Unauthorized file upload in Lara Dashboard before 1.3.2 allows any authenticated account - regardless of content permissions - to reach the post-builder image and video upload endpoints. The pre-patch code derived the stored filename extension from the client-supplied value via `getClientOriginalExtension()`, enabling attackers to write polyglot files with arbitrary extensions (e.g., `.php`) into the public web root. On deployments where the web server executes the uploaded file type (e.g., PHP on a standard LAMP stack), this escalates to remote code execution. No public exploit identified at time of analysis; vendor-released patch v1.3.2 is confirmed.
Unauthorized correlation data exposure in MISP ≤2.5.45 allows authenticated users with restricted access to observe event correlations, event metadata, and feed URLs that their ACL would normally block. The freetext feed preview endpoint invoked two raw database queries against the Attribute model filtered only by attribute value and deletion status, entirely bypassing MISP's multi-layered access controls covering event distribution, organization membership, sharing groups, and attribute- and object-level permissions. A second sub-issue in the same code path leaked cross-feed correlation results and configured feed URLs for feeds not marked as lookup-visible. No public exploit or KEV listing exists at time of analysis.
Authorization bypass in ILIAS e-learning platform allows authenticated group members with only read access to modify group map settings and didactic template assignments via crafted POST requests to saveMapSettingsObject() and updateGroupTypeObject() in ilObjGroupGUI, changing group modes and effective permissions for all members. Versions 9.x before 9.23, 10.x before 10.11, and 11.x before 11.4 are confirmed affected per EUVD-2026-72363. No public exploit code has been identified at time of analysis, but the published patch commit reveals the exact missing permission gate, substantially lowering the reconstruction barrier for exploitation.
Authenticated users in MISP ≤2.5.45 can retrieve object-reference records outside their authorized scope via an Insecure Direct Object Reference (IDOR) flaw in EventGraphTool::get_reference_data(). The vulnerable code queried ObjectReference by UUID and returned the matching row without verifying the requesting user has access to the parent object the reference belongs to. An authenticated attacker who knows or enumerates a reference UUID can access reference metadata - including relationship types, comments, and referenced UUIDs - from objects in events they are not permitted to view. No public exploit or CISA KEV entry exists at time of analysis.
Unauthenticated deletion of arbitrary student course progress records is possible in the Masteriyo LMS WordPress plugin through version 2.2.0. The `delete_item_permissions_check` function in the `CourseProgressItemsController` REST API controller omits any WordPress capability check, allowing any unauthenticated network attacker to permanently erase course progress belonging to any enrolled student. No public exploit has been identified and the vulnerability is absent from CISA KEV, but the trivial exploitation conditions (PR:N, AV:N, AC:L) make remediation a clear priority for any site running this plugin.
Authenticated information disclosure in MISP ≤2.5.45 allows any logged-in user to bypass email-address redaction by switching from the HTML interface to the REST/JSON representation of DashboardsController::listTemplates(). The query always fetched User.email columns, but the redaction logic only executed inside the non-REST rendering branch - meaning the same session that saw blank email fields in the browser received raw email addresses when requesting JSON. The fix, contributed by CIRCL (MISP's primary maintainer) and released in commit fd554c3bd, centralizes the privilege decision in a new User::canSeeEmails() static helper, conditioning email retrieval on site-admin role or the Security.disclose_user_emails instance setting.
Remote denial-of-service in MediaTek Modem firmware affects 19 chipset variants spanning the MT6xxx and MT8xxx families - when a device embedding an affected chipset connects to an attacker-controlled rogue base station, a missing bounds check (CWE-617: Reachable Assertion) in the modem subsystem triggers a system crash, causing loss of connectivity. The CVSS score of 5.3 (AV:A/AC:H) reflects the elevated operational complexity of deploying rogue cellular infrastructure to exploit this flaw. No public exploit has been identified at time of analysis, and no CISA KEV listing exists.
Remote denial of service against MediaTek modem firmware affects 57+ chipset variants spanning the MT6xxx and MT8xxx series when a user equipment (UE) connects to an attacker-controlled rogue base station, triggering a missing bounds check (CWE-617 reachable assertion) that crashes the modem subsystem. The attack requires no privileges or user interaction on the victim device, though the adjacent network vector (AV:A/AC:H) demands the attacker operate specialized RF equipment in physical proximity. No public exploit code has been identified, CISA KEV is not listed, and SSVC rates exploitation as none and automatable as no - consistent with a moderate real-world risk despite the broad chipset deployment footprint.
Symlink-following race condition in GLib2's g_file_replace() allows a local attacker with write access to the destination directory to redirect privileged file writes to arbitrary files. When the G_FILE_CREATE_REPLACE_DESTINATION flag is set and creation of the .goutputstream-XXXXXX temporary file fails, GLib2 unlinks the destination and then recreates it without O_EXCL (exclusive creation) or symlink-safe open semantics, opening a TOCTOU race window. An attacker who wins this race by placing a symlink at the destination path can cause any process using this code path - potentially running with elevated privileges - to overwrite files the attacker cannot directly modify. No public exploit has been identified at time of analysis.
Insecure Direct Object Reference in Otter Blocks (WordPress plugin by Themeisle) through version 3.1.7 enables unauthenticated attackers to decouple the `product_id` and `price_id` parameters in a Stripe checkout URL, paying the price of a cheaper product while the `watch_checkout` function grants entitlement for the premium product whose ID was substituted. The flaw is exploitable against any WordPress site running the plugin with a Stripe checkout block configured. No public exploit has been identified at time of analysis, and a patch commit (changeset 3496611) has been applied to the plugin repository.
Open redirect in MISP ≤2.5.45 allows authenticated users to store a protocol-relative URL (e.g., //attacker.example) as a custom homepage setting, bypassing a path validation check that only required a leading /. On login, the post-login routing logic in UsersController and NewsController emits the stored value verbatim to the browser's Location header, redirecting victims to attacker-controlled external origins. No public exploit or active exploitation (CISA KEV) is identified; a vendor patch is confirmed in commit bd454f65a.
Stored XSS in MISP's dashboard Button widget (≤2.5.45) allows an authenticated low-privilege user to embed javascript: URLs or WHATWG-normalized backslash authority forms into widget configuration, which execute in the browser of any analyst who subsequently interacts with that widget. The root cause is a parser differential between PHP's URL handling and the WHATWG URL Standard implemented by browsers: forms such as \\evil.com or /\evil.com appear relative or host-matching under PHP's parse_url() but resolve to an off-origin authority in modern browsers. The upstream fix, confirmed via commit adf704e94 authored by the MISP maintainers at CIRCL, introduces a shared DashboardURLValidator that explicitly rejects raw backslashes, javascript: and other dangerous schemes, control characters, and unauthorized absolute origins. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 allows a low-privileged local user to escalate privileges by planting a malicious DLL in an untrusted path from which the application loads libraries. The flaw (CWE-269, Improper Privilege Management) requires local access, user interaction, and high attack complexity to exploit, and carries a scope change indicating impact beyond the vulnerable component itself. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch version 11.5.2605.01 is confirmed.
Heap-use-after-free in ImageMagick's PerlMagick Layer method allows an attacker supplying a crafted list of images to trigger memory access after deallocation, causing a crash. Affected versions include ImageMagick before 7.1.2-30 and the 6.9.x branch before 6.9.13-55. Impact is limited to denial of service (crash); no confidentiality or integrity compromise is possible from this flaw. No public exploit code or active exploitation has been identified at time of analysis.
Heap-use-after-free in ImageMagick's PerlMagick Perl binding crashes the host process via a crafted call to the GetList method. Affected versions span the 6.9.x branch before 6.9.13-55 and the 7.x branch before 7.1.2-30. Impact is limited to denial of service (process crash); no confidentiality or integrity compromise has been demonstrated. No public exploit code or active exploitation is identified at time of analysis.
Certificate hostname validation bypass in Dell Secure Connect Gateway (SCG) 5.0 enables unauthenticated remote attackers positioned on the network path to perform man-in-the-middle attacks against TLS-protected communications. The flaw (CWE-297) means SCG accepts certificates whose hostname does not match the server being contacted, allowing an adversary to impersonate backend endpoints and intercept or manipulate encrypted traffic. No public exploit code has been identified, and the vulnerability has not been added to the CISA KEV catalog; however, the network-accessible attack vector and absence of required privileges make opportunistic interception feasible for network-adjacent adversaries.
Plaintext credential storage in Dell Secure Connect Gateway 5.0 exposes passwords to local low-privileged attackers, leading to information disclosure. Both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified; the CVSS score of 4.7 Medium reflects the local-only, high-complexity attack path.
Stored XSS in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privilege users to inject AngularJS template expressions through issue assignee name fields, which are then evaluated as client-side JavaScript in the browsers of any user who views the affected issue or project board. The attack persists server-side, meaning every subsequent viewer triggers execution without further attacker interaction. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Local information disclosure in MediaTek's Audio Hardware Abstraction Layer (HAL) exposes sensitive data to an attacker who has already escalated to System privilege on an affected Android device. Improper input validation (CWE-35 path-traversal class) in the audio subsystem allows a System-level process to read confidentiality-critical data it should not have access to, with no user interaction required. No public exploit code and no CISA KEV listing exist at time of analysis; SSVC assigns exploitation status 'none' and technical impact 'partial', positioning this as a post-compromise data-harvesting primitive rather than a primary attack vector.
Local information disclosure in MediaTek's GeniZone trusted execution environment component allows a System-privileged attacker to read out-of-bounds memory due to a missing bounds check (CWE-125), potentially leaking confidential data from the TEE. The flaw affects seventeen MediaTek chipsets documented in the September 2026 security bulletin, and patches are available under IDs ALPS10867524 and ALPS10876355. No public exploit code or active exploitation has been identified at time of analysis, and SSVC assessment rates exploitation status as none.
Local information disclosure in MediaTek's Audio Hardware Abstraction Layer affects 63 distinct chipsets, from MT6761 to MT8910, allowing a process already operating at Android System privilege to bypass an absent permission check and extract audio HAL data without authorization. Patch ID ALPS11087632 (Issue MSV-8244) addresses the missing authorization gate, and MediaTek published remediation through the September 2026 security bulletin. SSVC assessment confirms no known exploitation and non-automatable attack path; no public exploit code identified at time of analysis.
Signed URL reuse in JetBrains YouTrack before 2026.2.18634 permits authenticated users to access restricted project icons they are not authorized to view. The flaw arises because signed URLs generated for project icon assets are not properly scoped or invalidated, allowing the same URL to be reused beyond its intended access context. No public exploit code has been identified and the vendor has issued a patch, making this a low-urgency but straightforward authorization control deficiency in a widely used issue tracker.
Authenticated users in JetBrains YouTrack before 2026.1.14047 can enumerate all group names via predefined search fields, bypassing group visibility permissions enforced elsewhere in the product. The flaw (CWE-862 Missing Authorization) means the access-control check applied to group visibility was not consistently applied to the predefined search field code path, leaking organizational structure to any logged-in user. No active exploitation has been identified and no public exploit code exists; CVSS 4.3 reflects the limited confidentiality impact.
Missing authorization (CWE-862) in JetBrains YouTrack before 2026.2.18769 allows any low-privileged authenticated user to read the email addresses of Helpdesk authorized reporters, who are external contacts registered to submit issues. The flaw bypasses the intended access control on the Helpdesk reporter roster, exposing personally identifiable contact data to users who should have no visibility into it. No public exploit is identified at time of analysis, and the vulnerability has been patched by JetBrains in version 2026.2.18769.
Insufficient data exists to characterize this vulnerability beyond its title. The only available intelligence is the description 'Memory Leak During Message Stringification' and a single Ubuntu vendor attribution. No affected product, version, CVSS score, CWE, CPE, references, or patch details have been provided. Memory leak vulnerabilities during message serialization or stringification operations typically result in heap exhaustion and denial of service, but the specific product, component, and exploitation context remain entirely unknown from available data.
Memory leak vulnerabilities in attribute certificate parsing expose affected cryptographic library users to potential denial-of-service via memory exhaustion. Attribute certificates (X.509v2 AC, RFC 5755) are distinct from public-key certificates and carry authorization attributes; parsing them from untrusted network input - for example during TLS handshakes or certificate validation workflows - would allow an unauthenticated remote attacker to trigger repeated leaks and exhaust process heap memory over time. Reported by Ubuntu, no active exploitation has been identified at time of analysis, and no CVSS score is yet assigned.
Memory exhaustion via PKCS#7 certificate processing affects an Ubuntu-packaged cryptographic component, allowing crafted certificate containers to gradually leak heap memory. The vulnerable component is reported by Ubuntu but the specific library (e.g., OpenSSL, GnuTLS, or another ASN.1/PKCS#7 parser) is not identified in available data. An attacker capable of delivering malicious PKCS#7 containers to a vulnerable service - such as a TLS endpoint, S/MIME mail processor, or package verification daemon - could trigger sustained memory growth leading to service degradation or crash.
The generic VCS webhook handler in JetBrains YouTrack before 2026.2.18634 fails open when no webhook secret is configured, allowing unauthenticated remote callers to trigger webhook processing without any valid credential check. This CWE-306 flaw means that deployments where the webhook secret field is intentionally or inadvertently left blank accept all inbound webhook payloads as legitimate, bypassing the shared-secret verification mechanism. No public exploit code has been identified and the vulnerability is not in CISA KEV; the low CVSS score of 3.7 with AC:H accurately reflects that exploitation is constrained to misconfigured instances.
HCL MyXalytics is susceptible to a low-severity denial-of-service condition via unrestricted character input in user-facing fields. Authenticated users can submit arbitrarily long strings into application inputs, potentially degrading system performance or availability due to absent input-length controls. No public exploit code exists and no active exploitation has been observed; the vendor CVSS score of 3.5 (Low) reflects limited real-world impact.
Content spoofing in HCL MyXalytics (CWE-451) enables an authenticated, low-privileged attacker to inject manipulated content into the application's user interface, causing it to appear as though the content originates from a trusted source. The vulnerability requires victim interaction - a user must view the attacker-influenced page - and carries a CVSS 3.5 (Low) base score, reflecting its constrained impact on integrity only with no confidentiality or availability effects. No public exploit code or active exploitation has been identified; the primary real-world concern is phishing and social engineering facilitated through the spoofed interface.
Improper input validation in HCL MyXalytics allows an authenticated low-privileged user to submit malicious or unexpected data through the application, causing unintended system behavior or minor integrity-affecting outcomes. The CVSS vector (PR:L/UI:R/I:L) indicates exploitation requires both an authenticated session and user interaction, with impact limited to low-level integrity modification and no confidentiality exposure. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows a high-privileged attacker to inject malicious scripts by uploading crafted project or organization icon files. When other authenticated users subsequently view the affected project or organization page, the stored payload executes in their browser context, enabling session data exposure or unauthorized in-application actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
IP spoofing via forged HTTP headers in JetBrains YouTrack before 2026.2.18634 allows unauthenticated remote attackers to bypass Bitbucket webhook source validation, causing YouTrack to process attacker-crafted webhook payloads as if they originated from a legitimate Bitbucket server. The root cause is CWE-291 - reliance on IP address for authentication - specifically trusting client-controlled headers such as X-Forwarded-For to gate webhook acceptance. No public exploit has been identified at time of analysis, and JetBrains has released a patched build.
IntelliJ IDEA before version 2026.2.2 leaks project metadata to JetBrains Marketplace due to a missing project-trust check, exposing potentially sensitive project information without developer consent. The flaw requires local access and user interaction - specifically, a developer must open an untrusted project for the metadata transmission to occur. No public exploit code exists and no active exploitation has been identified; the impact is limited to a low-severity confidentiality breach (CVSS 3.3).
Server-Side Request Forgery (SSRF) in JetBrains IntelliJ IDEA before version 2026.2.2 allows an attacker to probe internal network resources by embedding a malicious Kubernetes spec-source URL inside a crafted project file. When a developer opens the untrusted project, the IDE automatically fetches the attacker-controlled URL, causing outbound requests to arbitrary hosts reachable from the developer's machine. Impact is limited to partial confidentiality loss (C:L) - internal network topology or service responses may be disclosed - with no integrity or availability consequences. No public exploit code is identified and the vulnerability is not listed in CISA KEV at time of analysis.
Authorization bypass in JetBrains YouTrack's whiteboard feature allows authenticated read-only whiteboard users to modify canvas content they should only be able to view, by sending a crafted WebSocket message. Affected versions are all YouTrack releases before 2026.2.18634. The vulnerability stems from CWE-863 (Incorrect Authorization) - the server-side WebSocket handler fails to enforce the read-only permission boundary, accepting write operations from users who lack write privileges. No public exploit or active exploitation has been identified.
Terminal command input written to idea.log in JetBrains IntelliJ IDEA before 2026.2.2 exposes sensitive command-line strings to any local party that can read the IDE's diagnostic log. Classified as CWE-532 (Insertion of Sensitive Information into Log File), the flaw means that developers who type passwords, API keys, or tokens as command-line arguments in IntelliJ's integrated terminal inadvertently persist those secrets on disk in a plaintext log file. No public exploit has been identified at time of analysis, and the vendor-assigned CVSS score of 2.8 accurately reflects the constrained local-only, user-interaction-dependent attack surface.
Terminal escape sequence injection in ash-project Igniter (versions 0.8.1-0.8.3) allows a malicious or typosquatted hex.pm package publisher to forge the `mix igniter.install` confirmation panel by embedding ANSI cursor-movement and line-erase control sequences in publisher-controlled metadata fields such as the package description, owner usernames, version, and download counts. Developers relying on this panel as an anti-typosquatting safeguard are shown attacker-crafted content that conceals the real metadata, potentially deceiving them into approving a malicious dependency. A vendor patch is available in version 0.8.4; no public exploit and no CISA KEV listing have been identified at time of analysis.
Authenticated MISP users can enumerate the hidden organisation directory in deployments running version ≤2.5.45 where Security.hide_organisation_index_from_users is enabled, because multiple dashboard widgets failed to enforce the same authorization check that guards the standard /organisations/index endpoint. Three compounding weaknesses escalate the exposure beyond simple enumeration: missing checkPermissions() in NewOrgsWidget and OrgsContributorsGeneric allows any authenticated user to bypass the intended restriction; unrestricted find('all') database queries returned full organisation table rows including contacts and metadata through the JSON export code path; and a limit parameter flaw (limit=0 or negative values exploiting CakePHP DboSource behavior) effectively removed result pagination, potentially dumping the entire organisation table. CIRCL reported and patched the issue via commits 67892d90e and 5e333a159; no public exploit is identified at time of analysis.
Organisation metadata enumeration in MISP ≤2.5.45 is possible for authenticated users when the `Security.hide_organisation_index_from_users` configuration option is enabled, because the dashboard organisation picker queries the full organisation table without applying the same ACL conditions enforced by the standard organisation index and per-organisation view endpoints. The picker returns organisation ID, UUID, and name for all organisations, bypassing the visibility restriction. Patch commit 8ca4486af from CIRCL adds the missing `Organisation::createConditions()` call to scope picker results to organisations the requesting user is already authorised to see. No public exploit code has been identified and this CVE is not listed in CISA KEV.
Reflected cross-site scripting in sfturing ssm_pro's OrderController allows unauthenticated remote attackers to inject arbitrary JavaScript via the hospitalName, officesName, or doctorName parameters of the Order Endpoint. The affected codebase (up to commit 627f426331da8086ce8fff2017d65b1ddef384f8) is a Java-based hospital order management system that fails to sanitize user-supplied input before rendering it in the browser. An exploit has been published and is publicly available; the project maintainer has not yet responded to the disclosure despite being notified via a GitHub issue report.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated low-privilege remote attackers to manipulate the `id` parameter in `/pages/emp_edit1.php`, enabling arbitrary SQL query manipulation against the underlying database. A public proof-of-concept has been published via GitHub (E:P confirmed in CVSS 4.0 vector). The CVSS 4.0 base score of 2.1 reflects limited assessed impact (VC:L/VI:L/VA:L), though real-world SQL injection impact is database-permission-dependent and may exceed this baseline in misconfigured deployments.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate database queries through the `Customer` argument at `/pages/pos_transac.php?action=add`. The flaw enables unauthorized data reading and modification within the application database. A proof-of-concept exploit has been publicly published, lowering the bar for exploitation.
ULID first-character non-canonicality in ash_double_entry (Elixir) exposes a multi-spelling identifier aliasing flaw affecting versions 0.1.0 through 1.0.18. The AshDoubleEntry.ULID type encodes 128-bit identifiers as 26 Crockford base-32 characters, but the first character carries only 3 usable bits - canonical values are 0 through 7 - while the library's decode and validation functions accepted all 32 possible characters there, allowing 8, G, and R to silently decode to the identical 16-byte value as their canonical counterpart. An attacker who can submit caller-controlled ULIDs over an HTTP or API boundary can exploit this to circumvent application-layer string comparisons such as idempotency keys, deduplication guards, deny-list lookups, or audit-trail correlation, causing the server to resolve the intended record while treating the alternate spelling as a distinct key. No public exploit has been identified at time of analysis.
ImageMagick's video decoder contains a TOCTOU race condition that allows a local low-privileged attacker to bypass the policy.xml path write restrictions by swapping a symlink between the policy validation step and the actual file write operation. Both the ImageMagick 7 branch (before 7.1.2-30) and the legacy ImageMagick 6 branch (before 6.9.13-55) are affected, covering a wide range of deployed versions. No public exploit code exists and no active exploitation has been confirmed; the CVSS 4.0 score of 2.0 accurately reflects the local-access and race-condition constraints.
Path policy enforcement in ImageMagick before 7.1.2-30 on Windows can be circumvented by a local attacker exploiting a TOCTOU symlink race condition (CWE-59), granting unauthorized read or write access to files explicitly blocked by the ImageMagick policy.xml security configuration. The race window opens between the moment ImageMagick validates the symlink target against its policy and the subsequent actual filesystem I/O call, allowing an attacker to atomically swap the symlink to a policy-denied destination in that interval. No public exploit code is identified at time of analysis, CISA has not listed this in KEV, and the CVSS 4.0 base score of 1.0 accurately reflects the high attack complexity and constrained local-only vector.
Stack buffer underflow in polkit's read_cookie() function, introduced as a regression by the fix for CVE-2026-4897, exposes Linux systems to potential memory corruption and privilege escalation via polkit's D-Bus authentication path. Systems that applied the CVE-2026-4897 patch are specifically affected, meaning the remediation for a prior vulnerability created new exposure. No public exploit code has been identified at time of analysis, but the target (polkit, a setuid/privileged authorization daemon) makes this class of memory corruption high-consequence.
CVE-2026-71223 is reported via Ubuntu's security channels, but no description, CVSS score, CWE classification, or affected product detail is available in the current dataset. The vulnerability cannot be characterized beyond its Ubuntu vendor attribution. Security teams should consult Ubuntu Security Notices (USN) or the Ubuntu CVE tracker directly for authoritative details before assessing exposure or priority.
CVE-2026-85218 is attributed to Ubuntu per the vendor intelligence source, but no public description, CVSS score, CWE classification, or technical detail has been released at the time of this analysis. The vulnerability type, affected component, attack vector, and impact are all unknown. No meaningful synthesis of exploitation conditions or attacker capability is possible from available data alone.