Credential exposure in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1) and IBM Integration Bus for z/OS (10.1.0.0-10.1.0.7) enables any local user to recover database credentials from application log files. The root cause is CWE-532: sensitive material - specifically database connection credentials - is written into log output that can be read by unprivileged local accounts. No public exploit is identified at time of analysis, but successful exploitation yields high confidentiality impact, enabling downstream database compromise.
Cleartext credential exposure in IBM App Connect Enterprise 12.x and 13.x and IBM Integration Bus for z/OS 10.x allows a local attacker to harvest service credentials directly from trace log files. The middleware writes authentication material in unencrypted form during trace operations, violating the principle of minimal data exposure in diagnostic output (CWE-532). No public exploit has been identified and exploitation requires local filesystem access under high-complexity conditions, but successful compromise yields full credential disclosure with a CVSS confidentiality impact of High.
Uncontrolled recursion in IBM App Connect Enterprise (versions 12.x and 13.x) and IBM Integration Bus for z/OS (version 10.1.x) allows a local authenticated attacker to crash the integration runtime via stack exhaustion, resulting in a denial of service. The flaw is classified as CWE-674 and affects a broad version range across both product lines, with a vendor-released patch now available. No public exploit code or active exploitation has been identified at time of analysis.
IBM i versions 7.5 and 7.6 expose privileged file contents to locally authenticated users operating over SSH, allowing a low-privilege account to read information that should be restricted by the operating system's privilege model. The vulnerability is rooted in CWE-267 (Privilege Defined With Unsafe Actions), meaning the IBM i SSH subsystem permits file access operations that violate the intended privilege boundary for the relevant file. No public exploit code has been identified and the vendor-assigned CVSS score of 3.3 (Low) reflects the constrained local access requirement and limited confidentiality impact.
Path traversal in IBM Langflow OSS 1.0.0-1.10.2 permits authenticated remote attackers to read arbitrary files on the underlying server by embedding dot-dot sequences (/../) in crafted URL requests. The vulnerability (CWE-22) exposes any file readable by the application process, potentially including configuration files, credentials, private keys, and other sensitive data. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch.
Remote authenticated attackers can bypass security restrictions in IBM i 7.3 through 7.6 by exploiting improper authentication logic during service-name matching (CWE-287). The flaw allows a low-privileged authenticated user to overstep their authorized service boundaries, achieving limited unauthorized reads and writes with no user interaction required. No public exploit code exists and this CVE does not appear in the CISA KEV catalog; IBM has released a patch via the support portal.
Let me synthesize. Product: pfSense (Netgate pfSense Plus / pfSense CE). Product name: "pfSense". Key facts: XSS in captive_portal_status.widget.php, affects pfSense Plus <= 26.03 and pfSense CE <= 2.8.1. CVSS 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. CWE-79. EPSS 0.26% (17th percentile). No KEV. Tags mention RCE — likely mislabeled/stretch (XSS → limited code exec in browser context). "N A" tag is noise. CPE is n/a — data quality flag possible: CPE missing. Hmm, the flag types are mislabeled_tag/wrong_vendor/wrong_product/missing_tag. Not "missing_cpe". I could flag "RCE" as mislabeled tag? The description says "execute arbitrary code" but it's XSS — the CWE is CWE-79, so "RCE" tag is arguably mislabeled. Hmm — but description itself says allows arbitrary code execution. I'd be careful. Maybe flag "RCE" mislabeled with medium/low confidence... Actually the rules say only emit flags when clearly wrong and verifiable. XSS in a captive portal widget page = script execution in victim's browser, not server RCE. CVSS vector C:L/I:L/A:N with S:U strongly implies no RCE. I think flagging "RCE" as mislabeled is defensible with medium confidence. Also "N A" tag — that's clearly a bad tag (from "n/a" vendor parsing). Could flag as mislabeled_tag target "N A" — but suggested? It's not a real tag. Hmm, "wrong_vendor"? The tag "N A" is a garbage placeholder. I'd flag it as mislabeled_tag with suggested null. Actually maybe better: type "mislabeled_tag", target "N A", suggested null, confidence high, reason "Placeholder 'N A' is an artifact of missing CPE vendor/product data, not a real tag." Also missing tags: "pfsense" would be a clearly applicable vendor/product tag. Suggested "pfsense". That seems high confidence and unambiguous. Also "netgate"? I'd emit missing_tag target "pfSense", suggested "pfsense". Hmm, but the instruction says emit missing_tag only when unambiguously implied — pfSense is the product; the tag list lacks it. Yes. Should I flag "PHP"? captive_portal_
Security restriction bypass in IBM i versions 7.3, 7.4, 7.5, and 7.6 enables remote authenticated attackers to circumvent platform-level access controls by exploiting predictable server-generated seed values (CWE-330). The vulnerability stems from insufficient entropy in IBM i's seed generation process, allowing an attacker with a valid low-privilege account to predict protected values - such as session tokens, nonces, or challenge-response material - and leverage them to bypass enforced security boundaries. No public exploit code has been identified at time of analysis; a vendor-supplied patch is available through IBM's support portal.
Stored cross-site scripting in the pfSense dashboard RSS Widget allows an authenticated attacker to inject arbitrary JavaScript into the browsers of all authenticated users who view the dashboard. The attacker configures the RSS widget to point to an attacker-controlled feed whose title element contains a malicious payload; because pfSense previously rendered the feed title via `<?=$item->get_title()?>` without sanitization, the script executes in any victim session that loads the dashboard. Affected versions are pfSense Plus 26.03 and 25.11.1, and pfSense CE 2.8.1; no public exploit has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in the WP Rentals WordPress theme (versions before 3.16.0) allows authenticated low-privileged users to manipulate user-controlled keys to access, modify, or delete rental objects-listings, bookings, or similar records-belonging to other platform users. The flaw, reported by Patchstack and classified as CWE-639, stems from the theme failing to verify server-side that the requesting user owns or is authorized to act on the referenced resource. No active exploitation or public exploit code has been identified at time of analysis.
Stored cross-site scripting in Menulux Portal (all versions before 20260903211448) allows an authenticated low-privileged user to inject persistent malicious scripts into web pages that execute in the browsers of other users who view the affected content. The scope change (S:C in CVSS) indicates the attack crosses the boundary from the application into victim browsers, enabling session theft, credential harvesting, or UI redirection against any user who views the poisoned content. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was reported by TR-CERT and a fix has been released.
Stored cross-site scripting in Gastromenum Ticket and QR Menu System allows authenticated low-privilege users to inject persistent malicious scripts that execute in other users' browsers. All versions prior to 2026.08.31 are affected. The vulnerability is tracked by TR-CERT (Turkish national CERT) and no public exploit or active exploitation has been identified at time of analysis.
phpMyFAQ versions before 4.1.8 expose TOTP shared secrets in plaintext within user data export ZIP archives, enabling two-factor authentication bypass. Any authenticated user who generates their own data export - or any party who obtains such an archive through secondary means (e.g., misconfigured storage, insider access, or a separate file-disclosure vulnerability) - can extract the raw TOTP seed and compute valid one-time codes indefinitely. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables a remote unauthenticated attacker to cause a denial of service by sending a crafted network request to the mirroring service. The flaw (CWE-125) is exploitable with no authentication or user interaction and can disrupt high-availability replication continuity. IBM has released a patch via advisory node/7285904; no public exploit code has been identified at time of analysis.
Incorrect authorization (CWE-863) in phpMyFAQ before 4.1.8 allows authenticated low-privileged editors to read draft and inactive content that is intentionally withheld from public view. Users holding only 'add' permissions can directly invoke the news-edit and FAQ-translate admin endpoints, bypassing the intended role separation and exposing unpublished material. No public exploit has been identified at time of analysis, and exploitation requires a valid account in the target phpMyFAQ installation.
Log injection in IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 allows unauthenticated remote actors to insert forged or malformed entries into application log files by supplying input containing special characters such as CRLF sequences that are written to logs without sanitization. The integrity impact is limited to log tampering - attackers cannot read data, escalate privileges, or disrupt service through this flaw alone, but forged log records can mislead incident responders and undermine audit-trail integrity. No public exploit has been identified at time of analysis, and IBM has released a patch via its support portal.
Missing authorization in phpMyFAQ's admin dashboard API exposes aggregate search statistics and content-health counters to any authenticated user, regardless of their assigned role or privilege level. All versions before 4.2.0-alpha.2 are affected, with the /searches and /content-health admin API endpoints enforcing only authentication - not permission checks - as the access gate. No public exploit has been identified, and the impact is confined to confidentiality of internal operational statistics.
Reflected cross-site scripting in AVideo's userLogin.php allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a script-breakout payload in the error parameter. The attack targets any user who follows the crafted link to the AVideo login page, enabling session hijacking, credential phishing overlays, or browser-based actions on behalf of the victim. No active exploitation (CISA KEV) is recorded and no public exploit code has been independently confirmed beyond the security advisory description.
Open redirect in Dub's link management platform allows unauthenticated network attackers to append a redir_url query parameter to any existing short link, redirecting visitors through the trusted Dub domain to arbitrary external URLs without validation or allowlist enforcement. All versions up to commit 73415cf5e6be13ce9adb7ba5e97474307db34a17 are affected, with the flaw residing in the get-final-url.ts middleware. The primary risk is phishing amplification: attackers can weaponize Dub's brand reputation and link-cloaking feature to deliver convincing lure URLs that bypass corporate URL reputation filters which trust the Dub domain.
Authenticated readers in SiYuan v3.8.1 can call the POST /api/transactions/undoState endpoint with a known document root ID to retrieve internal root IDs of other documents - including private or unpublished ones - that participated in the same cross-document transaction. The flaw is CWE-639 (IDOR via user-controlled key): the endpoint reads from the global undo-log stack and returns peekMutatedRootIDs without applying publish-access visibility filtering to the returned identifiers. Document body contents are not exposed; however, internal identifiers and cross-document transaction relationships leak across trust boundaries. Vendor-released patch v3.8.2 resolves the issue; no public exploit or CISA KEV listing is known at time of analysis.
Server-side request forgery in Camaleon CMS 2.7.5-2.9.1 allows authenticated users to abuse the media library's 'Upload from URL' feature to reach internal network services. The root cause is Ruby's OpenURI library transparently following HTTP redirects, so a URL that passes initial host validation can redirect to an internal address (cloud metadata endpoints, internal APIs) that the server then fetches and returns. Version 2.9.2 patches the issue with a redirect-blocking download helper; no public exploit or CISA KEV listing has been identified.
Chunked-body handling in undici's dump interceptor triggers a double-completion assertion that tears down the underlying TCP connection while returning a misleading success status to the application. Affected are undici versions 7.1.0 through 7.29.0 and 8.0.0 through 8.10.1; fixed releases 7.29.1 and 8.10.2 are available. No public exploit or active exploitation has been identified; the CVSS 3.7 score reflects the high attack complexity and limited real-world impact relative to the narrow exploitation path.
Credential redirect vulnerability in Snowflake JDBC Driver 4.2.0-4.3.3 allows a lower-trust principal who can control the account identifier to cause the driver to transmit login credentials to an attacker-chosen HTTPS endpoint rather than Snowflake's legitimate servers. The attack is exclusively exercisable through the jdbc:snowflake:auto connection scheme when the connections.toml configuration omits an explicit host value; applications using ordinary JDBC URLs are entirely unaffected. Captured credentials are reusable and can be replayed against Snowflake infrastructure to gain the full privileges of the victimized account. Vendor-released patch 4.3.4 is available and requires manual upgrade; no public exploit or CISA KEV listing has been identified at time of analysis.
Missing Authorization in MarketKing WordPress plugin (≤2.1.60) allows unauthenticated remote attackers to perform integrity-affecting actions by exploiting incorrectly configured access control security levels. The CVSS vector (PR:N/UI:N/AV:N) confirms no authentication or user interaction is required. No public exploit or CISA KEV listing identified at time of analysis; impact is limited to partial integrity (C:N/A:N) per CVSS.
Missing authorization in WCFM Membership WordPress plugin through version 2.11.11 allows unauthenticated remote attackers to exploit incorrectly configured access control and perform unauthorized write operations on protected endpoints. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is network-accessible without any authentication, though impact is bounded to limited integrity modification (I:L) with no confidentiality or availability exposure. No public exploit code and no active exploitation have been identified at time of analysis.
Cross-tenant broken object level authorization (BOLA) in OpenPanel before 2.3.0 exposes confidential report definitions and enables permanent destruction of dashboard layouts across tenant boundaries. The `report.getLayouts` and `report.resetLayout` tRPC procedures accept caller-supplied `projectId` values without verifying tenant ownership, allowing any authenticated user to target a victim organization's dashboards by supplying guessable `dashboardId` values. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Payment forgery in the Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 lets unauthenticated attackers submit crafted HTTP requests that mimic PayPal Instant Payment Notification (IPN) callbacks, marking their own orders as paid and completed without transferring any funds. Merchants suffer direct financial loss - goods or services are dispatched against orders that were never paid. No public exploit has been identified at time of analysis, but the attack primitive is trivial: any HTTP client can replay the IPN POST format since the plugin performs no cryptographic or out-of-band verification with PayPal.
Payment fraud is possible against any WooCommerce store running the ePayco Payment Gateway plugin before version 8.4.7, because the plugin accepts payment confirmation callbacks without verifying the gateway signature. Unauthenticated remote attackers can POST a crafted IPN/webhook payload to the store's payment callback endpoint, causing the plugin to transition order status to 'paid' and triggering fulfillment workflows - without any actual funds being transferred. No public exploit has been identified at time of analysis, and the CVSS score of 5.3 significantly understates real-world merchant financial exposure.
Cross-tenant insecure direct object reference in Openpanel before 2.3.0 allows authenticated users to read or reset other tenants' dashboard layouts by supplying arbitrary dashboardId values in tRPC API calls. The report.getLayouts and report.resetLayout tRPC procedures accept a caller-supplied dashboardId without verifying it belongs to the authenticated user's own projectId, enabling horizontal privilege escalation across tenant boundaries. No public exploit code has been identified, and no active exploitation is confirmed, but the flaw is trivially exploitable by any authenticated user on a shared Openpanel instance.
mTLS certificate reuse in Checkmk before 2.5.0p10 enables a relay or push agent to authenticate against agent receiver endpoints using a peer component's certificate, provided both share the same UUID. The agent receiver endpoints fail to verify that a presented client certificate was issued by their own root CA, breaking the intended role-based trust boundary between relay and push agent components. No public exploit has been identified, and exploitation requires an attacker to already control one of the affected agent components (PR:L), limiting realistic risk despite the network-reachable vector.
undici's cache interceptor incorrectly permits responses to unsafe HTTP methods - POST, PUT, DELETE, and PATCH - to be stored and later replayed, because the skip-list that gates caching is built by subtracting configured methods from the safe-method set rather than by positively excluding all non-safe methods, leaving unsafe methods unguarded. A remote origin that returns a heuristically cacheable status code or an explicit Cache-Control directive in response to a state-changing request causes undici to store that response; all subsequent client requests to the same path using the same method are then served from the stale cache entry without ever reaching the origin. Affected versions span undici 7.0.0 through 7.29.0 and 8.0.0 through 8.10.1; no public exploit has been identified at time of analysis.
Apache SkyWalking's PagerDuty alarm hook in versions 9.6.0 through 10.x transmits the PagerDuty integration routing key inside an unencrypted HTTP POST body before any redirect response from PagerDuty's HTTPS-only endpoint is received. Because the initial TCP socket write occurs in plaintext prior to the 301/302 redirect, a passive eavesdropper or MITM attacker positioned between the SkyWalking host and PagerDuty's API can capture the routing key verbatim from network traffic. No public exploit code has been identified and no active exploitation is confirmed; the practical impact is unauthorized PagerDuty event submission using the stolen credential, enabling false incident creation or alert fatigue rather than system compromise.
Server-side request forgery in Trigger.dev before 4.5.2 allows authenticated organization members to register webhook alert channel URLs targeting internal network services, loopback addresses, or cloud provider metadata endpoints such as the AWS IMDSv1 service. When an alert is delivered, the Trigger.dev server issues an outbound POST request to the attacker-controlled URL without any URL validation or SSRF filtering, exposing internal infrastructure to probing and potentially yielding cloud IAM credentials. The vendor released v4.5.2 as a security hardening release that introduces URL sanitization via a `sanitizeHttpUrl` utility; no public exploit code or CISA KEV listing has been identified at time of analysis.
Missing authorization checks in Crocoblock's JetPopup WordPress plugin (versions through 2.0.20.2) allow unauthenticated remote attackers to access functionality or data that should be restricted to authorized users. The flaw, classified as CWE-862 (Missing Authorization), enables exploitation of incorrectly configured access control levels, resulting in low-impact information disclosure with no integrity or availability consequence. No public exploit has been identified at time of analysis, and EPSS and KEV data were not provided.
Unverified access-point ownership in the AWS EFS CSI Driver before v3.4.1 enables an authenticated Kubernetes user holding PersistentVolume creation privileges to trigger recursive deletion of directory trees on EFS filesystems they are not authorized to access. The volume deletion component accepts a crafted volumeHandle that cross-pairs an access point from one EFS filesystem with a different target filesystem, and the driver never validates that the access point belongs to the stated filesystem before executing the deletion. No public exploit has been identified at time of analysis, but the technique is mechanically straightforward for any attacker who already holds the required cluster-scoped RBAC rights.
Stored cross-site scripting in Grav Admin plugin (getgrav/grav-plugin-admin2) versions <= 2.0.19 allows a low-privileged attacker to inject HTML/JavaScript payloads via a crafted username that bypasses server-side validation, executing in an administrator's browser session when specific UI surfaces render the stored username. The root cause is the `tHtml()` internationalisation function in `src/lib/stores/i18n.svelte.ts`, which inserts unescaped user-supplied parameters into locale template strings before markdown parsing - a classic stored XSS pattern. Fixed in version 2.0.21; no public exploit code or CISA KEV listing is known at time of analysis.
Stored XSS in Grav Admin before 2.0.20 allows arbitrary JavaScript to execute within authenticated admin browser sessions by embedding malicious javascript: URI schemes inside plugin or theme changelogs. The root cause is that MarkdownEditor and MarkdownModal Svelte components pass marked.parse() output directly into the DOM via Svelte's {@html} directive without sanitization, meaning any attacker who can publish or distribute a crafted Grav package can trigger JavaScript execution when an admin views that package's changelog. No public exploit code or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects the constrained impact on subsequent systems only.
Order confirmation in Roskus Prospero Flow CRM before 5.15.11 can be triggered by an unauthenticated attacker on behalf of any authenticated user through a classic CSRF exploit. The root cause is a state-changing action exposed via HTTP GET at /order/confirm/{order_number}, which Laravel's VerifyCsrfToken middleware does not protect - middleware enforcement is limited to POST, PUT, PATCH, and DELETE. Because session cookies are configured with SameSite=Lax, a single crafted link navigated by the victim automatically includes their session cookie, silently transitioning the target order from pending to confirmed. Sequential integer order numbers further allow an attacker to enumerate and mass-confirm all outstanding orders in a single automated sweep. No public exploit or KEV listing is identified at time of analysis; vendor patch is available in 5.15.11.
Stored cross-site scripting in Grav Shortcode Core before 6.2.5 allows authenticated users with page-edit permissions to inject arbitrary HTML and JavaScript via the [lorem] tag parameter and [details] summary parameter, both of which are written to rendered pages without output escaping. Any visitor who loads an affected page - including site administrators - will have the injected script execute in their browser, enabling session hijacking, credential theft, or further privilege escalation against admin accounts. Vendor-released patch version 6.2.5 resolves both injection points; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in Grav CMS versions 2.0.0 through 2.0.17 allows authenticated page editors to plant persistent XSS payloads via the modular page subsystem, which bypasses the CMS's save-time XSS sanitization entirely. By embedding malicious Twig template code into a modular page, an attacker with page-edit privileges can cause arbitrary JavaScript to execute in the browsers of any visitor to the parent page - including site administrators. If an administrator is targeted, the attacker can escalate to full site compromise through session hijacking or forced admin-side actions. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored cross-site scripting in phpMyFAQ before 4.1.8 allows authenticated FAQ editors to plant persistent JavaScript payloads that execute in every visitor's browser. The root cause is FaqHelper::convertOldInternalLinks() calling html_entity_decode() on content that was previously sanitized via entity encoding - effectively undoing the protection and re-introducing executable HTML. The impact extends beyond the attacker's own session to all users who subsequently view the poisoned FAQ pages, confirmed by the scope-change metrics in the CVSS 4.0 vector. No public exploit or KEV listing exists at time of analysis.
Blind SQL injection in Emlog CMS Pro's `User_Model::getUserDataByLogin()` function allows a remote attacker who controls the application's AUTH_KEY to enumerate database contents via the authentication cookie validation path. The `$account` value read from the HMAC-signed cookie is interpolated directly into SQL with no sanitization; the HMAC guard, which requires AUTH_KEY to forge, is the sole access barrier before the vulnerable query executes. All Emlog Pro releases before 2.6.16 are affected; the vendor released a confirmed patch at the pro-2.6.16 tag. No public exploit code or active exploitation has been identified at time of analysis.
IBM i versions 7.3 through 7.6 expose encryption key material to high-privileged local users due to hardcoded cryptographic constants used in the key-obfuscation layer. An attacker with elevated local privileges can leverage knowledge of these constants to reverse the obfuscation and recover plaintext encryption keys, gaining access to data that was assumed to be cryptographically protected. No public exploit has been identified at time of analysis, and IBM has released a patch via its support portal.
Reflected XSS in DreamMaker (Interinfo) allows authenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by luring them to a specially crafted URL. The vulnerability affects all tracked versions per the wildcard CPE string and was reported by TWCERT; the CVSS 4.0 vector confirms a network-reachable, low-complexity attack that nonetheless requires both attacker authentication and victim interaction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Local information disclosure in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 stems from a predictable Unix domain socket path placed in a world-writable directory, enabling a TOCTOU race condition (CWE-367). A local, low-privileged attacker can pre-create or replace the socket at the predictable path before the Db2 Mirror service claims it, intercepting communications that flow through that socket and obtaining sensitive information. No active exploitation has been confirmed, and no public exploit code has been identified at time of analysis.
Parameter injection in IBM i 7.3 through 7.6 allows a local authenticated attacker to inject malicious parameters into Control Language (CL) commands by exploiting improper neutralization of special elements (CWE-78). The flaw requires local access with low-level privileges and produces limited confidentiality and integrity impacts without availability consequence, consistent with the CVSS 4.4 Medium rating. IBM has released a patch via their support portal, and no public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the web management interface (wwwugw.cgi) of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote attacker holding only the low-privileged Standard role to change the password of arbitrary accounts, including administrative ones. Successful exploitation yields account takeover and, by resetting an administrator's credentials, effective full control of the gateway. No public exploit identified at time of analysis and EPSS probability is low (0.24%, 15th percentile); the flaw is not listed in CISA KEV, so real-world exploitation is not confirmed.
Incorrect authorization in IBM i 7.4, 7.5, and 7.6 permits remote authenticated users with low privileges to modify certain system messages beyond their intended permission scope. The flaw is rooted in CWE-863 (Incorrect Authorization), where the platform performs an authorization check but does so inadequately, allowing privilege overstep without authentication bypass. No public exploit or active exploitation has been identified at time of analysis; IBM has released a patch via its support portal.
Missing authorization in Menulux Portal allows authenticated low-privileged users to access functionality not constrained by access control lists, resulting in unauthorized information disclosure. Affecting all versions before the timestamp-build 20260903211448, the flaw is rooted in CWE-862 (Missing Authorization) and was reported by TR-CERT, Turkey's national cybersecurity authority. No public exploit or KEV listing exists; the CVSS score of 4.3 (Medium) reflects limited confidentiality impact with no integrity or availability consequences.
Unbounded synchronous DNS amplification in Robots::Validate for Perl (versions 0.3.2 through 0.3.10) allows a network attacker who controls the reverse DNS zone for their IP address to force arbitrarily many forward DNS lookups per validation call, exhausting server threads and causing application-level denial of service. The _check_dns FCRDNS loop issues one forward query per PTR record returned for the connecting IP, with no cap; Net::DNS's default TCP fallback for truncated UDP answers removes the 512-byte payload as a natural limit. No public exploit has been identified and EPSS is 0.17% (7th percentile), but the attack primitive requires only a cloud VM with PTR editing rights and knowledge of the target's bot-rule configuration.