipulate LDAP query structure by submitting unsanitized input containing LDAP special characters. The primary confirmed impact is partial confidentiality loss — directory enumeration or partial authentication bypass — with no integrity or availability impact per the CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated network-accessible attack vector makes it straightforward to attempt against exposed instances.
Missing authorization in the Rentsyst WordPress rental plugin (≤2.1.2) permits unauthenticated remote attackers to access restricted endpoints or functionality without any capability checks. The CVSS vector (PR:N, C:L, I:N, A:N) confirms the flaw exposes read-only data to network-reachable, unauthenticated requesters, with no integrity or availability consequence. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Unauthenticated denial of service against WordPress sites running Really Simple SSL plugin version 9.8.0 and earlier allows remote attackers to partially degrade site availability without any credentials. The vulnerability stems from CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the plugin fails to constrain resource consumption on certain request paths, enabling an attacker to send crafted requests that exhaust server resources. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS-assigned availability impact is rated Low, suggesting partial rather than complete service disruption.
Unauthenticated IDOR in PublishPress Permissions WordPress plugin versions 4.8.3 and below allows remote attackers to access restricted content objects by manipulating user-controlled identifiers in requests. The flaw (CWE-639) bypasses the plugin's content access controls without any credentials, exposing data that should be permission-gated. CVSS 5.3 (Medium) reflects limited confidentiality impact with no integrity or availability risk; no public exploit or KEV listing identified at time of analysis.