Stored cross-site scripting in the Aruba HiSpeed Cache WordPress plugin (all versions ≤ 3.0.14) allows authenticated Contributor-level users to inject persistent JavaScript via post content that executes in any visitor's browser when they access the affected page. The scope change in the CVSS vector (S:C) correctly reflects that execution occurs in victims' browser contexts - enabling session hijacking, credential theft, or further site compromise against administrators who visit the page. No public exploit code and no active exploitation have been identified at time of analysis.
Stored cross-site scripting in the Easy Google Fonts WordPress plugin (versions ≤ 2.0.4) allows authenticated attackers with Author-level access to inject arbitrary JavaScript that executes in victims' browsers. The flaw stems from the plugin registering the `control_selectors` post meta field with `show_in_rest: true` and no `sanitize_callback`, then writing that unsanitized value directly into `<style>` tags rendered on the frontend. No public exploit or KEV listing is present at time of analysis, but the low privilege bar (Author) and automatic execution on page load make this an elevated concern for multi-author WordPress deployments.
Stored cross-site scripting in the Ninja Forms - Scheduled Exports WordPress plugin (all versions through 3.0.3) allows any authenticated subscriber-level user to inject persistent malicious scripts via the REST API parameters interval, format, and emailTo, which then execute in the browsers of any user who visits the affected page. The root cause is a REST endpoint registered without a permission_callback that relies solely on nonce validation rather than WordPress capability checks, meaning the lowest default user role can reach it. No public exploit has been identified at time of analysis, but the subscriber-level entry barrier makes this meaningful on any site with open user registration.
Stored cross-site scripting in the Builderall for WordPress plugin (versions ≤3.0.2) allows authenticated contributors to inject persistent JavaScript via the Photo Module's unsanitized 'attributes' setting, executing against any subsequent visitor to an affected page. The attack requires only contributor-level WordPress credentials and results in scope-changed impact against victim browsers, enabling session hijacking or malicious redirects. No public exploit code or active exploitation has been identified; Wordfence reported the issue with precise source-code references across multiple affected PHP files.
Stored XSS in the Builderall for WordPress plugin (all versions through 3.0.2) enables authenticated contributors to inject persistent JavaScript via the 'bg_video_service_url' page-builder setting, with payloads executing in the browsers of any subsequent visitor - including administrators - who loads an affected page. The flaw is rooted in absent input sanitization and output escaping across the plugin's AJAX handling, model storage, and rendering pipeline, as confirmed by Wordfence and Trac source references. No public exploit code has been identified at time of analysis, and exploitation is constrained by the requirement for at least contributor-level WordPress credentials.
Concrete CMS versions prior to 9.5.3 allow deactivated or email-unvalidated users to bypass account-status enforcement by authenticating through the OAuth callback path. When a user whose account has been deactivated or whose email address has not been verified holds an existing OAuth provider binding, the CMS completes the OAuth handshake, records a login event, and issues a fully-authenticated session without verifying whether the account is permitted to log in. No public exploit has been identified at time of analysis; the vendor (Concrete CMS security team) assigned a CVSS 4.0 score of 6.3 reflecting the constrained attack preconditions.
Unauthenticated event metadata disclosure in Concrete CMS 9.5.2 and earlier allows any visitor to enumerate private calendar event details via a sequential IDOR on the frontend lightbox endpoint. The controller at /ccm/calendar/view_event/{bID}/{occurrence_id} loads occurrence records directly from attacker-supplied integer IDs without verifying that the occurrence belongs to the calendar block referenced by bID or that the caller holds read permission on the owning calendar. This enables systematic disclosure of event titles, dates, descriptions, page links, and configured attributes across all calendars on the installation, including those intended to be access-restricted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Hash type confusion in Concrete CMS (below 9.5.3) allows cross-purpose token redemption: a long-lived registration hash (60-day expiry) can be submitted to the password-change endpoint to take over an account, or a password-reset hash can activate an unverified account. This is an amplifier vulnerability - exploitation requires the attacker to first acquire a valid hash through a separate channel such as email interception, log exposure, or SSRF against an internal mail relay, making it a force-multiplier for hash disclosure rather than a standalone attack path. No public exploit is identified and the vendor-assigned CVSS 4.0 score of 6.3 with AC:H and AT:P reflects the conditional nature of exploitation.
Path traversal (Zip Slip class) in rclone's archive ZIP backend permits arbitrary file writes outside the intended destination directory when processing a malicious ZIP archive. Versions 1.72.0 through 1.75.0 are affected: the readZip function in backend/archive/zip/zip.go trusts central directory filenames from untrusted ZIP sources without confining path.Clean output to the archive namespace, allowing entries like ../../etc/cron.d/evil to propagate as Object.Remote() values and be written by fs/sync and fs/operations to attacker-chosen filesystem locations. A separate bug used strings.HasPrefix without a path separator, causing root 'foo' to incorrectly match sibling entries named 'foobar'. Vendor-released patch is available in version 1.75.1; no public exploit identified at time of analysis.
Broken access control in the IMPress for IDX Broker WordPress plugin (versions <= 3.3.0) allows authenticated subscriber-level users to perform actions or access data that should be restricted to higher-privileged roles. The flaw stems from missing authorization checks (CWE-862), enabling low-privilege WordPress accounts - such as those automatically created for site visitors or registered users - to cross privilege boundaries within the plugin's functionality. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
JavaScript injection in Evolution email client allows a remote, unauthenticated attacker to execute arbitrary JavaScript within the mail-viewing context by sending a specially crafted HTML email containing a spoofed vCard control. When the victim clicks the vCard control, Evolution's trusted JavaScript handler incorrectly places an attacker-controlled javascript: URL into an iframe's src attribute, bypassing Evolution's own script-execution protections for email content. The vulnerability is classified CWE-84 (improper neutralization of encoded URI schemes), and exploitation requires one user interaction gesture - clicking the vCard element - making it realistic against any Evolution user on a RHEL or GNOME desktop. No public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected XSS in the Form Maker by 10Web WordPress plugin (all versions ≤1.15.46) allows unauthenticated attackers to inject arbitrary JavaScript into WordPress admin pages via the unsanitized `bulk_action` parameter in the Submissions controller. Successful exploitation requires social-engineering an authenticated WordPress admin into clicking a crafted link, enabling session hijacking or unauthorized admin actions in the victim's browser context. No public exploit code or CISA KEV listing has been identified; version 1.15.47 resolves the issue per confirmed WordPress SVN changesets.
NoSQL injection in the MongoDB Go Driver's GridFS component allows an authenticated, low-privileged user who can influence the file identifier forwarded by an application to trigger mass deletion of all file chunks in the affected GridFS bucket. The GridFS delete and lookup operations fail to enforce that a caller-supplied identifier is a literal value, so a structured query object (e.g., a BSON operator expression) is passed directly to MongoDB's query engine as a filter condition rather than a point lookup. No public exploit has been identified at time of analysis; the CVSS 4.0 metrics confirm high integrity and availability impact (VI:H, VA:H) against a specific attack condition (AT:P), scoring 6.1.
NoSQL query injection in the GridFS component of the MongoDB Ruby Driver allows an authenticated low-privileged user to exceed their intended file access scope. When an application passes a caller-influenced structured identifier - such as a Ruby Hash containing MongoDB query operators - to GridFS retrieval or deletion operations without coercing it to a literal BSON type, the driver forwards the structure directly to the MongoDB query layer, which interprets it as a query condition. Exploitation can yield unauthorized read access to stored GridFS file chunks belonging to other identifiers, or mass deletion of all chunks within the affected bucket, permanently rendering all stored files unreadable. No public exploit has been identified at time of analysis.
NoSQL injection in the GridFS component of the MongoDB Python Driver allows an authenticated attacker who controls a caller-supplied file identifier to inject MongoDB query operators instead of literal identifiers. Depending on the affected operation, exploitation can expose stored file content beyond the intended target (reads), permanently destroy all GridFS file chunks in the affected bucket (deletes), or corrupt stored file metadata by renaming the wrong file (renames). No public exploit has been identified at time of analysis, and no KEV listing exists; the CVSS 4.0 score of 6.1 reflects the authentication requirement and the specific attack condition that the application must pass user-controlled identifiers directly to GridFS APIs.
GridFS NoSQL injection in the MongoDB C Driver (libmongoc) enables authenticated users with influence over file identifier parameters to either access file content beyond their intended authorization or destroy all GridFS file chunks in the affected bucket, rendering stored data permanently unreadable. The root cause (CWE-943) is the driver's failure to distinguish between structured query operators and literal identifier values in GridFS operations, allowing attacker-controlled input to redirect or broaden MongoDB queries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high integrity and availability sub-scores in the CVSS 4.0 vector indicate genuinely severe outcomes in vulnerable deployments.
NoSQL injection (CWE-943) in the GridFS component of the MongoDB C++ Driver allows an authenticated low-privileged user who can influence file identifiers to read unauthorized stored file content or cause mass deletion of all GridFS chunks in an affected bucket, rendering stored data unreadable. The flaw arises because caller-supplied structured file identifiers are not neutralized before being evaluated as query conditions rather than literal values. No public exploit has been identified at time of analysis, but the potential for irreversible, bucket-wide data destruction makes this a significant integrity and availability risk for any C++ application using GridFS where user-controlled identifiers reach the driver API.
NoSQL injection in the GridFS component of the MongoDB Java Driver allows an authenticated low-privilege user who can influence the file identifier passed by an affected application to break out of the intended document scope. By supplying a structured identifier containing MongoDB query operators instead of a literal file ID, the attacker can read file chunks belonging to other owners, delete all file chunks in the affected GridFS bucket (rendering stored content permanently unreadable), or rename an arbitrary stored file rather than the intended target. No public exploit code or CISA KEV entry has been identified at time of analysis, and exploitation requires a specific application code pattern that forwards user-controlled input directly to GridFS operations without sanitization.
NoSQL injection in the GridFS component of the MongoDB C# Driver allows an authenticated low-privilege attacker who can influence file identifiers passed by an affected application to execute query-condition attacks against GridFS bucket operations. Exploitation can yield unauthorized read access to stored file content, complete destruction of all file chunks in the affected bucket (rendering all stored content unrecoverable), or misdirection of rename operations to unintended files. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 6.1 reflects the AT:P (attack-requirements present) constraint that the vulnerable application must forward user-controlled identifiers to the driver without sanitization.
NoSQL injection in the MongoDB Rust Driver's GridFS component allows an authenticated, low-privileged user to supply a crafted file identifier that is evaluated as a query predicate rather than a literal scalar value. Depending on the operation targeted, this can expose GridFS file content belonging to unintended records within the bucket, or - in the most destructive path - cause all file chunks in the affected bucket to be deleted, permanently rendering stored file content unreadable. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue is acknowledged by MongoDB via JIRA issue RUST-2469.
NoSQL injection (CWE-943) in the MongoDB PHP Library's GridFS component allows a low-privileged authenticated user who can influence the file identifier parameter to achieve three distinct impacts: reading file content beyond the intended target, deleting all GridFS file chunks within a bucket (rendering stored files unrecoverable), or renaming an unintended file. The CVSS 4.0 vector (AT:P) confirms exploitation depends on the target application routing attacker-influenced input directly into GridFS operations without sanitization. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds heap read in Netskope Client's Endpoint DLP (EPDLP) service allows a local unprivileged user to crash the kernel driver handler by sending a specially crafted, unbounded message, temporarily suspending DLP policy enforcement. The flaw additionally leaks per-boot kernel memory layout information, providing an attacker a potential ASLR-bypass primitive. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis.
Use-after-free in Suricata 8.0.0-8.0.4 causes an engine crash when a malicious detection rule chains decompress transforms (gunzip or zlib_deflate with max-size exceeding 4096) after another transform, allowing the pipeline to read from a freed inspection buffer during subsequent network traffic processing. The net effect is a reliable denial-of-service: once the offending rule is loaded, any matching network traffic will crash the Suricata process regardless of traffic content. No public exploit or active KEV listing exists at time of analysis. Vendor-released patch is available in version 8.0.5.
Use-after-free in Suricata's inspection-buffer helper crashes the IDS/IPS engine, yielding a network-exploitable denial-of-service against any deployment running rules that chain the `dotprefix` transform after another transform. Affected versions prior to 7.0.16 (stable) and 8.0.5 include all prior 7.x and 8.x releases. No public exploit code and no CISA KEV listing have been identified; exploitation requires an attacker to know or guess that the target's ruleset matches the vulnerable pattern, and then craft traffic to trigger the reallocation path.
Uncontrolled recursion in Red Hat Service Interconnect 2's skupper-router AMQP field parser allows a remote unauthenticated attacker to crash the router by sending a specially crafted network message, resulting in denial of service for all services relying on the interconnected network. The vulnerability stems from an absent recursion depth limit during AMQP message parsing, causing stack memory exhaustion. No public exploit code has been identified at time of analysis, and the CVSS AC:H rating reflects the need to craft a payload that precisely triggers the unbounded recursion path.
Multiple local privilege escalation flaws in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow any authenticated local user to elevate privileges to NT AUTHORITY\SYSTEM or root. The root cause is CWE-426 (Untrusted Search Path), a class of vulnerability commonly manifesting as DLL search-order hijacking or PATH manipulation that the privileged VPN client process follows. No public exploit is known at time of analysis, and Palo Alto has released fixed versions; iOS, Android, and ChromeOS deployments are explicitly not affected.
XML External Entity injection in the OpenNMS Meridian and Horizon XML collector allows an attacker who controls a monitored endpoint's HTTP response - via a compromised host or a network man-in-the-middle position - to force the OpenNMS service to resolve external entities, exfiltrating files readable by the service account, including database credentials. Affected versions span all releases of both Meridian and Horizon prior to the fixed versions. No public exploit identified at time of analysis; vendor-released patches are available in Meridian 2024.3.13 / 2025.0.10 and Horizon 36.0.4.
Calendar event authorization in Concrete CMS 8.3.0-9.5.2 is bypassed because the event edit dialog validates the actor's permissions against a calendar identifier supplied in the HTTP request rather than the calendar that actually owns the targeted event occurrence. An authenticated user holding 'Add Event' rights on any single calendar can read and overwrite events across all other calendars in the installation, and delete individual event occurrences; publishing the injected version as the live-approved revision additionally requires approve_calendar_event workflow rights or an auto-approving workflow. Vendor-released patch is available in version 9.5.3; no public exploit has been identified at time of analysis.
Suricata 8.0.0 through 8.0.4 fails to consistently enforce the configured Lua sandbox memory ceiling (`security.lua.max-bytes`), allowing certain Lua allocation patterns to grow unbounded and exhaust host memory. The root cause (CWE-770) is an incomplete enforcement path for new allocations in the sandbox, introduced in the 8.0.0 branch. An attacker whose traffic is inspected by a sensor with Lua rules enabled can craft packets that trigger the vulnerable allocation patterns, causing a denial-of-service condition; no public exploit has been identified at time of analysis.
Unauthenticated command execution is possible against the career-ops local web dashboard (web/) because its /api routes - which spawn child processes and write user files - accepted cross-origin requests without validating the Sec-Fetch-Site or Origin header, and without enforcing loopback-only binding. Two independent attack paths exist: a drive-by CSRF where any malicious page in another browser tab POSTs silently to http://localhost:<port>/api, and a LAN-direct path if the dev server is bound to 0.0.0.0. Fixed in web-v0.8.0; the published npm package is unaffected because the web/ directory is excluded from it. No public exploit or CISA KEV listing exists at time of analysis.
DLP policy enforcement bypass in Palo Alto Networks Prisma Access Agent on Windows allows a low-privileged local user to circumvent configured EndPoint Data Loss Prevention controls and exfiltrate sensitive data that configured policy should block. The vulnerability is explicitly scoped to Windows deployments only - macOS, Linux, iOS, Android, and Chrome OS agents are confirmed unaffected by the vendor. No public exploit code is identified at time of analysis, and the CVSS 4.0 exploitation metric (E:U) indicates no observed active exploitation.
Integer overflow in the MongoDB C Driver's SASL authentication path allows an abnormally large username to bypass a size check via arithmetic wrap-around, writing past the end of a fixed-size buffer and crashing the embedding application. Only applications compiled with the optional external SASL backend and configured to use it are reachable; the impact is limited to availability with no confidentiality or integrity consequence per CVSS VC:N/VI:N. No public exploit has been identified at time of analysis.
Symlink-following in crun's container runtime allows a low-privileged container user to redirect stdio file descriptors to host files and alter their ownership. Affecting crun 1.29.1 and earlier, the flaw manifests when crun reopens /dev/null for stdio after pivot_root: if the container's /dev/null has been replaced with a symlink to a host path, crun resolves the symlink outside the container namespace and chowns the target file to the container UID. No vendor-released patch is available at time of analysis. No public exploit identified at time of analysis.
Integrity escape in crun 1.29.1 and earlier allows a low-privileged local attacker to redirect /dev/console to an attacker-controlled filesystem path, breaking container boundary isolation. The flaw (CWE-59, improper link resolution) triggers during terminal setup when a container configuration omits a dedicated /dev mount, including via the read-only-rootfs bind-mount fallback path, resulting in a scope-changed integrity impact on the host. No vendor-released patch exists at time of analysis, and no public exploit has been identified.
CAPTCHA verification bypass in the Simple Cloudflare Turnstile WordPress plugin (versions ≤ 1.42.1) allows unauthenticated network attackers to spoof successful challenge completion and circumvent bot-protection controls on any WordPress form protected by this plugin. The root cause is classified as CWE-290 (Authentication Bypass by Spoofing), meaning the plugin fails to adequately verify the integrity or authenticity of the Turnstile challenge response before granting form access. Reported by Patchstack, no active exploitation is confirmed at time of analysis.
Stored XSS in AnythingLLM 1.16.1 and earlier enables a manager-role user to inject arbitrary JavaScript into the application homepage by writing a malicious meta_page_title or meta_page_favicon value via /api/admin/system-preferences - MetaGenerator renders those values into page HTML without any HTML entity encoding. When an administrator visits the homepage, the injected script executes in their browser session and can exfiltrate the administrator JWT token. With the stolen JWT, the attacker escalates fully to administrator level, gaining the ability to create API keys, read or alter all workspace and chat data, delete users, and execute any other administrative operation. No fixed release version is available; only an upstream commit patch exists.
Stored cross-site scripting in FairSketch Rise CRM 3.9.6 allows an authenticated administrator to inject persistent JavaScript into an item's title field, which executes in the browser of every client user who subsequently visits the affected store page. The scope-changing nature of the attack means a single malicious admin-level injection silently exposes all visiting clients to session hijacking, account takeover, and phishing without any per-victim interaction beyond a routine page visit. A GitHub repository exists under the CVE identifier (https://github.com/moksh-nfsu/CVE-2026-36392), suggesting proof-of-concept code may be publicly accessible.
Authorization bypass in Consul's catalog deregistration path allows authenticated low-privileged callers to delete services, checks, or nodes that were imported from a peered cluster without holding authority over that peer origin. Affecting Consul through 2.0.3 and Consul Enterprise through 1.21.17/1.22.11/2.0.3, any ACL token holder with `service:write` or `node:write` permissions can exploit the missing peer-origin authority check (CWE-863) to disrupt service discovery across cluster peering relationships. No public exploit code exists and this is not in CISA KEV; the CVSS 5.4 Medium score correctly reflects the real constraint of requiring a valid low-privileged ACL token and an active peering configuration.
Stored cross-site scripting in LIBRID/LIBREF (versions 2.01.0.2183 through 10092026) by Ankaref Innovation and Technology Inc. allows low-privileged authenticated users to inject persistent malicious scripts that execute in victims' browsers when affected pages are viewed. The vulnerability carries a scope change, enabling a limited user account to compromise sessions of higher-privileged users such as administrators. The vendor did not respond to TR-CERT's disclosure, and no patch has been issued; no public exploit or active exploitation has been identified at time of analysis.
Stored cross-site scripting in LIBRID/LIBREF (Ankaref Innovation and Technology Inc.) allows a low-privileged authenticated attacker to inject persistent malicious scripts that execute in the browsers of other users visiting affected pages. The vulnerability spans all versions from 2.01.0.2183 through build 10092026 and was disclosed by TR-CERT (advisory TR-26-1064). No vendor patch is available - the vendor did not respond to coordinated disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Angular's compiler and runtime (@angular/core, @angular/compiler) prior to versions 20.3.28, 21.2.20, and 22.1.0 allows unauthenticated remote attackers (with user interaction) to execute arbitrary JavaScript by bypassing built-in sanitization for security-sensitive host bindings. The compiler incorrectly derived SecurityContext from the declaring directive's CSS selector rather than the actual concrete host element, causing it to emit the wrong sanitizer-or no sanitizer at all-for attributes such as href, src, action, xlink:href, and data. Vendor-released patches exist for all three active release lines; no public exploit or KEV listing has been identified at time of analysis.
Server-side request forgery (SSRF) in IBM WebSphere Application Server 8.5 and 9.0 enables unauthenticated remote attackers to induce the server to issue arbitrary outbound HTTP requests, potentially reaching internal network resources not exposed externally. The vulnerability carries a CVSS 5.3 medium score, reflecting the constrained confidentiality impact (C:L) and absence of integrity or availability effects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though SSRF in enterprise middleware is a well-understood technique for internal network reconnaissance and cloud metadata exposure.
Missing authentication in VPN configuration management on TP-Link 4G LTE routers (Archer MR600 v2/v3/v5 and TL-MR6400 v8) permits an unauthenticated adjacent-network attacker to read and overwrite VPN credentials and tunnel configuration without any valid credentials. The vendor's CVSS 4.0 vector (AV:A) indicates the attack surface is adjacent-network rather than fully internet-routable, constraining exposure to attackers with local LAN, Wi-Fi, or cellular-segment access. No public exploit has been identified at time of analysis; a vendor-released patch is available via firmware update.
Authorization bypass in BurgerEditor 3.0.0 through 3.4.0 allows authenticated low-privileged users to alter page content outside their permitted scope by manipulating user-controlled key parameters. Rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), the flaw permits any logged-in user to substitute a legitimate resource identifier with one belonging to another user or content area, bypassing ownership checks server-side. No public exploit code or active exploitation has been identified; the CVSS 4.3 Medium rating reflects the authentication prerequisite and limited integrity-only impact.
Header aliasing in Traefik's reverse proxy middleware allows a low-privilege authenticated user to smuggle dot-form header aliases (e.g., X.Authenticated.User) past ForwardAuth and other security middleware, causing CGI, WSGI, PHP, or NGINX backends to read the attacker-supplied value instead of the identity Traefik asserted. In tested PHP 8.2 SAPI over HTTP/1, Go's lexical header ordering makes the attacker-supplied value win deterministically, enabling privilege escalation to any role or user identity the backend trusts via headers. This is an incomplete fix for GHSA-x677-9fxg-v5c5, which previously blocked only the underscore form; fixes exist in v2.11.56 and v3.7.12 but require explicit opt-in configuration to take effect. No public exploit or CISA KEV listing identified at time of analysis.
Authorization bypass in SHIRASAGI's groupware shared file feature allows an authenticated low-privileged user to retrieve files belonging to groups or users other than their own by manipulating a user-controlled resource key (CWE-639 IDOR). Reported by JPCERT/CC and published as JVN#37476837, the issue affects all tracked SHIRASAGI versions (cpe:2.3:a:shirasagi_project:shirasagi:*) with a CVSS score of 4.3 reflecting constrained confidentiality-only impact and a required authenticated session. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site request forgery in AVideo's default-enabled CustomizeUser plugin allows an unauthenticated remote attacker to forge the ExtraSubscribers count on any user channel by inducing a logged-in administrator to load a crafted page containing an img tag. The root cause is that the setSubscribers.json.php endpoint accepts state-mutating GET requests via the $_REQUEST superglobal without any CSRF token validation, because autoCSRFGuard() is scoped exclusively to POST requests and the mutation path bypasses ObjectYPT::save()/isUntrustedRequest() checks. No vendor-released patch was available at the time of reporting; the issue affects all AVideo commits through c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23). No public exploit identified at time of analysis.
Cross-site request forgery in Concrete CMS 9.x through 9.5.2 allows an unauthenticated attacker to forge board-content modifications on behalf of any authenticated user who holds board-edit permission. The saveTemplate() action in the Boards custom slot dialog controller omits anti-CSRF token validation, permitting a crafted HTTP request to write attacker-controlled slot and template data to a board under the victim's authority. No public exploit has been identified at time of analysis, and the vendor has released version 9.5.3 as the fix.
Remote denial-of-service in IBM WebSphere Application Server 8.5 and 9.0 allows an unauthenticated network attacker to degrade service availability by sending a specially crafted request that triggers uncontrolled resource consumption (CWE-400). The CVSS A:L metric indicates partial rather than complete service disruption, limiting but not eliminating operational impact. IBM has released a patch via advisory 7286610; no public exploit code or active exploitation has been identified at time of analysis.
Denial of service in rclone prior to 1.75.1 allows unauthenticated remote attackers to crash individual HTTP or WebDAV connections by sending a Range request with an offset exceeding a symlink target's length. When `--links` or `links=true` is enabled, symlinks are exposed as `.rclonelink` pseudo-objects whose content is the target path string; the `openTranslatedLink` function sliced that string using a caller-controlled offset without bounds validation, producing a deterministic Go slice-bounds panic. Go's `net/http` recovers panics per connection rather than per process, limiting impact to request-level denial of service. No public exploit has been identified and the vendor-released fix is available in version 1.75.1.