Server-side request forgery in AVideo's EPG parser allows authenticated uploaders to force the server to fetch arbitrary internal URLs via the epg_link parameter during video upload. Any AVideo instance through commit c91b5975d is affected; the parameter undergoes only syntactic validation at submission time, and the actual server-side HTTP fetch during EPG generation occurs without SSRF protections such as private-IP blocking, allowlisting, or DNS rebinding defenses. No public exploit has been identified at time of analysis, but the attack requires only uploader-level credentials and is straightforward to execute against cloud-hosted or internally-networked deployments.
Token store authorization bypass in Rancher Manager before 2.15.1 allows any authenticated user to enumerate every other user's session tokens by supplying a crafted label selector to the ext.cattle.io/v1 Token API. The owner-scoped filter that restricts results to the calling user's own tokens is silently dropped when the caller supplies a label selector naming a different user, instead of returning an empty result set as intended. Exposed data includes token metadata and salted bearer-token hashes, creating an offline cracking risk. No public exploit is identified at time of analysis; a vendor-released patch is available in v2.15.1.
Out-of-bounds memory read in the Linux kernel's DRM HDMI connector subsystem allows a local, low-privileged user to potentially leak up to 32 bytes of adjacent kernel heap memory or trigger a page fault leading to kernel crash. The flaw exists in a helper function that copies audio infoframe data using the destination buffer size (60 bytes) rather than the source structure size (28 bytes), reading 32 bytes beyond the source allocation. No public exploit code exists, and EPSS sits at the 10th percentile; however, the availability impact is real - the overread can cross a page boundary and cause an access violation.
Out-of-bounds kernel memory read in the Linux kernel DRM log subsystem allows a local low-privileged user to potentially disclose kernel memory contents or crash the system. The flaw resides in drm_log_draw_kmsg_record(), where an unsigned integer underflow on a zero-length message causes an array access at offset UINT_MAX (0xFFFFFFFF) rather than a valid buffer position. No public exploit exists and EPSS sits at 0.20% (10th percentile), indicating low observed exploitation interest, though the kernel DRM panic-display path is reachable on any system with a GPU using the DRM framework.
Unauthenticated stored cross-site scripting in WP QuickLaTeX for WordPress (versions <= 3.8.8) allows a remote unauthenticated attacker to inject malicious scripts into LaTeX-rendered content. When a privileged user such as a site administrator views the affected page, the injected script executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. Reported by Patchstack; no public exploit code or active exploitation confirmed at time of analysis.
Cross-site scripting in the Ninja Forms File Uploads Extension for WordPress (versions up to and including 3.3.26) allows unauthenticated remote attackers to inject malicious scripts that execute in the browser of any user who views the affected content. The scope change (S:C) indicates the injected payload runs in the victim's browser context rather than the server, enabling session theft, credential harvesting, or UI redressing against site visitors or administrators. No public exploit code has been identified at time of analysis, though the Patchstack advisory provides sufficient detail for researchers to reproduce the issue.
Unauthenticated cross-site scripting in the Under Construction WordPress plugin (versions ≤ 5.82) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by enticing them to follow a crafted URL. The scope-change vector (S:C) confirms the payload executes in the browser's security context, enabling session token theft, credential harvesting, or malicious redirects against site visitors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege requirement lowers the bar for abuse significantly.
Cross-site scripting in the Quick Event Manager WordPress plugin (versions ≤ 9.17) allows unauthenticated remote attackers to inject malicious JavaScript into pages rendered for authenticated users. Exploitation requires a victim - typically a logged-in WordPress administrator or editor - to load a page or follow a crafted link carrying the payload, which then executes in their browser context with scope change beyond the plugin itself. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Cross-site scripting in the BP Better Messages WordPress plugin (≤2.15.27) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The CVSS scope-change metric (S:C) indicates the injected payload can escape the plugin's execution context and affect the broader WordPress environment, enabling session hijacking, credential theft, or admin-level CSRF actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in RTMKit (RomethemeKit For Elementor) versions up to and including 2.1.5 allows remote attackers to inject and execute arbitrary JavaScript in victim browsers without any prior authentication. Exploitation requires a victim to visit or interact with a page or crafted URL where the plugin renders unsanitized attacker-controlled input. The CVSS vector (S:C) confirms a scope change to the victim's browser context; no public exploit code or active exploitation has been identified at time of analysis.
Cross-site request forgery in WWBN AVideo through commit c91b5975d allows unauthenticated remote attackers to hijack authenticated streamers' live broadcasts by tricking them into loading a malicious page. The saveLive.php endpoint in the Live plugin omits both POST-method enforcement (forbidIfNotPost) and CSRF token validation (forbidIfInvalidToken), so a crafted image tag silently overwrites the victim's RTMP key, password, and stream title when loaded by a logged-in streamer. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in the WC Ukraine Shipping WordPress plugin versions 1.22.3 and earlier allows subscriber-level authenticated users to access and partially modify shipping and order objects belonging to other customers. Reported by Patchstack and classified CWE-639, the flaw arises from the plugin resolving shipping or order records via user-supplied identifiers without verifying the authenticated session owner is authorized to access that resource. With a CVSS 7.1 score carrying C:H/I:L impact, successful exploitation can expose customer PII, order histories, and shipping records; no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated cross-site scripting in the Breadcrumb NavXT WordPress plugin (versions <= 7.5.1) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for visiting users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable, low-complexity exploitation with scope change into the victim's browser context. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the unauthenticated trigger and large install base elevate real-world risk.
Unauthenticated cross-site scripting (XSS) in the Calculation For Contact Form 7 WordPress plugin (all versions up to and including 1.0) allows a remote unauthenticated attacker to inject malicious scripts into pages viewed by other users. With no privileges required and a scope change confirmed by the CVSS vector (S:C), a successful exploit executes arbitrary JavaScript in the victim's browser context, enabling session hijacking, credential harvesting, or UI redressing. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity makes opportunistic targeting straightforward once a vulnerable site is discovered.
Cross-site scripting in the Simple Payment WordPress plugin (versions ≤ 2.5.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered for victim users, including site administrators. The scope-changed CVSS vector (S:C) indicates the injected script executes outside the plugin's own origin - enabling session hijacking, credential theft, or administrative actions executed on the victim's behalf. No public exploit code or active exploitation has been identified at time of analysis.
Process-terminating denial of service in libmongocrypt's decryption path allows a low-privileged attacker to crash applications using MongoDB Client-Side Field Level Encryption (CSFLE). Tracked as MONGOCRYPT-971, the vulnerability is triggered when an unexpected-size encrypted value reaches the decryption routine, firing a reachable assertion (CWE-617) that abruptly terminates the host process rather than returning a handled error. An attacker who can store crafted encrypted values in a shared MongoDB collection, or influence the encrypted data an application receives, can repeatably crash the targeted application.
Guest checkout address IDOR in J2Store Joomla extension exposes personally identifiable information of guest purchasers to any authenticated site user. The `editAddress()` function's ownership guard only fires when the address row carries a non-empty `user_id`; guest-checkout rows have a null `user_id`, silently bypassing the check. Any registered Joomla account can iterate sequential `address_id` integers to retrieve full name, street address, and phone number for all guest orders across J2Store versions 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6. No public exploit has been identified at time of analysis, but the attack is trivially simple for any authenticated user.
Server-side request forgery in OpenStack Glance before 32.0.1 allows authenticated cloud tenants to probe internal network endpoints by registering HTTP image locations that bypass host-restriction filtering. The location API - both POST /v2/images/{id}/locations and the PATCH API when show_multiple_locations is enabled - validates only the URL scheme and ignores the import_filtering_opts host allow-list that guards the web-download path, permitting requests to addresses such as the cloud metadata service at 169.254.169.254. A low-privileged tenant can then retrieve the server's response by downloading the image, potentially exposing ephemeral instance credentials or bootstrap secrets. No public exploit code has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 7.0 with SC:H reflects genuine cross-boundary credential exposure risk on affected deployments.
Unauthenticated bootloader command execution in ShizenBox2 (dev-conf) firmware ≤v1.0.10 is achievable by any attacker with physical access to the device. The 'dev-conf' firmware variant from Shizen Connect Inc. fails to enforce authentication on bootloader interfaces (CWE-1263), exposing full device control - including firmware manipulation - without credential verification. Reported through JPCERT/JVN responsible disclosure; no public exploit code identified and no CISA KEV listing at time of analysis.
Stack buffer overflow in gfs2-utils' savemeta function allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The vulnerability stems from using an attacker-controlled `height` field from on-disk inode metadata as a loop bound without validation, overwriting stack memory beyond the buffer's allocated region. Exploitation requires convincing a privileged or standard user to run gfs2-utils tooling against a malicious image, with successful exploitation granting code execution at the privilege level of the running process. No public exploit code or active exploitation has been identified at time of analysis.
Stack buffer overflow in the gfs2_edit utility within gfs2-utils allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The di_height field from on-disk inode metadata is used as an array index with no bounds validation, enabling a stack overwrite with fully controlled data from an untrusted image. Affected systems include all supported Red Hat Enterprise Linux 7, 8, and 9 installations that ship gfs2-utils; no public exploit or active exploitation has been identified at time of analysis.
Weak credential management in the mapp Audit component of B&R Industrial Automation's mapp Services framework allows network-accessible, unauthenticated attackers to leverage predictable or default credentials to gain unauthorized access with high confidentiality and integrity impact on downstream industrial systems connected through the platform. All mapp Services versions prior to 6.8.0 are affected. No public exploit or CISA KEV listing has been identified at time of analysis, but the OT/ICS deployment context - where integrity compromise can translate to physical process disruption - elevates the practical severity beyond the numeric score.
OptimiDoc Server (On-Premise) exposes cleartext credentials for integrated external services - SMTP, FTP, Active Directory, and SharePoint - directly in the HTML page source of the web administration panel. Any authenticated administrator who views the configuration pages can read these stored passwords without any additional steps. Fixed in version 26.08 per CERT-PL advisory; no public exploit or KEV listing at time of analysis.
Business logic manipulation in HKUDS AI-Trader's unauthenticated selfRegister API endpoint allows remote attackers to supply an arbitrary initial_balance value, inflating their simulated starting cash in the trading competition platform. Critically, the description confirms that profit_percent_for_display() and challenge scoring's return_pct both normalize against the inflated starting capital, making percentage-based returns immune; exploitation achieves only cosmetic inflation of absolute cash and equity leaderboard columns, not artificial percent-return gains. A public proof-of-concept exploit exists per a GitHub security advisory and VulDB entry 398295, though no active exploitation (KEV) has been identified.
Prototype pollution in node-csv's csv-parse package (prior to 7.0.2) allows unauthenticated remote attackers to inject inherited array values into parsed record objects by supplying a CSV with duplicate __proto__ column headers when both the columns and group_columns_by_name options are enabled. The parser's direct obj['__proto__'] assignment replaces the parsed record's prototype with an attacker-controlled array, causing inherited numeric-index values to be silently hidden from JSON.stringify(), corrupt property enumeration, and subvert type or shape checks in downstream application logic. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available in version 7.0.2.
Synchronous CSS color string parsing in colord (npm, versions prior to 2.9.4) exposes Node.js applications to event-loop denial of service through catastrophic regex backtracking (ReDoS). The ambiguous numeric pattern `([+-]?\d*\.?\d+)` used across five color-model parsers - RGB, HSL, HWB, LCH, and CMYK - allows overlapping quantifiers to partition the same digit sequence in O(n²) ways during rejection, blocking the JavaScript thread for seconds per malformed payload. An unauthenticated attacker who can supply an unbounded color string to any exposed application endpoint that calls `colord()`, `getFormat()`, `isEqual()`, `mix()`, or `contrast()` can render the service unresponsive; no public exploit code has been identified at time of analysis.
Server-side request forgery in PlaywrightCapture's favicon retrieval function allows a remote attacker to cause the PlaywrightCapture host to issue HTTP requests to internal or loopback-addressed services by exploiting a redirect-bypass in the aiohttp HTTP client. When the `only_global_lookup` configuration is active, the library validates the user-supplied favicon URL before the first request but does not re-validate URLs generated by automatic HTTP redirects, allowing a publicly reachable attacker-controlled URL to redirect to restricted destinations such as 127.0.0.1 or internal network services. Depending on what internal HTTP services are reachable from the PlaywrightCapture host and how favicon response content is surfaced, this enables internal network probing and potential information disclosure. A patch is available via the upstream Lookyloo repository; no active exploitation has been identified.
Broken access control in WWBN AVideo's unauthenticated feed/index.php RSS endpoint allows any remote attacker to bypass per-video visibility enforcement by supplying a program_id parameter, exposing unlisted and group-restricted video metadata and content URLs. The flaw is particularly severe in that empty playlist IDs trigger return of the platform's entire hidden video catalogue, making targeted enumeration trivial. No public exploit code or KEV listing confirmed at time of analysis; the CVSS 4.0 score of 6.9 reflects the unauthenticated, low-complexity network vector tempered by a limited confidentiality impact.
Broken access control on the WWBN AVideo public channel page allows unauthenticated remote visitors to retrieve full URLs of unlisted videos and thumbnails of member-only content, bypassing the operator-configured hidePrivateVideos setting. The flaw originates from hardcoded visibility flags and an undefined property check in the channel endpoint's authorization logic, rendering the platform's content-restriction model ineffective. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the BSON decoding component of the MongoDB PHP Driver (all versions per CPE cpe:2.3:a:mongodb:php_driver) allows an unauthenticated remote party to cause a small quantity of adjacent process memory to be copied into an error message that is returned to application code. The disclosure is limited in scope - only a few bytes of process memory are exposed, and they surface in application-level error messages rather than being sent directly in a network response - but may inadvertently reveal stack variables, pointers, or partial secrets depending on memory layout. No public exploit code has been identified at time of analysis.
Authorization bypass in NousResearch hermes-agent 0.18.0 allows unauthenticated remote attackers to manipulate the `session_id` argument passed to the `_sess_nowait` function in `s71.py`, circumventing session-based access controls without supplying valid credentials. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivially network-reachable exploitation with no prerequisites, though impact is bounded at low across confidentiality, integrity, and availability, yielding a CVSS 4.0 score of 6.9. No vendor patch exists; NousResearch did not respond to the reporter's disclosure, and no public exploit code has been identified at time of analysis.
PowerProtect Data Manager versions 20.2.0.0 and earlier contain a CWE-188 (Reliance on Data/Memory Layout) flaw that enables unauthenticated remote attackers to launch phishing attacks against users of the platform. The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates the attack is network-reachable without credentials but requires high complexity and user interaction, consistent with an open-redirect or token/URL-manipulation mechanism that makes the product's trusted domain a vehicle for directing victims to attacker-controlled infrastructure. Dell has addressed this in advisory DSA-2026-368; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in MOOS-IvP SplitHandler (through version 24.8.1) allows an attacker who supplies a crafted alog file to write files outside the intended split output directory on Windows systems. By embedding backslash sequences in variable names within the alog file, the inadequate prior sanitization - which only replaced forward slashes - can be bypassed to escape the output directory boundary and append to arbitrary files. A vendor patch is available via PR#137; no public exploit or KEV listing has been identified at time of analysis.
XML External Entity (XXE) injection in Exterro FTK Imager before 8.3 allows an attacker to read arbitrary files from a forensic examiner's workstation by embedding malicious entity references and XSLT scripts within a crafted UFDR evidence archive. When an examiner previews the weaponized archive, the XML parser resolves file:// URIs and executes msxsl:script within an attacker-controlled stylesheet, exfiltrating file contents to an external endpoint via a generated image URL. The attack is particularly dangerous in forensic workflows because examiners routinely open submitted evidence archives, making file delivery a plausible social-engineering vector. No public exploit or CISA KEV listing has been identified; vendor-released patch version 8.3 is available.
XML External Entity injection in Keyence XG VisionTerminal and XG-X VisionTerminal exposes sensitive host system files when a user opens a maliciously crafted settings file. Rooted in CWE-611, the XML parser fails to restrict external entity resolution, allowing a crafted DOCTYPE declaration to cause the software to read and disclose local file contents - credentials, configuration data, or OS-level secrets accessible under the running user context. No public exploit code or active exploitation has been identified at time of analysis, and the JPCERT/JVN advisory confirms vendor awareness with a remediation reference.
Web origin policy bypass in Google Chrome for Android (prior to 152.0.7977.82) exploits a use-of-released-resource flaw (CWE-672) in the browser's mobile implementation, allowing cross-origin content manipulation via a crafted HTML page. An attacker must socially engineer a victim into visiting the malicious page, after which Chrome's Same-Origin Policy enforcement can be circumvented, resulting in high integrity impact against targeted origins. No public exploit code or CISA KEV listing exists at time of analysis; Google issued a fix in stable channel release 152.0.7977.82.
Incorrect Authorization (CWE-863) in the REST API of Dell PowerProtect Data Manager versions 20.2.0.0 and below allows a low-privileged authenticated remote attacker to bypass protection mechanisms and perform integrity-impacting actions beyond their authorized scope. The CVSS vector (PR:L, I:H, C:N, A:N) confirms the impact is confined to unauthorized modification of data or configuration - there is no confidentiality or availability exposure. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the WPFunnels WordPress plugin (versions <= 3.12.13) permits unauthenticated remote attackers to invoke restricted plugin actions without authorization. The CVSS vector (PR:N/UI:N/AV:N) confirms no credentials or user interaction are required to trigger the flaw. Impact is bounded to limited integrity and availability degradation (I:L/A:L) with no confidentiality exposure, and no public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in VillaTheme's Product Variations Swatches for WooCommerce plugin (versions <= 1.1.18) allows authenticated subscribers to inject malicious JavaScript that executes in the browsers of higher-privileged users, such as administrators, when they view affected content. The flaw stems from insufficient input sanitization or output escaping of subscriber-controllable data processed by the plugin's variation swatch rendering logic. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the low authentication bar - subscriber role - expands the potential attacker pool on any store permitting public registration.
Stored or reflected Cross-Site Scripting in the Graphene WordPress theme (by silverks) version 2.9.4 and earlier allows a low-privileged Subscriber-level user to inject malicious JavaScript that executes in the browser of any higher-privileged user who views the affected content. The scope change (S:C) in the CVSS vector confirms impact extends beyond the attacker's own session to other users, enabling session hijacking, credential theft, or privilege escalation against site administrators. No public exploit code or active exploitation has been identified at time of analysis, but Patchstack has reported and documented the issue.
Incorrect authorization in Kibana (CWE-863) allows a low-privileged authenticated user to access data or resources beyond their intended authorization level, resulting in high-impact confidentiality breach. Affected versions are addressed in Kibana 9.4.6 and 9.5.3 per Elastic advisory ESA-2026-175. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in Business Directory WordPress plugin versions 6.4.26 and earlier exposes unauthenticated endpoints that should require authorization, allowing remote attackers to perform unauthorized write operations affecting directory listings and plugin data. The root cause is CWE-862 (Missing Authorization) - the plugin omits capability or permission checks on one or more AJAX or form handlers. With a CVSS 6.5 score reflecting limited integrity and availability impact, no public exploit code has been identified at the time of analysis, and the vulnerability is not listed in CISA KEV.
IBM Netezza Software 11.3.0.3 through Interim Fix 002 omits the AWS S3 `ExpectedBucketOwner` validation parameter on S3 API calls, leaving the application blind to bucket ownership. An unauthenticated remote attacker who registers an S3 bucket with a name matching or colliding with the target environment's configured bucket can intercept outbound data writes or inject crafted data into Netezza's S3-backed workflows. Both confidentiality and integrity are at risk; no patch version has been independently confirmed beyond the vendor advisory, and no public exploit or active exploitation has been observed.
Missing Authorization in MountDev AI MCP Connector for WordPress (≤1.6.5) by Cascadia Web Services allows any authenticated low-privileged user to invoke plugin endpoints without proper capability checks, producing high integrity impact with no confidentiality or availability exposure. The root cause is CWE-862 (Missing Authorization), meaning the plugin registers REST or AJAX handlers that omit WordPress capability checks, permitting subscriber-level users to perform actions reserved for administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated IDOR in the Business Directory WordPress plugin (versions <= 6.4.26) allows remote attackers to access or modify directory listing objects belonging to other users without authentication. The flaw stems from missing authorization checks on direct object references, enabling both unauthorized data reads and writes against business listing records. No public exploit code or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and low attack complexity lower the barrier to opportunistic exploitation.
DOM-Based XSS in WPKoi Templates for Elementor (WordPress plugin) versions through 3.7.2 allows a low-privileged authenticated attacker to inject malicious scripts that execute in victims' browsers when they view affected pages. The flaw stems from insufficient neutralization of user-supplied input during web page generation, enabling script injection into the DOM without server-side reflection. No public exploit or CISA KEV listing has been identified at time of analysis, but Patchstack has publicly documented the vulnerability, lowering the bar for exploitation.
Stored Cross-Site Scripting in Magepeople Inc.'s Booking and Rental Manager WordPress/WooCommerce plugin (all versions through 2.7.7) allows authenticated low-privileged users to inject persistent malicious scripts into pages rendered by the application. When a higher-privileged user such as an administrator subsequently views the affected page, the stored payload executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken access control in the Mail Mint WordPress plugin (≤1.31.0) exposes one or more endpoints to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication or user interaction against default installations. Partial confidentiality and integrity impact (C:L/I:L) suggests attackers can read or modify data - such as subscriber lists, campaign settings, or plugin configuration - without holding any WordPress account. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken access control in the Timetics WordPress booking and scheduling plugin (versions ≤ 1.0.61) exposes unauthenticated REST or AJAX endpoints that lack authorization checks, allowing remote attackers to modify or disrupt scheduling data without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward network exploitation requiring no authentication or user interaction against any WordPress site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is bounded by the plugin's relatively limited deployment footprint.
Unauthenticated authentication bypass in the Pre-Orders for WooCommerce WordPress plugin (versions <=2.3) allows remote attackers to spoof identity or session context and gain limited read and write access to pre-order functionality without credentials. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw enables network-accessible exploitation with no user interaction required, resulting in partial confidentiality and integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.