Broken object-level authorization (IDOR) in Plane through 1.4.2 allows authenticated attackers to post comments on arbitrary issues across any workspace by supplying a manipulated issue_id to the public deploy-board comment endpoint. The endpoint at apps/api/plane/space/views/issue.py (lines 258-275) performs no validation that the supplied issue belongs to the project associated with the deploy board, enabling cross-workspace data pollution. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS 4.0 base score is 5.3 (Medium).
Broken object-level authorization in BookWyrm through 0.9.1 lets authenticated users favorite or unfavorite followers-only and direct statuses they are not permitted to view. By POSTing a controlled status ID to the /favorite or /unfavorite endpoint, an attacker can create unauthorized social interactions, trigger ActivityPub federation broadcasts that notify the content owner's network, and enumerate private status IDs through response differentiation attacks. No public exploit code has been identified at time of analysis, though a detailed researcher writeup is publicly available via VulnCheck and a GitHub disclosure.
SiYuan's `getAttributeViewKeysByID` endpoint, present in all versions before v3.8.2, allows authenticated publish readers to retrieve full key schemas-including sensitive field names and relation definitions-from private or hidden databases they have no visibility into. The flaw is an authorization bypass (CWE-639/IDOR) where the endpoint validates that a caller holds a publish-reader session but never verifies the caller's access rights against the parent database owning the requested attribute view. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world risk moderate despite the network-accessible attack vector.
Stored XSS in Grav CMS before 2.0.20 lets low-privileged page editors inject arbitrary JavaScript that executes in every visitor's browser, including administrators, by abusing the Twig content sandbox's allowlisted `addJs`/`addCss` methods on `Grav\Common\Assets`. The asset URL is concatenated directly into `<script src>` and `<link href>` tags in the document head without output escaping, and Grav's built-in XSS scanner cannot detect the payload because `addJs()` mutates the shared Assets service and returns only an object key - no inspectable markup is produced at scan time. Vendor-released patch Grav 2.0.20 is available; no public exploit has been identified at time of analysis.
Blind Server-Side Request Forgery in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contributor-level users to coerce the web server into making arbitrary outbound HTTP requests, including to private and reserved IP ranges unreachable from the public internet. The root cause is the use of WordPress's unrestricted `wp_remote_get()` instead of the network-safe `wp_safe_remote_get()` in the `et_pb_set_video_oembed_thumbnail_resolution()` function. Although response bodies are withheld (blind SSRF), two side-channel oracles - a status oracle based on the returned URL string and a timing oracle based on response latency - allow limited internal network reconnaissance. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available as of Divi 4.27.7.
Remote memory disclosure in libpcap's rpcap client allows a malicious or compromised rpcap server to cause a connected client to read up to 20 bytes beyond the end of its receive buffer and treat that data as captured packet content. All libpcap versions with rpcap support are affected per CPE cpe:2.3:a:the_tcpdump_group:libpcap:*:*:*:*:*:*:*:*. The root cause is an incorrect boundary check in pcap_read_nocb_remote(): the RPCAP_MSG_PACKET caplen field was validated against the full payload length rather than against the payload length minus the fixed-size RPCAP_MSG_PACKET header, creating a window of up to sizeof(struct rpcap_pkthdr) bytes that could be read beyond the buffer. No public exploit or CISA KEV listing is identified at time of analysis.
Heap buffer over-read in ugrep before 7.6.0 allows a local attacker to crash the utility by supplying a malformed .Z (Unix compress) archive file to its LZW decompressor. The flaw, located in src/zopen.c at approximately line 673, causes the decompressor to read exactly one byte past the end of the allocated heap buffer, resulting in a process crash. The CVSS 4.0 vector confirms the impact is limited to availability at the Low severity level with no confidentiality or integrity exposure; no public exploit has been identified at time of analysis.
Authorization bypass in the Custom Contact Forms WordPress plugin (all versions ≤ 7.16) grants authenticated contributors the ability to permanently force-delete arbitrary posts of any type - including administrator-authored pages and WooCommerce product listings - and write arbitrary ccf_field_* post meta onto any post regardless of ownership. The root cause is that _create_and_map_fields() and _create_and_map_choices() accept arbitrary post IDs in nested fields[].ID and choices[].ID parameters with no capability or post-type validation, leaving those REST API sinks fully unguarded while the developer had already implemented equivalent guards elsewhere in the same controller. No public exploit code exists and the vulnerability is not listed in CISA KEV.
Theme My Login plugin for WordPress (≤7.1.15) on Multisite installations allows authenticated Subscriber-level accounts to bypass the network's `active_signup` registration policy by posting directly to the `gimmeanotherblog` handler, which omits the policy gate enforced by sibling branches and unconditionally invokes `wpmu_create_blog()` with the attacker's user ID. WordPress core then assigns the Administrator role on the resulting subsite, granting full subsite control - including plugin and theme installation - to an otherwise low-privileged user. No public exploit code or CISA KEV listing has been identified; Wordfence reported the issue and a fix is confirmed in version 7.2.0.
Memory exhaustion in libpcap's rpcapd remote capture daemon allows an authenticated remote client to degrade or crash the service by triggering unreleased heap allocations. The daemon allocates up to 65536 bytes per RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message processed in daemon_unpackapplyfilter(), but the bf_insns BPF filter instruction array is never freed on any code path - success or error - under the pre-patch logic. A malicious rpcap client can accelerate memory exhaustion by rapidly submitting filter-update or capture-start requests. No active exploitation is confirmed and no public exploit code exists at time of analysis.
Missing authorization in the Ninja Forms - Save Progress WordPress plugin (versions ≤3.0.30) allows any subscriber-level authenticated user to bulk-delete arbitrary records from the wp_nf3_objects database table via the unprotected bulk_actions function. The handler enforces neither WordPress capability checks nor nonce verification, meaning any logged-in site user can destroy saved form submission data at will. No public exploit has been identified at the time of analysis; CVSS 4.3 reflects the constrained, integrity-only impact gated behind authentication.