CPU exhaustion in Temporal Server before v1.30.7 and v1.31.3 allows an authenticated caller holding namespace write permission (PR:L) to persist a Schedule whose fine-grained cadence is fully negated by an exclusion calendar, forcing the next-action-time search to evaluate excluded candidates without any per-search work budget and burning CPU in the Frontend and Schedule worker components. Because the abusive specification is stored, consumption continues through repeated backing-Workflow failures and retries even after the initial request finishes, until the Schedule is deleted or its backing Workflow terminated; repeated or parallel Schedules can degrade or deny service to shared infrastructure. The impact is availability-only with no exposure or modification of Workflow data, no public exploit code has been identified at time of analysis, and vendor-released patches are available in v1.30.7 and v1.31.3. This is a genuine but bounded availability issue whose severity is highest in multi-tenant clusters where one namespace's write access can degrade shared Frontend and Schedule-worker capacity.
Missing write-command registration for graph.UDF in the FalkorDB Redis module versions 4.20.1 through 4.20.4 allows a client that is already authenticated and authorized to issue module commands (CVSS PR:L, unauthenticated external attackers are not sufficient) to invoke a command that Redis does not treat as a write, producing incorrect behavior in deployments whose correctness depends on write-command semantics such as replication propagation, persistence, and replica handling. The assessed impact is primarily availability (A:H) with a minor integrity effect (I:L) and explicitly no confidentiality impact (C:N), giving a CVSS of 7.1; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exposed version range is narrow. Note that the supplied 'Information Disclosure' tag is not supported by the assessed vector, which sets C:N and attributes risk almost entirely to availability.
Improper header handling in Canva Mobile App for HarmonyOS before v1.15.1 allows an unauthenticated remote attacker who controls content loaded in a privileged WebView to hijack a logged-in user's session by capturing sensitive headers sent to an external origin. Exploitation requires the victim to interact with the malicious content, and only the HarmonyOS build is affected; iOS and Android are not impacted. No public exploit has been identified at time of analysis, and the assessed risk is conditional rather than a mass-exploitation priority.
NooBaa's S3 presigned URL verification fails to reject unsigned x-amz- headers, allowing an attacker who holds a valid SigV4 presigned PUT URL to inject an x-amz-copy-source header and convert an upload into a CopyObject operation. This can lead to unauthorized copying of any data the original signer can access within the NooBaa / OpenShift Data Foundation 4 storage system. The issue affects noobaa-core and is rated 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N); no public exploit or active exploitation has been identified at time of analysis.
Cross-site scripting in idccms V1.70 lets a remote, unauthenticated attacker inject script that is rendered by the administrative endpoint /admin/makeDiy_deal.php, executing in the browser of an administrator who is induced to load the crafted request or link (CVSS 3.1 base 7.1; assessed vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The consequence is confined to script execution inside the victim's admin session - cookie/session theft, forged administrative actions, credential or token harvesting - rather than direct server compromise, and successful abuse requires both a live idccms V1.70 instance and a targeted, logged-in administrator who interacts with the payload. No active exploitation has been confirmed (the CVE is not in CISA KEV), EPSS is low at 0.14% (3rd percentile), and no public exploit code has been independently confirmed at time of analysis, though a public GitHub repository documents the flaw; the product's very small deployment footprint further limits realistic exposure.
Missing update-signature verification in Joplin Desktop for Windows (versions prior to 3.7.2) lets an attacker who controls the update delivery path substitute both the app-update.yml metadata and the installer, because the absent publisherName field causes electron-updater's NsisUpdater.verifySignature() to skip comparing the downloaded installer's Authenticode signer against Joplin's own. The attacker is positioned adjacent/on-path (MITM or compromised update server) and unauthenticated per the CVSS vector (PR:N), but exploitation requires the victim to approve the installation prompt (UI:R); successful abuse runs attacker-controlled code with the user's privileges and can compromise notes, credentials, and local data. No public exploit has been identified at time of analysis, and the 7.1 score with AC:H and UI:R indicates this is a meaningful supply-chain integrity flaw rather than a mass-exploitation priority.
Cross-site request forgery in MISP's AttributesController::editField allows an attacker to silently alter threat-intelligence data - an attribute's value, type, category, comment, distribution settings or related timestamps - in any MISP instance where a user is currently logged in, simply by luring that user to an attacker-controlled web page. All MISP builds before 2.5.47 are affected because the editField action had been placed in CakePHP's Security->unlockedActions list, which switched off the framework's forged-request and form-tampering protection; the attacker needs no MISP account of their own (the CVSS vector carries PR:N, i.e. unauthenticated from the attacker's perspective), but the forged request executes with the victim's session and is bounded by that victim's own edit permissions on the target attribute. Impact is integrity-only - no data disclosure or service disruption - rated 7.1 under both the vendor's CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P/VI:H) and the independently assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N); a vendor fix is available via commit dfbae33f9 and no public exploit code has been identified at time of analysis.
Path traversal in Joplin's sync resource handling lets an attacker who can write to a synchronized target (a shared notebook or a compromised/shared sync backend) plant a resource item with a malformed id or file_extension, causing the client to write the attacker-controlled blob outside the resource directory at an attacker-chosen existing path. Affected clients are Joplin versions before 3.6.15 and 3.7.2; exploitation occurs during routine background synchronization, with no user interaction, and integrity impact is high while confidentiality and availability impacts are low. This is a genuine but conditionally-gated integrity issue rather than a mass-exploitation priority: the attacker must already be inside the sync trust boundary (as a shared-notebook collaborator or with credentials to the sync store), and there is no public exploit identified at time of analysis.
Stored cross-site scripting in GoCD (versions 13.3.0 through 26.1.0) allows an authenticated user who holds write access to a material tracked by the server to embed arbitrary HTML or JavaScript in a modification comment crafted to imitate the special package-material trackback JSON format. The payload executes in the browser of a privileged user who later views a page that renders that comment - Stage Detail, Job/Build Detail, Value Stream Map, or Pipeline History - potentially exposing the victim's session or permitting actions with the victim's privileges; not every material comment is rendered in every view, so victim interaction and payload placement are required. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but a public upstream fix commit and the release of GoCD 26.1.0 are available, and the EPSS-style risk is bounded: this is a genuine but contained stored-XSS risk rather than a drop-everything emergency. The CVSS 4.0 vector (PR:L, UI:P, VC:L/VI:H/VA:L) confirms the authenticated, victim-interaction-dependent nature of exploitation.
Path traversal in Tautulli's configuration and database import handlers allows an authenticated administrator or anyone holding the instance API key to write files outside the intended CACHE_DIR by supplying a multipart filename containing parent-directory ('../') segments, enabling configuration tampering, service disruption, or potentially code execution before any file-content validation occurs. All Tautulli releases prior to 2.17.2 are affected (CPE cpe:2.3:a:tautulli:tautulli:*:*:*:*:*:*:*:*), and the flaw is reachable over the network without user interaction, though the high privilege requirement (PR:H in the CVSS 4.0 vector, PR:H in the independent CVSS 3.1 assessment) sharply narrows the attacker population. No public exploit identified at time of analysis and no CISA KEV listing; vendor-released patch: 2.17.2.