Cross-tenant disclosure of durable workflow callback results in Hatchet before 0.95.3 lets an authenticated tenant worker receive another tenant's durable callback result payload. The V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownership is verified, and callback delivery resolves that map by task UUID alone with no tenant identity, so a tenant worker that knows a victim's durable task UUID and holds a stream open on the same dispatcher process can be handed the victim's payload. Exploitation requires out-of-band knowledge of a non-enumerable UUIDv4 plus same-process co-location, giving an assessed CVSS of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N); no public exploit identified at time of analysis, and single-tenant deployments are unaffected in practice.
Command injection in the Feiyu Star Router web management CGI (/send_order.cgi?parameter=del_expmac) lets an attacker who already holds an authenticated router-administration session execute arbitrary shell commands on the device by embedding shell metacharacters in the 'mac' argument; the flaw is confined to firmware build B-MB5E202-210322-r11656 from Chengdu Feiyuxing Technology. The vendor was contacted early but never responded, so no official fix has been published, and publicly available exploit code exists for the affected endpoint. Because exploitation requires admin-level access (CVSS PR:H), risk is real but access-gated: the practical priority is moderate, driven mainly by the prevalence of default or weak credentials on SOHO router management interfaces rather than by any unauthenticated attack path.
Command injection in the Feiyu Star Router (Chengdu Feiyuxing Technology, firmware build B-MB5E202-210322-r11656) lets an attacker who can reach the device's web management interface run arbitrary commands on the underlying operating system by manipulating the session_id cookie handled by /send_order.cgi?parameter=loginout. Publicly available exploit code exists, giving attackers a ready reference implementation, while the vendor did not respond to the disclosure, so no vendor-released patch has been identified at time of analysis. The vendor's CVSS 4.0 base score of 5.3 is internally inconsistent with the flaw class; an independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning a low-privilege authenticated attacker over the network can achieve high confidentiality, integrity and availability impact on the device, with the practical caveat that the management interface is normally LAN-facing and default or weak consumer credentials frequently make the PR:L prerequisite trivial to satisfy.
Open redirect in ST Engineering iDirect Evolution and Velocity WebServer Evolution (builds up to 20260717) lets remote, unauthenticated attackers craft a link whose manipulated 'Success' argument is processed by the authorize function in /usr/sbin/webserver, causing the victim's browser to be redirected to an attacker-chosen site. Impact is limited to integrity-low on the victim's browsing session - there is no server compromise, data disclosure, or denial of service - and exploitation depends on the victim actively following the crafted link (UI:P). Publicly available exploit code exists (per the VulDB-linked proof-of-concept write-up), but there is no confirmed active exploitation (not in CISA KEV); the vendor was contacted early and did not respond.
Open redirect in ST Engineering iDirect Evolution and Velocity WebServer Evolution (up to version 20260717) allows remote unauthenticated attackers to manipulate the Host argument on /login.html and redirect victims to arbitrary external websites. Exploitation requires user interaction-a victim must click a crafted link-and publicly available exploit code exists, though the vendor did not respond to disclosure. This low-severity issue affects the Management Service, which is typically isolated on satellite operations networks, and the integrity impact is limited to the redirect itself.
Open redirect in WuzhiCMS up to 4.1.0 lets remote attackers redirect users to arbitrary external websites by crafting a link to the member login endpoint (/index.php?m=member&v=Login) with a manipulated forward parameter. The attack requires no authentication and can be launched remotely, but it does require the victim to click the malicious link (UI:P). Publicly available exploit code exists; however, there is no evidence of confirmed active exploitation (CISA KEV) and the impact is limited to integrity (redirecting users), not code execution or data disclosure.
Authorization bypass in Omega Solution FBP Fulfillment by People 2025 allows authenticated low-privilege users to read other users' profile data via the /user/ User Profile API endpoint by manipulating the ID argument. This is a CWE-639 insecure direct object reference, requiring a valid low-privilege account but no user interaction, and results in confidentiality-only disclosure (no integrity or availability impact). Publicly available exploit code exists and the vendor was contacted early but did not respond; there is no CISA KEV listing, and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Improper control of resource identifiers in Omega Solution HRM OS (versions up to 20260717) allows an authenticated low-privilege user to enumerate the permission mappings of arbitrary roles by manipulating the roleId parameter of the /role-permission/permission endpoint. The outcome is confidentiality-only: role and permission metadata can be read, but no data can be modified and no code can be executed, and the CVSS v4.0 base is only 2.1 (assessed CVSS v3.1 4.3, AV:N/AC:L/PR:L/UI:N/C:L/I:N/A:N). Publicly available exploit code exists (PoC referenced via VulDB and the linked GitHub issue), but there is no confirmed active exploitation (not in CISA KEV); the vendor was contacted early and did not respond, and no vendor-released patch has been identified at time of analysis.
Code injection in RooCMS (versions up to and including 1.2.2, 1.3.4 and 1.4RC2) allows an attacker who holds a privileged content-editing or administrator account to place PHP code into a page's 'content' field, which the frontend renderer passes to eval() in roocms/site_pagePHP.php, resulting in arbitrary PHP execution on the server. The flaw is CWE-94 and is remotely reachable, but exploitation is gated behind high privileges (CVSS:4.0 PR:H / CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so realistic exposure is limited to insiders or attackers who have already obtained editor credentials rather than an anonymous internet-facing surface. Publicly available exploit code exists (a public proof-of-concept write-up is referenced), the vendor was contacted but did not respond, and no vendor-released patch has been identified at time of analysis.
Stored cross-site scripting in XXL-JOB up to 3.5.0 allows an authenticated user with permission to manage job groups to inject script through the Name parameter of the /jobgroup/insert endpoint, which then executes in the browser of any admin who views the job-group listing. Publicly available exploit code exists (a GitHub proof-of-concept), but there is no evidence of active exploitation (not in CISA KEV), and no fixed version has been released because the vendor did not respond to coordination attempts. The practical risk is moderate: session or token theft, forced admin actions via the victim's browser, and defacement within the admin console, but no direct server-side code execution.
Stored cross-site scripting in Leantime (up to and including 3.9.8) lets a low-privileged authenticated user inject HTML/JavaScript that executes in the browser of anyone who later views the affected Kanban, list, or table board. The root cause is the getAllGrouped() grouping-label function in app/Domain/Tickets/Services/Tickets.php, which concatenates user-controlled values such as project names, status labels, ticket types, milestone headlines, and editor names directly into labels that consumers render raw; the maintainers patched it by treating that switch as the escaping boundary (htmlspecialchars with ENT_QUOTES/UTF-8, plus a preg_replace sanitizer for the id used inside inline onclick handlers). Publicly available exploit code exists (a GitHub vulnerability-research write-up), but there is no indication of confirmed active exploitation, and the issue is assessed as moderate severity (CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) rather than critical, because it requires authenticated low-privileged access and a victim passively viewing the board for the stored payload to fire.
Cross-site scripting in Omega HRM OS up to 20260717 allows an authenticated attacker with high privileges and file-upload permissions to inject malicious SVG files through the /media/view/ endpoint. Publicly available exploit code exists, enabling attacks that execute arbitrary JavaScript in a victim's browser when they view the crafted SVG. This is a low-severity issue due to the high privilege requirement and mandatory user interaction, and no vendor patch is available.
Stored cross-site scripting (XSS) in Leantime 3.9.8 and earlier allows an authenticated user with EDIT permission on a project to plant a malicious status label that executes in the browser of any other user-including project Owners-who views the Project Dashboard. The payload is stored in a project status/label name and echoed without encoding in /app/Domain/Dashboard/Templates/show.blade.php, and it requires a second user to load the dashboard for the script to fire. Publicly available exploit code exists, but the vendor did not respond to the disclosure and no patch has been identified.
Path traversal in the self-hosted draw.io server (jgraph/drawio) before version 30.2.7 allows unauthenticated remote attackers to redirect the ExportProxyServlet's internal proxy request to unintended routes on the configured export backend by supplying dot segments (literal or percent-encoded) in the request path. Because the servlet copies all request headers and the request body to the traversed destination, an attacker can reach administration, debugging, health, or configuration endpoints that the export server happens to expose, and may trigger unintended internal actions, though the practical impact is bounded by how that backend is configured. Exploitation requires a deployment that has the export proxy feature enabled and pointed at an internal export service; there is no public exploit identified at time of analysis, and no EPSS score was supplied, so the vendor's modest CVSS of 3.7 is a reasonable reflection of real-world risk.
Unconstrained memory consumption in Thinkst Canary's OpenCanary Redis emulation module can be driven by an unauthenticated remote attacker, causing the deception sensor process to exhaust memory and degrade or crash. The issue affects OpenCanary 0.9.9 as reported by Thinkst Applied Research and is availability-only (CWE-770, resource allocation without limits), assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - a low-severity, low-priority finding. No public exploit code exists and there is no indication of active exploitation (not in CISA KEV), and exploitation requires the Redis honeypot module to be enabled and reachable; the impact is confined to the OpenCanary honeypot process rather than the underlying host, making real-world risk limited.
Denial of service in the Thinkst Canary honeypot's optional Redis service can be triggered by unauthenticated remote attackers when that service is enabled, causing limited availability impact to the Redis service without confidentiality or integrity loss. The Canary is not affected if Redis is disabled, and the high attack-complexity score reflects that the trigger requires specific conditions rather than a reliable full-appliance outage. Thinkst has addressed the issue across supported platforms and published a patched Docker image, with automatic updates already in distribution; no public exploit identified at time of analysis.
Incorrect authorization in GoCD 13.1.0 through versions before 26.1.0 lets an authenticated internal user call the /go/api/support/process_list endpoint without the intended administrator privileges and read command-line arguments, usernames, remote material URLs, and internal material paths for materials they cannot otherwise access. Exploitation is gated by a timing race, since the endpoint only leaks this material metadata while source-control child processes are actively running, and disclosure is bounded because credentials, environment variables, and user-defined secrets remain masked or omitted. No public exploit code or confirmed active exploitation was identified, and the issue is fixed in GoCD 26.1.0.
Unauthenticated remote attackers can inject arbitrary published posts and taxonomy terms into WordPress sites running the To Do List Member plugin through version 1.6, because the plugin's import routine performs neither authorization nor nonce checks and never validates the remote location it fetches data from. The outcome is integrity-only (CVSS 3.7, vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) - no disclosure of existing data, no code execution, and no availability impact. No public exploit code has been identified at time of analysis and the plugin is not listed in CISA KEV, so despite being unauthenticated and trivially reachable in principle, this remains a low-real-priority issue, further capped by the plugin's small deployment footprint and the non-trivial setup (hosting or referencing attacker-controlled data for the fetcher to ingest) implied by the AC:H rating.
In Keycloak, a flaw in the User-Managed Access (UMA) permission-ticket flow can cause authorization scopes from two same-named resources owned by different users to be merged, allowing an authenticated attacker to obtain unintended access scopes on a victim's resource. The issue affects deployments where UMA is explicitly enabled and requires the attacker to have an account that can create resources plus a resource-name collision with the victim; it is not a default deployment mode. Independent assessment rates this low severity and confines impact to scope leakage on the specific colliding resource; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Keycloak's client-policy-enforced mandatory 2FA enrollment can be bypassed by an authenticated user who manually triggers a session-restart web link during the login flow, causing the internal markers tracking required authentication steps to be cleared so the session completes with only a password. The flaw only manifests in deployments where an administrator has explicitly enforced step-up/2FA setup through a client policy, and it is a self-bypass by a legitimate password holder rather than a remote compromise; the assessed vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) reflects an integrity-only weakening of the authentication posture. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); no EPSS data was supplied.
Information disclosure in Joplin Desktop note rendering: from version 1.4.0 up to (but not including) 3.7.2, the KaTeX renderer runs with the 'trust' option enabled unconditionally, so a note author can embed a KaTeX \href or \url whose target bypasses Joplin's normal Markdown URL allowlist. On Windows, if a victim clicks such a link pointing at an attacker-controlled UNC or file:// path, the operating system attempts SMB authentication and leaks the user's NTLMv2 challenge-response to the attacker without any warning; the same technique can invoke other registered URL handlers (for example vscode:// or ms-msdt:). Exploitation requires a victim running Joplin Desktop on Windows, delivery of an attacker-authored note (shared notebook, sync, or import), and an explicit click on the rendered link, and it is fully fixed in 3.7.2 where KaTeX trust is restricted to http(s), mailto, joplin:// and internal anchor/id schemes; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Markup injection in Warpgate's form_post SSO return interstitial (warpgate-protocol-http/src/api/sso_provider_list.rs) affects all versions prior to 0.27.6 and allows an attacker who can influence the `next` redirect parameter or IdP-derived error text to break out of the page's inline redirect script with a script-closing sequence. Because Warpgate's strict Content-Security-Policy blocks injected JavaScript and inline event handlers, the practical impact stops at content spoofing, a fabricated login form, or a meta refresh - not script execution. Reaching the sink requires an authenticated actor with SSO configuration influence (or control of an identity provider / of an email or username claim that the IdP accepts unvalidated), and the victim must actively complete the form_post SSO flow, so exploitation is high-friction; there is no public exploit identified at time of analysis and the issue is rated low severity (CVSS 3.1 base 2.4, assessed vector PR:L). The vendor released the fix in 0.27.6.
Persistent sidebar layout manipulation in the Nextcloud Collectives app allows an authenticated user with page-edit permission to submit oversized text containing line breaks to the page emoji update endpoint, which accepts the value without length or character validation. When another user subsequently views the affected collective page, the unvalidated emoji string overflows and breaks the rendered sidebar, hiding other navigation items from view. The impact is confined to client-side layout integrity with no confidentiality or availability loss (CVSS 3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, published vector 2.4 with PR:H), making this a genuinely low-risk issue; no public exploit code has been identified at time of analysis, and it applies only where the optional Collectives app is installed.
Authenticated, low-privileged users of GoCD before 26.1.0 can retrieve source-control credentials in cleartext from several read-only pipeline and material APIs whose responses fail to mask the userinfo portion of material URLs. Exposure is narrow: it only affects legacy configurations where an administrator embedded a username and password directly in a material URL, while credentials held in GoCD's dedicated password fields or secret-management plugins stay encrypted and are not disclosed by this issue. The CVSS 4.0 base score of 2.3 reflects the uncommon prerequisite configuration (AT:P) and limited confidentiality impact, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
In Beszel before 0.19.0, any authenticated user - including a read-only account - can create or delete alert rules on monitoring systems they are not authorized to view, because the POST and DELETE /api/beszel/user-alerts handlers fail to verify that the supplied system ID belongs to the caller. Exploitation requires knowledge or guessing of a target system's 15-character PocketBase record ID (reflected in the CVSS 4.0 AT:P prerequisite), which limits practical impact and severity; successful abuse leaks target system names and metrics through the resulting alert notifications and allows unauthorized tampering with alert configuration. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV; the vendor-released fix is Beszel 0.19.0.
Stored cross-site scripting in XXL-JOB (xxl-job) 3.4.2 and 3.5.0 lets an authenticated operator inject script through the job 'name' or 'author' fields in the admin Task Management interface (JobInfoController); the payload is persisted and executes in the browser of any other user who later opens the affected job list or detail page. Publicly available exploit code exists, but exploitation requires an existing admin-console account with job create/edit rights plus interaction from a second user, so the practical risk is assessed as low despite the public disclosure. No confirmation of active exploitation (CISA KEV) is present in the available intelligence.
Local denial of service in Hangzhou Shunwang Technology's shzh 10.7.2.693 (internet-café management software) allows a local, low-privileged authenticated user to crash the host by sending a crafted IRP_MJ_DEVICE_CONTROL request with a manipulated PID argument to the shdrv_x64.sys kernel-mode driver, which mishandles the value and fails to release resources cleanly. The provider records CVSS 4.0 base 4.8 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/E:P), while our independent assessment maps the flaw to CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, i.e. a local user can fully disrupt availability of the host. No CISA KEV entry or EPSS data was provided, but the vector's exploit maturity value (E:P) indicates publicly available proof-of-concept exploit code exists; because the attack requires an attacker to already have local access to a machine running this specialized software, real-world risk is low-to-moderate.
Eclipse iceoryx2 versions after v0.8.0 up to v0.9.x contain a Rust soundness defect in which StaticString exposes its contents as mutable bytes via safe APIs, and the associated String::as_str() conversion does not validate UTF-8, allowing safe Rust code to construct an invalid &str and trigger undefined behavior. Exploitation requires a local authenticated attacker with low privileges and high attack complexity, and it additionally depends on an application coded in the vulnerable pattern; impact is limited to minor integrity and availability loss with no confidentiality impact, and the defect is not remotely exploitable against a default configuration. No public exploit code or active exploitation has been identified, and the vendor has released a patched version v0.10.0.