An authorization bypass in ArcadeDB before 26.9.1 lets authenticated users read data they are explicitly denied at the per-type and per-bucket level by steering the AI chat assistant's query_database tool, which executes queries without binding the authenticated principal to DatabaseContext so ACL checks silently pass. Exploitation requires a valid ArcadeDB account, network reach to the instance, and the AI chat endpoints exposing the tool to be enabled or reachable; impact is limited to unauthorized read of otherwise-restricted types and buckets, with no write or availability effect. The flaw is rated 7.1 (CVSS 4.0 AV:N/AC:L/PR:L, independent assessment agrees at CVSS 3.1 C:H/I:N/A:N), a vendor fix is available in 26.9.1, and no public exploit code or confirmed active exploitation was identified at time of analysis.
django-page-cms through 2.0.13 fails to enforce page-permission checks in its admin helper views, allowing low-privilege authenticated staff accounts to read arbitrary page content, unpublished drafts, listings, and stored media file paths. No write access or code execution is possible, and exploitation requires a valid Django admin staff login, confining the issue to insiders or compromised/over-provisioned staff accounts. No public exploit code or active exploitation has been identified at time of analysis, and the flaw is a bounded broken-access-control issue rather than a top-tier emergency.
Authenticated SQL injection in ClipBucket v5 (through release 5.5.3) lets any logged-in user read arbitrary database contents - including all user credential hashes and email addresses - by submitting the msg_id parameter as an array to the private-message deletion handler. The array form evades the clean_requests() sanitizer in ClipBucket.class.php, so unsanitized elements reach cb_pm::delete_msg(), which interpolates the message ID directly into a SQL query string and supports time-based blind extraction. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms a low-privilege authenticated remote attacker with high confidentiality impact only; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Authenticated workspace members in DataEase SQLBot through 1.10.1 can rename and rewrite other users' private dashboards because the update_resource and update_canvas endpoints never verify that the requesting user owns the target dashboard, letting any member of the same workspace supply an arbitrary dashboard ID and overwrite component data, canvas styles, and view information. Exploitation requires only a valid low-privileged workspace account over the network (PR:L, no user interaction, no admin rights), and the impact is confined to integrity - confidentiality and availability are unaffected per the assessed vector. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, but a vendor patch is available, so unpatched multi-tenant deployments should be upgraded promptly.
An authenticated user with access to the OpenStack Blazar V2 REST API can enumerate leases belonging to other projects in Blazar versions before 17.0.1, because the GET /v2/leases endpoint enforces neither project scoping nor an administrator-only policy. This broken access control (CWE-862) exposes lease IDs, reservation IDs, resource IDs, and reservation metadata; the leaked lease IDs can then be leveraged with a separate object-level authorization bypass to modify or delete those leases. The flaw requires valid Blazar credentials and a deployment running the optional Blazar reservation service, and no public exploit identified at time of analysis.
Silent, warning-free failure of encryption-configuration generation in the Mongoid object-document mapper causes fields that an application explicitly declared for client-side field-level encryption (CSFLE) to be written to MongoDB as cleartext, allowing any party with ordinary read access to the database - a DBA, a read replica, a backup, or a lower-privilege account with query rights - to read values that were intended to be protected from them. Only applications built on Mongoid that use MongoDB CSFLE and declare fields for encryption are affected; the CVSS vectors (the supplied 4.0 vector with PR:L and the independently assessed 3.1 vector with PR:L) indicate the attacker requires some existing privilege, consistent with the assessed precondition of ordinary database read access rather than an unauthenticated remote path. No public exploit code has been identified at time of analysis, and this is assessed as a genuine but conditional data-protection failure rather than an actively exploited priority.
Mongoid can silently persist values in readable form that applications intended to encrypt, because its client-side field-level encryption (CSFLE) schema generation omits encryption rules for fields declared on embedded models - the MongoDB driver then writes those values unencrypted with no error or warning. The exposure is limited to applications that both enable CSFLE and declare encrypted fields on embedded documents (top-level fields are not implicated), and to parties who already hold read access to the database, a backup, or the underlying on-disk data files; there is no write, integrity, or availability impact and no remote code execution. Data-level risk is real but bounded: no public exploit code identified at time of analysis, no confirmed active exploitation, and the reported CVSS 4.0 base score of 7.1 is consistent with the independent CVSS 3.1 assessment of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Authorization bypass in IBM MQ Console allows an authenticated but non-administrative user to create and start queue managers through the web interface, violating intended role separation. This is network-reachable and low-complexity but requires a valid non-admin account (CVSS 3.1 PR:L, base 7.1), with impact limited to low integrity and high availability effects rather than data confidentiality. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published a patch advisory.
ArcadeDB deployments through 26.8.1 allow any authenticated principal - including a low-privileged user explicitly denied readRecord and deleteRecord on a given type - to bypass per-type/per-record access-control rules and read indexed key values, record IDs, MIN/MAX values, record counts and TimeSeries samples, and to delete index entries via ordinary SQL statements such as SELECT key, rid FROM INDEX:Type[field] and DELETE FROM INDEX:Type[field]. The flaw exists because ACL checks are enforced only in LocalBucket (keyed on file id) and are never invoked by query paths that reach record data through LSM index files or the TimeSeries engine, while schema discovery via SELECT FROM schema:indexes is unfiltered and exposes the index and type names needed to build an exploit. It affects both embedded and server deployments across all transports (HTTP, Bolt, Postgres, Gremlin), is exploitable with a single ordinary SQL statement and no user interaction, carries a CVSS 4.0 base score of 7.1, and has no public exploit identified at time of analysis; upgrading to 26.9.1 removes the flaw.
Man-in-the-middle attackers positioned on the network path between a Synology DiskStation and its configured mail server can exploit improper TLS certificate validation in the DSM Email API to read or write arbitrary files and trigger denial-of-service conditions. The flaw affects DSM builds before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2, and is rated CVSS 7.1 with an adjacent-network, high-complexity, unauthenticated vector requiring some user interaction. Exploitation demands that the appliance actually send email and that an email-sending action be triggered, so this is a genuine but hard-to-exploit MITM issue rather than a mass-exploitable one; no public exploit identified at time of analysis, and CISA KEV status is not indicated.
Remote unauthenticated denial of service affects NanoMQ MQTT brokers running versions earlier than 0.24.14, where a crafted MQTT v5 SUBSCRIBE packet triggers a heap out-of-bounds read in the broker receive path and can crash the broker process. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H): no confidentiality or integrity effect was confirmed, and the assessed vector carries PR:N, so exploitation is possible without credentials wherever anonymous MQTT access is enabled, though any authentication or ACL gate that requires a valid client before SUBSCRIBE is processed limits reachability. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limiting factor on a successful crash (versus a benign over-read) is heap layout, which is why AC is rated High.