Missing per-object authorization checks in the King Addons for Elementor WordPress plugin (affected range 51.1.56 through versions before 51.1.81) allow an authenticated user holding at least the WordPress 'author' role to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media files belonging to other users, including administrator-owned media. The plugin's image-optimization actions gate access only on a coarse capability that authors already possess and never verify ownership of the targeted attachment, so no user interaction or non-default configuration is required beyond having the plugin active. Exploitation is bounded by the authenticated author-level prerequisite, but publicly available exploit code exists and a vendor patch (51.1.81) is available, so sites that issue author accounts to untrusted or numerous users - multi-author blogs, membership and community sites - should treat this as a genuine but lower-tier priority to remediate promptly.
Broken object-level authorization in the MasterStudy LMS WordPress plugin before 3.7.50 lets an authenticated user holding the Instructor role modify any order on the site through the plugin's order REST API, enabling free course enrolment, revocation of other users' paid enrolments, and tampering with order notes. The flaw is an IDOR (CWE-639) reachable remotely over the network with low privileges required and no victim interaction; publicly available exploit code exists, though there is no confirmation of active exploitation (CISA KEV). Our assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) places this at moderate severity, with the Instructor account requirement being the principal real-world constraint.
Missing rate-limit enforcement in Saleor's authentication throttling allows attackers to defeat brute-force protection by spoofing the client IP used as the throttle key, and publicly available exploit code exists. Saleor versions up to and including 3.20.118, 3.21.54, 3.22.47, and 3.23.14 are affected: get_client_ip() in saleor/account/throttling.py trusts a client-supplied X-Forwarded-For value when the deployment does not sanitize or pin that header, so an attacker who rotates spoofed IPs across repeated login attempts is never throttled. The vendor disputes the report as working-as-intended, the proposed fix (right-to-left RFC 7239 hop selection) remains unmerged, and the project's own issue #19203 concedes 'IP can be spoofed in most deployments'; impact is limited to weakening authentication throttling (C:L) with no integrity or availability effect, so this is a low real-world priority despite the public POC.
Missing authorization on an appointment-retrieval action in the Bookit - Booking & Appointment Calendar WordPress plugin before 2.6.0.5 lets an authenticated user holding a low-privilege Bookit-specific role pull other customers' appointment records, including names, email addresses, phone numbers and private booking comments. The underlying issue is a CWE-200 information-exposure pattern: the action returns booking PII without verifying that the caller owns the appointment or holds the capability that normally gates such data. Publicly available exploit code exists and WPScan published the finding, but there is no indication of active exploitation, impact is confined to confidentiality with no write or availability effect, and a vendor fix is available in 2.6.0.5 - making this a low-to-moderate priority disclosure issue rather than a high-severity threat.
Deletion of arbitrary appointment records is possible in the WordPress plugin Bookit - Booking & Appointment Calendar in all versions before 2.6.0.5, because one of its appointment-deletion functions omits a capability check (CWE-862 Missing Authorization). Exploitation is authenticated: an attacker must already hold the plugin's custom low-privileged Staff role - a non-default WordPress role that an administrator has to provision - and can then invoke the deletion routine to remove bookings they should not be able to touch. Publicly available exploit code exists (referenced through the WPScan advisory), but this is not confirmed as actively exploited (no CISA KEV listing), and given the Staff-role prerequisite and the integrity-only, appointment-record-limited impact, it is a low-priority insider or multi-staff-deployment risk rather than an internet-wide unauthenticated threat.
MasterStudy LMS WordPress plugin before 3.7.50 fails to verify that an Instructor-role user owns a course before returning its enrolled-student data, allowing disclosure of student names and email addresses for other instructors' courses. Publicly available exploit code exists, and vendor has released patched version 3.7.50. The independent assessment rates this as genuinely low severity (CVSS 2.7) because exploitation requires an authenticated Instructor account and only exposes limited personal data with no write or privilege-escalation impact.
King Addons for Elementor versions before 51.1.81 fail to enforce capability, post-status, or password checks when rendering the content of a requested post, allowing any authenticated user with Contributor-level access or higher to read the contents of private, draft, pending, and password-protected posts they are not authorized to view. The flaw is an authenticated information-disclosure issue (CWE-200) that requires only an active contributor-level account on a site running the affected plugin plus the choice of a target post ID; it grants no write, modification, or destructive capability. Publicly available exploit code exists, but there is no indication of confirmed active exploitation and the vendor has shipped a fix in 51.1.81; our independent assessment rates this a genuinely low-priority, though real and patch-worthy, authorization flaw (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Improper authentication in the password-change handler of gedelumbung HospitalManagement allows an authenticated low-privilege user to tamper with another account's credentials by manipulating the kode_user/username argument passed to the simpan actions in application/modules/global/controllers/password.php and profil.php. The flaw is network-reachable, requires no victim interaction (CVSS:4.0 AV:N/AC:L/PR:L/UI:N) and yields partial confidentiality, integrity and availability impact (VC:L/VI:L/VA:L), consistent with the 5.3 base score; because the identifier is not bound to the caller's session, an attacker holding any valid account can target other users' password/profile records. Publicly available exploit code exists - the disclosure was filed as a public GitHub issue against the project - but there is no indication of confirmed active exploitation, and the maintainer has not responded or published a fix.
Null pointer dereference in Freedesktop Poppler 26.07.0 within JBIG2Stream::rewind lets an unauthenticated remote attacker deliver a crafted PDF containing a malformed JBIG2 stream that crashes applications using Poppler for parsing, resulting in a low-severity denial of service. The victim must open or render the document (UI:P), and there is no server-side auto-trigger unless a backend automatically renders untrusted PDFs; impact is limited to a process crash, with no code execution or information disclosure. Publicly available exploit code exists, and the vendor has released Poppler 26.08.0 with patch commit 5e49250f13b0390edeb3f90eb4c02c9941f97067 to address the issue.
Integer overflow in Freedesktop Poppler 26.07.0's SampledFunction::SampledFunction (poppler/Function.cc) allows unauthenticated remote attackers to crash PDF-rendering applications by supplying a crafted PDF with an oversized BitsPerSample value, resulting in an availability-only denial of service. Exploitation requires a victim to open or render the malicious file (UI:P/UI:R), and publicly available exploit code exists; the issue is not confirmed as actively exploited in CISA KEV. With a CVSS 4.0 base score of 2.1 and an independent CVSS 3.1 assessment of AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, the risk is low and confined to availability with no demonstrated confidentiality or integrity impact.
Rendering a crafted PDF with Freedesktop Poppler 26.07.0 can trigger a signed integer overflow in the TrueType font handler FoFiTrueType::mapCodeToGID when an embedded font supplies a manipulated segCnt value, producing a crash or a bounded out-of-bounds read rather than confirmed code execution. The flaw is remotely reachable with no authentication (CVSS 4.0 PR:N, CVSS 3.1 PR:N) but requires the victim or an automated pipeline to open or convert the attacker-supplied document (UI:P/UI:R), so it is not a hands-off network exploit; publicly available exploit code exists but there is no indication of confirmed active exploitation (no CISA KEV listing). With a base score of 5.3 and C:L/I:L/A:L on the assessed 3.1 vector, this is a moderate, opportunistic-risk issue rather than a top-tier priority, and it matters most to environments that automatically render or convert untrusted PDFs at scale.
Cross-site request forgery in HospitalManagement allows remote attackers to trick an authenticated user's browser into submitting forged state-changing requests against the application. All versions are affected because the project follows a rolling-release model, and the maintainer has not released a fix after being notified via an early issue report. Publicly available exploit code exists, though there is no confirmed CISA KEV active exploitation; our independent assessment rates this low priority because it requires the victim to be logged in, depends on social engineering to deliver the malicious content, and causes only limited integrity impact (no data theft or service disruption).
Integer overflow in the JBIG2 code-table parser (JBIG2Stream::readCodeTableSeg) of Freedesktop Poppler 26.07.0 allows a remote attacker to crash or destabilize the rendering process by supplying a crafted PDF that embeds a malicious JBIG2 image stream. The flaw is reachable without authentication, but requires the victim to open the document or have a batch tool such as pdftoppm or pdfimages process it, and the independent assessment limits realistic impact to denial of service (integrity and confidentiality are unaffected). Publicly available exploit code exists (a write-up and PoC linked from the CVE references), and the CISA KEV catalog does not list this CVE, so it is a low-to-moderate, non-urgent memory-safety issue rather than a confirmed actively exploited threat.
Physical access to a CareCam CM2507 IP camera running firmware HMT.CM2507 v251211.1507 lets an attacker connect to an unauthenticated debug interface, interrupt the normal boot sequence, and reach an interactive bootloader that can inspect or modify boot configuration, firmware data, and loaded software. The weakness requires hands-on access and a physical connection to the device's debug port, so exploitation is confined to scenarios such as device theft, supply-chain tampering, or unsupervised physical placement. It carries a low CVSS base score of 3.5, no public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided in the available intelligence.
CareCam CM2507 IP cameras expose an insufficiently protected network maintenance mechanism that can activate a remote debugging service, and an attacker positioned on the same local network who is able to satisfy certain device-state conditions could make that debugging endpoint remotely reachable and use it to obtain unauthorized administrative access. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV does not list this CVE); EPSS data was not supplied. Severity is low - the vendor-published CVSS 4.0 base score is 2.3 (AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N) and our independent assessment scores it CVSS 3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - because exploitation demands LAN adjacency plus an unspecified device-state prerequisite and the immediate consequence is limited to enabling further access rather than full compromise.
An integer-overflow flaw in libheif's RGB-to-YCbCr conversion path (libheif/color-conversion/rgb2yuv.cc) can crash an application that encodes extremely large RGB images constructed via heif_image_create() and heif_image_add_plane() before calling heif_context_encode_image(); a 32-bit stride field wraps, so the conversion loop computes an invalid input pointer and reads past the end of the allocated interleaved plane. Affected deployments are those running libheif versions prior to 1.19.6 that expose the ENCODE path to caller- or attacker-influenced image dimensions - pure decode/parsing workflows are not affected. Impact is limited to process termination (no code execution, no data disclosure), and no public exploit code was identified at time of analysis.
Missing authorization checks in the IBM WebSphere Application Server 8.5 and 9.0 administrative console allow a remote, unauthenticated attacker (per the CVSS vector PR:N) to read limited sensitive information exposed by affected console functions. The issue is rated low severity (CVSS 3.1 base 3.7, C:L/I:N/A:N) and carries a high attack complexity (AC:H), meaning the attacker must know and reach the specific console paths where checks are absent rather than sending a single trivial request. There is no public exploit identified at time of analysis, no indication of confirmed active exploitation (CISA KEV), and a vendor patch is available via IBM's advisory page.
Session fixation in the password-protected shared-notes flow of SysReptor (Syslifters) before version 2026.68 lets an attacker who can plant a known, unauthenticated share-page session cookie in a victim's browser reuse that session after the victim enters the correct note password, gaining access to that shared note. The main SysReptor login is unaffected; only the 'publicshareinfo-auth' / 'sharednote-detail' share flow fails to rotate the session identifier on successful authentication (CWE-384). Exploitation requires a separate cookie-injection capability (for example an XSS vector, a shared or attacker-controlled device, or a network man-in-the-middle position) plus precise knowledge of the shared-note URL the victim will authenticate against, and the victim must actively submit the password, so the assessed CVSS 3.1 score is 3.7 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N); no public exploit code was identified at time of analysis.
NanoMQ MQTT brokers prior to 0.24.14 can be driven unresponsive by a remote unauthenticated client that sends MQTT v5 PUBLISH or SUBSCRIBE packets containing a large number of User Properties. Each property is inserted via property_append(), which re-walks the entire linked list, so a single packet with many properties forces quadratic (O(N²)) CPU work in the decoder; repeating the packet sustains the denial of service. The vendor has released a fix in 0.24.14, and no public exploit code or confirmed active exploitation has been identified at time of analysis; impact is availability-only and rated low, with the independent assessment noting that effectiveness depends on how many properties can be packed into a packet and on continued resending.
Information disclosure in Synology DiskStation Manager (DSM) lets unauthenticated remote attackers read a limited set of files by overwhelming the built-in Auto Block brute-force protection with sustained authentication attempts. The root cause is an improper restriction of excessive authentication attempts (CWE-307), and exploitation is technically difficult (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) with the payoff confined to low-confidentiality reads and no write or denial-of-service capability. Affected versions are DSM before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2; no public exploit identified at time of analysis, and this remains a low-priority finding despite being remotely reachable and unauthenticated.
An integer-wraparound in Cockpit's do_lastlog() login-accounting routine on ILP32 (32-bit) builds allows a low-privileged but authenticated local user holding an administrator-provisioned abnormally large UID to read and modify other users' lastlog records, producing low confidentiality and low integrity impact (CVSS 3.1 base 3.6, AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Exploitation requires a 32-bit build, a deliberately created large-UID account, and local access to the host; 64-bit LP64 builds do not overflow and are unaffected, and no public exploit code has been identified at time of analysis.
Unauthenticated holders of a SysReptor public note share link can retrieve project-wide collaborative-editing metadata for any deployment running a version prior to 2026.55, because the public-share WebSocket consumer joins the same collaboration group as authenticated project members and forwards client-information, connect/disconnect, awareness, and deletion events without restricting them to the shared note subtree. This leaks project member usernames and display names plus the identifiers and live editing activity of notes that were never shared; note content itself stays protected and no write access is granted. Our reassessment rates the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), higher than the vendor-assigned 3.5 (PR:L/UI:R) because the metadata is returned to an unauthenticated share-link holder on connection, though exploitation still requires possession of a valid share link. There is no public exploit code and no confirmed active exploitation (CISA SSVC exploitation: none); the fix is included in release 2026.55 via commit 1e52e5058b0c7f420dc45c87ad72e7a4585477b1.
Improper neutralization of CRLF sequences in the Sharing API of Synology DiskStation Manager (DSM) allows remote authenticated users to write limited files on the appliance when a victim clicks an attacker-crafted sharing URL. The issue affects DSM builds prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075, and is scored CVSS 3.1 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) - a low-priority rating the vector fairly reflects, since exploitation requires both a valid low-privileged DSM account and a victim's click-through, and yields only a low integrity impact with no confidentiality or availability loss. No public exploit identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Improper filtering of D-Bus broadcast signals in xdg-dbus-proxy allows a sandboxed Flatpak application to receive signal traffic that the configured path, interface, and member restrictions are meant to block, potentially exposing sensitive information carried on the D-Bus session bus and the AT-SPI accessibility bus. The weakness is strictly local and sandbox-scoped: it requires the attacker to already control a Flatpak application running inside the proxy sandbox, involves user interaction, and produces confidentiality-only impact, which is why the assessed CVSS base score is only 3.2 (AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) with no integrity or availability consequences and no code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
An out-of-bounds read in the Zephyr RTOS gPTP (IEEE 802.1AS) Ethernet layer lets an attacker on the same link crash-free but silently expose memory contents: a truncated Ethernet frame with ethertype 0x88F7 and fewer than 34 bytes of payload is accepted by gptp_handle_msg(), which dereferences a gPTP header pointer that extends past the received data and then retains the short packet for later state-machine parsing. Affected are Zephyr releases from 1.13.0 up to (but not including) 4.4.2 built with CONFIG_NET_GPTP on an interface configured as a gPTP port; no authentication or user interaction is required (PR:N/UI:N), though exploitation is limited by the adjacent-only vector and the requirement for a link that can deliver sub-minimum frames (for example the native_sim TAP driver or a MAC that accepts undersized frames). The impact is read-only and low (CVSS 3.1 base 3.1, C:L/I:N/A:N): under the default fixed-size buffer allocator only stale recycled buffer contents within the 128-byte fragment are disclosed, while a genuine out-of-bounds read requires the experimental CONFIG_NET_BUF_VARIABLE_DATA_SIZE allocator. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; an upstream fix commit and vendor advisory are available.
Authorization bypass in Nextcloud Server (Circles feature) lets an authenticated user retrieve the membership list of a circle they do not belong to, exposing membership information for Nextcloud Server 32.0.0 through 34.0.0, as detailed in HackerOne report 3484601. Exploitation is gated by a severe practical constraint: the attacker must supply an existing circle's unique identifier, which lives in a 62^15-space (roughly 90-bit) keyspace, so the CVSS 3.1 score reflects high attack complexity rather than an easily reachable bypass and no public exploit has been identified at time of analysis. Impact is limited to confidentiality of one circle's member list; no modification, deletion, or service disruption is possible, making this a low-priority issue for most deployments.
A SQL injection vulnerability in the EventScheduler API of Synology DiskStation Manager (DSM) allows an authenticated remote attacker with administrator privileges to retrieve non-sensitive information from the underlying database. Affected versions include DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. The CVSS score of 2.7 (Low) accurately reflects the limited impact, and no public exploit has been identified at time of analysis. The primary limiting factor is the requirement for high-privileged (admin) access to the DSM management interface.
ImageMagick's PNM (Netpbm) image coder can be crashed via a NULL pointer dereference when processing a specially crafted or sufficiently large PNM image that pushes the library to its configured memory/resource limit at a specific allocation point where the failed allocation is never checked. The flaw affects ImageMagick releases before 7.1.2-31 on the 7.x branch and before 6.9.13-56 on the legacy 6.x branch, and the outcome is limited to a denial of service - a single-process crash that can be restarted - with no data exposure, integrity loss, or code execution. Severity is low (vendor CVSS 4.0 base 2.3; independent assessment rates CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:L with high attack complexity and partial prerequisite conditions), no public exploit code was identified at time of analysis, and a vendor-released patch is available.
Denial of service in Vinyl Cache releases before 9.0.2 (and in the related Varnish Cache lineage, per the affected CPEs): when the deployed VCL calls the .upper() or .lower() string methods on an attacker-influenced value, a carefully sized request string can overrun the remaining worker-thread workspace at that call site, causing the child process to segfault or trip an assertion and then restart. Reachability is gated by a non-default prerequisite - the VCL must actually apply these methods to request-derived data - and the attacker must know that VCL logic well enough to size the string to land in the narrow window between filling the remaining workspace and the http_req_size / http_req_hdr_len request limits, so this is a deliberately low-priority memory-corruption issue rather than a general-purpose remote attack. No public exploit code has been identified at time of analysis, and the impact is a transient, self-healing outage rather than a persistent one, with no effect on confidentiality or integrity.
Resource exhaustion in the VES Collector component of O-RAN-SC SMO OAM 2025-06-10 allows an authenticated remote attacker to cause a limited denial of service by submitting manipulated input that drives uncontrolled resource allocation. Publicly available exploit code exists, but the issue is low priority per CVSS 2.1 and the independent assessment, with impact limited to availability of the collector and no confidentiality or integrity effect. The project has been notified via a bug report and has not responded, so no vendor patch is confirmed.
Name-constraint bypass in rustls-webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha.1 through 0.104.0-alpha.5 allows a misissued wildcard certificate to escape permitted-subtree DNS name constraints, potentially permitting names outside the intended subtree. The flaw is reachable only after signature verification succeeds and requires a misissued wildcard certificate from a name-constrained CA, making real-world exploitation narrow and high-complexity (assessed CVSS 3.1 base 2.1, PR:N, AC:H). No public exploit identified at time of analysis; vendor-released patches are available in 0.103.12 and 0.104.0-alpha.6.
rustls-webpki 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 accept X.509 name constraints that apply to URI names instead of enforcing them, so a misissued certificate that violates such a constraint is treated as valid. Impact is deliberately narrow: URI name constraints are only reachable after successful signature verification, the library provides no API for asserting URI names, and exploitation therefore requires a certificate authority in the trusted path to have misissued a certificate. There is no public exploit identified at time of analysis, no CISA KEV listing, and our assessment treats this as a low-priority, defense-in-depth hardening fix consistent with the vendor's CVSS 4.0 score of 2.1 rather than an urgent vulnerability.
Memory corruption in ImageMagick's ImagesToBlob blob-conversion routine can crash an affected process on 7.x releases before 7.1.2-31 and 6.x releases before 6.9.13-56. The flaw is a use-after-free (CWE-416) in which a pointer is not updated correctly, and exploitation requires a crafted image to reach a local ImageMagick process or library call (CVSS 4.0 AV:L/AC:H/AT:P, PR:N), so no authentication is required but the attack surface is local and the trigger is difficult to satisfy reliably. Impact is confined to availability (VC:N/VI:N/VA:L) with no evidence of code execution or data exposure, and no public exploit identified at time of analysis; vendor patches are available.
Uncontrolled resource allocation in the VES Collector component of the O-RAN-SC SMO OAM stack (2025-06-10 snapshot) lets an authenticated, low-privilege remote user exhaust collector resources and degrade availability of the OAM event-streaming service. The impact is availability-only and partial (CVSS 4.0 score 2.1; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:N/I:N/A:L), with no confidentiality or integrity effect. Publicly available exploit code exists and was published alongside an upstream bug report (Jira SMO-202) that the project has not responded to, so no vendor patch or fixed version is available; the issue is not reported as confirmed actively exploited (CISA KEV), and overall risk is low.
The NanoMQ MQTT client (versions prior to 0.24.14) can be hung and driven into a CPU- and memory-consuming infinite loop by a malicious or compromised MQTT broker that replies to a client UNSUBSCRIBE exchange with a malformed packet containing a zero-length topic followed by trailing data. The defect is CWE-835 in nni_mqtt_msg_decode_unsubscribe() (nng/src/supplemental/mqtt/mqtt_codec.c), where a failed read_uint16() during topic counting leaves buf.curpos unchanged while topic_count keeps incrementing, so the parse loop never terminates; when automatic reconnection is enabled the client re-enters the same state repeatedly, producing a sustained denial of service against the client itself. The independent assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L - a low-impact, low-priority availability issue with an inverted threat model, since the victim is the client and the attacker must supply the hostile endpoint; no public exploit code was identified at time of analysis and the issue is not in CISA KEV. Vendor-released patch: 0.24.14.