Unauthenticated broken access control in the Ultimate Gift Cards for WooCommerce WordPress plugin (all versions through 3.2.9) permits any remote unauthenticated user to reach one or more restricted plugin endpoints, yielding limited information disclosure. The root cause is missing authorization checks (CWE-862) rather than a bypass of the authentication mechanism itself. No public exploit code or active exploitation has been confirmed at time of analysis; the Patchstack advisory is the sole reporting source.
Authorization bypass in Kimai's REST API timesheet collection endpoint exposes restricted timesheet data to authenticated users lacking team membership. In versions before 2.65.0, users holding the `view_other_timesheet` permission can query the `/api/timesheets` endpoint and retrieve timesheets tied to team-restricted activities, circumventing the intended per-team data isolation model. No public exploit code has been identified and no active exploitation is confirmed, but the flaw is straightforwardly triggered by any authenticated user with the noted permission.
Privilege escalation in Kimai time-tracking (through 2.65.0) allows authenticated users with project permission-management privileges to seize team-lead rights over arbitrary existing teams they do not control. The three team-assignment REST API endpoints (POST /api/customers/{id}/team, POST /api/projects/{id}/team, POST /api/activities/{id}/team) silently reuse any existing team whose name matches the resource being configured, then promote the caller to teamlead without verifying they hold authorization over that team - effectively granting them administrative control. Fixed in 2.65.0; no public exploit or CISA KEV listing identified at time of analysis.
Improper authorization in Kimai before 2.63.0 allows authenticated users holding team-edit permissions combined with read-only entity access to modify access control lists for customers, projects, or activities they should not control. The flaw resides in team access endpoints that validate team-edit role but omit a secondary entity-level write authorization check, enabling privilege escalation within the ACL layer via crafted POST requests. The vendor released a fix in version 2.63.0; no public exploit code or active exploitation has been identified at time of analysis.
Insufficient authorization in Kimai's REST API allows authenticated low-privilege users to modify admin-only work-contract preferences on their own account. The WorkContractPreferenceSubscriber, introduced in version 2.61.0, registers employment-contract fields as writable via PATCH /api/users/{id}/preferences without enforcing the contract_other_profile permission check that protects equivalent fields in the web UI. Any authenticated Kimai user on versions 2.61.0 through 2.62.x can tamper with their own work-contract data - a capability reserved for administrators - by calling the API directly. No public exploit has been identified at time of analysis.
Missing authorization enforcement in Craft CMS versions 5.7.0 through 5.10.12 allows authenticated control panel users to query volume metadata for asset repositories they are not permitted to access. The AssetsController::actionMoveInfo method accepts POST requests with arbitrary folderIds and returns asset count and total storage size without verifying the requesting user's volume permissions, violating the principle of least privilege within Craft's multi-volume access model. No public exploit code exists at time of analysis and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 5.3 with PR:L accurately reflects that an authenticated session is required.
Authorization bypass in Craft CMS before version 5.10.11 allows authenticated low-privilege users to delete other users' provisional (unsaved) drafts by exploiting a missing ownership check on the deleteProvisionalDraft parameter in ElementsController::actionDuplicate(). The flaw is exploitable by any account holding the createEntries permission, and can silently destroy another author's in-progress content without their knowledge. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in Craft CMS before 5.10.11 permits authenticated control panel users with restricted section permissions to move or publish entries into sections they are not authorized to edit. The `element-indexes/save-elements` endpoint validates only the originating section permissions during the initial authorization check, but fails to re-enforce permissions against the destination section when the `sectionId` attribute is overwritten in the request body - a classic check-then-act authorization gap (CWE-862). No public exploit code has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Stored cross-site scripting in NocoBase's rich text field read renderer allows any authenticated user with record-creation permissions to inject persistent malicious HTML into the application's collection API, executing arbitrary JavaScript in the browsers of all users who subsequently view the affected record. The vulnerable component is the ReadPretty renderer (packages/core/client/src/schema-component/antd/input/ReadPretty.tsx), which fails to sanitize event handlers from stored rich text values before rendering them. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Persistent denial of service in Elastic APM Server allows an authenticated user with write access to source map content to upload specially crafted, highly compressed payloads that exhaust server memory upon processing. The condition (CWE-409, CAPEC-130) is self-reinforcing: every restart triggers re-processing of the stored content and re-crashes the server, making recovery impossible without manual removal of the malicious content. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the persistence characteristic significantly elevates operational impact compared to a transient DoS.
Cross-site scripting in the Drupal Address Suggestion contributed module allows an authenticated administrator to inject persistent malicious JavaScript into pages served to other users. Affected versions span all releases from 0.0.0 through 1.0.24; version 1.0.25 resolves the issue per Drupal security advisory SA-CONTRIB-2026-103. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high-privilege requirement substantially limits the realistic attacker pool.
Stored cross-site scripting in the Drupal Entity Browser contributed module (versions prior to 2.16.0) allows a high-privileged authenticated attacker to inject persistent malicious script payloads that execute in victims' browsers when affected pages are loaded. The scope change (S:C in the CVSS vector) confirms the injected script crosses into the victim's browser context, enabling session hijacking or credential theft against users who view affected content. No public exploit code or active exploitation has been identified; the vendor (Drupal Security Team) has released a patched version and published advisory SA-CONTRIB-2026-094.
Stored XSS in Craft CMS 5.0.0-RC1 through 5.10.10 allows a malicious administrator to inject arbitrary JavaScript into the site name field, which executes in the browsers of other users who subsequently view control panel settings pages. The attack requires existing administrator-level credentials (PR:H per CVSS 4.0 vector) and passive user interaction to trigger, making it primarily a threat in multi-administrator deployments where one privileged account may be compromised or untrustworthy. Vendor-released patch is available at version 5.10.11; no public exploit or CISA KEV listing identified at time of analysis.
OAuth nonce replay attacks against Open edX LMS's LTI 1.1 Provider endpoint allow an attacker who intercepts a valid LTI launch request to resubmit it an unlimited number of times, gaining unauthorized access to course content or LTI tool sessions as the original user. Prior to commit 3a5ac85, the validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py returned True unconditionally, performing neither timestamp window checks nor nonce deduplication, rendering the entire OAuth 1.0a replay-protection layer inert. The issue has been patched via three commits introducing atomic nonce storage through Django's shared cache backend, with no public exploit code identified at time of analysis.
XML deserialization in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows any authenticated user holding the minimal Overall/Read permission to inject crafted XML that causes the server to instantiate user objects as nested field values within other deserialized structures, producing unauthorized modifications to the Jenkins user database. The root cause is CWE-502 - insufficient type filtering during XML deserialization - which permits user-typed objects to be materialized outside normal user-creation workflows. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified; patched releases (2.580 weekly, 2.568.3 LTS) are available per the Jenkins security advisory.
Incorrect Authorization (CWE-863) in Kibana's machine learning feature allows authenticated users to invoke ML functionality beyond their assigned authorization scope, consuming Elasticsearch cluster resources they are not permitted to access. Affected across all Kibana versions prior to the 8.19.21, 9.4.6, and 9.5.2 releases patched under Elastic advisory ESA-2026-169. No confidentiality or integrity impact is present; exploitation is bounded to cluster resource exhaustion, with CVSS 4.3 (Medium) reflecting the limited blast radius and authentication prerequisite.
Jenkins REST API in versions 2.579 and earlier (LTS 2.568.2 and earlier) fails to escape map keys during JSON and Python serialization, enabling authenticated users who can control map property names to inject arbitrary fields into API responses consumed by downstream tooling or users. The flaw (CWE-116, improper output encoding) is rated CVSS 4.3 Medium with integrity-only impact and requires low-privilege authenticated access. No public exploit code or CISA KEV listing has been identified; vendor patches 2.580 and LTS 2.568.3 were released on 2026-09-02.
Improper use of the @DataBoundConstructor annotation in Jenkins Script Security Plugin versions ≤1412.v7737b_3405f86 enables low-privileged authenticated users to read the plugin's script approval configuration by submitting certain Jenkins forms. The flaw allows enumeration of which Groovy scripts, methods, and signatures have been approved for execution - information that could assist an attacker in mapping permitted scripted operations within the Jenkins environment. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at the time of analysis.
Missing authorization (CWE-862) in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) permits any authenticated user holding Item/Read on at least one job to read build parameter names and values from jobs they are not authorized to access. The CVSS vector (PR:L, AV:N, AC:L) confirms low-complexity, network-accessible exploitation requiring only a minimal authenticated foothold. Patched releases (2.580 weekly, LTS 2.568.3) are available per the official vendor advisory; no public exploit or CISA KEV listing has been identified at time of analysis.
Open redirect in the password-reset workflow of an unidentified Red Hat product allows unauthenticated attackers to redirect users to arbitrary external sites after completing a legitimate password reset. The vulnerability exists because reset_password.html reads a url query-string parameter and assigns it directly to window.location without any validation or allowlisting, optionally after a configurable delay. No public exploit has been identified at time of analysis, and EPSS/KEV data are absent from the provided intelligence.
Server-side request forgery in Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows low-privileged authenticated attackers to cause the Jenkins server to initiate connections to arbitrary, attacker-specified URLs via unsanitized Stapler data binding on the LDAP configuration endpoint. This enables internal network probing or interaction with attacker-controlled infrastructure from the Jenkins server's network perspective. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier allows any low-privileged authenticated Jenkins user to disable the 'Force the use of the sandbox globally in the system' security control via a missing permission check exposed through Stapler data binding. The CVSS score of 4.3 reflects only the direct act of altering a setting, but the chained real-world risk is substantially higher: disabling global sandbox enforcement removes the primary defense against unrestricted Groovy execution, enabling subsequent RCE by any user with script authorship rights. No public exploit has been identified at time of analysis, and exploitation has not been confirmed by CISA KEV.
Address bar spoofing in Google Chrome prior to version 152.0.7977.75 allows remote attackers to visually deceive users by manipulating the browser's fullscreen UI state through a crafted HTML page, causing the displayed origin to misrepresent the actual site being visited. The vulnerability (CWE-451) carries no confidentiality or availability impact - the risk is exclusively to integrity through phishing enablement, consistent with Google's own 'Low' severity designation. No public exploit code has been identified, and exploitation probability is negligible at EPSS 0.16% (6th percentile).
Plaintext token storage in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier exposes authentication tokens to any Jenkins user holding Item/Extended Read permission or to anyone with direct access to the Jenkins controller filesystem. Tokens written to job config.xml files are readable without decryption, potentially allowing lower-privileged users to impersonate legitimate remote-trigger callers and invoke builds on downstream Jenkins instances. No public exploit has been identified; SSVC assessment confirms no active exploitation and a non-automatable attack path.
Observable response discrepancy in Kibana's Osquery feature enables cross-space scheduled query ID enumeration by authenticated low-privileged users. An attacker holding Osquery live-query privileges can determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access by observing distinguishably different API responses. Vendor-released patch is version 9.4.4 per ESA-2026-161; no public exploit or CISA KEV listing is identified at time of analysis.
Missing authorization in Jenkins' CLI build command allows authenticated low-privileged users to cancel builds they did not initiate. When invoking the `build` CLI command with the `-s` flag (wait-for-completion mode), Jenkins 2.579 and earlier and LTS 2.568.2 and earlier skip the required `Item/Cancel` permission check, enabling any user holding only `Item/Build` permission to abort in-flight builds owned by other users. No public exploit code has been identified at time of analysis, and this issue is not listed in the CISA KEV catalog.
Address bar spoofing in Google Chrome's Downloads component (versions prior to 152.0.7977.75) is reachable only after an attacker has already achieved code execution within the renderer process, enabling display of a falsified URL via a crafted HTML page. The flaw stems from improper privilege management (CWE-269) in the Downloads subsystem, which fails to enforce the privilege boundary between the sandboxed renderer and the trusted browser UI. No public exploit identified at time of analysis; a vendor-released patch is available in Chrome 152.0.7977.75.
The Drupal contributed module 'Disable Login Page' fails to fully suppress access to Drupal's login interface, allowing its security control to be bypassed via an alternate path or channel (CWE-288). Affected versions span 0.0.0 through 1.1.4 (exclusive), targeting Drupal sites that rely on this module to hide their login page - typically to enforce SSO or obscure attack surface. The vendor-assessed CVSS vector (PR:H, S:C, C:L) indicates scope change into Drupal core's login component, with low confidentiality exposure and no patch-related active exploitation identified; EPSS at 0.19% (9th percentile) reflects negligible current threat activity.
Authentication bypass in the Drupal CAPTCHA Protected Page contributed module (versions before 1.0.2) allows unauthenticated network attackers to access pages that should be gated behind a CAPTCHA challenge by using an alternate access path or channel that circumvents the protection logic. The confidentiality impact is limited - only the content of the CAPTCHA-protected pages is exposed, and the CVSS high-complexity rating indicates the bypass requires specific conditions to execute. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog. A vendor patch is available at version 1.0.2.
Drupal's Commerce CyberSource payment integration module (all versions prior to 1.10.0) contains a timing side-channel vulnerability (CWE-208) that enables brute-force attacks against authentication or token-validation operations. Remote unauthenticated attackers can exploit measurable differences in response timing to iteratively confirm the validity of credentials or secrets, achieving limited integrity impact. Vendor-released patch version 1.10.0 is available via the Drupal security advisory sa-contrib-2026-106; no public exploit code or CISA KEV listing has been identified at time of analysis.
Incomplete credential cleanup in Elastic Cloud on Kubernetes (ECK Operator) allows a low-privileged tenant to retain unauthorized read access to an associated Elasticsearch cluster after a cross-namespace association attempt has been denied by Kubernetes RBAC enforcement. The root cause is CWE-459: when RBAC rejects the cross-namespace binding, ECK fails to revoke the authentication credentials it provisioned, leaving them valid and usable. With CVSS 3.5 and scope-changed vector (S:C), the vendor advisory ESA-2026-146 identifies the fix in ECK 3.5.0.
Improper permission enforcement in Jenkins's Appearance configuration page allows authenticated users holding the Overall/Manage permission to modify Appearance configuration options beyond their authorized scope. Affected are Jenkins 2.579 and earlier (weekly) and LTS 2.568.2 and earlier. The vendor has released fixes in Jenkins 2.580 and LTS 2.568.3; no public exploit or active exploitation has been identified, and EPSS places this at the 6th percentile of exploitation likelihood.
Privilege escalation in Drupal's Content Moderation Notifications module (all versions before 3.9.0) stems from unsafe privilege definitions (CWE-267) embedded in the module's moderation workflow handling. An already-highly-privileged Drupal user can exploit improperly scoped permissions granted by the module to perform actions or access content beyond their intended role boundary within Drupal's RBAC model. No active exploitation (CISA KEV) or public proof-of-concept has been identified; a vendor patch at version 3.9.0 is available per Drupal security advisory SA-CONTRIB-2026-107.
Incorrect authorization in Elastic Fleet Server allows any authenticated enrolled agent to interfere with multi-part upload sessions belonging to other enrolled agents, causing a denial of service of those upload operations. Fleet Server fails to verify session ownership during chunked data uploads, meaning a low-privileged agent credential is sufficient to disrupt peer agent activity. No public exploit exists and no active exploitation has been confirmed; CVSS rates this Low (3.1) reflecting the authentication prerequisite and high complexity timing condition.
Incorrect authorization in Chrome's Navigation component allows a remote attacker who has already compromised the renderer process to bypass the web same-origin policy via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.75. This is a chained, second-stage exploitation primitive - it does not grant initial access but extends the reach of an already-compromised renderer, enabling limited cross-origin data reads. SSVC and CVSS both assess technical impact as partial with no active exploitation identified.
Incorrect authorization in Chrome's Actor component allows a remote attacker who has already compromised the renderer process to bypass web origin policy via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.75, which carries the fix. Chromium's own severity rating is Low, consistent with the CVSS 3.1 base score of 3.1 and the requirement for a pre-compromised renderer as a prerequisite; no public exploit or active exploitation is identified at time of analysis.
Missing FileSystem authorization in Google Chrome prior to 152.0.7977.75 allows an attacker who has already achieved renderer process compromise to bypass the web origin policy via a crafted HTML page. The flaw (CWE-862) grants cross-origin file access that the browser's same-origin policy should prohibit, extending the impact of any renderer exploitation chain. Chromium's own severity rating of Medium aligns with the strict prerequisite of prior renderer compromise; SSVC rates exploitation as none and technical impact as only partial.
Cross-origin data leak in Google Chrome's Skia graphics library (prior to 152.0.7977.75) enables an attacker who has already achieved renderer process compromise to extract cross-origin data via a crafted HTML page. This is a second-stage vulnerability in an exploit chain: it does not enable initial access but amplifies an existing renderer compromise by breaking the Same-Origin Policy boundary. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Google internally rates this 'High' severity - notably elevated above the computed CVSS 3.1 (Low) score.
Error message spoofing in F5 BIG-IP's Configuration utility (TMUI) allows a remote, unauthenticated attacker to reflect fabricated error messages inside an authenticated administrator's browser session by tricking them into clicking a crafted link. The flaw is rooted in CWE-451 (UI Misrepresentation of Critical Information) and is strictly a control-plane issue - the data plane handling live traffic is unaffected. F5 has assigned a CVSS 4.0 score of 2.3, reflecting the combination of high attack complexity, mandatory user interaction, and the narrow integrity-only impact of spoofed UI content.
Mass assignment (CWE-913) in gouguoa's edit_personal endpoint allows authenticated remote users to manipulate the position_id argument to dynamically set arbitrary object attributes within the update function of app/home/controller/Index.php. Affected versions are gouguoa 5.10.0 and 6.0.1 and below; a fix was released in 6.0.3. A public proof-of-concept exploit has been disclosed on GitHub, raising the practical risk above what the low CVSS 4.0 score (2.1) alone might suggest.
Path traversal in wcurl for Windows allows a crafted URL containing percent-encoded backslashes to redirect a downloaded file to an attacker-controlled directory outside the user's intended destination. Affecting wcurl shipped with curl 8.14.0 through 8.21.0 and standalone wcurl 2024.12.08 through 2026.01.05, the flaw exploits Windows path-separator semantics: wcurl decodes %5C to a backslash, which Windows treats as a directory separator, causing file placement at an unintended filesystem path. No public exploit code and no active exploitation have been identified at time of analysis; vendor-released patches are available as of September 2, 2026.
CVE-2026-80220 is attributed to Ubuntu but carries no description, CVSS score, CWE classification, or technical details in the available intelligence data. Without a vulnerability description or affected component, no characterization of attacker capability, impact type, or affected user population is possible. Security teams should monitor Ubuntu Security Notices directly at ubuntu.com/security/notices for authoritative details as they become available.
CVE-2026-16658 is attributed to Ubuntu (vendor source) but carries no available description, CVSS score, CWE classification, or reference data at time of analysis. The affected component, attack vector, and impact are entirely unknown from the provided intelligence. No meaningful characterization of attacker capability or defender exposure can be made without additional disclosure from Canonical or NVD.