NFSD's seq-lock-like rq_status_counter protocol in nfsd_dispatch() is broken on three non-success exit paths - cache-hit (RC_REPLY), drop (RC_DROPIT/RQ_DROPME), and encode-error - leaving the counter permanently odd and exposing actively-mutating kernel fields to the lockless reader in nfsd_nl_rpc_status_get_dumpit(). A local low-privileged user on an NFS server who can poll NFSD RPC status via the netlink interface while requests traverse these paths can trigger out-of-bounds reads past the 8-element inline ops array embedded in the rqstp structure, disclosing kernel memory or causing a kernel panic. No public exploit exists (EPSS 0.19%), but the 6.12 LTS series appears unpatched, with fixes confined to 7.2.4 and 7.3-rc1.
Stale opcnt in nfsd4_release_compoundargs() enables an out-of-bounds slab read that leaks kernel memory to userspace via the netlink RPC status interface on Linux NFS servers. When nfsd_dispatch() hits an error path that leaves rq_status_counter at an odd value, the RPC status dumpit handler reads up to 16 entries from args->ops[] - but the inline iops[] array has only 8 elements and is the last field in the struct, so indices 8-15 access adjacent slab memory belonging to whatever object follows in the allocator. The fix zeroes opcnt unconditionally at compound-args release time. No public exploit or active exploitation has been identified; EPSS is 0.17%.
Integer underflow in the Linux kernel CIFS client's cifs_remap_file_range() corrupts SMB protocol fields and inverts write-range operations when a clone-to-EOF request is made with a source offset exceeding the file's current size. A local user with low privileges and access to a CIFS-mounted filesystem can trigger this by supplying len=0 and an offset beyond i_size in a FICLONERANGE ioctl, sending a malformed FSCTL_DUPLICATE_EXTENTS_TO_FILE request to the SMB server and disrupting filemap_write_and_wait_range() with an inverted range. No public exploit has been identified at time of analysis; vendor-released patches are available in stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Out-of-bounds heap read latency exists in the Linux kernel's `platform/x86/hp-bioscfg` ACPI package parser, where five `hp_populate_*_elements_from_package()` parsers derive their iteration bounds from `elements[0]->string.length` (the name field's byte length) rather than `obj->package.count` (the real package element count). Currently unexploitable because `hp_init_bios_package_attribute()` enforces a strict element-count pre-check, the flaw becomes reachable the moment an anticipated upstream relaxation of that check lands - at which point a local authenticated user on HP hardware could induce the parsers to read past the end of the ACPI `elements[]` array, disclosing kernel heap memory or crashing the kernel. Patches have been backported to stable series 6.12.109, 6.18.50, and 7.2.4; no public exploit exists (EPSS 0.17%).
Stack memory disclosure and integer underflow in the Linux kernel's IPMI ipmb subsystem allow a local low-privileged attacker with write access to the IPMB device node to read uninitialized kernel stack bytes and trigger a buffer length underflow in `ipmb_write()`. The root cause is that `ipmb_write()` parses message fields prior to validating the length byte, so a zero-length or undersized write crosses into adjacent stack memory. CVSS rates confidentiality impact as High (stack leak) and availability impact as High (SMBus block-write length underflow), while EPSS at 0.17% reflects the niche attack surface. No public exploit or active exploitation has been identified.
Stale fscache data exposure in the Linux kernel CIFS client allows a local low-privileged user with access to a mounted SMB share to read file data that should have been discarded after an O_TRUNC open. When cifs_do_truncate() is called from cifs_open() without holding i_rwsem, the fscache cookie invalidation step is skipped - meaning previously cached file contents remain readable via fscache_use_cookie() even after the file has been truncated to zero. This produces both confidentiality and integrity violations: a process can obtain pre-truncation data and the kernel cache becomes inconsistent with actual file state. No public exploit is identified at time of analysis; EPSS is 0.17%.
Hugetlb reservation accounting in the Linux kernel underflows when a huge-page folio shared between a parent and child process (after fork) is unmapped by the parent first. Since commit df7a6d1f6405 introduced reservation adjustment logic into `__unmap_hugepage_range()`, the function decrements the reservation counter without verifying that the folio's mapcount has reached zero, leaving the child's mapping unaccounted and the counter in an arbitrarily large (underflowed) state until the child unmaps. Affected kernels from 6.9 through the fix commits expose systems using hugetlb-backed workloads to integrity corruption (overcommit of huge pages) and availability risk (kernel memory management instability). No public exploit or active exploitation is identified at time of analysis.
Out-of-bounds heap read in the Linux kernel CXL fwctl driver allows a local low-privileged user to leak kernel memory to a CXL device mailbox and crash the kernel. The root cause is cxlctl_fw_rpc() ignoring the in_len bound established by fwctl_cmd_rpc(), letting a user-controlled op_size value drive memcpy reads beyond the kvzalloc(in_len) allocation. With a sufficiently large op_size the read walks into unmapped memory, causing a kernel oops. No public exploit code has been identified and EPSS stands at 0.17%, indicating limited active exploitation interest.
Out-of-bounds read in the Linux kernel dm-pcache subsystem allows a local low-privileged user to read past segment data boundaries into adjacent control areas, exposing sensitive kernel memory and potentially crashing the kernel. Specifically, cache_replay(), the writeback worker, and the GC worker all miscalculate the tail-kset read length using PCACHE_SEG_SIZE minus the segment offset rather than the actual data-region remainder via cache_seg_remain(). This affects Linux 6.18.x (before 6.18.50), 7.2.x (before 7.2.4), and pre-release 7.3-rc1. No public exploit or active exploitation has been identified; EPSS is 0.17% (6th percentile).
CVE-2026-19816 is a vulnerability reported by Ubuntu with no public description, CVSS score, or CWE classification available at the time of analysis. The affected product is an Ubuntu package or system component, but the specific vulnerability class, attack vector, and impact cannot be determined from the available intelligence. No exploitation conditions, technical root cause, or patch details are derivable from current data.
Missing origin validation in wpa_supplicant's driver-based PMKSA cache selection path allows a local low-privileged attacker to bypass network context and AKMP matching, forcing the supplicant to use a cached Pairwise Master Key Security Association from a mismatched network or authentication method. All wpa_supplicant versions prior to 2.12 are affected. Successful exploitation can allow the attacker to bypass Wi-Fi authentication controls, potentially enabling connection to unintended network segments or interception of traffic through credential reuse across network boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing authorization in the Master Addons for Elementor WordPress plugin (≤3.2.2) by Pixar Labs enables privilege abuse by authenticated low-privileged users. The CVSS vector (PR:L/C:N/I:L/A:H) indicates that a subscriber-level or similarly low-privileged WordPress account is sufficient to trigger operations with high availability impact - likely destructive actions such as resetting plugin settings, deleting content blocks, or disrupting site functionality - while retaining limited integrity modification capability. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Password hash extraction from any Dolibarr 24.0.0 user account, including administrators, is possible for authenticated low-privileged users via a case-sensitivity mismatch in the sqlfilters API parameter denylist. The PHP guard in dolForgeSQLCriteriaCallback() performs case-sensitive string matching against forbidden field names, while the underlying database resolves column names case-insensitively, allowing bypasses using uppercase variants such as PASSWORD instead of password. By submitting prefix-matching predicates as boolean oracle queries, an attacker can extract full credential hashes character-by-character without elevated privileges. No public exploit code has been identified at time of analysis; a patch commit is available upstream.
Unrestricted wallet-credit minting in AVideo's AD_Server plugin allows any authenticated user to fraudulently inflate YPTWallet balances for campaign video owners without proof of ad delivery. The flaw resides in plugin/AD_Server/log.php, which accepts arbitrary label values - including label=start - via POST requests and credits the associated campaign wallet unconditionally. Repeated exploitation constitutes ad fraud, enabling attackers to generate synthetic platform currency at will. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in WWBN AVideo's playlistRemove.php endpoint allows remote attackers to silently delete authenticated users' playlists by luring victims to a malicious webpage. The endpoint processes POST requests for playlist deletion without validating a CSRF token, meaning any browser-initiated request carrying a valid session cookie - regardless of origin - is accepted. No public exploit has been identified at time of analysis, though the attack is trivially constructible from a standard HTML form.
Silent data corruption in the Linux kernel's s390/dasd subsystem causes local processes to silently receive zeroed data for the unread portion of partially-completed ESE (Extent Space Efficient) disk reads that pass through the ERP (Error Recovery Procedure) chain. The root cause is dasd_default_erp_postaction() omitting the proc_bytes field when copying per-request state back from the ERP request to the originating request, which causes __dasd_cleanup_cqr() to treat the request as fully satisfied and return without requeuing the unread remainder. No public exploit code exists and no active exploitation is confirmed; vendor-released patches are available across multiple stable branches.
Register corruption in Linux kernel s390/percpu silently drops the `mviy` instruction on kernels compiled with GNU binutils prior to 2.39, leaving the per-CPU address register unrepaired after CPU migration following an interrupt. Affected kernels are limited to IBM s390/zSeries architecture builds in the 7.2 lineage using the older toolchain. With C:H/I:H/A:H in the CVSS vector, successful exploitation by a local attacker could lead to privilege escalation via corrupted per-CPU data, though no public exploit or KEV listing exists and EPSS is 0.15%.
Hard-coded bootloader credentials in the ANJIA AJL33PC0801 IP camera allow any attacker with physical device access to authenticate to the bootloader without knowing a legitimate password. Successful exploitation grants full control over firmware loading and system configuration, enabling persistent device compromise, implant installation, or complete operational disruption. CISA issued ICS advisory ICSA-26-251-01 for this vulnerability; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in ArduinoCore-avr versions prior to 1.8.8 allows an attacker who can influence float or double values passed to Arduino String concatenation methods to corrupt stack memory on AVR-based Arduino boards, causing denial of service and - under specific conditions - arbitrary code execution on the microcontroller. The flaw resides in `String::concat(float)` and `String::concat(double)` in `WString.cpp`, where a fixed 20-byte stack buffer is insufficient for values near the extremes of the float or double range when processed by `dtostrf()`. A vendor-released patch is available in version 1.8.8; no public exploit has been identified at time of analysis.
Client-side authentication bypass in Kingdom Communication Associated's Smart Video Intercom System (models EH3040, EH4200, EH1000B, EH2070) exposes configuration data to unauthenticated remote attackers. The authentication gate is enforced only in client-side code rather than on the server, allowing direct traversal to restricted pages without supplying credentials. An attacker with network access to the device's web interface can retrieve partial system configuration values - including likely network and device settings - without any login. No public exploit or active exploitation has been identified at time of analysis.
Reverse proxy authentication passthrough in an ICS inventory-management component exposes the bundled credential-store administrative interface directly to the network when a specific authentication mode is configured. Under this mode, the gateway forwards requests to the credential store's admin UI without enforcing its own authentication, delegating all access control to that third-party interface's own login mechanism. This is the same OT product covered by CISA advisory icsa-26-254-01, which also documents CVE-2026-90456 (default credentials in example config); if both conditions align, an attacker can reach the admin UI of the credential store that gates every other service in the deployment with no gateway-layer resistance.
Path traversal in a-blog cms Ver. 3.2.33 and earlier enables unauthenticated remote attackers to read or delete arbitrary files on the server filesystem. Reported by JPCERT/CC and confirmed via JVN advisory JVN#20829034, the flaw carries a CVSS PR:N/AC:L vector indicating no authentication or special configuration is needed to trigger it. The dual read-and-delete capability substantially amplifies real impact beyond the assigned CVSS 6.5 score, as arbitrary file access can expose credentials and configuration secrets, while arbitrary deletion can destabilize or destroy the application and underlying OS. No public exploit code or CISA KEV listing is identified at time of analysis.
User account enumeration via observable response discrepancy (CWE-204) affects Kingdom Communication Associated's Smart Video Intercom System across four product lines (EH3040, EH4200, EH1000B, EH2070). Unauthenticated remote attackers can distinguish valid from invalid usernames by measuring or parsing differences in system responses to authentication or lookup requests, yielding a valid account list without credentials. No public exploit code or KEV listing has been identified; the practical impact is limited to reconnaissance - harvested account names enable targeted credential attacks such as password spraying or brute force against the intercom management interface.
Unauthenticated access to Mousehole's HTTP/WebSocket management interface (port 5010) exposes the stored MyAnonamouse (MAM) session cookie to any network peer in versions prior to 0.4.0. The service serializes its internal state - including the live MAM session cookie - identically across persisted storage, public API responses, and WebSocket push updates, meaning a passive read of any endpoint yields the credential. An attacker who can reach port 5010 can additionally overwrite the stored cookie and trigger MAM IP-update side effects, turning a disclosure into account manipulation. No public exploit code has been identified at time of analysis.
Server-side request forgery in WWBN AVideo's login endpoint enables unauthenticated remote attackers to read arbitrary local files or probe internal services by supplying crafted file paths or HTTP URLs to login.json.php. The vulnerability resides in the _json_decode function, which fetches attacker-supplied URLs and local paths without SSRF validation; the fetched content is then parsed as login credentials, creating an unusual secondary attack surface for potential authentication bypass against internal services that return predictable responses. Affected versions span all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1, with no public exploit code identified at time of analysis.
Weak password hashing combined with world-readable file permissions in an ICS inventory-management component allows any local OS user-or any party possessing a configuration backup-to offline-crack the administrative password and authenticate as administrator across every authentication path the product supports. The credential store backing one authentication path stores the admin password hash using a computationally cheap algorithm (CWE-916), inconsistently with a stronger algorithm applied on a second authentication path, and the hash file is written with permissions permitting any local user to read it. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; however, once the hash is obtained the attack is trivially executable with commodity tools.
Unauthenticated information disclosure in AVideo's WebRTC plugin exposes sensitive server-side configuration data to any remote user. When the WebRTC plugin is installed, the `/plugin/WebRTC/status.json.php` endpoint responds with the absolute filesystem path of the WebRTC2RTMP binary (revealing document-root layout), the configured WebRTC port, binary existence and executability status, WebRTC log file contents, and TCP reachability results for both loopback and the public address. The endpoint performs no authentication or authorization check of any kind, and no vendor patch had been released at the time of reporting.
Out-of-bounds read in Qt's NFC connectivity module (qtconnectivity) exposes applications to denial of service or limited process memory disclosure when parsing crafted NFC tags with malformed language code length fields. All Qt versions fall within the affected CPE scope, with the flaw residing in NDEF Text Record parsing logic invoked when a user scans a malicious tag. No active exploitation has been confirmed and no public exploit code exists, but the zero-privilege requirement lowers the bar for a physically proximate adversary.
Relative path traversal in projen's generated file manifest cleanup component allows recursive deletion of files and directories outside the project directory during project synthesis. Projen versions before 0.101.37 consume a version-controlled manifest of generated files; crafted entries with traversal sequences (e.g., '../..') cause the cleanup routine to delete writable paths beyond the project root when a developer runs projen. No public exploit code has been identified at time of analysis, though the AWS security bulletin (2026-108-aws) confirms the issue and references the fixed release.
The Endpoint DLP kernel driver (epdlpdrv.sys) in Netskope Client for Windows before release R141 exposes two overlapping flaws: an absent token-validation check on the internal kernel-to-userspace IPC channel, and an uninitialized reply buffer in the port message handler that returns residual kernel pool contents to callers. Any local unprivileged process can send unauthorized queries to the driver port without proving it is the legitimate hook DLL, then read uninitialized response buffers to extract DLP configuration data, feature flags, live session tokens, and kernel memory fragments from other users' concurrent operations. No public exploit code or CISA KEV listing exists at time of analysis.
Kernel pointer disclosure in NetBSD's mm_open() allows unprivileged local users to bypass the CANSEE_KPTR address obfuscation mechanism and recover real kernel virtual addresses. The flaw stems from world-accessible device nodes such as /dev/null and /dev/zero incorrectly inheriting the PK_KMEM process flag - a privilege reserved for kernel memory inspection tools - which then grants those processes unfiltered sysctl KERN_PROC results containing actual pointers to sensitive kernel structures including struct proc, kauth_cred, filedesc, and vmspace. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the reliability of exploitation (AC:L, PR:L, no user interaction) makes it a useful primitive for chaining into privilege escalation attacks.
Workspace data exfiltration in Amazon Kiro IDE before version 0.8.135 allows remote unauthenticated attackers to steal developer credentials and sensitive project data through crafted repository content. When a developer opens a malicious project, the Kiro AI agent is manipulated - via CWE-829 inclusion from an untrusted control sphere - into overwriting the workspace settings file, redirecting the Kiro Powers registry to an attacker-controlled endpoint. Once the developer subsequently opens the Powers panel, workspace data, including any credentials present in the project, is transmitted to the attacker's server. Vendor-released patch 0.8.135 is available; no public exploit has been identified at time of analysis.
Broken object-level authorization in the Visualizer WordPress plugin before 4.0.6 allows any authenticated Contributor-level user to permanently delete charts created by other users, including administrators, by exploiting a missing per-chart ownership check on deletion requests. The plugin validates only a site-wide capability (confirming the user can edit content generally) but never verifies whether the requesting user owns the specific chart being deleted - a classic BOLA/IDOR pattern under CWE-862. A publicly available proof-of-concept from WPScan demonstrates trivial exploitation with any valid Contributor account. No public exploitation (KEV) status is confirmed at time of analysis.
Shopper Framework versions prior to 2.9.0 permit authenticated administrators to create fixed-amount discount records with negative values through the /cpanel/discounts control panel, bypassing all server-side validation. The malformed values persist to the sh_discounts database table and flow unchecked through DiscountCalculator.php, where PHP's min() built-in lacks a lower-bound guard; a negative discount (e.g., -$99,999,999) causes the subtraction in Calculate.php to inflate rather than reduce order totals (subtotal 10,000 − discount −5,000 = 15,000). No public exploit code or CISA KEV listing exists; the issue is fixed in version 2.9.0.
Unauthenticated order enumeration via IDOR in Woo PDF Invoice Builder (also marketed as PDF Builder for WooCommerce) for WordPress exposes every WooCommerce order on affected stores to any logged-in user with Subscriber-level access or higher. The InspectOrder() AJAX handler registered on wp_ajax_rednao_wcpdfinv_inspect_order performs no capability check and no nonce verification before accepting an attacker-supplied OrderNumber POST parameter, loading the matching WC_Order object, and serializing its complete data-billing and shipping addresses, customer email and phone, payment method, gateway transaction ID, and order totals-to the response. All plugin versions through 2.0.8 are affected; no public exploit or CISA KEV listing has been confirmed at time of analysis.
OCI artifact signature verification bypass in Doco-CD prior to v0.90.1 allows an attacker with write access to a monitored OCI registry tag to circumvent the global OCI_TRUST_POLICY enforcement and deploy unsigned or improperly signed artifacts. By publishing an artifact containing a crafted .doco-cd.yml with oci.verify: false, the attacker exploits a circular trust dependency - the tool reads per-deployment config from artifact contents before verifying that artifact - causing signature checking to be disabled for that same artifact. The vendor-released patch at v0.90.1 enforces a strict no-downgrade trust boundary; no public exploit has been identified at time of analysis.
Integer overflow in pcre2_compile_32 on 32-bit platforms allows network-reachable attackers to trigger an out-of-bounds heap write when a PCRE2-consuming application compiles attacker-supplied regex patterns. Affected versions are all PCRE2 releases prior to 10.48. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the widespread use of PCRE2 as a dependency in web servers, databases, and language runtimes means the actual attack surface is broader than PCRE2's own footprint might suggest.
Authenticated low-privileged users in ZoneMinder prior to versions 1.36.39, 1.38.4, and 1.39.11 can bypass monitor-level access controls to retrieve private surveillance footage from cameras they are not authorized to access. The event media endpoints accept an arbitrary event ID parameter without enforcing the per-monitor ACL that the UI correctly applies, creating a server-side IDOR (CWE-639) condition. No public exploit has been identified at time of analysis, and the vendor has released patches across three supported branches.
Stored Cross-Site Scripting in Visual Composer Website Builder WordPress plugin (versions up to and including 45.16.1) allows an authenticated Contributor-role user to inject malicious scripts into page builder content. When a higher-privileged user such as an Editor or Administrator subsequently views or reviews that content, the injected script executes in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Simple Payment WordPress plugin (≤2.5.4) allows authenticated contributors to inject malicious scripts into content that executes in the browsers of higher-privileged users - including administrators - who view the affected content. The vulnerability stems from insufficient output encoding (CWE-79) and carries a scope-changed CVSS vector (S:C), indicating the injected payload escapes the contributor context to affect admin sessions. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Bold Page Builder (WordPress plugin by BoldThemes) versions up to and including 5.9.9 allows authenticated attackers holding the Contributor role to inject persistent malicious scripts into page content. When an administrator or higher-privileged user views the affected content, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation has been identified at time of analysis, but the low barrier to exploitation (any registered Contributor account suffices) makes this a meaningful risk for multi-author WordPress sites.
Authenticated SQL injection in GamiPress ≤7.9.7 allows a Subscriber-level WordPress user to exfiltrate the entire site database through a boolean-based blind injection channel in the wpForo integration AJAX handler. The flaw exploits a subtle interaction between WordPress core magic-quote processing and MySQL backslash semantics: `$wpdb->esc_like()` is called after magic quotes have already escaped a single quote to `\'`, producing `\\'` — which MySQL parses as one literal backslash plus a live closing quote, escaping the LIKE string context. No public exploit or CISA KEV listing has been identified at time of analysis, but Wordfence has confirmed the vulnerability with direct source-code references.
Unauthenticated shortcode injection in the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin (versions 1.2.2 through 1.42.2) allows any visitor to execute arbitrary WordPress shortcodes registered on the site. The plugin incorrectly passes the entire rendered Contact Form 7 output - including raw visitor-supplied field values - through the WordPress shortcode parser before returning the response. The practical impact scales with which shortcodes are registered: benign sites face limited exposure, but sites with shortcodes that disclose data, modify content, or trigger code execution face proportionally higher risk. No public exploit has been identified at time of analysis.
Stored DOM-based XSS in Dobase prior to 2026.06.03 allows any authenticated workspace member to persist an executable JavaScript payload in the public, unauthenticated shared-folder image gallery by crafting a malicious file name. The public-gallery Stimulus controller reads the filename from a data-name HTML attribute via el.dataset.name (which HTML-decodes it) and injects the raw value into innerHTML without sanitization, converting a server-side ERB-escaped attribute back into an executable sink. Critically, the application's Content-Security-Policy is deployed in report-only mode rather than enforcement, so inline onerror handlers execute freely against any unauthenticated visitor who opens the public share link. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Media Library Assistant WordPress plugin (versions ≤3.35) allows authenticated contributors to inject persistent malicious scripts via the unsanitized `mla_link_attributes` shortcode parameter. Any user who subsequently loads the injected page executes the attacker-controlled script in their browser context, enabling session hijacking, credential theft, or privilege escalation to administrator. A patch was committed in changeset 3512155 and no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in Media Library Assistant (WordPress plugin, ≤3.35) allows authenticated attackers with Author-level access to poison bulk edit preset configurations and execute arbitrary JavaScript in the context of an administrator's browser session. The flaw bypasses the `wp_kses()` tag-filtering safeguard because the payload operates at the HTML attribute level - injecting closing quotes and inline event handlers - exploiting the absence of `esc_attr()` escaping when preset field values are rendered into `<input value="...">` attributes via simple string replacement in `mla_generate_bulk_edit_form_fieldsets()` and the `mla-bulk-edit-fieldsets.tpl` template. No public exploit code and no CISA KEV listing are present in the available data; exploitation requires social engineering an administrator into importing a crafted preset file.
Stored XSS in the Bold Timeline Lite WordPress plugin (versions ≤1.2.8) allows authenticated Contributor-level users to inject arbitrary JavaScript via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode, executing in the browsers of any visitor loading the injected page. The root cause is unsanitized attribute input and unescaped HTML output in bold_timeline_item_view.php (lines 202 and 204), confirmed by WordPress plugin trac source references. A fix has been committed to the plugin trunk per the referenced changeset, though no public exploit or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the Media Library Assistant WordPress plugin (versions ≤3.35) allows authenticated contributors to plant persistent JavaScript payloads that execute in any visitor's browser. The injection point is the mla_link_href parameter of the [mla_gallery] shortcode when mla_output is set to 'paginate_links': the _paginate_links() function processes the value through mla_process_shortcode_parameter() and _replace_query_parameter() but writes the result directly into href attributes without invoking WordPress's esc_url() sanitizer, leaving the output unsanitized. No public exploit has been identified at time of analysis, and a fix has been committed to the plugin's SVN trunk (changeset 3512155), though the exact released patch version is not independently confirmed from the available references.
Dependency regression in a log-processing component of an ICS inventory-management product reintroduced a previously remediated, vulnerable HTTP client library version after a security-focused update was reverted. The reintroduced library is used in exactly one code path - an outbound initialization request to a single fixed, vendor-controlled URL - and never processes attacker-supplied input, severely constraining practical exploitability. Exploitation would require an adversary positioned to subvert the single outbound call to the trusted endpoint and leverage known vulnerabilities in the older HTTP client library, a scenario the CVSS 4.0 AC:H/AT:P metrics reflect. No public exploit and no KEV status are associated with this finding.
OpenStack Ironic through version 38.0.0 leaks HTTP Basic Authentication credentials to unintended remote hosts during image retrieval, when the Image Service is configured to use HTTP(S) Basic Authentication. An authenticated, low-privileged attacker who can influence image fetch operations or position a rogue endpoint in the network path can capture plaintext usernames and passwords belonging to the Image Service account. No public exploit or CISA KEV listing has been identified at time of analysis, but the scope-change CVSS metric confirms impact extends beyond the Ironic component itself to whichever service's credentials are leaked.