Cleartext transmission of sensitive information in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can expose financial transaction data to passive interception by an attacker who is positioned on the adjacent network path carrying the affected traffic. Only deployments where a sensitive channel lacks properly configured transport encryption (for example, TLS disabled or misconfigured) are exposed; where channels are protected end to end, the flaw does not arise. Cisco-style remote internet exploitation is not the scenario here, and no public exploit code or confirmed active exploitation was identified at time of analysis. Our independent assessment rates this as a real but low-priority issue, with an assessed vector of CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - adjacent-network access plus a cleartext deployment are both required, making successful exploitation contingent on deployment configuration.
Cross-site request forgery in Adobe Experience Manager Forms JEE (AEM 6.5 and 6.5 LTS) lets an attacker forge requests that bypass a security control and perform unauthorized writes on behalf of a logged-in user, producing a limited availability disruption. The attacker requires no authentication of their own (CVSS vector PR:N), but exploitation depends entirely on a victim who holds a valid AEM Forms JEE session being induced to visit a malicious URL or interact with a compromised page (UI:R); there is no confidentiality impact, and integrity (I:H) plus a minor availability effect (A:L) account for the 7.1 base score. No public exploit code has been identified at time of analysis, and real-world risk is best judged as moderate rather than critical given the victim-interaction prerequisite.
Unauthenticated remote access to an HPE Analytics and Location Engine (ALE) deployment can yield limited sensitive-information disclosure, partial bypass of security controls, or a partial denial of service. The flaw is network-reachable, low complexity, and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 7.3), so it is exploitable by anyone able to reach the ALE service or to intercept and manipulate its network traffic. HPE has published an advisory (hpesbnw05137en_us), and no public exploit code and no CISA KEV entry were identified at time of analysis; with each impact dimension rated only Low, this is a broad but shallow weakness rather than a full-system compromise.
Command execution in the HPE Analytics and Location Engine (ALE) web interface allows remote, high-privilege authenticated users to run arbitrary commands as root on the underlying host, resulting in complete compromise of the appliance. The flaw is network-reachable with low attack complexity and requires no user interaction, but the attacker must already hold valid administrative/high-privilege credentials for the ALE web interface (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 HIGH), which materially narrows the realistic attack surface to organizations running the ALE platform with its web interface exposed. No public exploit code has been identified at time of analysis, and no CISA KEV listing is associated with this CVE; successful exploitation yields full confidentiality, integrity, and availability impact because commands execute with root privileges.
Unauthenticated attackers can bypass authentication in the WordPress plugin Taxi Booking Manager for WooCommerce (Magepeople Inc.) at versions before 2.0.8, reaching plugin functionality that should require a valid session - an alternate path or channel skips the authentication check entirely. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote, unauthenticated, low-complexity, and requires no user interaction on a default install with the plugin (and WooCommerce) active; however, the all-LOW confidentiality, integrity, and availability scores mean the bypass yields only bounded access rather than full administrative takeover. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so this is a genuine unauthenticated authentication-bypass issue whose real-world priority is moderate rather than critical.
Local privilege escalation in HP Support Assistant versions prior to 9.55.10.0 allows an authenticated local attacker to gain elevated privileges on affected Windows hosts through insufficient access controls (CWE-269, improper privilege management). The flaw is not remotely reachable and requires the attacker to already hold low-privileged local access plus satisfaction of a specific attack precondition (expressly flagged as AT:P in the CVSS 4.0 vector), which constrains reliable exploitation; no public exploit code and no confirmed active exploitation were identified at time of analysis. Impact is rated high for confidentiality, integrity and availability of the affected host, making patched builds (9.55.10.0 and later) the primary mitigation.
Root-level file system access in HPE Analytics and Location Engine (ALE) can be obtained by an authenticated administrator through the product's maintenance restore function, which processes attacker-supplied restore data with root privileges and permits writes to the host file system (CVSS 3.1 base 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector requires high privileges (PR:H), the practical attack surface is limited to administrators or adversaries who have already compromised an admin account, though the flaw is network-reachable (AV:N) and needs no user interaction (UI:N). No public exploit code was identified and there is no confirmed active exploitation at time of analysis.
Integer overflow combined with improper access control in the core libraries of RTI Connext Professional (versions 7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the 6.1.0 6.1.x branch) allows manipulation of shared resources, giving an attacker high impact to confidentiality, integrity, and availability of the affected host. Exploitation is not remote: it requires local access to a host running the Connext core libraries plus an existing low-privileged authenticated context, and the trigger conditions are hard to control (high attack complexity), so this is realistically a post-compromise privilege/resource escalation on DDS-participant hosts rather than a remotely reachable flaw. No CISA KEV listing and no public exploit code were identified for this issue at time of analysis. This is a genuine but access-gated issue, not a drop-everything remote emergency.
Privilege escalation in the CMP - Coming Soon & Maintenance plugin by NiteoThemes for WordPress, affecting all versions up to and including 4.1.17, lets authenticated attackers with Editor-level access or above rewrite arbitrary WordPress options through the unprotected 'cmp_ajax_import_settings' AJAX action. By pointing the site's default_role at administrator and switching on users_can_register, the attacker can self-register a brand-new administrative account and take full control of the site; the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2) confirms network-reachable, low-complexity exploitation that requires a valid high-privilege session but no user interaction. Remediation status: upstream fix available (WordPress.org plugin repository changeset); released patched version not independently confirmed. Exploitation status: no public exploit identified at time of analysis.
Stored cross-site scripting in the WordPress plugin TranslatePress - Translate Multilingual sites with AI Translation, affecting all versions up to and including 3.3.5, lets unauthenticated attackers plant executable HTML into the translation memory 'original' column through the front-end rendering pipeline, which runs html_entity_decode() on entity-encoded input before the value is persisted from a column that is deliberately exempt from WordPress kses filtering. The injected markup is later rebound into the DOM by the Vue-based Translation Memory Suggestion Panel component (v-html on suggestion.original) and executes in the browser of a privileged administrator who opens that panel, which is why the vendor applies a scope change (S:C) - an unauthenticated payload executes inside an authenticated admin session. No public exploit code and no CISA KEV confirmed active exploitation were identified at time of analysis; the vendor rates this 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while independent assessment conservatively applies UI:R because administrator interaction with the suggestion panel is the required trigger. The vendor-released fix is TranslatePress 3.3.6.
Stored cross-site scripting in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) versions up to and including 3.15.3 allows an unauthenticated visitor to submit a plain, non-rich-text textarea field value that is persisted and later rendered without HTML encoding in the plugin's legacy submission editor, so a crafted payload breaks out of the textarea element and executes as script. The script runs in the WordPress admin origin, but only when a logged-in Administrator opens the specific, attacker-known direct submission URL - meaning the attack requires victim interaction and does not fire automatically. Severity is rated 7.2 (High) by the vendor, while our independent assessment adjusts the vector to UI:R because the described trigger is a manual admin click, clarifying that real-world exploitability is lower than the vendor score implies; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the WP Yelp Review Slider WordPress plugin (all versions up to and including 9.2) lets an unauthenticated attacker plant arbitrary JavaScript that executes in the browser of anyone viewing a page that renders the affected review slider. The payload enters through the Yelp review text pulled in by the plugin's Download Reviews import routine (wpyelp_download_source), so an anonymous party simply publishes a booby-trapped review on the target business's public Yelp listing and waits for a site administrator to import it; no WordPress account on the victim site is needed. This is a conditional, not internet-scale, risk: exploitation requires the admin to actually run an import, and code only fires for subsequent visitors to the affected page, so sites that never import reviews or that have updated past the vulnerable builds are not exposed. No public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Stored cross-site scripting in WPC Product Bundles for WooCommerce, in all versions up to and including 8.6.6, allows an unauthenticated attacker to inject arbitrary JavaScript through the 'qty' parameter that is then persisted in order item metadata under the '_woosb_ids' key. Because the plugin casts the quantity to a float during validation, a numeric-prefixed payload such as '1<img src=x onerror=...>' passes the check while retaining its malicious HTML, which is stored verbatim and executes when a WordPress administrator or shop manager later opens the affected order record. Wordfence reported the issue with a CVSS 3.1 base score of 7.2 and an independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, meaning exploitation also depends on a privileged user viewing the injected data; no public exploit code and no CISA KEV entry were identified at time of analysis, and exploitation additionally requires a WooCommerce store with the plugin active and at least one bundle product available for ordering.
OpenClaw iOS builds before 2026.8.11 write complete agent deep-link URLs - including persistent bearer keys - into the iOS unified log with public diagnostic visibility, so anyone who obtains a diagnostic archive (sysdiagnose bundle, device backup, or MDM-collected log set) can recover those keys and replay them inside forged deep links to submit agent requests without the normal on-device confirmation prompt. Exploitation is local and conditional rather than remote: the recovered bearer key must still be unrotated and valid at replay time, and the attacker must reconstruct a working forged deep link, which is why the assessed vector carries AV:L/AC:H (CVSS:3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N). The status of this issue is that of a genuine but constrained credential-exposure flaw - no public exploit identified at time of analysis, no confirmed actively exploited (CISA KEV) activity, and a vendor patch shipping in 2026.8.11.
Missing authorization in the Kaneo bulk task endpoint (PATCH /api/task/bulk) allows any authenticated workspace member holding only a viewer or member role to permanently delete every task in the workspace or silently rewrite task status, priority, assignee, due date, and labels - actions that all other task endpoints correctly restrict by role. Affected deployments are Kaneo versions 2.3.12 through 2.12.1 (fixed in 2.12.2). Exploitation requires valid credentials and existing membership in the target workspace (PR:L), no user interaction, and no special configuration; no public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the CVSS 4.0 base score is 7.2 (High) reflecting high integrity and availability impact with no confidentiality loss.
Flatpak's root-privileged D-Bus service flatpak-system-helper fails to validate the remote name, ref, and architecture arguments passed to its Deploy, DeployAppstream, InstallBundle, ConfigureRemote, UpdateRemote, RemoveLocalRef, and GenerateOciSummary methods, letting a local unprivileged user supply '/' or other traversal sequences (CWE-22). Successful abuse gives that local user the ability to cause the privileged helper to operate on paths outside the intended repository/metadata locations, yielding high confidentiality and integrity impact on the host. The flaw affects systems with a system-wide Flatpak installation and the helper service active (the default for system installs); exploitation is local only, requires an existing unprivileged login plus the additional precondition captured by the AT:P metric, and single-user desktops or per-user-only installations are far less exposed. Upstream fixes exist as GitHub pull request 6768 and three commits referenced from advisory GHSA-v2gw-v9h5-9q4x; no public exploit code and no CISA KEV listing were identified at time of analysis.
Authenticated users of Unleash (the open-source feature management platform) can bypass project-scoped authorization and reach configuration data and write operations belonging to projects and environments they should not control, due to a cluster of broken-access-control defects fixed in version 8.0.3. The most serious is a missing `await` on an async permission check in POST /api/admin/segments/strategies, which lets any authenticated account with an admin-API session modify segment assignments on any strategy in any project; four additional cross-project IDOR issues (CWE-639) expose variant configurations, strategy configurations, environment information, and permit tag modification across project boundaries. Exploitation requires only a valid Unleash account at any privilege level with network reach to the admin API - no anonymous access and no administrator role - so practical exposure is concentrated in multi-project or multi-tenant deployments where authenticated users are not uniformly trusted with every project; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited.
Authenticated remote attackers can exhaust node memory on Erlang/OTP SSH daemons by repeatedly opening "session" channels that never receive a shell, exec, or subsystem handler, eventually driving the BEAM emulator out of memory and terminating it - which kills every application sharing that node, not just the SSH service. The flaw (CWE-770) affects OTP 17.0 through 27.3.4.18, 28.5.0.7, and 29.1.1 (ssh 3.0.1 through 5.2.11.13, 5.5.2.6, and 6.0.6); an attacker must be able to complete SSH authentication first, but no user interaction, special configuration, or valid file/credential access is required, and CVSS scores it 7.1 (CVSS 4.0 availability-high, PR:L). No public exploit identified at time of analysis, and vendor-released patches are available. The documented max_channels daemon option does not mitigate the attack, so operators cannot rely on it as a stopgap.
Field-level read permission bypass in Twenty CRM before 2.22.0 lets an authenticated workspace member or API key that is allowed to read an object but explicitly denied read on a specific field still reference that denied field inside GraphQL or REST filter predicates, turning the returned totalCount and row presence into a boolean/count oracle that can reconstruct the hidden values. The vulnerability is a bounded confidentiality issue: exploitation requires a principal whose role actually configures field-level read restrictions, and reconstruction only works against records already visible under that principal's row-level policy, and it is iterative across many queries rather than a single-shot dump. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released a patch in Twenty 2.22.0.
Authenticated subscriber-level users can retrieve the complete vendor directory from WordPress sites running MarketKing before 2.1.72 by invoking the marketking_admin_vendors_ajax AJAX action, which lacks a capability check. This exposes internal user IDs, usernames, and email addresses of all registered vendors to any logged-in user, making it a personally identifiable information disclosure issue rather than code execution or data modification. No public exploit identified at time of analysis, and the independent assessment rates real-world risk as low-to-moderate because exploitation requires an account, though open registration on marketplace sites can lower that barrier.
Authenticated attackers with subscriber-level access or above can trash or restore any post, page, or custom post type on WordPress sites running the WP Table Builder - Drag & Drop Table Builder plugin in versions up to and including 2.2.1. The vulnerability arises from a broken authorization check in the plugin's trash_table_bulk() and restore_table_bulk() functions, where an operator precedence bug prevents the intended post-type guard from executing and the permission callback only verifies plugin role membership without per-post-type or ownership checks. With a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H), exploitation requires an authenticated foothold but no user interaction, resulting in high availability impact and limited integrity impact with no confidentiality loss; no public exploit identified at time of analysis.
Root-level remote code execution in HPE Analytics and Location Engine (ALE) can be achieved when an attacker first establishes a man-in-the-middle position on the network path to the appliance's administrative component and an administrator then interacts with that component. The CVSS 7.1 vector (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that no authentication is needed once the MitM and user-interaction preconditions are met, and successful exploitation grants root privileges. No public exploit code has been identified at time of analysis, and the provided data does not specify a patched version.
Hard-coded cryptographic keys and initialization vectors in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allow a remote authenticated attacker (CVSS 3.1 PR:L, 7.1 overall) to decrypt protected sensitive information and forge authentication tags, because the same static key material is baked into every deployment rather than generated per installation. Affected builds are the OpenShift-packaged FTM at 4.0.6.0 (including Interim Fixes 1 through 6) and, per ENISA EUVD, the 4.0.7.0 through 4.0.10.0 Interim Fix 06 range; the decisive prerequisite is compromise of a low-privilege account, and impact is primarily confidentiality with only partial integrity (C:H/I:L/A:N) and no availability loss. Exploitation is currently assessed as none - no public exploit code identified at time of analysis, EPSS only 0.22% (13th percentile), CISA SSVC exploitation "none", automatable "no" - which makes this a moderate-severity, lower-priority issue in practice.
Server-side request forgery (CWE-918) in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift at affected levels allows an authenticated local attacker to coerce the FTM server into issuing attacker-influenced requests, yielding disclosure of sensitive information and enabling unauthorized actions - rated CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), high confidentiality and integrity impact with no availability impact. Exploitation requires a deployed affected FTM instance plus valid low-privilege authenticated access reachable locally (the vector is local, not internet-facing, and user interaction is not required); no public exploit code has been identified at time of analysis and EPSS is 0.15% (5th percentile), while CISA SSVC records Exploitation: none and Automatable: no. This is a moderate-priority, not a drop-everything, issue: the niche financial middleware footprint, locally-scoped vector, and mandatory authentication mean an unauthenticated external attacker cannot exploit it directly against a default internet-facing posture. A vendor patch is available.
Local credential exposure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an already-authenticated, low-privilege local user to read insufficiently protected credentials and then use them to perform unauthorized actions against the environment, yielding high confidentiality and integrity impact with no availability impact. Only deployments running FTM for Red Hat OpenShift 4.0.6.0 through 4.0.10.0 (including the 0.6.0 Refresh build with Operator 4.4.6+20260807.081800 and 4.0.10.0 Interim Fix 064) are affected. Exploitation requires local access plus a valid low-privilege identity; no public exploit code has been identified at time of analysis (EPSS 0.14%, 4th percentile), and CISA SSVC records no known exploitation.
Hard-coded credentials embedded in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let a local, low-privileged attacker - someone with at least an account, shell, pod, or container context in the deployment - reach a privileged FTM interface or data store and both read sensitive information and modify transaction data. Impacted releases include FTM for OpenShift 4.0.6.0 through the 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800), plus 4.0.7.0, 4.0.8.0, 4.0.9.0, and 4.0.10.0 Interim Fix 064. The issue is not remotely exploitable (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 7.1), is not listed in CISA KEV, has no public exploit identified at time of analysis, and carries an EPSS of 0.14% (3rd percentile), keeping realistic risk moderate and largely confined to insiders or attackers who already hold a local foothold.
Privilege escalation in the Adobe Premiere Pro desktop application is achievable through a server-side request forgery flaw (CWE-918) that Adobe's own PSIRT self-reported in advisory APSB26-157, carrying a CVSS 3.1 base score of 7.1 (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N). Because the attack vector is Local, successful exploitation requires the victim's installed copy of Premiere Pro to process attacker-supplied content - in practice a crafted project or media file - and the changed scope (S:C) indicates the forged request reaches a component outside Premiere Pro's own security authority, yielding integrity and privilege-escalation impact with no confidentiality or availability loss. No public exploit code and no CISA KEV entry are associated with this CVE, so no public exploit is identified at time of analysis; note also that the vendor's UI:N claim conflicts with the ordinary desktop file-open workflow, which our assessment scores as UI:R, and this discrepancy is the environment mismatch flagged in the source description and should be verified against APSB26-157 before external publication.
Missing authentication on Postiz's enterprise/reseller organisation provisioning endpoint lets an authenticated low-privilege user escalate into full control of a newly minted top-tier organisation. Because the enterprise controller was omitted from the authentication middleware's allow-list, the route is network-reachable without any session, and its sole gate - a signature check on a token in the request body - is satisfied by the attacker's own ordinary login token, since login tokens are signed with the same instance secret and carry no purpose, audience or expiry claim. The endpoint then creates an organisation on the highest subscription tier flagged lifetime with an oversized channel allowance, provisions an owner account for the attacker, and returns a working API key for the public API in the response body (CVSS 3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L; CWE-306). No public exploit code has been identified at time of analysis, but the attacker only needs any valid account on the instance, which on self-registration-enabled deployments means anyone. Vendor-released patch: v2.24.0.
Missing authorization in the MarketKing multivendor marketplace plugin for WordPress (before 2.1.72) lets any authenticated user with subscriber-level access or higher read other vendors' payout pages, financial reports, and dashboard content by submitting an arbitrary vendor user ID to the marketking_get_page_content AJAX action. Exploitation is a single parameter-tampering request over the network with no victim interaction, but it requires a valid low-privilege session on a site that runs the plugin as an active marketplace with vendor accounts holding financial data, as reflected in the assessed CVSS vector (PR:L, UI:N). Impact is limited to confidentiality - no modification or denial of service is possible - and no public exploit code has been identified at time of analysis; the vendor has released a fix in 2.1.72.
ZenHive mpp versions 0.14.0 through 0.16.1 fail to charge clients that hold an open payment channel, allowing an authenticated client to obtain an unbounded number of paid units from a single signed voucher. The flaw sits in MPP.Session.Actions.accept_voucher/3, which returns the channel unchanged when a voucher's cumulativeAmount equals the already-accepted cumulative amount, so the credential verifies, the protected resource is served, and no spend is recorded; because the server issues a fresh challenge per request and the replay store keys only on challenge id plus payload, the same voucher can be re-presented under every new challenge. The result is a high-integrity billing/accounting bypass (CVSS 4.0 7.1, PR:L) reachable over the network through the Plug, MCP, JSON-RPC and WebSocket transports; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though a vendor patch is available.
Local privilege escalation in the Netdata Windows Agent (versions 2.0.0 through 2.10.3) lets an authenticated low-privileged local user obtain SYSTEM-level code execution by interacting with or hijacking the elevated interactive process windows that the MSI repair action spawns in that user's own desktop session. Carrying a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-269 improper privilege management, exploitation is genuinely constrained: it is local-only, requires the ability to trigger an MSI repair under the host's Windows Installer elevation policy, and depends on a timing/UI race against transient elevated windows, so it is a bounded privilege-escalation issue rather than a remotely reachable emergency. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; the vendor has shipped a fix in stable release 2.10.4.
Unsafe reflection in Apache Calcite Avatica before 1.29.0 allows an attacker who can influence plugin-instantiation parameters to force the loading and static initialization of arbitrary classes on the server classpath. Exploitation requires low privileges (PR:L per the assessed CVSS vector) and a dangerous static-initializer gadget already present on the classpath; the vendor states no well-known class currently satisfies this, so real-world risk is low despite the RCE tag. No public exploit code or active exploitation has been identified at time of analysis.