DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to manipulate client-side DOM processing and execute arbitrary JavaScript in a victim's browser session. Affected deployments span AEM 6.5 up to version 6.5.24, AEM 6.5 LTS up to SP2, and AEM as a Cloud Service up to release 2026.7.0. Exploitation requires convincing an authenticated victim to visit a specially crafted URL; scope is changed because the injected script runs in the victim's browser context outside the AEM application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis; Adobe has issued patches under advisory APSB26-98.
Stored XSS in Adobe Experience Manager allows authenticated low-privileged attackers to inject malicious JavaScript into vulnerable form fields that later executes in victims' browsers when they visit the affected page. Affected deployments span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Adobe has addressed this in security bulletin APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged, network-accessible attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Scope change (S:C) confirms the attack crosses from the application server context into the victim's browser security context, enabling session hijacking, credential theft, or further phishing within the authenticated AEM environment. No public exploit or KEV listing is present at time of analysis; CVSS 5.4 (Medium) reflects the privilege and user-interaction barriers that limit opportunistic mass exploitation.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to persistently inject malicious JavaScript into vulnerable form fields within the CMS. When any victim - including administrators - browses to the page containing the injected payload, the script executes in their browser session under the AEM application's trust boundary, with scope changing to the victim's context. Affected versions span AEM 6.5 ≤6.5.24, AEM as a Cloud Service ≤2026.7.0, and AEM 6.5 LTS ≤SP2, with remediation available via Adobe advisory APSB26-98. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of users who visit the affected pages. Affected deployments include AEM 6.5 through version 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the scope-changed CVSS vector indicates meaningful session and interface impact when exploited.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated low-privileged attackers to execute arbitrary JavaScript in victims' browsers by crafting pages that manipulate the DOM environment. Affected deployments include AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The scope-changed CVSS vector signals that script execution can cross component or trust boundaries within the victim's browser session. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0 allows low-privileged authenticated attackers to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Exploitation requires the victim to visit a crafted webpage, placing this in a social-engineering or insider-threat scenario rather than direct network exploitation. The scope change (S:C) in the CVSS vector confirms the JavaScript executes outside AEM's security boundary in the victim's browser context. No public exploit or CISA KEV listing is identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the DOM environment via a crafted webpage. Affected deployments span AEM as a Cloud Service through July 2026, AEM 6.5 through version 6.5.24, and AEM 6.5 LTS through SP2. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 5.4 reflects the authentication prerequisite and mandatory victim interaction, though the scope-changed rating indicates the injected script can affect resources outside the AEM application boundary.
DOM-based cross-site scripting in Adobe Experience Manager allows authenticated users to execute malicious JavaScript within their browser context by visiting a crafted webpage. The vulnerability affects AEM as a Cloud Service (up to version 2026.7.0) and on-premises versions (6.5 up to 6.5.24, 6.5 LTS through SP2). With scope changed, the attack can extend beyond the vulnerable component to affect other AEM systems or data. No public exploit code or active exploitation confirmed at time of analysis.
DOM-based cross-site scripting in Adobe Experience Manager 6.5 releases through version 6.5.24 and Cloud Service deployments through 2026.7.0 allows authenticated attackers to execute malicious JavaScript in victims' browsers by injecting attacker-controlled DOM manipulation code into shared content. Successful exploitation harvests session tokens, performs unauthorized actions as the victim, and accesses sensitive data within the victim's authorized scope. The attack requires both attacker authentication and victim user interaction with crafted pages; no active exploitation or public exploits identified at analysis time.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM as a Cloud Service through 2026.7.0 and on-premises AEM 6.5 through 6.5.24 and LTS through SP2. Exploitation requires that a low-privileged attacker socially engineer a target user into visiting a specially crafted URL or page; vendor advisory APSB26-98 confirms the issue and provides patched releases. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute malicious JavaScript within a victim's browser session by manipulating client-side DOM data without server-side interaction. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed nature of the flaw means successful exploitation can affect browser resources beyond the AEM application boundary; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser by inducing them to visit a crafted URL. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 on-premises (≤6.5.24), as confirmed by EUVD-2026-74147 and Adobe APSB26-98. The scope-change rating reflects that injected script runs in the victim's browser security context, enabling session theft, credential harvesting, or UI redress attacks against higher-privileged users. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute arbitrary JavaScript within victim browsers by crafting a malicious URL that manipulates the client-side DOM environment. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed CVSS vector (S:C) indicates the injected script can reach resources beyond the AEM application's own security boundary. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager 6.5 (through 6.5.24), 6.5 LTS (through SP2), and Cloud Service (through 2026.7.0) enables an authenticated attacker to inject malicious JavaScript that executes in a victim's browser by manipulating client-side DOM state. The scope change (S:C) in the CVSS vector reflects that the injected script runs within the AEM domain's browser context, potentially reaching session tokens, saved credentials, or authoring capabilities beyond the attacker's original privilege level. Exploitation requires the attacker to hold a valid low-privilege AEM account and to socially engineer a victim into visiting a crafted URL; no public exploit code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL that manipulates the DOM environment. Affected across AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). The scope-changed CVSS vector confirms the script executes outside the originating security context, enabling session theft, credential harvesting, or actions-on-behalf-of-victim against the AEM interface. No public exploit code or CISA KEV listing identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating client-side DOM sinks via a crafted URL. Scope change (S:C) means the injected script executes outside AEM's own origin context, enabling session token theft or privilege escalation against higher-privileged AEM users. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, per Adobe advisory APSB26-98. No public exploit or active exploitation is identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables an authenticated low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by tricking them into visiting a specially crafted URL. The vulnerability spans AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, covering a broad enterprise install base. The CVSS scope-change flag (S:C) is the most significant risk amplifier, indicating injected scripts can reach security contexts beyond the originating AEM application. No public exploit or CISA KEV listing exists at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker with low privileges to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Because scope is changed (S:C per CVSS), the injected script can reach browser resources beyond the AEM origin, enabling session token theft or unauthorized actions performed as the victim. No public exploit code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged remote attacker to execute malicious JavaScript in a victim's browser by manipulating the DOM environment of a crafted webpage. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through the 2026.7.0 release, and AEM 6.5 LTS through SP2. No public exploit or active exploitation has been identified at time of analysis; Adobe has issued advisory APSB26-98 with patch availability.
Improper access control (CWE-284) in Fortinet FortiSOAR allows an authenticated low-privilege user to escalate their privileges within the platform via an undisclosed attack vector. Both PaaS and on-premise deployments across FortiSOAR versions 7.3 through 7.6.6 are affected. No public exploit or CISA KEV listing is present at time of analysis; the Fortinet PSIRT advisory FG-IR-26-164 is the sole authoritative source.
Use-after-free in Windows Distributed File System (DFS) enables an authenticated network attacker to crash the DFS service, resulting in denial of file-sharing access across affected Windows client and server versions. The CVSS vector (AV:N/AC:H/PR:L) confirms network reachability but constrains exploitation to low-privilege authenticated accounts under high-complexity conditions. Microsoft has released patches covering the full affected range from Windows 10 1607 through Windows Server 2025; no public exploit code or active exploitation has been identified at time of analysis.
Unauthorized plugin update execution in the Bookly scheduling plugin for WordPress (all versions through 27.2) allows any authenticated Subscriber-level user to force co-installed plugins whose main entry point is named `main.php` to update to their latest version, bypassing WordPress's standard `update_plugins` capability gate. The root cause is a missing capability check (CWE-862) on the `updateAddon` function in `lib/PluginsUpdater.php`, as identified by Wordfence and confirmed by the WordPress plugin SVN diff. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the low authentication bar makes it relevant on open-registration or multi-tenant WordPress sites.
Unauthorized information disclosure in TYPO3 CMS backend localization wizard exposes records and content elements outside a low-privileged user's permitted access scope. Multiple AJAX endpoints in the PHP LocalizationController - used to drive the multi-step translation wizard - accept arbitrary record UIDs without performing authorization checks, allowing any authenticated backend user to query metadata about content they should not be able to see. All actively maintained TYPO3 major branches (10.x through 14.x) are affected, vendor patches are available, and no public exploit or active exploitation has been identified at time of analysis.
Path traversal in n8n's Git node allows authenticated workflow editors to exfiltrate the contents of arbitrary local git repositories readable by the n8n process. The flaw exists in `packages/nodes-base/nodes/Git/GenericFunctions.ts`: `setUpstream` writes an unvalidated `branch.<branch>.remote` value into the repository configuration, and a subsequent `fetch` or `pull` resolves the remote from that persisted config rather than the validated `repository` parameter - a TOCTOU-style validation bypass classified as CWE-22. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 1.123.76, 2.37.7, and 2.38.2.
Token introspection cache in multi-tenant Quarkus OIDC configurations permits cross-tenant authorization bypass, allowing a bearer token issued by one OIDC provider to authenticate against endpoints secured by a different, independent OIDC provider. Affected are Enterprise Build of Quarkus versions 3.27.1-3.27.5 and 3.33.1-3.33.3 when both multi-tenant OIDC routing and the optional token introspection cache are active simultaneously. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV.
Missing authorization controls in n8n's workflow REST API expose all active workflow IDs, version IDs, and activation error details to any authenticated instance member, regardless of workflow sharing permissions. The flaw spans two surfaces: the /rest/active-workflows endpoint and the real-time push notification service (workflow-push-notifier.service.ts), which broadcasts workflow lifecycle events to clients without per-resource access checks. Patched releases 1.123.76, 2.37.7, and 2.38.2 are available; no public exploit or active exploitation has been identified.
XML External Entity (XXE) injection in NanoXML 2.2.3 allows low-privileged network attackers to trigger unauthorized interaction with external systems or read internal resources, because the library enables external entity processing by default with no opt-out enforced at the API level. The affected product is identified under CPE cpe:2.3:a:cyberelf:nanoxml:*:*:*:*:*:*:*:* and was reported by TCS-CERT with an ENISA EUVD entry (EUVD-2026-72683). No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 5.3 reflects a moderate, subsequent-system confidentiality impact rather than direct system compromise.
Heap out-of-bounds read in MongoDB Server's query planning component allows an authenticated database user with read/write privileges to disclose partial server heap memory contents. Crafted query operations cause the server to read beyond allocated heap buffer boundaries during query plan construction, with leaked memory fragments surfacing through diagnostic query statistics output. Affected releases span MongoDB Server 7.0.0-7.0.40, 8.0.0-8.0.29, and 8.3.0-8.3.8, with fixed versions available across all three branches per vendor advisory SERVER-131562.
Stack buffer over-read in PX4 Autopilot through v1.17.0 exposes stack memory via the netman system command's interface name handling. Supplying an interface name of 74 bytes or more via the -i option bypasses missing length validation, causing reads beyond allocated buffer boundaries; the over-read data leaks to console output and may also be written into persistent network configuration files, risking both information disclosure and config corruption across reboots. No public exploit or active exploitation has been identified, but the upstream fix is available as a merged GitHub PR and commit.
Server-side request forgery in Apache Impala 2.0.0 through 4.5.1 allows SQL-authenticated users to coerce the Impala daemon into issuing arbitrary HTTP or file-system GET requests by specifying a malicious URL in the `avro.schema.url` table property. Internal service responses reachable by Impala but not directly by the attacker are partially exposed through SQL parsing error messages, enabling internal network reconnaissance, cloud metadata enumeration, and local file disclosure. Reported by zhaokaifei of ChinaTelecom, the vulnerability is resolved in version 4.5.2; no public exploit code or CISA KEV listing has been identified at time of analysis.
Missing authorization on the GET /hardware/{asset}/barcode endpoint in Snipe-IT before 8.7.0 allows any authenticated user to enumerate asset IDs and retrieve barcodes for arbitrary assets, including those belonging to other tenants and soft-deleted records. Authenticated attackers can iterate predictable integer asset IDs to harvest cross-company asset tags and inventory data in multi-tenant deployments, violating tenant isolation and soft-delete access controls. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the fix is version 8.7.0, confirmed by the vendor GHSA advisory.
Cross-site request forgery in WWBN AVideo's CustomizeUser plugin allows an unauthenticated attacker to cause an authenticated administrator to lose administrative access. The `swapUser.json.php` endpoint accepts `users_id` via GET requests without CSRF token validation - the global `autoCSRFGuard()` guard is only applied to POST requests - meaning an img tag or crafted link embedded on any attacker-controlled page can silently invoke `User::swapUser()` in the context of a logged-in admin's browser session. Additionally, the JSON response leaks the target user's `session_id`, adding a secondary information disclosure impact. No patch was available at time of publication and the vulnerable plugin is enabled by default.
Credential exposure in Okta Hyperdrive Agent versions 1.4.0 through 1.5.1 allows any local user with log file read access to obtain live SAML bearer assertions logged in cleartext on every successful MFA completion. Because SAML bearer assertions function as authentication credentials, a local attacker can replay them to authenticate as the victim user to any service provider trusting the Okta identity provider. No public exploit has been identified at time of analysis, but the vulnerability is trivially exploitable once log file access is obtained.
Null pointer dereference in Windows Schannel - Microsoft's native TLS/SSL security package - allows an authenticated network attacker to crash the affected service on Windows Server 2022, Windows Server 2025, and Windows 11 versions 23H2 through 26H1. The CVSS vector (AV:N/AC:H/PR:L) places this as a moderate-severity denial-of-service requiring valid credentials and non-trivial triggering conditions, with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Counter integrity corruption in Snipe-IT before 8.7.0 allows authenticated users to manipulate the assets.requests_counter field through two distinct abuse patterns: repeatedly invoking the cancel checkout endpoint without an active request drives the counter negative, while submitting duplicate checkout requests inflates it with phantom demand. The impact is confined to the integrity of the admin asset-request queue - administrators see a falsified count of pending checkout requests, which can cause misallocation of assets. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis.
Broken access control in the Smart Polling configuration endpoint of Nozomi Networks' web management interface allows a low-privileged authenticated user to remotely modify discovery configuration that should be restricted to higher-privileged roles. The Smart Polling feature governs active network discovery of OT/ICS assets, so unauthorized modification can degrade or blind the platform's asset visibility - a significant operational impact in industrial security monitoring contexts. No public exploit or CISA KEV listing is present at time of analysis; the vulnerability is internally reported by Nozomi Networks' own product security team (NN-2026:17-01).
Credential interception via man-in-the-middle attack is possible against Nozomi Networks Guardian sensors using the Smart Polling feature, which establishes encrypted connections to polled OT/ICS devices without validating the remote host's identity and provides no configuration option to enable such validation. An attacker with network positioning between the sensor and a target device can impersonate the device, capture the authentication credentials transmitted during polling sessions, and replay those credentials to authenticate directly against the device or other devices sharing the same credentials. This enables unauthorized access, data manipulation, and operational disruption of monitored industrial devices. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
NTLM credential hash theft from Windows users running ASUS Armoury Crate is possible when a user visits an attacker-controlled web page that exploits the application's permissive cross-domain (CORS) policy. The local Armoury Crate service accepts cross-origin requests from untrusted web origins, allowing malicious JavaScript to inject a UNC path into a service call; Windows then automatically initiates SMB authentication to the attacker's server, transmitting the user's NTLMv2 hash without further interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the underlying coercion technique is well-understood and the attack requires only a single user click.
Missing authorization in XenForo before 2.3.13 permits any ACP administrator to access and submit the force-agreement controller irrespective of their assigned permission set, bypassing the option permission declared in the navigation configuration. An ACP admin with insufficient privileges can update the global policy last-updated timestamp, triggering a site-wide re-consent prompt that forces every registered user to re-accept the privacy policy or terms of service. Vendor-released patch 2.3.13 is available; no public exploit or active exploitation has been identified at time of analysis.
Cross-site scripting in XenForo's dynamic redirect handler allows unauthenticated attackers to inject and execute arbitrary JavaScript in the board origin against authenticated users. The attack abuses a URI parsing confusion flaw: crafting a javascript: URI with the legitimate board hostname embedded in the authority component and percent-encoded newlines (%0a) to evade server-side host validation filters. When a logged-in user is induced to perform a Follow action via the crafted URL, attacker-controlled JavaScript executes in the victim's browser under the XenForo board's origin. No public exploit or KEV listing identified at time of analysis; vendor patch released in 2.3.13.
Authorization bypass in XenForo's ACP cache-rebuild dispatcher (versions prior to 2.3.13) allows a limited administrator holding only the rebuildCache permission to invoke arbitrary job classes-including the approval queue job-under any user identity. By crafting a POST body with an arbitrary job class name and actor user ID, the attacker can approve queued user registrations without holding approval-queue or moderator permissions, while the moderation log falsely attributes actions to an impersonated account. No public exploit code has been identified at time of analysis; a vendor-released patch is available in XenForo 2.3.13.
Missing authorization in n8n's role assignment API allows authenticated project managers to enumerate member names and email addresses from projects they lack permission to access. The /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members endpoints in packages/cli/src/controllers/role.controller.ts verified only the role management permission (role:manageProject) but omitted the required project:list scope check, enabling cross-project member enumeration. Versions prior to 2.37.7 (stable branch) and 2.38.2 (prerelease branch) are affected; vendor-released patches are available.
Query statistics serialization on the MongoDB sharded cluster router (mongos) fails to apply redaction to search query literals, exposing sensitive data to holders of the monitoring privilege. An improper conditional check in the serialization logic causes the redaction mechanism to be bypassed specifically for search queries transiting the router, leaving raw query text - which may contain PII, credentials embedded in queries, or proprietary data - stored and accessible via the queryStats interface. Affected versions are MongoDB Server 8.3.0 through 8.3.8; a fix is available in 8.3.9. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Unauthenticated information disclosure in XenForo before 2.3.13 exposes private content metadata through the unfurl link-preview endpoint, which performs no session, user identity, or visibility checks on retrieved records. An unauthenticated remote attacker can enumerate predictable auto-increment integer IDs to retrieve rendered preview HTML, original URLs, and query strings generated from private conversations and other access-controlled forum areas. No public exploit has been identified at time of analysis, but the attack is trivially automatable through sequential ID iteration; the issue is fixed in XenForo 2.3.13.
Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture Kernel Drivers allows a local non-privileged process to access already-freed GPU memory through otherwise-valid GPU memory processing operations. The flaw spans a wide range of driver releases across all three GPU families - covering most modern Arm Mali GPU generations deployed in Android SoCs from r41p0 onward. No public exploit code or active exploitation has been identified; EPSS sits at 0.14% (4th percentile), and the vulnerability is not listed in the CISA KEV catalog.
Use-after-free memory access in Arm's Valhall and 5th Gen GPU Architecture userspace drivers allows a non-privileged local process - including browser-hosted WebGL or WebGPU workloads - to read and write already-freed GPU memory regions, yielding limited confidentiality and integrity compromise. Arm reported this issue internally; no active exploitation has been identified. The wide deployment of Arm Mali GPU hardware in mobile and embedded SoCs makes the affected driver versions relevant across a large device population, though the limited CVSS impact scores constrain severity.
Unverified ownership checks in Fortinet FortiClientWindows allow a locally authenticated administrator to perform improper access control operations, resulting in high availability impact and minor integrity modification of the endpoint security client. Affected versions are FortiClientWindows 7.4.0 through 7.4.7 and 7.2.0 through 7.2.15 on Windows endpoints. No public exploit or active exploitation has been identified; the attack surface is substantially constrained by the local-only, high-privilege prerequisite.
Login CSRF in a Nozomi Networks web-based platform - affecting both standard credential and SAML authentication flows - allows a network-accessible attacker holding a valid account to trick a victim into silently authenticating under the attacker's identity, causing the victim's subsequent actions to be attributed to the attacker's account in the audit log. The root cause is the absence of anti-CSRF token validation on the login endpoints themselves, a class of flaw distinct from conventional post-login CSRF. The CVSS 4.0 score of 5.1 reflects constrained prerequisites (attacker credential ownership and passive victim interaction); no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side template injection (SSTI) in Nozomi Networks Guardian and CMC Dashboard functionality (versions prior to 26.3.0) allows an authenticated low-privilege user to embed malicious template payloads in dashboard definitions. When a victim - potentially one with elevated privileges - views or imports the crafted dashboard, the payload executes in their browser context, enabling modification of application data or disruption of the monitoring platform. No public exploit has been identified and the vulnerability is not listed in CISA KEV; a vendor-released patch is available.