WP Travel plugin versions before 12.0.2 for WordPress exposes an Insecure Direct Object Reference (IDOR) flaw in the bank-deposit slip submission endpoint, enabling unauthenticated remote attackers who possess a target customer's email address to fraudulently alter that customer's booking payment state and attach files to their booking without any ownership validation. The root cause is the plugin's reliance on email address alone as a booking identifier with no session or token-based ownership check. Publicly available exploit code exists via the WPScan advisory, though EPSS sits at a very low 0.15% (4th percentile) and SSVC reports no active exploitation; vendor-released patch is confirmed in version 12.0.2.
Improper access control in the WP Travel WordPress plugin before 12.0.2 exposes booking payment records to unauthenticated manipulation via a missing authorization check on one branch of the bank-deposit payment handler. Any remote attacker who knows a target customer's email address can reset that booking's payment status to unpaid and permanently erase the associated deposit-reconciliation data, causing financial record corruption for travel agencies using bank-deposit workflows. A publicly available proof-of-concept exists per the WPScan advisory, though EPSS (0.15%, 4th percentile) and SSVC exploitation status of 'none' indicate no widespread active exploitation at time of analysis.
Resource pack handler in PocketMine-MP before 5.44.2 allows connected clients to repeatedly trigger pre-spawn progression by sending multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status, causing the server to instantiate duplicate Player objects and amplify both memory consumption and network traffic. The affected code path in ResourcePacksPacketHandler.php lacked a re-entry guard to prevent handler transitions from executing more than once per session. A publicly available exploit exists via the GHSA-pg53-p7qp-65cv GitHub security advisory, though real-world impact is constrained by a CVSS 4.0 score of 2.3 and the requirement for authenticated client connections.
Cross-site scripting in Rizwan17's open-source PHP inventory-management-system allows remote attackers to inject arbitrary JavaScript via unsanitized category_name, brand_name, or product_name parameters handled by the List Handler in includes/DBOperation.php. A publicly available proof-of-concept (GitHub issue #12) demonstrates exploitation. No patch exists - the maintainer has not responded to the responsible disclosure report - and the project uses rolling releases with no versioned fix available.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 exposes enterprise environments to unauthorized information disclosure via a network-based man-in-the-middle attack. Both the Appliance form factor (versions prior to 5.36.00.16) and the Application form factor (versions prior to 5.36.00.00) are affected. An unauthenticated remote attacker who can intercept network traffic between the SCG and a remote endpoint could present a forged or invalid certificate that the product accepts, allowing interception of sensitive communications. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and a vendor-released patch is available.
Stored Cross-Site Scripting in LF Edge eKuiper (versions prior to 2.4.0) allows an authenticated API user to inject arbitrary HTML or JavaScript into external service names, which execute in any administrator's browser when the administrative web UI renders the unescaped identifier. Successful exploitation can lead to session token exfiltration or unauthorized browser-context actions on behalf of the viewing administrator. A detailed public proof-of-concept exists in GitHub Security Advisory GHSA-g8rh-fjm6-h2h9; no active exploitation has been confirmed by CISA KEV at time of analysis.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker occupying a network interception position to bypass TLS certificate checks, enabling unauthorized access to protected communications. Both the Appliance (versions prior to 5.36.00.16) and Application (versions prior to 5.36.00.00) variants are affected. Dell has released fixed versions and published advisory DSA-2026-382; no public exploit or active exploitation has been identified at time of analysis.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows a network-positioned unauthenticated attacker to intercept TLS communications, potentially gaining unauthorized access to data in transit. The Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are both affected. CVSS 3.7 reflects the high attack complexity requirement - a man-in-the-middle network position - and a limited confidentiality-only impact, with no integrity or availability consequence. No public exploit or CISA KEV listing exists at time of analysis.
Improper certificate validation in Dell Secure Connect Gateway 5.0 (both Appliance and Application variants) exposes organizations to protection mechanism bypass by unauthenticated remote attackers positioned on the network path. Affected are all Appliance versions prior to 5.36.00.16 and all Application versions prior to 5.36.00.00, as confirmed by Dell advisory DSA-2026-382 and EUVD-2026-75026. The CVSS 3.7 Low score reflects high attack complexity - requiring man-in-the-middle positioning - with only limited confidentiality impact; no public exploit or active exploitation has been identified at time of analysis.
Cyrus IMAP before 3.12.4 exposes private calendar events and contacts to partially-privileged authenticated users through a broken ACL enforcement path in the CalDAV/CardDAV multiget REPORT handler. An attacker who already holds some shared DAV access to a target user's calendar or address book can include hrefs of unshared resources in a calendar-multiget or addressbook-multiget REPORT request, causing the server to return those resources without enforcing per-href access controls. The vulnerability is fixed across the 3.8, 3.10, and 3.12 release branches; no public exploit or CISA KEV listing has been identified.
Cyrus IMAP before 3.12.4 permits an authenticated sharee who holds the `maySetKeywords` ACL right on a shared mailbox to overwrite that mailbox's RFC 6154 `specialuse` annotation via a JMAP `Mailbox/set` request, a capability that should be restricted to the mailbox owner. By reassigning the shared mailbox to a system role such as Archive or Snoozed, the sharee can cause the victim's mail client to route messages into the now-shared folder, disclosing content beyond what was originally granted. No public exploit has been identified at time of analysis; vendor-released patches are available across three supported stable branches.
Unauthorized system log modification in Dell PowerScale OneFS (versions 9.5.0.0-9.7.1.15, 9.8.0.0-9.13.1.0, and all versions prior to 9.15.0.0) results from an Incorrect Authorization flaw (CWE-863) that allows a low-privileged attacker with adjacency to the cluster management network to tamper with audit logs. The direct impact is limited to low-integrity loss-no confidentiality or availability exposure is confirmed-but log tampering poses a meaningful forensic risk by enabling attackers to obscure prior activity. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Memory read outside the renderer sandbox in Google Chrome's GPU component affects all desktop versions prior to 153.0.8010.36. An uninitialized GPU resource (CWE-908) enables an attacker who has already gained code execution inside the renderer process to read stale memory contents from outside the sandbox boundary via a crafted HTML page, exposing browser process memory or heap addresses. No active exploitation has been confirmed (not in CISA KEV) and EPSS is 0.24% at the 16th percentile, consistent with the high-complexity, two-stage attack prerequisite.
Uninitialized resource use in Chrome's Media component (CVE-2026-87456) enables a renderer-compromised attacker to read memory outside the Chrome sandbox via a crafted HTML page, fixed in version 153.0.8010.36. This is a post-compromise, second-stage information disclosure capability rather than a standalone entry-point vulnerability - successful exploitation requires the attacker to have already achieved code execution within the renderer process through a separate exploit. CVSS 3.4 (Low), Chromium-rated Medium, with EPSS at 0.23% and no public exploit or CISA KEV entry.
Uninitialized GPU resource in Google Chrome for Android (prior to 153.0.8010.36) allows a renderer-compromised attacker to read memory outside the browser sandbox via a crafted HTML page. This is a second-stage vulnerability - it requires the renderer process to already be compromised, meaning it operates as a chained exploit component rather than an independent attack path. No public exploit has been identified; EPSS is 0.19% (9th percentile), and the Chromium team rates severity as Medium, consistent with the constrained impact and high prerequisite bar.
Least Privilege Violation in Dell Secure Connect Gateway (SCG) 5.0 allows a locally authenticated high-privileged attacker to perform unauthorized operations beyond their intended permission scope, resulting in low-impact integrity and availability degradation. Affected are both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00). No public exploit or active exploitation has been identified; the low CVSS score of 3.4 reflects the constrained attack surface requiring local, high-privileged access.
Dell Secure Connect Gateway 5.0 Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) contain a CWE-250 Execution with Unnecessary Privileges flaw in which internal components operate with OS-level permissions exceeding what their function requires, allowing a locally authenticated high-privileged attacker to perform unauthorized modifications to system integrity and availability. The affected products are Dell's enterprise remote support gateway platform used to facilitate secure ProSupport connectivity in production environments. No public exploit code has been identified and the CVSS 3.4 Low rating reflects the substantial access prerequisites - local access and a pre-existing high-privilege account - sharply limiting opportunistic exploitation potential.
Least Privilege Violation in Dell Secure Connect Gateway 5.0 allows a locally authenticated, high-privileged attacker to perform actions beyond their authorized scope, resulting in unauthorized integrity and availability impact. Affected deployments include Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00, with a vendor-released patch available via Dell Security Advisory DSA-2026-382. No public exploit code or CISA KEV listing has been identified at time of analysis.
Dell Secure Connect Gateway (SCG) 5.0 - both the Appliance and Application editions - writes sensitive information into files or directories that are externally accessible on the local system (CWE-538). A local attacker with low privileges who can read those files gains access to information they should not be authorized to see. No public exploit code exists and no active exploitation has been reported; the low CVSS base score of 3.3 reflects the local, low-privilege access requirement and limited confidentiality impact.
Sensitive information insertion into log files in Dell Secure Connect Gateway (SCG) 5.0 exposes confidential data to local low-privileged users. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are affected, with the vulnerability covered under Dell advisory DSA-2026-382 alongside additional CVEs. No public exploit code or active exploitation has been identified, and the low CVSS score of 3.3 accurately reflects the constrained local access requirement and limited confidentiality impact.
Sensitive information insertion into log files in Dell Secure Connect Gateway (SCG) 5.0 exposes confidential data to local low-privileged users. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected. A local attacker with standard OS-level access can read log files containing sensitive data, potentially including credentials or configuration secrets. No active exploitation or public proof-of-concept has been identified at time of analysis.
Dell Secure Connect Gateway (SCG) 5.0 exposes sensitive system information through uncleared debug artifacts accessible to local low-privileged users, affecting both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00). The root cause is CWE-1258: debug data containing sensitive system details is not purged and remains readable on the local filesystem. No public exploit code has been identified and exploitation requires local authenticated access, making real-world impact limited to insider threat scenarios or post-compromise reconnaissance.
Prerender's confused deputy flaw in Google Chrome prior to 153.0.8010.36 enables an attacker who has already compromised the renderer process to bypass the web Same-Origin Policy via a crafted HTML page, potentially exposing limited cross-origin data. This is a chaining vulnerability: it requires a prior renderer compromise and user interaction, not a standalone exploit path. Google rated it Chromium 'Medium', consistent with the CVSS 3.1 base score of 3.1 (Low); no public exploit code exists and it is not listed in CISA KEV.
CORS authorization bypass in Google Chrome prior to 153.0.8010.36 allows an attacker who has already achieved renderer process compromise to circumvent the browser's same-origin policy and read limited cross-origin response data. The flaw (CWE-862, Missing Authorization) is a chaining primitive: it requires both user interaction via a crafted HTML page and a pre-existing renderer exploit, making it a second-stage capability rather than an independent entry point. No public exploit code has been identified, EPSS is 0.31% (24th percentile), and the vulnerability is not listed in CISA KEV, all consistent with its constrained real-world utility.
Incorrect authorization in Chrome's PushAPI (all versions prior to 153.0.8010.36) permits a remote attacker who has already obtained a renderer process compromise to bypass the web origin policy, potentially gaining access to push subscription data belonging to other web origins. This is a chained, secondary-stage vulnerability - it extends a renderer compromise rather than providing initial access, and its confidentiality impact is limited to PushAPI subscription metadata. No public exploit exists and EPSS is low at 0.29%; a vendor patch is available in the stable channel release 153.0.8010.36.
CORS authorization bypass in Google Chrome prior to 153.0.8010.36 enables a remote attacker - who has already compromised the renderer process - to circumvent the browser's web origin policy via a crafted HTML page. The vulnerability is classified CWE-863 (Incorrect Authorization) and is confined to a post-renderer-compromise scenario, meaning it functions as a second-stage primitive rather than an initial access vector. CVSS 3.1 and an EPSS of 0.26% (18th percentile) reflect the high exploitation complexity; no public exploit or CISA KEV listing exists at time of analysis.
Use-after-free in Chrome's V8 JavaScript engine enables an attacker with a pre-compromised renderer process to read arbitrary memory within the sandbox boundaries via a crafted HTML page. Affected versions are Chrome prior to 153.0.8010.36 on all desktop platforms. Unlike most Chrome UAF findings that achieve sandbox escape, this vulnerability is constrained to intra-sandbox memory disclosure (C:L, S:U), making it a stepping-stone primitive rather than a standalone critical exploit. No public exploit code or CISA KEV listing exists at time of analysis.
Cross-origin data disclosure in Chrome's WebMCP component before 153.0.8010.36 enables a renderer-compromised attacker to exfiltrate cross-origin page data via a crafted HTML page. This is a second-stage vulnerability in a multi-step exploit chain - it does not enable initial access but amplifies the impact of a prior renderer compromise by breaking the same-origin boundary through the WebMCP interface. With a CVSS score of 3.1, EPSS at 0.24% (15th percentile), no KEV listing, and no public exploit identified, real-world risk is low except in targeted attack chains pairing this with a separate, more severe renderer exploit.
Cross-origin data leakage in the Chrome Downloads subsystem exposes sensitive information to attackers who have already established renderer process compromise. Chrome versions prior to 153.0.8010.36 are affected; exploitation requires a renderer-compromised context combined with user interaction via a crafted HTML page. Google rated this 'Medium' internally; the CVSS 3.1 score of 3.1 reflects its role as a second-stage exploitation step rather than a standalone critical flaw. No public exploit code or CISA KEV listing exists at time of analysis.
Cross-origin data leakage in Google Chrome's Network component prior to version 153.0.8010.36 allows remote attackers to infer information about cross-origin resources through observable behavioral discrepancies (CWE-203). Exploitation requires a victim to visit a crafted HTML page (UI:R) and involves high attack complexity (AC:H), indicating that reliable exploitation depends on meeting specific preconditions in the victim's browser or network environment. With an EPSS of 0.21% (11th percentile), no CISA KEV listing, and no confirmed public exploit, real-world risk is low despite the network-accessible attack vector.
Heap memory disclosure in Cyrus IMAP before 3.12.4 allows authenticated users to leak adjacent heap contents via a crafted JMAP blob ID. By issuing a JMAP blob download request using the internal format H<emailid>-<index> with an index value that exceeds the length of the blob_headers array, an attacker triggers an out-of-bounds read (CWE-125) and receives whatever heap memory follows the array in the server's response. The CVSS 3.1 score of 3.1 (Low) reflects the authentication requirement, high attack complexity, and limited confidentiality impact; no public exploit has been identified at time of analysis.
Web origin policy bypass in Google Chrome's Mobile component on iOS allows a remote attacker to read cross-origin content via a race condition triggered through a crafted HTML page. Affected versions are all Chrome releases prior to 153.0.8010.36 on iOS. Exploitation requires social engineering to induce the target to visit a malicious page, and the race condition's timing dependency (AC:H) limits reliable exploitation, though a successful attack permits limited cross-origin data disclosure. No public exploit identified at time of analysis.
Incorrect GPU authorization in Google Chrome on macOS (prior to 153.0.8010.36) allows an attacker who has already compromised the renderer process to read cross-origin data by directing the victim to a crafted HTML page. This is a second-stage, chained vulnerability - not an initial access primitive - requiring prior renderer compromise and user interaction, which constrains its practical exploitability. Chromium rates this Medium, consistent with the CVSS 3.1 base score and the strictly limited confidentiality-only impact.
Incorrect authorization in the ServiceWorker component of Google Chrome prior to 153.0.8010.36 enables a remote attacker who has already compromised the renderer process to bypass the browser's web origin policy via a crafted HTML page. Exploitation is constrained by two hard prerequisites: a prior renderer process compromise and user interaction, reflected accurately in the CVSS 3.1 Low score and Chromium's own 'Low' severity classification. No public exploit code or active exploitation (CISA KEV) has been identified; SSVC rates exploitation status as none and automatable as no.
Missing authorization in Chrome's WebUI component (prior to 153.0.8010.36) allows an attacker who has already compromised the renderer process to bypass the web origin policy via a crafted HTML page, potentially reading cross-origin content. This is a chained post-exploitation technique requiring a separately-achieved renderer compromise as a hard prerequisite, not a standalone initial-access vector. No public exploit code has been identified and the EPSS score of 0.19% (9th percentile) reflects low mass-exploitation probability; Google rates the Chromium severity as High, which diverges significantly from the CVSS 3.1 base score of 3.1.
Cross-origin data exfiltration in Google Chrome's CORS implementation prior to 153.0.8010.36 is exploitable only as a second-stage technique by an attacker who has already compromised the renderer process, allowing them to read data from foreign origins the victim is authenticated to via a crafted HTML page. With a CVSS of 3.1, EPSS of 0.17% (7th percentile), no CISA KEV listing, and no public exploit code identified, this represents a low standalone risk - its relevance is as a data-harvesting primitive chained after a renderer RCE. Chromium rated it 'Medium,' consistent with the constrained exploitation path.
Cross-origin data disclosure in Google Chrome's FileSystem component allows a remote attacker who has already compromised the renderer process to bypass authorization checks and read data from origins other than the attacker-controlled page. Affected versions are all Chrome releases prior to 153.0.8010.36. This is a post-renderer-compromise information disclosure step, not an initial entry point; no public exploit code has been identified and EPSS sits at 0.17% (6th percentile), consistent with its role as a chained component rather than a standalone threat.
Case-insensitive username comparisons in two code paths of the CUPS scheduler - printer ACL validation and private-attribute filtering - allow an authenticated adjacent-network attacker to bypass username-based access controls in configurations that rely on those ACLs. The bypass exposes private print attributes to users who should be excluded by ACL policy. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation has been identified at time of analysis, consistent with the low CVSS base score of 3.0.
Out-of-bounds memory read in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows prior to 153.0.8010.36 allows a local attacker to read memory beyond the Chrome sandbox boundary via a crafted local program. The vulnerability carries a CVSS score of only 2.7 (Low), reflecting significant exploitation constraints: local access, high attack complexity, required user interaction, and a partial confidentiality-only impact with no integrity or availability consequence. No public exploit has been identified, EPSS sits at the 4th percentile (0.15%), and SSVC classifies exploitation status as none with non-automatable, partial technical impact.
Uncleared debug information in Dell Secure Connect Gateway (SCG) 5.0 exposes sensitive system data to physically present unauthenticated attackers. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are affected, per CPE data and the Dell advisory DSA-2026-382. The CVSS vector (AV:P) confirms exploitation is constrained to physical access, yielding a low overall severity of 2.4, and no public exploit or active exploitation has been identified at time of analysis.
Snipe-IT 8.6.3 and earlier silently produce false compliance artifacts when the configured storage backend fails to write acceptance evidence files. In Account\AcceptanceController::store(), the return value of Storage::put() is never checked; if the storage layer returns false rather than throwing an exception, execution proceeds unconditionally to $acceptance->accept(), which stamps the record as complete, records signature and PDF filenames, creates the audit-log entry, and dispatches notifications - all referencing evidence files that were never persisted. The practical result is a compliance record whose audit trail appears valid but whose supporting documentation does not exist, a material risk in regulated environments using Snipe-IT for EULA acknowledgement or equipment-receipt workflows. No public exploit code exists and no active exploitation has been identified; the CVSS 4.0 score of 2.3 reflects the low real-world risk.
Race condition in Snipe-IT ≤8.6.3 allows two concurrent checkout requests for the same available asset to both pass the availability check and both commit, corrupting the audit trail with duplicate checkout-history rows, a doubled checkout_counter, and two spurious CheckoutableCheckedOut events. Authenticated users holding the assets.checkout permission can trigger this by issuing precisely timed concurrent HTTP requests. The visible asset assignment remains singular, so the primary tracking record is not altered, but reconciliation, utilization reporting, and ITSM integrations that rely on event counts or the checkout_counter are affected. No public exploit has been identified and CVSS 4.0 scores this 2.1 (Low).
Local information disclosure in Samsung Mobile's Watch Plugin for Android allows attackers with physical or local software access to read sensitive data from the device. Affected versions are all Watch Plugin releases prior to the Android Watch 17 patch, as confirmed by the Samsung Mobile security advisory. No active exploitation (not in CISA KEV) and no public proof-of-concept code are identified at time of analysis; the CVSS 4.0 score of 2.1 accurately reflects the constrained local-only, low-confidentiality-impact nature of this vulnerability.