Unauthenticated integrity manipulation in MoguBlog through 6.2 allows any remote caller to silently disable email reply notifications for arbitrary users by invoking the unprotected /web/comment/closeEmailNotification REST endpoint. The root cause is a missing authentication gate in WebSecurityConfig.java, which permits the endpoint to be reached without a session or credentials, directly writing a suppression flag into the Redis-backed user cache. A publicly available proof-of-concept exploit script exists, lowering the bar for mass or targeted abuse; no patch version has been identified at time of analysis.
Unauthenticated access to Elasticsearch index management endpoints in MoguBlog's mogu_search microservice (through version 6.2) allows any remote attacker to wipe, restructure, or poison the platform's blog search index. The ElasticSearchRestApi controller exposes POST operations - index initialization, bulk delete, single-document delete, and arbitrary entry injection - without any authentication gate in WebSecurityConfig. Four distinct proof-of-concept Python scripts are publicly available on GitHub, scripting each attack path and significantly lowering the exploitation barrier.
Stored XSS in the Featured Image with URL WordPress plugin before 1.0.6 allows any authenticated user holding at least a Contributor role to inject malicious JavaScript via an unsanitized image attribute value, which then executes in the browser of every subsequent viewer - including Editors and Administrators. A publicly available proof-of-concept is documented by WPScan. Vendor-released patch version 1.0.6 is available, and no active exploitation has been confirmed in the CISA KEV catalog.
Stored XSS in the AI Builder WordPress plugin (versions 2.4.1 through <2.7.8) allows any authenticated contributor-level user to inject persistent JavaScript via an unsanitized custom JS field, which executes in the browser of every subsequent viewer - including editors and administrators who review the post. This creates a reliable privilege-escalation path from contributor to full WordPress site administrator via session token theft or forced admin-action execution. Publicly available exploit code exists per WPScan, and a vendor-released patch is available in version 2.7.8.
Stored cross-site scripting in the CoolClock WordPress plugin before 4.3.8 allows contributor-level and higher authenticated users to inject arbitrary JavaScript via an unsanitized skin configuration value, which is rendered unescaped within an HTML attribute and executes in any visitor's browser upon page load. A publicly available proof-of-concept exploit has been published by WPScan. The vulnerability enables session hijacking, credential theft, or unauthorized actions within the WordPress admin panel when an administrator views affected content.
Stored cross-site scripting in the CoolClock WordPress plugin (before 4.3.8) allows contributor-level users to inject arbitrary JavaScript through an unsanitized custom skin setting that is echoed verbatim into an inline script block. When a higher-privileged user such as an administrator views the affected post or page, the payload executes in their browser, enabling session hijacking or full site takeover. A publicly available proof-of-concept exploit has been published by WPScan, and a vendor-released patch is available in version 4.3.8.
Unauthenticated order-management access in WPCafe WordPress plugin before 3.0.18 stems from REST API permission callbacks that return an incorrect PHP type on failure, causing WordPress's REST dispatcher to grant rather than deny access. Remote unauthenticated attackers can enumerate guest order information (names, addresses, items) and manipulate any order's status or move orders to trash without logging in. A publicly available exploit reported by WPScan exists; the vendor has released a patch in version 3.0.18.
REST API authorization bypass in BackWPup WordPress plugin (versions 5.2.2 through 5.7.4) allows users holding a plugin-defined limited role to invoke privileged backup management endpoints - creating jobs, specifying attacker-controlled destinations, and triggering execution to exfiltrate a complete database backup. WPScan reported the flaw and has published exploit code; vendor-released fix is available in version 5.7.5. No CISA KEV listing exists, but the public POC and high-value database credential exposure make this a genuine remediation priority for sites that have provisioned BackWPup limited roles to potentially untrusted users.
Broken object-level authorization in the Visualizer WordPress plugin before 4.0.6 allows any authenticated user holding at least the Contributor role to publish, rename, and overwrite posts and pages belonging to other users - including private drafts they would normally have no access to. The flaw stems from chart-building AJAX/REST actions that do not verify post ownership before acting on the supplied post identifier. A publicly available proof-of-concept exploit exists, confirmed by WPScan research; no active exploitation (CISA KEV) has been reported.
Stored cross-site scripting in the Advanced Customized Prompts WordPress plugin (≤1.0.1) allows any authenticated subscriber-level user to inject persistent JavaScript into product popup configurations, which then executes in the browsers of all visitors viewing the affected product. The plugin performs no capability check, ownership verification, or nonce validation before persisting popup data, and fails to escape stored values on output - a dual failure enabling both unauthorized write and reflected-on-read XSS. A publicly available proof-of-concept exists via WPScan; no vendor-released patch has been identified at time of analysis.
Unauthenticated information disclosure in the Teddy Bear Customize Addon WordPress plugin through version 1.0.5 exposes WooCommerce order metadata and customer-uploaded file attachment URLs to any network attacker without credentials. The plugin's data-return endpoints implement no authorization or ownership checks whatsoever, enabling an attacker to enumerate and retrieve private order records and attachment links belonging to arbitrary customers. Publicly available exploit code exists via WPScan; the same plugin also carries a separate RCE vulnerability (CVE-2026-14560), making immediate removal or patching urgent.
Missing authorization on the wishlist rename endpoint in YITH WooCommerce Wishlist (WordPress plugin before 4.18.1) permits any unauthenticated network attacker to rename any customer wishlist sitewide by supplying a target wishlist identifier. The flaw is rooted in CWE-639 - the plugin never verifies that the requesting user owns or has permission over the wishlist identified by a user-controlled key. A publicly available proof-of-concept exists via WPScan; no active exploitation (KEV) has been confirmed. CVSS rates impact at 5.3 (I:L) as only wishlist names - not data, credentials, or site availability - are affected.
TLS private key disclosure in the SSL Zen WordPress plugin (all versions before 4.7.40) allows any authenticated user - including Subscribers, the lowest-privilege WordPress role - to download the site's TLS private key, certificate files, and diagnostic logs. The plugin's certificate-file download handler fires early in the WordPress admin request lifecycle without performing WordPress capability checks or nonce verification, bypassing the standard authorization layer entirely. A public exploit is available via WPScan; vendor-released patch 4.7.40 resolves the issue.
Missing authorization on a MoguBlog admin-backend endpoint allows authenticated back-office users to retrieve image-category records beyond their assigned role permissions. The POST /pictureSort/getPictureSortByUid handler in versions through 6.2 omits the @AuthorityVerify annotation that enforces role-based access control, making it a classic Broken Function Level Authorization (BFLA) flaw. Impact is limited to confidentiality of image-category metadata (names, cover UIDs, sort order, timestamps); a publicly available Python POC confirms exploitability.
Comment author spoofing in MoguBlog through version 6.2 allows any authenticated user to post comments attributed to arbitrary accounts - including administrators - by supplying an attacker-controlled userUid value in the POST /web/comment/add request body. The server performs no server-side validation that the submitted userUid matches the authenticated session identity, making this a classic IDOR (Insecure Direct Object Reference) flaw under CWE-639. A public proof-of-concept exploit script is available via VulnCheck and GitHub, lowering the bar for abuse; no patched release has been confirmed in the referenced advisories.
Order metadata tampering in the Advanced Customized Prompts WordPress plugin (all versions through 1.0.1) allows any authenticated subscriber to overwrite WooCommerce order item metadata for orders belonging to other customers. The plugin performs no capability, ownership, or nonce verification before applying user-supplied metadata updates to an arbitrary order ID, making every order's custom fields writable by any registered user. WPScan has published a proof-of-concept, reducing the technical bar for exploitation on any WooCommerce store running this plugin.
Stack-based buffer overflow in ArduinoCore-avr versions prior to 1.8.8 allows an attacker who can influence float or double values passed to Arduino String concatenation methods to corrupt stack memory on AVR-based Arduino boards, causing denial of service and - under specific conditions - arbitrary code execution on the microcontroller. The flaw resides in `String::concat(float)` and `String::concat(double)` in `WString.cpp`, where a fixed 20-byte stack buffer is insufficient for values near the extremes of the float or double range when processed by `dtostrf()`. A vendor-released patch is available in version 1.8.8; no public exploit has been identified at time of analysis.
Client-side authentication bypass in Kingdom Communication Associated's Smart Video Intercom System (models EH3040, EH4200, EH1000B, EH2070) exposes configuration data to unauthenticated remote attackers. The authentication gate is enforced only in client-side code rather than on the server, allowing direct traversal to restricted pages without supplying credentials. An attacker with network access to the device's web interface can retrieve partial system configuration values - including likely network and device settings - without any login. No public exploit or active exploitation has been identified at time of analysis.
Reverse proxy authentication passthrough in an ICS inventory-management component exposes the bundled credential-store administrative interface directly to the network when a specific authentication mode is configured. Under this mode, the gateway forwards requests to the credential store's admin UI without enforcing its own authentication, delegating all access control to that third-party interface's own login mechanism. This is the same OT product covered by CISA advisory icsa-26-254-01, which also documents CVE-2026-90456 (default credentials in example config); if both conditions align, an attacker can reach the admin UI of the credential store that gates every other service in the deployment with no gateway-layer resistance.
Path traversal in a-blog cms Ver. 3.2.33 and earlier enables unauthenticated remote attackers to read or delete arbitrary files on the server filesystem. Reported by JPCERT/CC and confirmed via JVN advisory JVN#20829034, the flaw carries a CVSS PR:N/AC:L vector indicating no authentication or special configuration is needed to trigger it. The dual read-and-delete capability substantially amplifies real impact beyond the assigned CVSS 6.5 score, as arbitrary file access can expose credentials and configuration secrets, while arbitrary deletion can destabilize or destroy the application and underlying OS. No public exploit code or CISA KEV listing is identified at time of analysis.
User account enumeration via observable response discrepancy (CWE-204) affects Kingdom Communication Associated's Smart Video Intercom System across four product lines (EH3040, EH4200, EH1000B, EH2070). Unauthenticated remote attackers can distinguish valid from invalid usernames by measuring or parsing differences in system responses to authentication or lookup requests, yielding a valid account list without credentials. No public exploit code or KEV listing has been identified; the practical impact is limited to reconnaissance - harvested account names enable targeted credential attacks such as password spraying or brute force against the intercom management interface.
Unauthenticated access to Mousehole's HTTP/WebSocket management interface (port 5010) exposes the stored MyAnonamouse (MAM) session cookie to any network peer in versions prior to 0.4.0. The service serializes its internal state - including the live MAM session cookie - identically across persisted storage, public API responses, and WebSocket push updates, meaning a passive read of any endpoint yields the credential. An attacker who can reach port 5010 can additionally overwrite the stored cookie and trigger MAM IP-update side effects, turning a disclosure into account manipulation. No public exploit code has been identified at time of analysis.
Weak password hashing combined with world-readable file permissions in an ICS inventory-management component allows any local OS user-or any party possessing a configuration backup-to offline-crack the administrative password and authenticate as administrator across every authentication path the product supports. The credential store backing one authentication path stores the admin password hash using a computationally cheap algorithm (CWE-916), inconsistently with a stronger algorithm applied on a second authentication path, and the hash file is written with permissions permitting any local user to read it. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; however, once the hash is obtained the attack is trivially executable with commodity tools.
Unauthenticated information disclosure in AVideo's WebRTC plugin exposes sensitive server-side configuration data to any remote user. When the WebRTC plugin is installed, the `/plugin/WebRTC/status.json.php` endpoint responds with the absolute filesystem path of the WebRTC2RTMP binary (revealing document-root layout), the configured WebRTC port, binary existence and executability status, WebRTC log file contents, and TCP reachability results for both loopback and the public address. The endpoint performs no authentication or authorization check of any kind, and no vendor patch had been released at the time of reporting.
Server-side request forgery in WWBN AVideo's login endpoint enables unauthenticated remote attackers to read arbitrary local files or probe internal services by supplying crafted file paths or HTTP URLs to login.json.php. The vulnerability resides in the _json_decode function, which fetches attacker-supplied URLs and local paths without SSRF validation; the fetched content is then parsed as login credentials, creating an unusual secondary attack surface for potential authentication bypass against internal services that return predictable responses. Affected versions span all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1, with no public exploit code identified at time of analysis.
Out-of-bounds read in Qt's NFC connectivity module (qtconnectivity) exposes applications to denial of service or limited process memory disclosure when parsing crafted NFC tags with malformed language code length fields. All Qt versions fall within the affected CPE scope, with the flaw residing in NDEF Text Record parsing logic invoked when a user scans a malicious tag. No active exploitation has been confirmed and no public exploit code exists, but the zero-privilege requirement lowers the bar for a physically proximate adversary.
Relative path traversal in projen's generated file manifest cleanup component allows recursive deletion of files and directories outside the project directory during project synthesis. Projen versions before 0.101.37 consume a version-controlled manifest of generated files; crafted entries with traversal sequences (e.g., '../..') cause the cleanup routine to delete writable paths beyond the project root when a developer runs projen. No public exploit code has been identified at time of analysis, though the AWS security bulletin (2026-108-aws) confirms the issue and references the fixed release.
The Endpoint DLP kernel driver (epdlpdrv.sys) in Netskope Client for Windows before release R141 exposes two overlapping flaws: an absent token-validation check on the internal kernel-to-userspace IPC channel, and an uninitialized reply buffer in the port message handler that returns residual kernel pool contents to callers. Any local unprivileged process can send unauthorized queries to the driver port without proving it is the legitimate hook DLL, then read uninitialized response buffers to extract DLP configuration data, feature flags, live session tokens, and kernel memory fragments from other users' concurrent operations. No public exploit code or CISA KEV listing exists at time of analysis.
Kernel pointer disclosure in NetBSD's mm_open() allows unprivileged local users to bypass the CANSEE_KPTR address obfuscation mechanism and recover real kernel virtual addresses. The flaw stems from world-accessible device nodes such as /dev/null and /dev/zero incorrectly inheriting the PK_KMEM process flag - a privilege reserved for kernel memory inspection tools - which then grants those processes unfiltered sysctl KERN_PROC results containing actual pointers to sensitive kernel structures including struct proc, kauth_cred, filedesc, and vmspace. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the reliability of exploitation (AC:L, PR:L, no user interaction) makes it a useful primitive for chaining into privilege escalation attacks.
Workspace data exfiltration in Amazon Kiro IDE before version 0.8.135 allows remote unauthenticated attackers to steal developer credentials and sensitive project data through crafted repository content. When a developer opens a malicious project, the Kiro AI agent is manipulated - via CWE-829 inclusion from an untrusted control sphere - into overwriting the workspace settings file, redirecting the Kiro Powers registry to an attacker-controlled endpoint. Once the developer subsequently opens the Powers panel, workspace data, including any credentials present in the project, is transmitted to the attacker's server. Vendor-released patch 0.8.135 is available; no public exploit has been identified at time of analysis.
Unauthenticated order enumeration via IDOR in Woo PDF Invoice Builder (also marketed as PDF Builder for WooCommerce) for WordPress exposes every WooCommerce order on affected stores to any logged-in user with Subscriber-level access or higher. The InspectOrder() AJAX handler registered on wp_ajax_rednao_wcpdfinv_inspect_order performs no capability check and no nonce verification before accepting an attacker-supplied OrderNumber POST parameter, loading the matching WC_Order object, and serializing its complete data-billing and shipping addresses, customer email and phone, payment method, gateway transaction ID, and order totals-to the response. All plugin versions through 2.0.8 are affected; no public exploit or CISA KEV listing has been confirmed at time of analysis.
OCI artifact signature verification bypass in Doco-CD prior to v0.90.1 allows an attacker with write access to a monitored OCI registry tag to circumvent the global OCI_TRUST_POLICY enforcement and deploy unsigned or improperly signed artifacts. By publishing an artifact containing a crafted .doco-cd.yml with oci.verify: false, the attacker exploits a circular trust dependency - the tool reads per-deployment config from artifact contents before verifying that artifact - causing signature checking to be disabled for that same artifact. The vendor-released patch at v0.90.1 enforces a strict no-downgrade trust boundary; no public exploit has been identified at time of analysis.
Integer overflow in pcre2_compile_32 on 32-bit platforms allows network-reachable attackers to trigger an out-of-bounds heap write when a PCRE2-consuming application compiles attacker-supplied regex patterns. Affected versions are all PCRE2 releases prior to 10.48. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the widespread use of PCRE2 as a dependency in web servers, databases, and language runtimes means the actual attack surface is broader than PCRE2's own footprint might suggest.
Authenticated low-privileged users in ZoneMinder prior to versions 1.36.39, 1.38.4, and 1.39.11 can bypass monitor-level access controls to retrieve private surveillance footage from cameras they are not authorized to access. The event media endpoints accept an arbitrary event ID parameter without enforcing the per-monitor ACL that the UI correctly applies, creating a server-side IDOR (CWE-639) condition. No public exploit has been identified at time of analysis, and the vendor has released patches across three supported branches.
Missing authorization in Shopper Framework's Livewire Media component (`Media.store()`) allows any authenticated staff user holding only `browse_products` to overwrite product thumbnail and gallery images without the required `edit_products` permission. This is an incomplete fix: the prior patch for GHSA-h4mp-g9c6-xwph (commit fcd0c59) added `#[Locked]` to the `$product` property but omitted the `authorize()` call present in the five sibling components it did repair (Edit, Inventory, Seo, Shipping, Files). A fully functional proof-of-concept is included in the advisory; vendor-released patch is version 2.9.2. No public exploit identifier at time of analysis beyond the advisory PoC.
Shopper Framework versions prior to 2.9.0 permit authenticated administrators to create fixed-amount discount records with negative values through the /cpanel/discounts control panel, bypassing all server-side validation. The malformed values persist to the sh_discounts database table and flow unchecked through DiscountCalculator.php, where PHP's min() built-in lacks a lower-bound guard; a negative discount (e.g., -$99,999,999) causes the subtraction in Calculate.php to inflate rather than reduce order totals (subtotal 10,000 − discount −5,000 = 15,000). No public exploit code or CISA KEV listing exists; the issue is fixed in version 2.9.0.
Stored Cross-Site Scripting in Visual Composer Website Builder WordPress plugin (versions up to and including 45.16.1) allows an authenticated Contributor-role user to inject malicious scripts into page builder content. When a higher-privileged user such as an Editor or Administrator subsequently views or reviews that content, the injected script executes in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Simple Payment WordPress plugin (≤2.5.4) allows authenticated contributors to inject malicious scripts into content that executes in the browsers of higher-privileged users - including administrators - who view the affected content. The vulnerability stems from insufficient output encoding (CWE-79) and carries a scope-changed CVSS vector (S:C), indicating the injected payload escapes the contributor context to affect admin sessions. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Bold Page Builder (WordPress plugin by BoldThemes) versions up to and including 5.9.9 allows authenticated attackers holding the Contributor role to inject persistent malicious scripts into page content. When an administrator or higher-privileged user views the affected content, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation has been identified at time of analysis, but the low barrier to exploitation (any registered Contributor account suffices) makes this a meaningful risk for multi-author WordPress sites.
Authenticated SQL injection in GamiPress ≤7.9.7 allows a Subscriber-level WordPress user to exfiltrate the entire site database through a boolean-based blind injection channel in the wpForo integration AJAX handler. The flaw exploits a subtle interaction between WordPress core magic-quote processing and MySQL backslash semantics: `$wpdb->esc_like()` is called after magic quotes have already escaped a single quote to `\'`, producing `\\'` — which MySQL parses as one literal backslash plus a live closing quote, escaping the LIKE string context. No public exploit or CISA KEV listing has been identified at time of analysis, but Wordfence has confirmed the vulnerability with direct source-code references.
Unauthenticated shortcode injection in the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin (versions 1.2.2 through 1.42.2) allows any visitor to execute arbitrary WordPress shortcodes registered on the site. The plugin incorrectly passes the entire rendered Contact Form 7 output - including raw visitor-supplied field values - through the WordPress shortcode parser before returning the response. The practical impact scales with which shortcodes are registered: benign sites face limited exposure, but sites with shortcodes that disclose data, modify content, or trigger code execution face proportionally higher risk. No public exploit has been identified at time of analysis.
Stored DOM-based XSS in Dobase prior to 2026.06.03 allows any authenticated workspace member to persist an executable JavaScript payload in the public, unauthenticated shared-folder image gallery by crafting a malicious file name. The public-gallery Stimulus controller reads the filename from a data-name HTML attribute via el.dataset.name (which HTML-decodes it) and injects the raw value into innerHTML without sanitization, converting a server-side ERB-escaped attribute back into an executable sink. Critically, the application's Content-Security-Policy is deployed in report-only mode rather than enforcement, so inline onerror handlers execute freely against any unauthenticated visitor who opens the public share link. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Media Library Assistant WordPress plugin (versions ≤3.35) allows authenticated contributors to inject persistent malicious scripts via the unsanitized `mla_link_attributes` shortcode parameter. Any user who subsequently loads the injected page executes the attacker-controlled script in their browser context, enabling session hijacking, credential theft, or privilege escalation to administrator. A patch was committed in changeset 3512155 and no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in Media Library Assistant (WordPress plugin, ≤3.35) allows authenticated attackers with Author-level access to poison bulk edit preset configurations and execute arbitrary JavaScript in the context of an administrator's browser session. The flaw bypasses the `wp_kses()` tag-filtering safeguard because the payload operates at the HTML attribute level - injecting closing quotes and inline event handlers - exploiting the absence of `esc_attr()` escaping when preset field values are rendered into `<input value="...">` attributes via simple string replacement in `mla_generate_bulk_edit_form_fieldsets()` and the `mla-bulk-edit-fieldsets.tpl` template. No public exploit code and no CISA KEV listing are present in the available data; exploitation requires social engineering an administrator into importing a crafted preset file.
Stored XSS in the Bold Timeline Lite WordPress plugin (versions ≤1.2.8) allows authenticated Contributor-level users to inject arbitrary JavaScript via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode, executing in the browsers of any visitor loading the injected page. The root cause is unsanitized attribute input and unescaped HTML output in bold_timeline_item_view.php (lines 202 and 204), confirmed by WordPress plugin trac source references. A fix has been committed to the plugin trunk per the referenced changeset, though no public exploit or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the Media Library Assistant WordPress plugin (versions ≤3.35) allows authenticated contributors to plant persistent JavaScript payloads that execute in any visitor's browser. The injection point is the mla_link_href parameter of the [mla_gallery] shortcode when mla_output is set to 'paginate_links': the _paginate_links() function processes the value through mla_process_shortcode_parameter() and _replace_query_parameter() but writes the result directly into href attributes without invoking WordPress's esc_url() sanitizer, leaving the output unsanitized. No public exploit has been identified at time of analysis, and a fix has been committed to the plugin's SVN trunk (changeset 3512155), though the exact released patch version is not independently confirmed from the available references.
Dependency regression in a log-processing component of an ICS inventory-management product reintroduced a previously remediated, vulnerable HTTP client library version after a security-focused update was reverted. The reintroduced library is used in exactly one code path - an outbound initialization request to a single fixed, vendor-controlled URL - and never processes attacker-supplied input, severely constraining practical exploitability. Exploitation would require an adversary positioned to subvert the single outbound call to the trusted endpoint and leverage known vulnerabilities in the older HTTP client library, a scenario the CVSS 4.0 AC:H/AT:P metrics reflect. No public exploit and no KEV status are associated with this finding.
OpenStack Ironic through version 38.0.0 leaks HTTP Basic Authentication credentials to unintended remote hosts during image retrieval, when the Image Service is configured to use HTTP(S) Basic Authentication. An authenticated, low-privileged attacker who can influence image fetch operations or position a rogue endpoint in the network path can capture plaintext usernames and passwords belonging to the Image Service account. No public exploit or CISA KEV listing has been identified at time of analysis, but the scope-change CVSS metric confirms impact extends beyond the Ironic component itself to whichever service's credentials are leaked.
Denial of service in multipathd allows a local attacker with access to the UNIX control socket to permanently block the daemon's listener thread by sending valid commands and then refusing to read the replies. This renders legitimate IPC operations - such as multipath path queries and storage management commands - unable to complete until the daemon is restarted. Red Hat, the reporting source, explicitly confirms the issue is bounded to availability impact only: no privilege escalation, no code execution, and no confidentiality or integrity loss. No public exploit code has been identified at time of analysis.
Reflected XSS in Relevanssi - A Better Search (≤4.28.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into WordPress search pages when a site administrator has enabled the plugin's 'Debugging mode' setting. The vulnerability exists in `relevanssi_debug_array()` (lib/debug.php), which passes raw user-supplied query parameters `s`, `post_types`, and `orderby` through PHP's `print_r()` into an unescaped `<pre>` HTML block. The debug code path is activated by appending `relevanssi_debug=on` to any search request and intentionally bypasses nonce, capability, and login checks - making it reachable by any unauthenticated visitor whenever debugging is active. Exploitation still requires user interaction (UI:R) to deliver the reflected payload, and no public exploit or KEV listing has been identified at time of analysis.