An open redirect in the Semantic MediaWiki extension (versions up to and including 7.1.0) lets an unauthenticated remote attacker craft a Special:URIResolver subpage link that issues an HTTP 303 redirect to an off-host destination, optionally embedding user:pass@host credentials in the URL authority. Because the redirect originates from a trusted wiki domain, the link is usable for phishing or credential-harvesting lures, though exploitation requires the victim to follow the crafted URL (UI:R) and no server data disclosure or code execution results directly. There is no indication of active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis; the vendor addressed the flaw in Semantic MediaWiki 7.2.0.
Local low-privileged users on Red Hat Enterprise Linux 9 and 10 systems running the cockpit-files module can abuse the privileged 'Paste as owner' feature by pre-staging a directory that contains a symbolic link, causing ownership changes to be applied to files outside the intended paste destination and thereby compromising data integrity (and, in some cases, confidentiality if the new ownership grants unauthorized read access). Exploitation is not remote - it requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L) and only completes when a more privileged operator performs the paste and actively selects a non-original owner, which is the primary limiting factor; no public exploit code and no confirmed active exploitation were identified at time of analysis. The issue is a genuine but locally scoped privilege/integrity problem, not a high-urgency remote threat.
Cross-site scripting (XSS) in the IBM Common Licensing Agent (9.0, 9.0.0.1, 9.0.0.2) and IBM ART (9.0, 9.0.0.1, 9.0.0.2) Web UI lets an unauthenticated attacker embed arbitrary JavaScript that executes in a victim's browser session, potentially altering page behavior and exposing credentials. The vulnerability is remote and requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1), meaning a user - typically an administrator or operator - must load the attacker-influenced page inside an authenticated, trusted session for the payload to fire; no attacker authentication is required. There is no CISA KEV entry and no public exploit identified at time of analysis, and a vendor patch is available, so this is a genuine but moderate-priority issue whose real-world risk depends largely on whether the licensing Web UI is exposed to untrusted or internet-facing users rather than confined to an isolated management network.
Reflected cross-site scripting (CWE-79) in KA Informatics Technologies Ltd. Co. 'Bar Association Website' builds through 18092026 lets remote, unauthenticated attackers inject script into pages that reflect user-supplied input, executing in the browser of any victim persuaded to open a crafted link. Per the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1 medium), network reachability is trivial and no credentials are needed, but the attacker must first lure a targeted user into clicking the malicious URL, so this is not a no-interaction or mass-automatable flaw; impact is confined to the victim's browser session (limited confidentiality/integrity, no server compromise). No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the vendor was contacted and did not respond, so no vendor-released patch was identified at time of analysis - remediation currently depends on WAF filtering, output encoding, or removing the vulnerable reflection point.
Reflected cross-site scripting in The Newsletter - Send awesome emails from WordPress plugin (satollo) versions up to and including 9.3.8 lets an unauthenticated attacker deliver a crafted link containing a malicious 'nn' parameter that executes script in the browser of a logged-in WordPress administrator who clicks it. The payload only survives to the reflected output branch of the plugin's dienow() function for authenticated users, because the built-in antibot/antispam check auto-passes logged-in accounts and returns the unsanitized value in administrator-visible output; anonymous or non-admin visitors do not trigger the sink. Impact is limited to session/token theft or admin-performed actions in the WordPress context of the victim (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), making it a genuine but contained issue that requires a specific social-engineering step against an administrator.
Reflected cross-site scripting in the Booking Calendar WordPress plugin through 11.8.2 enables unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via the 'options' parameter, provided they can trick the user into clicking a crafted link (CVSS 6.1, user interaction required). The nonce check that would normally block unauthenticated requests is bypassed on default installations because the 'booking_is_nonce_at_front_end' option ships disabled, making default setups exploitable. No public exploit code has been identified at time of analysis, but the flaw is reflected rather than stored, so each victim must be individually lured-limiting mass exploitation while still posing a moderate risk.
Reflected cross-site scripting in the EmbedPress WordPress plugin through version 4.6.5 lets unauthenticated attackers inject arbitrary JavaScript into a page returned to a victim who clicks a crafted link carrying a payload in the plugin's 'unique' parameter. Any WordPress site with the plugin installed and active at or below 4.6.5 is exposed, though exploitation depends on successful social engineering because the script is reflected per-request rather than stored, and the most impactful target is a logged-in administrator. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited; this is a moderate, vendor-assigned CVSS 6.1 issue and a regression of CVE-2023-5749, whose esc_url() escaping was removed in the 4.3.0 refactor that introduced the 'unique' parameter.
A local time-of-check/time-of-use (TOCTOU) race condition in cockpit-files on Red Hat Enterprise Linux 9 and 10 allows an unprivileged local attacker to redirect a privileged chown operation to an arbitrary file by replacing a newly created directory with a symlink, resulting in potential information disclosure or unauthorized modification of sensitive files. Exploitation requires a privileged operator to trigger directory creation with owner assignment via cockpit-files inside an attacker-controlled writable parent directory, and the attacker must win a narrow timing window (CVSS 3.1: AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N, 6.0). No public exploit code or confirmed active exploitation was identified at time of analysis; this is a modest-priority local privilege/integrity issue rather than a mass-exploitation threat.
A symlink race condition (CWE-363) in cockpit-files, the file-management component shipped with the Cockpit web console on Red Hat Enterprise Linux 9 and RHEL 10, lets a local attacker with an unprivileged shell account redirect privileged file-ownership or permission changes to arbitrary files. Exploitation requires the attacker to win a narrow, non-deterministic timing window while an administrator concurrently performs a chown or chmod operation through the cockpit-files UI, so the practical result is unauthorized modification of file ownership/permissions affecting system integrity and availability rather than confidentiality. There is no public exploit identified at time of analysis and no confirmed CISA KEV active exploitation; this is a moderate-severity local integrity issue, not an urgent internet-facing threat.
Denial of service in Red Hat's cockpit-ws web service lets a remote, unauthenticated attacker crash the process by sending a request to the exact configured WebService.UrlRoot prefix without a trailing slash, taking the Cockpit management interface offline. The flaw is only reachable on installations that have explicitly set the non-default WebService.UrlRoot option; default deployments are unaffected, and impact is availability-only with no data exposure or code execution. There is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and exploitation carries a high-attack-complexity rating (AC:H) because the attacker must know and target the exact URL-root path.
JVM memory exhaustion in the wildfly-elytron-asn1 DERDecoder allows unauthenticated remote attackers to exhaust heap on any service that feeds untrusted DER/ASN.1 bytes into the library, notably SASL authentication flows and X.500 certificate principal parsing. The decoder reads an attacker-supplied length value and attempts a corresponding allocation without validating it against the actual remaining input, so a crafted payload can force an oversized allocation and destabilize or crash the JVM (availability impact only, CVSS 5.9, AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, CWE-770). Exploitation is opportunistic rather than deterministic because the AC:H rating means success depends on payload size/repetition relative to the victim's configured heap, and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV and no EPSS score was provided. Scope is limited to Red Hat products that bundle the affected elytron-asn1 library, including Red Hat Build of Keycloak, JBoss EAP 7/8 (and EAP XP), Red Hat Single Sign-On 7, Fuse 7, Quarkus, Data Grid 8, Camel, Debezium, and Cryostat.
Cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated remote attacker inject arbitrary JavaScript into web management pages that is then executed in the browser of a user who views the injected content, because user-supplied input is not properly neutralized during page generation (CWE-79). Exploitation requires a valid low-privileged session on the appliance (CVSS vector PR:L) and, in practice, a second user - typically an operator or administrator - to render the tampered page, which is why our independent assessment scores it slightly differently from the vendor's CVSS 3.1 base of 5.9 (vendor UI:N, assessed UI:R with scope change). No public exploit code or confirmed active exploitation was identified at time of analysis; impact is bounded by the high attack complexity, the credential prerequisite, and the confined web-management context of a niche data-security appliance.
Information disclosure in IBM Cognos Analytics 12.1.0 through 12.1.3 FP1 and 12.0.4 through 12.0.4 FP2 allows an unauthenticated attacker on a shared network segment to capture sensitive data because the product uses insecure network communication (CWE-327). Exploitation requires the attacker to achieve a man-in-the-middle or traffic-capture position on the same network, making it impractical over the open internet; the impact is limited to confidentiality. The vendor CVSS score of 5.9 is a fair reflection of the moderate risk, no public exploit code has been identified, and a vendor patch is available.
IBM Controller versions 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 send sensitive data in cleartext, allowing an attacker who occupies a man-in-the-middle position on the network path to capture confidential information. Exploitation requires an on-path adversary (e.g., via ARP or DNS spoofing or a compromised intermediary) but no authentication or user interaction; the CVSS 3.1 base score is 5.9 with high confidentiality impact but no integrity or availability impact. No public exploit code or confirmed active exploitation has been identified, and IBM has released a patch.
CRL revocation-check bypass in rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 can cause revoked X.509 certificates to be accepted when a relying application uses the non-default UnknownStatusPolicy::Allow, because the CRL authority-matching logic compares only a certificate's first distributionPoint against each CRL's IssuingDistributionPoint and ignores any additional distributionPoints. Exploitation requires an attacker who has already compromised a trusted issuing CA (a high-privilege position, consistent with the CVSS PR:H vector) plus a target certificate that carries more than one CRL distributionPoint; the default UnknownStatusPolicy::Deny fails safe by returning Error::UnknownRevocationStatus instead of accepting the certificate. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so the mid-range 5.9 CVSS 4.0 score overstates what the vendor and independent analysis both describe as a limited-impact, largely latent issue that would most plausibly let an attacker keep using an already-revoked credential.
Certificate revocation checking in the OCSP client shipped with Red Hat Build of Apache Camel for Spring Boot 4 can be bypassed because the client does not verify the OCSP-signing Extended Key Usage (EKU) on the certificate that signs an OCSP response, allowing a revoked certificate that still chains to a trusted CA to be accepted as valid. The issue is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, 5.9), although exploitation is conditional: the deployment must actually rely on this OCSP client for revocation checking and the attacker must already possess a revoked-but-chainable certificate. No public exploit identified at time of analysis, and this is assessed as a genuine but moderate-priority integrity flaw rather than a high-urgency issue.
Certificate revocation validation performed by Netty's optional netty-handler-ssl-ocsp module can be silently skipped when the OCSP response omits the optional nextUpdate field, causing the application to proceed with a certificate that should have been rejected. The flaw is remote and requires no credentials or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, 5.9), but exploitation is conditional: the deployment must actually use the opt-in OCSP-stapling component, and the attacker must control or intercept the OCSP response seen by the client, typically through a man-in-the-middle position or by operating the TLS server whose certificate is being validated. There is no public exploit identified at time of analysis and no KEV listing, and the practical impact is confined to acceptance of a revoked or otherwise unvalidated certificate rather than code execution or data disclosure.
Broken object-level authorization (IDOR/BOLA) in CordysCRM allows any authenticated user holding the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission to read leads and customer accounts belonging to other users, departments, or organizations by supplying an arbitrary record ID to GET /pool/lead/get/{id} or GET /pool/account/get/{id}. The flaw affects all CordysCRM deployments prior to version 1.7.4 and is read-only in effect, but it exposes highly sensitive CRM data including contact names, phone numbers, owner and department attribution, and custom field values, with no special privileges, administrative rights, or non-default configuration required beyond valid credentials. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is an authenticated information-disclosure issue rather than an RCE-class emergency, though the confidence is high because the affected code path is the default behavior of every pre-1.7.4 install.
Server-side request forgery in the search functionality of HCL BigFix Service Management allows remote attackers to make the application server issue requests to internal systems that are not reachable from the internet, potentially exposing internal APIs, admin interfaces, or cloud metadata services. The vendor scores this 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), but our independent assessment places it lower: the scope-change and high-confidentiality components are contestable, and realistic impact depends on whether the deployment has internal routes worth abusing and on whether responses are reflected to the attacker. No public exploit code or confirmed active exploitation was identified at time of analysis, though the unauthenticated, no-interaction attack profile (PR:N/UI:N) makes this a strong candidate for automated scanning against internet-exposed instances.
Remote command injection in marcopiovanello yt-dlp-web-ui up to v4 lets a remote attacker (CVSS 4.0 vector records PR:N/UI:N, i.e. unauthenticated and no user interaction) abuse the params argument processed by NewGenericDownload in server/internal/downloaders/generic.go to inject arbitrary yt-dlp flags and shell metacharacters into the spawned download command. Publicly available exploit code exists - the flaw was publicly disclosed alongside the CVE, so any network-reachable instance of the generic download feature is a realistic target; there is no indication of confirmed active exploitation (not in CISA KEV). An upstream fix commit (c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897) replaces the previous weak sanitizer with a strict allowlist of yt-dlp flags, but no tagged patched release version is confirmed in the available data, so operators must either track the commit or restrict exposure.
Error-based SQL injection in CordysCRM 1.7.0 through pre-1.7.4 lets an authenticated user holding the MODULE_SETTING_UPDATE permission inject database functions into the sort parameter of POST /account-pool/page, exposing database values through an error oracle when the query returns at least one row. No public exploit code is identified at time of analysis, and the independently assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). The vendor fixed the flaw in version 1.7.4.
Imager for Perl before 1.036 can leak uninitialised process heap memory when an application reads an attacker-supplied paletted image and then retrieves its pixels or converts it to RGB, because palette entries beyond the number of colours populated by the reader are read without being initialised. The TGA reader stores pixel indexes without validating them against the colour map, and the affected accessors (i_gpix_p, i_glin_p) mishandle indexes equal to or past the populated count, returning zeroed-but-uninitialised heap contents as pixel data. Exploitation is local (AV:L) and requires user or application interaction to load and then read back the crafted image (UI:R); no public exploit code has been identified at time of analysis and CISA KEV does not list this issue, while EPSS is very low (0.18%, 8th percentile). The vendor-released patch is Imager 1.036, which allocates and zero-initialises a full 256-entry palette and corrects the out-of-range checks.
Denial of service in OpenImageIO's PSD reader allows a crafted PSD file carrying an invalid color_mode value to index beyond the fixed color-mode tables, producing a global out-of-bounds read and potentially a bogus allocation that crashes the reading process. The exposure is narrow: the raw path is only reachable when the non-default oiio:RawColor or psd:RawData option is explicitly enabled, and an attacker must get a target application or automated pipeline to open the malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.5, CWE-125), so impact is availability-only with no confidentiality or integrity effect. No public exploit has been identified at time of analysis, and vendor-released fixes exist in 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
Denial of service in OpenImageIO versions prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1 occurs when the library processes a truncated TGA file while writing GIF output, triggering a signed 32-bit integer overflow in GifSplitPalette() that leads to an out-of-bounds read (CWE-125) and a process crash. The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates the attacker is unauthenticated (PR:N) but requires local access and user interaction, with no remote or unauthenticated network trigger. No public exploit code or active exploitation has been identified; this is a low-priority hardening issue for workflows that transcode untrusted images to GIF.
A heap out-of-bounds read in the OpenImageIO PSD reader can crash any application that processes a crafted indexed Photoshop (PSD) file while the non-default oiio:rawcolor or psd:rawdata option is enabled. The flaw affects OpenImageIO builds prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, where a PSD whose transparency metadata yields fewer stored channel buffers than the advertised channel count causes PSDInput::interleave_row() to read past the end of channel_buffers. Exploitation is local with required user interaction (the victim must supply or open the malicious file), the vulnerable rawcolor/rawdata path is not the default configuration, and impact is limited to a denial-of-service crash of the processing process, with no code execution or data disclosure reported; no public exploit has been identified at time of analysis, and CVSS 5.5 (A:H, C:N/I:N) reflects the availability-only, non-default-path nature of the issue.
Heap buffer overflow in Suricata 8.0.0 through 8.0.5 lets a user who can supply or modify a local detection rule crash the engine by loading a ruleset that pairs frame inspection without a content keyword with a transformed match that also lacks content. The flaw is reached during signature preparation in src/detect-engine-prefilter.c and fires even in config-test mode (suricata -T), so no live traffic is required, but it is strictly local, requires rule-loading privilege, and results only in a denial-of-service crash rather than code execution. This is a low-severity issue: the assessed CVSS vector is AV:L/PR:L with A:L impact only, there is no public exploit identified at time of analysis, and Suricata 8.0.6 plus the entire 7.x line are not affected.
OS command injection in the Spatie Scotty developer CLI (through v1.4.4) lets a malicious 'host' value in a Scotty @servers configuration directive break out of the local shell and execute arbitrary commands when a victim runs the Doctor command. Because the host string is interpolated unescaped into Process::fromShellCommandline, shell metacharacters such as ';' and '${IFS}' in a crafted host are interpreted by the local shell rather than passed literally to ssh. This is a local CLI tool, so exploitation requires the attacker to get malicious configuration in front of the victim and the victim to subsequently invoke Doctor (checkSshConnectivity or checkRemoteTools), and any injected commands run only with the victim's own user privileges; no public exploit code has been identified at time of analysis, and vendor CVSS 4.0 rates this 5.3 with current exploit maturity unproven (E:X).
Local information disclosure in cockpit-machines on Red Hat Enterprise Linux 9 and 10 allows an authenticated local user to read plaintext VM credentials - including passwords - that the component passes directly on process command-line arguments during VM creation or installation. Exploitation is timing-dependent: the secret is only readable while a provisioning operation is in flight, and it also requires that /proc process arguments remain visible to other users (i.e., the host is not hardened with a hidepid-style mount option), so risk concentrates on multi-user or shared virtualization hosts. It yields no code execution and no privilege escalation, but a disclosed password compromises access to the affected VM; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV).
Rendering a crafted PDF through Poppler's Splash backend can pin a CPU core at 100% for an extended attacker-controlled duration. The flaw in SplashOutputDev::tilingPatternFill computes an excessive loop count from tiling-pattern geometry near the int32 limit, without allocating memory. This availability-only issue affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and Red Hat Hardened Images, and exploitation requires a victim to open a malicious PDF (UI:R, AV:L, PR:N - no privileges required). No public exploit identified at time of analysis, and no confirmed active exploitation.
Unauthenticated information disclosure affects the Multicluster Observability Addon in Red Hat Advanced Cluster Management for Kubernetes, enabling attackers on the adjacent network to access a debug endpoint that leaks goroutine, heap, and command-line profiling data. The misconfiguration originates in the underlying addon-framework library, which exposes the endpoint without requiring credentials; exploitation only requires a basic encrypted (TLS) connection. No public exploit has been identified at time of analysis, and the vulnerability does not permit remote code execution, but the exposed profiling information could aid reconnaissance or further attacks.
IBM Controller 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 permit an authenticated low-privilege user to bypass file-size validation by tampering with client-side input, producing low integrity and availability impact without confidentiality exposure. The issue is rated CVSS 5.4 and assessed as a moderate, not a priority, issue; no public exploit identified at time of analysis. A vendor patch is available per IBM advisory, and exploitation requires a valid IBM Controller account with network access.
Stored cross-site scripting in the FileBird WordPress media library and file manager plugin (all versions up to and including 6.5.6) allows authenticated users with Author-level capabilities or higher to inject arbitrary JavaScript through an image's alt-text field, which is then rendered without adequate escaping in FileBird gallery and PhotoSwipe output. The payload persists in attachment metadata and executes in the browser of any user who later views an affected gallery page, including administrators, so a low-privileged content author can pivot into an administrative session context. The vendor score is moderate (5.4) and our assessment raises the scope to changed (S:C); no public exploit code has been identified at time of analysis and no EPSS or KEV signal was provided, so this should be handled as a routine patch-in-cycle item rather than an emergency.
Denial of service in IBM i 7.3, 7.4, 7.5, and 7.6 allows unauthenticated attackers on an adjacent network segment to disrupt the integrated FTP server by sending authentication commands that are not properly validated. Because the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, the credential-free USER/PASS handshake is the likely trigger path, but realistic exposure is confined to LAN or same-broadcast-segment reachability rather than arbitrary internet access, and there is no confidentiality exposure or code execution evidenced. IBM has published a vendor fix, and no public exploit code or confirmed active exploitation was identified at time of analysis; this is a moderate-severity, low-real-world-priority issue.
Cross-site scripting in IBM Common Licensing Agent and ART versions 9.0, 9.0.0.1, and 9.0.0.2 allows a user who already holds a low-privilege account on the licensing Web UI (PR:L) to embed arbitrary JavaScript that executes in another user's trusted session when that victim loads the tainted page (UI:R), potentially disclosing credentials or other session data. The flaw is rated CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) and carries CWE-79; exploitation is limited to authenticated attackers and depends on a victim viewing the affected content, so it is not remotely exploitable without credentials or user interaction. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (not listed in CISA KEV); a patch is available from the vendor.
Stored cross-site scripting in the WP Recipe Maker plugin for WordPress affects all versions up to and including 10.8.1, allowing an authenticated attacker holding Contributor-level access or above to inject arbitrary JavaScript through the recipe 'notes' parameter, which is neither properly sanitized on input nor escaped on output. The injected script executes in the browser of any user - visitor, editor, or administrator - who subsequently views the affected recipe page, and per the CVSS vector (PR:L, UI:R) the attack requires both a valid low-privilege account and a victim's interaction with the poisoned page. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so exposure is confined to multi-author WordPress installations that grant Contributor accounts to untrusted users; the scope-change rating (S:C) reflects that successful script execution extends impact beyond the plugin itself into the surrounding site's user sessions.
Cross-site scripting in the Video API of Synology DiskStation Manager (DSM) allows a remote authenticated user to read or write a limited set of files in the context of a victim's browser session when the video player is launched. Affected builds are DSM before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2; exploitation requires a valid DSM account with Video API access plus victim interaction (launching the player), and impact is bounded to low-confidentiality and low-integrity file access rather than code execution. No public exploit code or confirmed active exploitation is identified in the available data, and the CVSS 5.4 / EPSS-consistent profile places this as routine-priority patching.
Cross-site scripting in the shared Biggop promotional library bundled with seven bdthemes Elementor plugins - Element Pack Addons for Elementor ≤8.7.14, Prime Slider ≤4.4.5, Ultimate Post Kit ≤4.2.0, Ultimate Store Kit ≤3.0.7, Pixel Gallery ≤2.1.14, Live Copy Paste ≤1.5.6, and Smart Admin Assistant ≤2.2.0 - allows arbitrary script injection through the unescaped 'display_id' value returned by the external Sigmative/Biggop API. Exploitation is not trivial: an attacker must first compromise or impersonate that third-party API server, and a victim (typically a logged-in administrator) must then load the plugin admin page that renders the tainted API response through the biggopti JavaScript. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the CVSS 5.4 score reflects high attack complexity (AC:H) and the scope change rather than a directly reachable flaw in the plugin itself.
Unauthenticated remote attackers can degrade the email service of IBM Sterling Partner Engagement Manager (PEM) by flooding it with requests, exploiting improper control of interaction frequency (CWE-799) so the service is unable to keep up with legitimate mail processing. The affected releases are Essentials Edition 6.3.0.0 through 6.3.0.2 and 6.2.4.0 through 6.2.4.4, plus Standard Edition 6.2.4.0 through 6.2.4.4; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 Medium), no authentication or user interaction is required against a default configuration when the email service is network-reachable. Impact is limited to partial availability loss (A:L) with no confidentiality or integrity effect and no scope change, so this is a service-degradation weakness rather than a full application outage; no public exploit code has been identified and the flaw is not listed in CISA KEV, so there is no public exploit identified at time of analysis.
IBM Controller releases 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 can return detailed technical error messages to the browser, allowing remote, unauthenticated attackers to harvest implementation details about the affected system (CWE-209). Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, exploitation is network-reachable and requires no credentials or user interaction, but the impact is confined to low-value information disclosure that is most useful as reconnaissance for follow-on attacks rather than for direct compromise. No public exploit code has been identified and the issue is not listed in CISA KEV, so this is a genuine but low-priority weakness whose practical risk largely depends on whether the Controller web interface is reachable from untrusted networks.
Denial of service in OpenImageIO prior to 3.1.16.0: processing a crafted ZIP/Deflate-compressed TIFF while TIFF multithreading is enabled can crash the image-reading process. The bug is an object destruction-order error in TIFFInput::read_native_scanlines(), where an error path returns before queued asynchronous strip-decompression tasks are joined, letting worker tasks touch stale stack and heap storage (use-after-scope). The assessed vector is CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H - no privileges required, but a user or pipeline must open the malicious file (UI:R) and the crash depends on a narrow timing window (AC:H); impact is availability only, with no memory disclosure or code execution, and no public exploit identified at time of analysis.
Server-side request forgery in SveltyCMS 0.0.6 lets an authenticated, low-privileged user (CVSS PR:L, confirmed in both the supplied CVSS 4.0 vector and the independent assessment) force the server to make outbound requests by supplying a crafted remote media/importer URL to the File Upload Endpoint at /mediagallery/upload-media. Exploitation requires valid credentials on a reachable instance that exercises remote media fetching, and the resulting impact is limited (low confidentiality, integrity, and availability, no scope change, no user interaction) - this is a real-but-modest issue rather than a top-priority one. No public exploit code was identified at time of analysis, the flaw is not confirmed actively exploited (CISA KEV), and the vendor has published an upstream fix commit (05b4f9efeb79e9d72a693232334d7529687f896f) that replaces raw outbound fetches with validated egress helpers.
Improper access control in SveltyCMS 0.0.6 allows an authenticated low-privilege user to submit privileged attributes such as role, isAdmin, roleIds, or permissions through the User Attribute Update Endpoint at src/routes/api/[...path]/+server.ts and thereby alter account privileges. The flaw is remotely reachable with no user interaction and, per the independent assessment, has high confidentiality, integrity, and availability impact, though exploitation requires valid low-privilege credentials and the product is a pre-release CMS with essentially no production deployment. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE; an upstream fix is available as commit 05b4f9efeb79e9d72a693232334d7529687f896f, but a tagged release containing it is not independently confirmed.
IBM WebSphere Application Server 9.0 and 8.5 allow remote, unauthenticated attackers to obtain sensitive file-system information through the FileTransfer servlet due to incorrect authorization (CWE-863). Exploitation requires network access to the servlet endpoint, which is part of the administrative/deployment interface, and impact is limited to confidentiality (CVSS 5.3, C:L). No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available per IBM's advisory.
Denial of service in Netty's HTTP/2 HPACK encoder (HpackEncoder) allows an unauthenticated remote attacker to force excessive CPU and memory consumption by sending SETTINGS frames that advertise an oversized MAX_HEADER_TABLE_SIZE, causing the encoder to retain an excessive number of unique header entries. The issue affects applications and Red Hat products that embed Netty and expose an HTTP/2 listener - including JBoss EAP 7 and 8, Keycloak, Red Hat Single Sign-On 7, AMQ Broker 7, Data Grid 8, Fuse 7, Quarkus, Camel 4 for Quarkus 3, Camel for Spring Boot 4, Apicurio Registry 3, and Debezium 3 - while HTTP/1.1-only endpoints are not exposed. Impact is bounded to availability (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, CVSS 5.3) with no data disclosure or modification; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation.
Unauthenticated network access to the SOAP/JMX administrative connector on IBM WebSphere Application Server 8.5 and 9.0 can bypass authentication, allowing an attacker to read limited information from the server (CWE-306, CVSS 5.3). The flaw is remotely reachable without credentials or user interaction (PR:N/UI:N/AC:L), but impact is confined to low confidentiality loss - no code execution, configuration change, or denial of service. A vendor patch is available per IBM's advisory; no public exploit has been identified at time of analysis, and real-world exposure is constrained by the fact that the SOAP/JMX connector is normally bound to a management interface that hardened deployments segment or firewall from untrusted networks.
Time-based blind SQL injection in CordysCRM versions prior to 1.7.0 allows an authenticated attacker holding the MODULE_SETTING:UPDATE permission to inject SQL into the ORDER BY clause via the sort.name field of the POST /account-pool/page endpoint, enabling inference of database metadata and sensitive values through induced delays and causing service degradation. Exploitation requires a privileged, trusted account and the blind nature of the flaw makes data extraction slow, so this is a genuine but modest-priority issue rather than a mass-exploitable one. No public exploit code has been identified at time of analysis, and the flaw is fixed in release 1.7.0 (GHSA-xrcr-hj37-q83j).
Mealie versions before 3.21.0 expose an insecure direct object reference (IDOR) in the per-user ratings and favorites endpoints, allowing any authenticated account holder to read another user's recipe ratings, favorite flags, and the private recipe identifiers attached to them by simply substituting a victim's user UUID in the request URL. Exploitation requires a valid account on the target instance but does not require the attacker to share a group or household with the victim - cross-group and cross-household reads succeed, which the upstream regression tests explicitly verify by expecting 403 once the fix is applied. The impact is read-only information disclosure (CVSS 3.1 5.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), with no write capability or service disruption, and no public exploit code identified at time of analysis; the practical limiting factor is that the attacker must know or enumerate target user UUIDs.
An out-of-order FTP command sequence can blind Suricata's FTP inspection for the remainder of a TCP flow. In Suricata versions prior to 8.0.6, when an FTP client issues a RETR or STOR command before completing PORT or PASV negotiation, the parser in src/app-layer-ftp.c raises an unrecoverable application-layer error rather than flagging a recoverable protocol event; that fatal state disables FTP parsing for the rest of the flow, creating a reporting and rule-matching blind spot in IDS deployments while IPS deployments drop the affected flow outright. Remote attackers who can influence the FTP control channel visible to a sensor (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, CWE-755) can therefore evade parser-dependent rules and logging, but no target host is compromised and no confidentiality is lost; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in 8.0.6.
SIP body-length truncation in Suricata 8.0.0 through 8.0.5 causes the IDS/IPS engine to expose only the first 65,536 bytes of oversized SIP request or response bodies to frame-based inspection, letting an unauthenticated remote attacker hide malicious content in the omitted remainder and evade detection. The flaw resides in the Rust SIP parser, which stores body offsets and lengths in 16-bit fields, so any body larger than 65,536 bytes wraps the stored length; this only matters on deployments that enable SIP application-layer parsing and run rules referencing frame:request.body or frame:response.body, and it degrades detection integrity only (no crash, no code execution, no data exposure). Per the CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, score 3.7) the impact is limited to integrity of the detection pipeline, and no public exploit code or confirmed active exploitation was identified at time of analysis.
SiYuan versions through 3.8.4 fail to enforce authorization on the getDynamicIcon endpoint, allowing authenticated attackers holding a read-only publish token to disclose metadata-such as block titles, names, aliases, and hierarchical paths-of restricted documents via a template injection triggered by type=8 requests. The flaw is rated medium severity (vendor CVSS 5.3, independent CVSS 3.1 5.3) and impacts confidentiality only; no public exploit or active exploitation has been identified at time of analysis.