Local file disclosure in ProjectDiscovery Nuclei 3.0.0 through 3.9.x lets an untrusted, unsigned workflow template read arbitrary files from the scanner host even when the operator has not enabled file-protocol templates. The workflow loading path fails to enforce the -file capability gate for file: templates referenced by a workflow, so CLI users running workflows with -w and SDK integrations that accept end-user-supplied workflows while relying on the default file-access restriction are exposed; per the CVSS vector (AV:L, PR:N, UI:R, C:H/I:N/A:N, score 5.5) an unauthenticated attacker can trigger the read only if the operator loads and runs the malicious workflow, and impact is limited to confidentiality with no code execution or data modification. No public exploit code was identified at time of analysis and there is no confirmed active exploitation; vendor-released patch 3.10.0 closes the bypass (CWE-284 improper access control).
Opening a specially crafted document in Adobe InDesign Desktop crashes the application through a NULL pointer dereference, giving an attacker a local denial-of-service against a single workstation. The flaw is rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), meaning the attacker needs no credentials but must socially engineer the victim into opening a malicious file locally; impact is limited to an application crash with no code execution, data disclosure, or integrity loss. No public exploit code or confirmed active exploitation was identified at the time of analysis, so this is a low-priority availability issue for most environments despite the MEDIUM base score - patching is still advisable to remove the crash vector and any future path to more serious memory-corruption abuse.
Unrestricted file upload in JosephChuks php-file-manager-with-code-editor through version 3.0 lets remote attackers write attacker-controlled files, including executable PHP, to the server by manipulating the filename and content arguments passed to file_put_contents in codeEditor.php's Save Handler, which can result in remote code execution wherever the write target is web-servable. The vendor's CVSS 4.0 vector indicates an unauthenticated attack (PR:N/UI:N) against the affected component, though file-manager and code-editor front ends are commonly placed behind an application login, in which case a valid session or credentials could be the real limiting factor. Publicly available exploit code exists (the disclosure was made public, and the vendor was contacted about it but did not respond); there is no CISA KEV listing and no EPSS score was provided, and the product has negligible real-world deployment.
Deleted or deprovisioned users can retain authorization on hosts running SSSD with the LDAP access provider when ldap_access_order includes ppolicy or lockout, because a user lookup that returns zero results trips a fail-open path that reports success and caches an allow decision. A remote attacker who already holds valid account context on the SSSD-managed host (authenticated, PR:L) can exploit this after offboarding to keep reading information and make limited modifications, giving low confidentiality and integrity impact (CVSS 3.1 5.4 Medium). The flaw only affects non-default access configurations that explicitly enable ppolicy/lockout ordering, and no public exploit identified at time of analysis.
Unauthenticated, network-reachable attacks against HPE Aruba Analytics and Location Engine (ALE) can degrade or knock out the service and may expose sensitive location/analytics data, with HPE reporting multiple issues bundled under CVE-2026-76716. Per the scored vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, no credentials and no user interaction are required, but the quantified impact is limited to low confidentiality and low availability, so this is a moderate rather than urgent priority. No public exploit code has been identified at time of analysis and there is no CISA KEV listing indicating confirmed active exploitation (CISA KEV); the realistic exposure is confined to internal/management networks where ALE is typically deployed, since it is a specialized Aruba analytics appliance that is rarely Internet-facing.
Denial of service in js-toml prior to 1.1.3 arises when load() processes attacker-controlled TOML with deeply nested arrays, deeply nested inline tables, or excessively long dotted/table-header keys, exhausting the V8 call stack and throwing a raw RangeError rather than the documented SyntaxParseError. The impact is limited to availability: applications that catch only SyntaxParseError and rethrow everything else can have a worker or process terminated, while consumers with broad exception handling are unaffected. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, score 5.3), the flaw does not affect confidentiality or integrity, and there is no public exploit identified at time of analysis - vendor-released patch: 1.1.3.
An out-of-bounds read in LibreOffice's PICT image import path allows a crafted PICT image - one whose stored palette index exceeds the number of entries in its colour palette - to read memory past the end of the palette buffer, crashing the application and potentially disclosing a small amount of adjacent heap memory. Exploitation requires a victim to locally open a document or image that embeds the malicious PICT file; no authentication or non-default configuration is required because PICT import is a standard feature, and the assessed CVSS vector carries an Exploit Maturity of Proof-of-Concept (E:P), indicating proof-of-concept exploit code exists, though there is no confirmed active exploitation (no CISA KEV listing). Our independent assessment rates this as a moderate-severity, denial-of-service-oriented client-side memory-safety bug (CVSS 3.1 base 5.4-equivalent, AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) rather than a high-priority remotely exploitable flaw.
Stack buffer overflow in LibreOffice's font subsetting path can crash the application and corrupt memory when a document containing an embedded CFF font is exported to PDF. The vulnerable routine converts CFF (Compact Font Format) glyphs to Type 1 operators during subsetting and writes them into a fixed-size stack buffer without verifying remaining capacity, so a glyph that emits many operators overflows the buffer (CWE-787). Exploitation is local and requires the victim to open an attacker-supplied document and trigger the subsetting code path (typically a PDF export); the CVSS v4.0 base score is 5.4 with PR:N and UI:P, and despite a proof-of-concept maturity rating (E:P) indicating publicly available exploit code exists, there is no confirmed active exploitation (not in CISA KEV). The most likely outcome is an application crash (VA:H) with limited confidentiality and integrity impact; headless or server-side document-to-PDF conversion services that ingest untrusted files are the highest-risk deployment mode.
Stack-based out-of-bounds write in LibreOffice's CFF font hint parser allows an attacker to corrupt memory and crash the application when a victim opens a document that embeds a maliciously crafted font. Affected are LibreOffice versions before the fix that checks the hint count against the array's actual capacity; exploitation requires the victim to open the crafted file (local vector, user interaction) and no authentication, with confirmed impact limited to a crash plus limited confidentiality/integrity effects-reliable arbitrary code execution is not demonstrated. No CISA KEV listing indicates active exploitation, but the CVSS 4.0 exploit maturity metric E:P indicates publicly available exploit code exists, so patching should be prioritized for users who handle untrusted documents.
Heap buffer overflow in LibreOffice Draw's PDF import path allows a crafted PDF to corrupt heap memory and crash the application when a victim opens or imports the document; the independent assessment rates confidentiality and integrity impact as low but availability impact as high, making denial of service the most realistic outcome. Exploitation requires local delivery and mandatory user interaction, and no authentication or non-default configuration is needed because PDF import is a standard feature. Publicly available exploit code exists per the CVSS 4.0 E:P metric, but there is no confirmed active exploitation (no CISA KEV entry); no EPSS score was provided.
Heap-based buffer overflow in LibreOffice's PDF import filter, reachable through LibreOffice Draw, can crash the application or corrupt heap memory when a victim opens a specially crafted encrypted PDF whose encryption dictionary declares a decryption-key length larger than the fixed-size key buffer the importer fills. Exploitation is local and requires user interaction (AV:L, UI:P/UI:R, PR:N per the CVSS 4.0 vector; the independent assessment is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H), so there is no remote or unauthenticated network trigger and only encrypted PDFs reach the flawed code path; the impact skews heavily toward availability (VA:H) with limited confidentiality and integrity effects. There is no CISA KEV listing indicating confirmed active exploitation, but the supplied CVSS 4.0 vector carries an exploit-maturity metric of E:P, meaning publicly available exploit code exists at proof-of-concept level. This is a moderate-priority memory-corruption bug, not an urgent one, because delivery requires convincing a user to open a malicious encrypted file locally.
Heap buffer overflow in LibreOffice's WMF graphics import path affects documents embedding a crafted Windows Metafile, allowing a local attacker to corrupt memory when the victim opens the file. The flaw arises in a text record that carries its own character advance widths, where the count of advance values and the text length are read independently and need not agree, so rendering walks the advance array past its end when the array is shorter than the text. No public exploit code has been identified at time of analysis, and the impact profile is crash-dominant (confidentiality and integrity Low, availability High), making realistic outcomes denial of service rather than reliable code execution. EPSS is not provided, but exploitation requires the victim to open a malicious document (AV:L, UI:P), so real-world priority is assessed as low despite the MEDIUM CVSS of 5.4.
Uncontrolled resource consumption in IBM Concert 1.0.0 through 3.0.0 allows a remote, unauthenticated attacker to degrade service availability by feeding a specially crafted regular expression through the affected input-processing path, causing excessive CPU and memory consumption. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N, availability impact Low only), no credentials or user interaction are required, but the practical blast radius is bounded: only availability is affected, so expect slowdowns or partial unavailability rather than data compromise or full host takeover, and only on Concert deployments that actually expose the vulnerable input surface to untrusted traffic. No public exploit code has been identified at time of analysis and there is no indication this issue is confirmed actively exploited (CISA KEV); the vendor has published a fix advisory, making this a genuine but low-priority patching item.
Configuration information disclosure in OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 arises because the firmware trusts a client-supplied X-Forwarded-For header when determining the request's source address, so an unauthenticated remote attacker can spoof a loopback address such as 127.0.0.1 and defeat local-connection-only controls on the appliance's non-TLS web interfaces. Successful abuse discloses configuration information only; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms no integrity or availability impact and no authentication or user interaction requirement. The flawed design has been present since at least firmware 2.2.3.4, is fixed in 3.5.4, and no public exploit has been identified at time of analysis, consistent with this being a genuine but modest-severity issue.
Server-side request forgery in Novu prior to 3.18.0 allows an authenticated user to make the notification worker issue attacker-directed POST requests to internal or otherwise restricted network services by supplying a chat webhook URL through subscriber credentials.webhookUrl, channel endpoint.url, event payload.webhookUrl, or event overrides.webhookUrl. The Slack, Discord, Mattermost, Microsoft Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, and Zulip chat providers pass that URL straight into raw HTTP requests in send-message-chat.usecase.ts without the normalizeOutboundHttpUrl, assertSafeOutboundUrl, or DNS-pinned safeOutboundJsonRequest guards that protect Novu's generic webhook providers, resulting in a largely blind, POST-only SSRF whose impact is bounded to interactions or actions offered by the reached internal service (CVSS 5.3; assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Exploitation requires a valid authenticated account and worker-level network reachability to the intended target; no public exploit code has been identified at time of analysis and there is no confirmation of active exploitation (CISA KEV). The issue is fixed in version 3.18.0.
Arbitrary filesystem writes are possible in MPXJ versions 7.3.0 through 16.4.x when an application parses an attacker-supplied Primavera P3 PRX or SureTrak STX file, because the library extracts archive entries to disk without validating that the resolved destination stays inside the intended target directory (CWE-22, a zip-slip style path traversal). The Java library and its ports (pip/mpxj, rubygems/mpxj, nuget/MPXJ.Net, nuget/net.sf.mpxj) are all affected; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates unauthenticated remote exploitation, with the sole impact being integrity (attacker-chosen file writes, including overwrite of existing files reachable by the process). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the real-world risk is gated by whether a consuming application exposes a PRX/STX import path to untrusted input; vendor-released patch: 16.5.0.
Unauthenticated information disclosure in the HPE Aruba Analytics and Location Engine (ALE) API allows any remote attacker who can reach the service to submit specially crafted input to a specific endpoint and retrieve sensitive user data, including password hashes, which can then be cracked or reused to pivot into other systems. No credentials, privileges, or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so the only practical barrier is network exposure of the ALE API, which is typically an internal Aruba/HPE wireless location-analytics component. HPE rates the flaw 5.3 (MEDIUM) with low confidentiality impact, while our independent assessment raises the confidentiality impact to High on the same vector; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so this is a patch-and-segment issue rather than a confirmed active campaign.
Sensitive environment-variable disclosure in ProjectDiscovery Nuclei (versions 3.0.0 through anything before 3.10.0) allows a malicious scan target to smuggle marker-shaped response content that is reinterpreted as template syntax in a later DAST/fuzz step and resolved against the scanner's own variable map, leaking host credentials, API keys, or tokens into scan output. The flaw is an unauthenticated, network-reachable issue (CVSS:3.1/AV:N/AC:H/PR:N/UI:R) but is tightly gated on the scanner host: the operator must run a multi-step DAST or fuzz template, that template must reuse response data through an internal:true extractor, and environment-variable expansion must be explicitly enabled with -env-vars; users who do not enable -env-vars are not affected by the disclosure. No public exploit identified at time of analysis, and this is an incomplete fix for CVE-2026-41645 remediated in Nuclei 3.10.0.
Local file disclosure in ProjectDiscovery Nuclei 3.0.0 through 3.9.x lets an attacker-controlled MySQL-compatible endpoint read arbitrary files off the host running the scanner, even when the local-file sandbox (-allow-local-file-access) is disabled. The nuclei/mysql JavaScript library honors an allowAllFiles MySQL DSN option supplied by an untrusted javascript: template, so the bundled Go MySQL driver accepts LOAD DATA LOCAL INFILE requests and returns file contents to the remote server; exploitation requires an operator to run the malicious template against the attacker's endpoint (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, 5.3). No public exploit code was identified at time of analysis, and the vendor-released fix is version 3.10.0.
Checkmk's REST API discloses stored monitoring credentials - SNMP community strings, SNMPv3 authentication and privacy passphrases, and IPMI passwords - in cleartext inside GET responses from the host and folder configuration endpoints, even though the setup GUI never renders those secrets. The defect affects Checkmk installations below 2.5.0p15, below 2.4.0p37, below 2.3.0p51, and the end-of-life 2.2.0 line, and is reachable only by an authenticated user (CVSS vector PR:L) whose role permits viewing a target host's configuration; an anonymous or unauthenticated attacker cannot trigger it. Scoring is low (vendor CVSS 4.0 base 2.3; independent CVSS 3.1 assessment AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N), and no public exploit code or CISA KEV entry was identified at time of analysis, so the real-world risk is driven mainly by whether valuable SNMP or IPMI secrets have actually been configured on monitored hosts and by how broadly host-config view rights are granted.
Open redirect in e621ng before 26.09.16 lets remote attackers rewrite pagination and navigation links to attacker-controlled origins: query parameters named host, protocol, and port are handed to Rails' url_for, which treats them as URL-generation options rather than ordinary search filters, so the Previous/Next and numbered-page links rendered by PaginatorComponent, several controllers, and the search-trend views point at a malicious domain while the page itself still loads from the legitimate instance. No authentication is required (PR:N) and the assessed vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so exploitation hinges on user interaction - the victim must open an attacker-supplied URL and then click a poisoned link, which is why the issue carries a modest CVSS 4.0 score of 5.3 and an assessed limited-severity rating. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vendor has released a fix in 26.09.16.
Duplicate and misappropriate other vendors' product listings in the MarketKing WordPress plugin before 2.1.72 by exploiting a missing authorization check in the marketking_duplicate_product AJAX action; this requires only subscriber-level access or higher and lets the attacker assign copied products, including private metadata, to their own vendor account. The vulnerability is remotely exploitable but low impact (confidentiality and integrity only, no availability impact), and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released version 2.1.72 as a fix.
Remote unauthenticated attackers can redirect payments on WordPress sites using the Handily plugin (versions up to and including 1.0.3) by modifying Stripe payment settings because of missing authorization checks (CWE-862). They can change publishable keys, secret keys, email addresses, success URLs, and cancel URLs to point to their own Stripe accounts. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 score is 5.3 (Medium).
Unauthenticated attackers can modify the Pixabay, Unsplash, and Pexels API keys configured in the Image Buzz WordPress plugin (versions up to and including 1.0.3) due to missing authorization checks. The flaw, rated CVSS 5.3, allows remote modification of site-wide API key settings without login or user interaction, though it does not enable data theft or code execution. No public exploit or active exploitation has been identified at time of analysis.
Unauthenticated attackers can delete administrator-configured third-party API keys (Pixabay, Unsplash, Pexels, and OpenAI) from WordPress sites running the PixelPlay plugin through version 1.0.2, by sending a request that sets the 'clear_api_type' parameter. The flaw is a missing authorization check (CWE-862) on an endpoint that should be restricted to privileged users, rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - a network-reachable, low-complexity attack with integrity-only impact and no data disclosure or code execution. No public exploit code has been identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); exploitation is only meaningful where an administrator has already stored API keys, and Wordfence is credited with the report.
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input, so an unauthenticated attacker can craft a malicious link that, once clicked by a logged-in user, makes the victim's browser pull attacker-controlled content from an external location and potentially expose data from the active session, producing a high confidentiality impact with no effect on integrity or availability. The issue is network-reachable (AV:N) but requires specific crafting conditions (AC:H) plus victim interaction (UI:R), while the attacker needs no credentials (PR:N); the assessed base score is 5.3 (Medium) on vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. No public exploit code was identified at time of analysis, and the weakness class (CWE-95) points to injection into dynamically evaluated code rather than a default-configuration remote compromise, so the realistic risk is a targeted phishing-style data-theft attempt against authenticated launchpad users with sensitive in-session data.
Layout template disclosure in Dancer2, the Perl web application framework, allows an unauthenticated remote requester to retrieve one of an application's layout templates by requesting a path that is spelled differently from, but resolves identically to, the layout directory. Versions before 2.2.0 are affected, and the flaw is reachable only when the AutoPage handler is explicitly turned on via the auto_page setting, which is off by default; the attacker exploits the gap between the handler's literal text comparison of the request path and the canonicalising lookup that follows, using a doubled slash, a dot segment, a percent-encoded slash, or a differently-cased path on a case-insensitive filesystem. Impact is confined to reading another layout template - no code execution, no credentials, no write access - and no public exploit code has been identified at time of analysis, with EPSS at 0.19% (8th percentile).
LightRAG API server versions prior to 1.5.5 return raw Python exception text to network clients through error handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and lightrag_server.py, leaking server filesystem paths, database host/port/user/name, LLM provider diagnostics, and library internals. Exploitation is unauthenticated (CVSS PR:N) because the server ships with an open default configuration, and it requires only that the API be network-reachable plus a request that triggers a server-side exception; deployments using URI-configured backends whose drivers embed connection strings can also leak credentials. Scored CVSS 3.1 5.3 MEDIUM with confidentiality-only impact, and no public exploit code was identified at time of analysis.
An authorization-check weakness in the Malware Information Sharing Platform (MISP) can allow an authenticated, low-privileged user to reach the previewEventAttributes endpoint because a typo in ACLComponent.php registers the required permission as 'theming_enabled*' - with a trailing asterisk - a string that matches no valid permission identifier in the ACL system. The issue affects MISP instances that ship the affected ACLComponent.php revision (CPE cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*); the practical outcome depends on the ACL evaluator's behavior on an unmatched key, failing open (exposing event attribute data to users who should not see it) or failing closed (denying access to legitimate theming_enabled users). Rated CVSS 4.0 base 5.3 (and CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N in independent review), this is a low-to-moderate-risk authorization flaw rather than an emergency; no public exploit code was identified at time of analysis and no KEV listing or EPSS data was provided.
Path traversal in the MISP OrgImgHelper (findOrgImage) lets an authenticated user who can create or import events craft an organisation name containing '../' sequences so that a filesystem path is built and tested with PHP's file_exists() outside the intended org-image directory. This yields an arbitrary file-existence oracle for any path the web process can read, plus read of files that end in .png or .svg whose resolved name is then rendered or served back to the requester. Exploitation requires an authenticated account with event create/import rights (PR:L) and is confidentiality-only and low impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published an upstream fix (commit e00986075).
Authenticated MISP users holding at least a sharing-group editor role can overwrite organization metadata that should be reserved for site administrators or accounts with sync permissions, because Organisation::captureOrg applies the $force branch without checking perm_site_admin or perm_sync. The result is an integrity-only issue: organization records and the sharing-group and blueprint configurations derived from them can be altered, but no data disclosure or service disruption is possible and the attacker must already have a valid account with elevated (SG editor) privileges on the instance. Vendor fix code exists in upstream commit f3ec974ee, and no public exploit identified at time of analysis.
MISP versions prior to commit 9a2a4acfe allow an authenticated user with the perm_add permission to probe arbitrary filesystem paths through the EventReport::uploadPicture method, leaking file existence and file type via distinct validation error responses. Exploitation requires a valid MISP account with event or attribute creation rights but not administrative access, and it cannot read file contents, write files, or execute code. This is a low-severity information disclosure issue; no public exploit was identified at time of analysis, and the vendor fix is available in commit 9a2a4acfe.
An authenticated user without the perm_add permission can modify suggestion content in MISP event reports via the replaceSuggestionInReport endpoint, due to an ACLComponent wildcard mapping error fixed in MISP 2.5.47. The flaw is limited to authenticated instances, causes only low integrity impact to shared threat-intelligence report data, and no public exploit identified at time of analysis; independent assessment rates it as a genuine but low-severity authorization flaw.
Information disclosure in MISP versions before 2.5.47 lets an authenticated user who holds at least read access to an event view the most recent report attached to that event even when the report's own distribution/ACL setting is more restrictive than the parent event's - or when the report has been soft-deleted. The Overmind event view automatically enriches an event with its latest attached report, and the enrichment query filtered only on the event ID, omitting the report ACL conditions and the deleted flag, so a legitimately authorized but not report-authorized user can read threat-intelligence content they should not see. Exploitation requires an authenticated MISP account with existing read access to the target event (CVSS PR:L), no user interaction beyond opening the Overmind view, and is meaningful only where a more-restricted or soft-deleted report actually exists; the issue is a low-severity confidentiality leak rather than an emergency, and no public exploit identified at time of analysis.
Missing authorization in the MarketKing multivendor marketplace plugin for WordPress (versions before 2.1.72) allows any authenticated user with subscriber-level access or higher to file refund requests against arbitrary orders through the marketking_send_refund AJAX action, simply by supplying someone else's order ID. The flaw is rated CVSS 5.3 / CVSS:3.1 5.3 (AV:N/AC:L/PR:L/UI:N, integrity-only impact) because the attacker needs a valid low-privilege session - a bar that is low on marketplace sites that permit open user self-registration - but gains no data disclosure or privilege escalation. Exploitation is bounded to creating spurious refund requests and marketplace disruption; there is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and a vendor patch is available in 2.1.72.
An authenticated access-control and input-validation weakness in MISP's EventsController.php allows any logged-in user with access to enrichment/analysis functionality to supply a module name that is not in the instance's enabled-modules list, causing queryEnrichment to silently proceed with default parameters (format='simplified', no module-specific configuration) instead of rejecting the request. Successful abuse does not grant code execution or alter data; the assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning confidentiality-only, low impact, with no scope change, so this is a low-severity issue rather than a high-priority emergency. No public exploit code has been identified, and the vendor has published an upstream fix via commit 7dfcc4d32, which should be applied to close the missing-validation gap.
Authenticated MISP users can bypass sharing-group authorization when creating collections by issuing a PUT request to the collections/add endpoint instead of the expected POST. Although the controller applies the sharing-group usability check only for POST, the underlying CRUDComponent::add() persists data on both verbs, letting a low-privileged account set distribution=4 and associate a collection with a sharing group it is not authorized to use. This is a low-severity authorization flaw (CWE-862) requiring a valid session and knowledge of the target sharing-group ID; no public exploit identified at time of analysis, and there is no CISA KEV listing. The vendor fix is available in upstream commit c20f5a836.
Checkmk versions before 2.5.0p14 allow authenticated users with access to the monitoring host and service list APIs to inject newline characters into filter values, which are improperly neutralized. This leads to injection of additional Livestatus query headers, bypassing contact-group-based object visibility in count queries to infer information about hosts and services outside the attacker's authorized groups, and can occupy web server and Livestatus workers for an attacker-controlled duration. The issue is fixed in Checkmk 2.5.0p14, and no public exploit identified at time of analysis.
Parsing a crafted, malformed YAML document with yaml-cpp 0.9.0 can underflow the scanner's indentation stack, crashing the parser and potentially leaking small amounts of process memory. The trigger is an unverified simple key - for example a plain scalar that spans a line break - which leaves a stale reference to an indent level that is subsequently popped, driving Scanner::PopAllIndents() past the bottom of the stack (CWE-822, untrusted pointer dereference); the practical outcome is a denial-of-parse/crash with at most Low confidentiality impact. Only yaml-cpp 0.9.0 is implicated, the consuming application must actually parse untrusted YAML for the bug to be reachable, and the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, 5.1) reflects that local access requirement; EPSS is a low 0.28% (21st percentile) and there is no public exploit code identified at time of analysis, only a crash reproducer documented in upstream issue #1475 and fixed by pull request #1476.
Authenticated file deletion via directory traversal in the CTX Feed (Product Feed Manager for WooCommerce - 220+ Shopping & Social Channels) WordPress plugin affects all versions up to and including 6.6.43: a user holding shop-manager capability or above can abuse the 'provider' parameter to walk out of the intended feed directory and force an unlink() against files whose extensions match the plugin's own whitelist (csv, xml, tsv, xls, xlsx, json, txt). Exploitation is a deliberate two-call REST sequence - first POST to /wp-json/ctxfeed/v1/make_feed/save_feed_config to persist the traversal string in wp_options, then a call to /wp-json/ctxfeed/v1/manage_feeds/delete_feed to trigger the deletion - so there is no unauthenticated path and no victim interaction beyond the attacker's own privileged session. Our independent assessment rates this a moderate, not high-priority, issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L); the frequently repeated 'leads to RCE' framing is sharply constrained because .php files such as wp-config.php cannot be deleted, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated MISP site administrators can abuse the organisation logo-upload handler (OrganisationsController::__uploadLogo) as a filesystem oracle, learning whether arbitrary server paths exist and, for image files, what image type is detected. The flaw affects versions prior to upstream fix commit 12eaadc9e and requires the highest privilege tier (site-admin), which is why it carries a moderate CVSS 4.0 score of 5.1 but low real-world risk. It exposes no file contents and provides no write, execution, or modification primitive, and no public exploit code has been identified at time of analysis.
Path traversal (CWE-22) in MISP's __statisticsOrgs handler in UsersController.php allows an authenticated user holding the privilege to create or rename an organisation (org-admin or site-admin, consistent with the vendor's PR:H) to embed directory traversal sequences in an organisation name and turn the resulting file_exists() call into a boolean oracle for arbitrary file existence on the server. Impact is limited to low-confidentiality information disclosure: no file contents are read, written, or executed, and the vulnerable code path is effectively dead in current MISP deployments because the hard-coded directory app/webroot/img/orgs no longer exists (org logos were relocated to files/img/orgs), so the check never fires. No public exploit code has been identified at time of analysis, there is no CISA KEV entry indicating confirmed active exploitation, and the vendor has published an upstream fix in commit a2f7cba6e.
Reflected cross-site scripting in the MISP attribute histogram view can execute arbitrary JavaScript in the browser of an authenticated MISP user, allowing session cookie theft, actions on behalf of the victim, or exfiltration of data accessible through the MISP interface. The issue stems from the URL-derived type parameter being placed unescaped into a JavaScript array literal inside an inline onClick handler; exploitation requires the authenticated victim to click an attacker-supplied link, and no public exploit identified at time of analysis. The flaw is fixed by upstream commit 95b8f21f6, which replaces manual quoting with JSON encoding and hex escaping.
MISP's event REST search export confirmation form reflects a URL-supplied event ID list into a single-quoted JavaScript string without escaping single quotes, allowing arbitrary JavaScript execution in an authenticated victim's browser. The attacker needs no MISP account, but exploitation requires the victim to be logged in and to open a crafted URL; only unpatched builds using the Default or UiBeta theme are affected, while the Overmind theme's form already uses an escaped data attribute and is not vulnerable to this sink. No public exploit identified at time of analysis, and the impact is bounded to the victim's web session rather than the MISP server itself.
Information disclosure in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a locally authenticated attacker who already holds high privileges read sensitive system information that remains in memory or logs because debug data was not cleared. The assessed vector is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N (4.1), meaning the attacker must already have local access and high privileges, and exploitation additionally depends on uncleared debug artifacts actually being present - a condition outside the attacker's direct control. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS signal provided, so this is best treated as a post-compromise information-gathering weakness rather than an initial-access threat.
Stored cross-site scripting in MISP's admin email composition screen allows a high-privileged user who can modify the MISP.org organization name to inject JavaScript that executes for another authenticated user who later opens that admin email page. Exploitation requires both the privileged configuration change and victim interaction with the affected view, and no public exploit has been identified at time of analysis. A vendor fix is available via upstream commit, though a tagged release version is not independently confirmed.
Reflected cross-site scripting in MISP before 2.5.47 lets an authenticated user craft a URL against the AnalystDataController::viewForObject (__hub) action whose parent object-type parameter is echoed unencoded into the Overmind theme's AnalystData thread element, so an authenticated victim who clicks the link has arbitrary JavaScript executed in their browser within the MISP origin. The attacker must hold a valid MISP account (CVSS PR:L) and the instance must be running the Overmind theme, while the victim must actively follow the crafted URL (UI:A); impact is scoped to the victim's session and page, not the server. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available in the 2.5.47 release line via commit 23b879073. This is a genuine but low-to-moderate priority issue given the authentication, theme, and user-interaction prerequisites.
Arbitrary shell command execution is possible in ProjectDiscovery Nuclei versions 3.0.0 through 3.9.x when DAST mode (-dast) loads an attacker-supplied, unsigned multiprotocol template that combines an HTTP fuzzing: block with a code: block, allowing the embedded unsigned code request to bypass the code-template signature check and run shell commands on the scanning host. The flaw is a signature-verification bypass (CWE-78 command injection) and is constrained in practice: it requires the operator to enable DAST and to point the scanner at a malicious template, and it does not affect users who scan only with trusted, signed first-party templates or who do not use DAST. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); it is fixed in Nuclei 3.10.0. Note that the independent assessment rates the vector at CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, treating confidentiality, integrity, and availability as fully impacted once the payload executes, which is a higher impact picture than the vendor-published 4.7 Medium score.
Reflected cross-site scripting in the x-ui management panel 0.3.2 lets an attacker run arbitrary JavaScript in the browser of an authenticated panel operator who follows a crafted URL, enabling same-origin data theft and unauthorized actions under the victim's session. The attacker requires no authentication (PR:N in the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base score 4.7) - the real precondition is social engineering a logged-in operator into clicking a malicious link, and the scope-changed rating reflects execution inside the panel's own origin with low confidentiality and integrity impact and no availability impact. No public exploit code and no CISA KEV entry were identified at the time of analysis, and the impact stays confined to the victim's already-authenticated browser session rather than affecting unauthenticated visitors or the server itself.
Improper input validation in Adobe Content Credentials - covering both the Content Credentials Rust SDK and the Content Credentials command-line tool - lets a remote attacker bypass security checks and obtain limited unauthorized write access when a victim visits a maliciously crafted URL or interacts with a compromised web page that supplies malformed input. It carries a 4.3 score (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), an on-the-low-end rating driven by the required victim interaction and the integrity-only, limited impact with no confidentiality or availability loss. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the Adobe advisory cited as the reference does not state a fixed version.