Information disclosure in Adobe Connect (server through 12.11 and Android mobile app through 4.4) stems from improper TLS certificate validation that lets an attacker who can intercept the connection present a forged certificate and induce the product to leak sensitive memory contents. The assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N with high confidentiality impact and no integrity or availability effect, reflecting that no authentication or user interaction is required once the attacker holds an active network-intercept position, which remains the hard prerequisite. No public exploit identified at time of analysis and no confirmed active exploitation; the EPSS score is 0.17% (6th percentile), so targeted rather than mass exploitation is the realistic concern.
Malformed UTF-8 passed directly to Perl's Net::IDN::Punycode encode_punycode() before version 2.590 can push the interpreter into an unending loop, abort the process, or return a Punycode label that encodes bytes the input never contained, depending on the Perl version and which backend is selected. Only code paths that call the low-level encoder itself on attacker-influenced, UTF-8-flagged byte strings are exposed, since the documented domain_to_ascii() and email_to_ascii() wrappers perform a Unicode property match first and die on such input, and the decoder is unaffected. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, with an independent assessment adding I:L for the wrong-label case), EPSS is 0.16% at the 6th percentile, CISA SSVC records Exploitation: none and Automatable: yes with partial technical impact, and no public exploit is identified at time of analysis, although the upstream fix commits do include regression tests that reproduce the malformed-input condition.
CPU exhaustion in Net::IDN::UTS46 before version 2.590 lets a single crafted overlong IDN label consume disproportionate CPU, because to_ascii punycode-encodes each label before applying the 63-byte DNS length check and the RFC 3492 encoder's outer loop runs once per distinct non-ASCII code point while rescanning the whole label each pass. Remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability-only impact A:H) who can reach Perl code that normalizes untrusted hostnames or email addresses through to_ascii, domain_to_ascii, or email_to_ascii can stall a request or worker with one input string. No public exploit code has been identified at time of analysis, the vulnerability is not in CISA KEV, and EPSS is low at 0.15% (5th percentile), so this is a genuine but bounded availability risk rather than a broadly exploited one.
CPU exhaustion in Net::IDN::Punycode before 2.590 lets unauthenticated remote attackers pin the CPU of a Perl application by supplying an over-long label to the to-Unicode decoder (domain_to_unicode or uts46_to_unicode), which performs quadratic work as it inserts each decoded code point. The flaw is availability-only (C:N/I:N) and requires no authentication, no user interaction, and no non-default configuration - the only prerequisite is that an application forwards attacker-controlled labels into the to-Unicode direction, since the 63-byte DNS length limit is enforced solely in the to-ASCII direction. A fix is available in the 2.590 release and in two upstream commits (00d7234, 447c6b3); no public exploit code was identified at time of analysis.
Unauthenticated network attackers can crash Ubiquiti UniFi gateway devices by sending crafted traffic that triggers an out-of-bounds write (CWE-787) in the affected firmware, producing a denial-of-service condition that can take the device offline or force a reboot. Tracked as CVE-2026-95862 with a CVSS 3.1 score of 7.5 (HIGH) and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, the flaw is reachable over the network without credentials or user interaction, but its impact is confined entirely to availability - no confidentiality or integrity loss, and no code execution or data disclosure is indicated. Affected product families per the vendor's CPE data include Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways; so far there is no public exploit identified at time of analysis and the issue has not been marked as confirmed actively exploited (CISA KEV).
Denial of service in Ubiquiti UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways) allows an unauthenticated remote attacker reachable over the network to crash the device by triggering uncontrolled recursion (CWE-674), rated CVSS 3.1 base 7.5 HIGH with impact confined to availability (C:N/I:N/A:H). Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials or user interaction are required and complexity is low; the practical gating factor is exposure of the affected service, so gateways with management/service interfaces reachable from the internet or untrusted networks are directly at risk while LAN-confined deployments are exploitable only by a host already on that segment. The outcome is limited to device crash/reboot with no data exposure or code execution; no public exploit identified at time of analysis and no KEV or EPSS data was provided.
Unauthenticated network attackers who can reach an affected Ubiquiti UniFi gateway can trigger an out-of-bounds read (CWE-125) that crashes the device, producing a denial-of-service condition rated 7.5 HIGH. The issue affects the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express/Express 7, and generic UniFi Gateway product lines, and no public exploit code was identified at time of analysis. Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no credentials, user interaction, or special configuration are required - the practical constraint is network exposure, since the attack surface shrinks considerably if the vulnerable service is bound only to a trusted LAN or management interface rather than the WAN or untrusted segments.
Denial of service in UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and other UniFi gateways) can be triggered by an unauthenticated network attacker who sends crafted input to a vulnerable interface, causing an out-of-bounds read (CWE-125) that crashes the device. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, but impact is limited to availability with no confidentiality or integrity loss. Exploitation requires the attacker to reach the exposed vulnerable service; if the affected parser listens only on LAN or management interfaces rather than the WAN, an internet-based attacker would need a foothold. No public exploit code or active exploitation has been identified at time of analysis.
Network-reachable out-of-bounds write in Ubiquiti UniFi gateway devices-including Dream Machine, Dream Router, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways-allows unauthenticated remote attackers to crash the device, causing a denial of service. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning availability-only impact with no confidentiality or integrity loss. No public exploit identified at time of analysis; Ubiquiti Security Advisory Bulletin 069 provides remediation guidance.
Unauthenticated remote attackers who can reach the network-facing services of certain Ubiquiti UniFi gateway devices can trigger an out-of-bounds write that crashes the device, producing a denial-of-service condition (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). The affected product lines span the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express, Express 7 and general UniFi Gateway families, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Exposure is bounded by network position: the CVSS vector confirms no authentication or user interaction is required, but the attacker must still be able to send traffic to the vulnerable service, so gateways whose attack surface is confined to trusted internal segments are materially less exposed than devices reachable from the WAN or other untrusted networks.
Remote, unauthenticated denial of service against applications running FasterXML jackson-core 2.17.0 through 2.18.10: a JSON string of attacker-supplied numeric-looking text coerced into a BigDecimal, BigInteger, Double, or Float target drives NumberInput.looksLikeValidNumber() into quadratic regular-expression backtracking, and a single 160,000-character value was measured at roughly 74 seconds, so a small number of concurrent requests of ordinary body size can exhaust a server's request-handling thread pool. Reachability is narrowed by the data-binding requirement: only endpoints where jackson-databind's StdDeserializer/NumberDeserializers perform String-to-number coercion are exposed, and 2.16.x and earlier do not contain the affected method at all. No public exploit code identified at time of analysis, and no CISA KEV confirmation of active exploitation.
Stored cross-site scripting in GitHub Enterprise Server (3.17 through 3.22 series) allows an authenticated user to inject arbitrary HTML attributes through crafted Markdown that survives initial sanitization but is then re-interpreted by the rendering pipeline's quote-character rewriting step, letting the payload chain same-origin JavaScript gadgets to bypass Content Security Policy and seize control of the page DOM in a victim's browser. When a second user views the rendered content, the attacker can read content visible to that victim, extract embedded CSRF tokens, perform state-changing actions as the victim, and exfiltrate data through same-origin writes, with the payload potentially propagating into any repository or organization where the victim holds write access. Exploitation requires an authenticated account and victim interaction (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N, vendor score 7.4), no public exploit code has been identified at time of analysis, and vendor-released patches exist in 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21.
Heap-based buffer overflow in libslirp's DHCPv6 and TFTP reply builders lets a malicious guest write attacker-controlled content and length past the end of the host-side reply buffer, causing host process crashes (denial of service) and potentially arbitrary code execution in the host. The flaw only manifests when the host interface is configured with a small, non-default MTU - the default MTU is explicitly unaffected - and requires the guest to reach libslirp's built-in DHCPv6 or TFTP service, which makes this a guest-to-host escape surface for QEMU user networking and slirp4netns rootless containers. Red Hat Enterprise Linux 8, 9 and 10 and OpenShift Container Platform 4 ship affected builds; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed vector is unauthenticated (PR:N) but high complexity (AC:H) because of the configuration prerequisite.
Improper restriction of XML external entity references in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker positioned on an adjacent network segment - or elsewhere within the same cluster network - to read sensitive files and internal resources by submitting a crafted XML document to an FTM parsing endpoint. The assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) confirms the exploitation requirements: no credentials and no user interaction are needed, but the adjacent-network prerequisite rather than an internet-facing vector meaningfully narrows the attacker population, and impact is confined strictly to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis, no EPSS signal or CISA KEV listing is present in the provided data, and IBM has published a vendor advisory with a patch available for this CWE-611 flaw.
Cleartext transmission of sensitive information in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can expose financial transaction data to passive interception by an attacker who is positioned on the adjacent network path carrying the affected traffic. Only deployments where a sensitive channel lacks properly configured transport encryption (for example, TLS disabled or misconfigured) are exposed; where channels are protected end to end, the flaw does not arise. Cisco-style remote internet exploitation is not the scenario here, and no public exploit code or confirmed active exploitation was identified at time of analysis. Our independent assessment rates this as a real but low-priority issue, with an assessed vector of CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - adjacent-network access plus a cleartext deployment are both required, making successful exploitation contingent on deployment configuration.
Cross-site request forgery in Adobe Experience Manager Forms JEE (AEM 6.5 and 6.5 LTS) lets an attacker forge requests that bypass a security control and perform unauthorized writes on behalf of a logged-in user, producing a limited availability disruption. The attacker requires no authentication of their own (CVSS vector PR:N), but exploitation depends entirely on a victim who holds a valid AEM Forms JEE session being induced to visit a malicious URL or interact with a compromised page (UI:R); there is no confidentiality impact, and integrity (I:H) plus a minor availability effect (A:L) account for the 7.1 base score. No public exploit code has been identified at time of analysis, and real-world risk is best judged as moderate rather than critical given the victim-interaction prerequisite.
Unauthenticated remote access to an HPE Analytics and Location Engine (ALE) deployment can yield limited sensitive-information disclosure, partial bypass of security controls, or a partial denial of service. The flaw is network-reachable, low complexity, and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 7.3), so it is exploitable by anyone able to reach the ALE service or to intercept and manipulate its network traffic. HPE has published an advisory (hpesbnw05137en_us), and no public exploit code and no CISA KEV entry were identified at time of analysis; with each impact dimension rated only Low, this is a broad but shallow weakness rather than a full-system compromise.
Command execution in the HPE Analytics and Location Engine (ALE) web interface allows remote, high-privilege authenticated users to run arbitrary commands as root on the underlying host, resulting in complete compromise of the appliance. The flaw is network-reachable with low attack complexity and requires no user interaction, but the attacker must already hold valid administrative/high-privilege credentials for the ALE web interface (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 HIGH), which materially narrows the realistic attack surface to organizations running the ALE platform with its web interface exposed. No public exploit code has been identified at time of analysis, and no CISA KEV listing is associated with this CVE; successful exploitation yields full confidentiality, integrity, and availability impact because commands execute with root privileges.
Unauthenticated attackers can bypass authentication in the WordPress plugin Taxi Booking Manager for WooCommerce (Magepeople Inc.) at versions before 2.0.8, reaching plugin functionality that should require a valid session - an alternate path or channel skips the authentication check entirely. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote, unauthenticated, low-complexity, and requires no user interaction on a default install with the plugin (and WooCommerce) active; however, the all-LOW confidentiality, integrity, and availability scores mean the bypass yields only bounded access rather than full administrative takeover. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so this is a genuine unauthenticated authentication-bypass issue whose real-world priority is moderate rather than critical.
Reflected cross-site scripting in Autonomy Logic OpenPLC 3 (OpenPLC Runtime) lets a remote, unauthenticated attacker craft a URL whose routing query-string parameter carries script payload that is reflected into the page without encoding, executing in the browser of any operator who clicks the link while holding an active web-management session. Exploitation is entirely dependent on social engineering of a legitimate operator (UI:R per CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) and the web interface must be network-reachable to that operator. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); impact is confined to the victim's browser session and same-origin web context, with no direct compromise of the PLC runtime or loss of availability.
Local privilege escalation in HP Support Assistant versions prior to 9.55.10.0 allows an authenticated local attacker to gain elevated privileges on affected Windows hosts through insufficient access controls (CWE-269, improper privilege management). The flaw is not remotely reachable and requires the attacker to already hold low-privileged local access plus satisfaction of a specific attack precondition (expressly flagged as AT:P in the CVSS 4.0 vector), which constrains reliable exploitation; no public exploit code and no confirmed active exploitation were identified at time of analysis. Impact is rated high for confidentiality, integrity and availability of the affected host, making patched builds (9.55.10.0 and later) the primary mitigation.
Root-level file system access in HPE Analytics and Location Engine (ALE) can be obtained by an authenticated administrator through the product's maintenance restore function, which processes attacker-supplied restore data with root privileges and permits writes to the host file system (CVSS 3.1 base 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector requires high privileges (PR:H), the practical attack surface is limited to administrators or adversaries who have already compromised an admin account, though the flaw is network-reachable (AV:N) and needs no user interaction (UI:N). No public exploit code was identified and there is no confirmed active exploitation at time of analysis.
Integer overflow combined with improper access control in the core libraries of RTI Connext Professional (versions 7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the 6.1.0 6.1.x branch) allows manipulation of shared resources, giving an attacker high impact to confidentiality, integrity, and availability of the affected host. Exploitation is not remote: it requires local access to a host running the Connext core libraries plus an existing low-privileged authenticated context, and the trigger conditions are hard to control (high attack complexity), so this is realistically a post-compromise privilege/resource escalation on DDS-participant hosts rather than a remotely reachable flaw. No CISA KEV listing and no public exploit code were identified for this issue at time of analysis. This is a genuine but access-gated issue, not a drop-everything remote emergency.
Privilege escalation in the CMP - Coming Soon & Maintenance plugin by NiteoThemes for WordPress, affecting all versions up to and including 4.1.17, lets authenticated attackers with Editor-level access or above rewrite arbitrary WordPress options through the unprotected 'cmp_ajax_import_settings' AJAX action. By pointing the site's default_role at administrator and switching on users_can_register, the attacker can self-register a brand-new administrative account and take full control of the site; the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2) confirms network-reachable, low-complexity exploitation that requires a valid high-privilege session but no user interaction. Remediation status: upstream fix available (WordPress.org plugin repository changeset); released patched version not independently confirmed. Exploitation status: no public exploit identified at time of analysis.
Stored cross-site scripting in the WordPress plugin TranslatePress - Translate Multilingual sites with AI Translation, affecting all versions up to and including 3.3.5, lets unauthenticated attackers plant executable HTML into the translation memory 'original' column through the front-end rendering pipeline, which runs html_entity_decode() on entity-encoded input before the value is persisted from a column that is deliberately exempt from WordPress kses filtering. The injected markup is later rebound into the DOM by the Vue-based Translation Memory Suggestion Panel component (v-html on suggestion.original) and executes in the browser of a privileged administrator who opens that panel, which is why the vendor applies a scope change (S:C) - an unauthenticated payload executes inside an authenticated admin session. No public exploit code and no CISA KEV confirmed active exploitation were identified at time of analysis; the vendor rates this 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while independent assessment conservatively applies UI:R because administrator interaction with the suggestion panel is the required trigger. The vendor-released fix is TranslatePress 3.3.6.
Stored cross-site scripting in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) versions up to and including 3.15.3 allows an unauthenticated visitor to submit a plain, non-rich-text textarea field value that is persisted and later rendered without HTML encoding in the plugin's legacy submission editor, so a crafted payload breaks out of the textarea element and executes as script. The script runs in the WordPress admin origin, but only when a logged-in Administrator opens the specific, attacker-known direct submission URL - meaning the attack requires victim interaction and does not fire automatically. Severity is rated 7.2 (High) by the vendor, while our independent assessment adjusts the vector to UI:R because the described trigger is a manual admin click, clarifying that real-world exploitability is lower than the vendor score implies; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the WP Yelp Review Slider WordPress plugin (all versions up to and including 9.2) lets an unauthenticated attacker plant arbitrary JavaScript that executes in the browser of anyone viewing a page that renders the affected review slider. The payload enters through the Yelp review text pulled in by the plugin's Download Reviews import routine (wpyelp_download_source), so an anonymous party simply publishes a booby-trapped review on the target business's public Yelp listing and waits for a site administrator to import it; no WordPress account on the victim site is needed. This is a conditional, not internet-scale, risk: exploitation requires the admin to actually run an import, and code only fires for subsequent visitors to the affected page, so sites that never import reviews or that have updated past the vulnerable builds are not exposed. No public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Stored cross-site scripting in WPC Product Bundles for WooCommerce, in all versions up to and including 8.6.6, allows an unauthenticated attacker to inject arbitrary JavaScript through the 'qty' parameter that is then persisted in order item metadata under the '_woosb_ids' key. Because the plugin casts the quantity to a float during validation, a numeric-prefixed payload such as '1<img src=x onerror=...>' passes the check while retaining its malicious HTML, which is stored verbatim and executes when a WordPress administrator or shop manager later opens the affected order record. Wordfence reported the issue with a CVSS 3.1 base score of 7.2 and an independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, meaning exploitation also depends on a privileged user viewing the injected data; no public exploit code and no CISA KEV entry were identified at time of analysis, and exploitation additionally requires a WooCommerce store with the plugin active and at least one bundle product available for ordering.
OpenClaw iOS builds before 2026.8.11 write complete agent deep-link URLs - including persistent bearer keys - into the iOS unified log with public diagnostic visibility, so anyone who obtains a diagnostic archive (sysdiagnose bundle, device backup, or MDM-collected log set) can recover those keys and replay them inside forged deep links to submit agent requests without the normal on-device confirmation prompt. Exploitation is local and conditional rather than remote: the recovered bearer key must still be unrotated and valid at replay time, and the attacker must reconstruct a working forged deep link, which is why the assessed vector carries AV:L/AC:H (CVSS:3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N). The status of this issue is that of a genuine but constrained credential-exposure flaw - no public exploit identified at time of analysis, no confirmed actively exploited (CISA KEV) activity, and a vendor patch shipping in 2026.8.11.
Missing authorization in the Kaneo bulk task endpoint (PATCH /api/task/bulk) allows any authenticated workspace member holding only a viewer or member role to permanently delete every task in the workspace or silently rewrite task status, priority, assignee, due date, and labels - actions that all other task endpoints correctly restrict by role. Affected deployments are Kaneo versions 2.3.12 through 2.12.1 (fixed in 2.12.2). Exploitation requires valid credentials and existing membership in the target workspace (PR:L), no user interaction, and no special configuration; no public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the CVSS 4.0 base score is 7.2 (High) reflecting high integrity and availability impact with no confidentiality loss.
Flatpak's root-privileged D-Bus service flatpak-system-helper fails to validate the remote name, ref, and architecture arguments passed to its Deploy, DeployAppstream, InstallBundle, ConfigureRemote, UpdateRemote, RemoveLocalRef, and GenerateOciSummary methods, letting a local unprivileged user supply '/' or other traversal sequences (CWE-22). Successful abuse gives that local user the ability to cause the privileged helper to operate on paths outside the intended repository/metadata locations, yielding high confidentiality and integrity impact on the host. The flaw affects systems with a system-wide Flatpak installation and the helper service active (the default for system installs); exploitation is local only, requires an existing unprivileged login plus the additional precondition captured by the AT:P metric, and single-user desktops or per-user-only installations are far less exposed. Upstream fixes exist as GitHub pull request 6768 and three commits referenced from advisory GHSA-v2gw-v9h5-9q4x; no public exploit code and no CISA KEV listing were identified at time of analysis.
Authenticated users of Unleash (the open-source feature management platform) can bypass project-scoped authorization and reach configuration data and write operations belonging to projects and environments they should not control, due to a cluster of broken-access-control defects fixed in version 8.0.3. The most serious is a missing `await` on an async permission check in POST /api/admin/segments/strategies, which lets any authenticated account with an admin-API session modify segment assignments on any strategy in any project; four additional cross-project IDOR issues (CWE-639) expose variant configurations, strategy configurations, environment information, and permit tag modification across project boundaries. Exploitation requires only a valid Unleash account at any privilege level with network reach to the admin API - no anonymous access and no administrator role - so practical exposure is concentrated in multi-project or multi-tenant deployments where authenticated users are not uniformly trusted with every project; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited.
Authenticated remote attackers can exhaust node memory on Erlang/OTP SSH daemons by repeatedly opening "session" channels that never receive a shell, exec, or subsystem handler, eventually driving the BEAM emulator out of memory and terminating it - which kills every application sharing that node, not just the SSH service. The flaw (CWE-770) affects OTP 17.0 through 27.3.4.18, 28.5.0.7, and 29.1.1 (ssh 3.0.1 through 5.2.11.13, 5.5.2.6, and 6.0.6); an attacker must be able to complete SSH authentication first, but no user interaction, special configuration, or valid file/credential access is required, and CVSS scores it 7.1 (CVSS 4.0 availability-high, PR:L). No public exploit identified at time of analysis, and vendor-released patches are available. The documented max_channels daemon option does not mitigate the attack, so operators cannot rely on it as a stopgap.
Field-level read permission bypass in Twenty CRM before 2.22.0 lets an authenticated workspace member or API key that is allowed to read an object but explicitly denied read on a specific field still reference that denied field inside GraphQL or REST filter predicates, turning the returned totalCount and row presence into a boolean/count oracle that can reconstruct the hidden values. The vulnerability is a bounded confidentiality issue: exploitation requires a principal whose role actually configures field-level read restrictions, and reconstruction only works against records already visible under that principal's row-level policy, and it is iterative across many queries rather than a single-shot dump. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released a patch in Twenty 2.22.0.
Authenticated subscriber-level users can retrieve the complete vendor directory from WordPress sites running MarketKing before 2.1.72 by invoking the marketking_admin_vendors_ajax AJAX action, which lacks a capability check. This exposes internal user IDs, usernames, and email addresses of all registered vendors to any logged-in user, making it a personally identifiable information disclosure issue rather than code execution or data modification. No public exploit identified at time of analysis, and the independent assessment rates real-world risk as low-to-moderate because exploitation requires an account, though open registration on marketplace sites can lower that barrier.
Authenticated attackers with subscriber-level access or above can trash or restore any post, page, or custom post type on WordPress sites running the WP Table Builder - Drag & Drop Table Builder plugin in versions up to and including 2.2.1. The vulnerability arises from a broken authorization check in the plugin's trash_table_bulk() and restore_table_bulk() functions, where an operator precedence bug prevents the intended post-type guard from executing and the permission callback only verifies plugin role membership without per-post-type or ownership checks. With a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H), exploitation requires an authenticated foothold but no user interaction, resulting in high availability impact and limited integrity impact with no confidentiality loss; no public exploit identified at time of analysis.
Root-level remote code execution in HPE Analytics and Location Engine (ALE) can be achieved when an attacker first establishes a man-in-the-middle position on the network path to the appliance's administrative component and an administrator then interacts with that component. The CVSS 7.1 vector (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that no authentication is needed once the MitM and user-interaction preconditions are met, and successful exploitation grants root privileges. No public exploit code has been identified at time of analysis, and the provided data does not specify a patched version.
Hard-coded cryptographic keys and initialization vectors in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allow a remote authenticated attacker (CVSS 3.1 PR:L, 7.1 overall) to decrypt protected sensitive information and forge authentication tags, because the same static key material is baked into every deployment rather than generated per installation. Affected builds are the OpenShift-packaged FTM at 4.0.6.0 (including Interim Fixes 1 through 6) and, per ENISA EUVD, the 4.0.7.0 through 4.0.10.0 Interim Fix 06 range; the decisive prerequisite is compromise of a low-privilege account, and impact is primarily confidentiality with only partial integrity (C:H/I:L/A:N) and no availability loss. Exploitation is currently assessed as none - no public exploit code identified at time of analysis, EPSS only 0.22% (13th percentile), CISA SSVC exploitation "none", automatable "no" - which makes this a moderate-severity, lower-priority issue in practice.
Server-side request forgery (CWE-918) in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift at affected levels allows an authenticated local attacker to coerce the FTM server into issuing attacker-influenced requests, yielding disclosure of sensitive information and enabling unauthorized actions - rated CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), high confidentiality and integrity impact with no availability impact. Exploitation requires a deployed affected FTM instance plus valid low-privilege authenticated access reachable locally (the vector is local, not internet-facing, and user interaction is not required); no public exploit code has been identified at time of analysis and EPSS is 0.15% (5th percentile), while CISA SSVC records Exploitation: none and Automatable: no. This is a moderate-priority, not a drop-everything, issue: the niche financial middleware footprint, locally-scoped vector, and mandatory authentication mean an unauthenticated external attacker cannot exploit it directly against a default internet-facing posture. A vendor patch is available.
Local credential exposure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an already-authenticated, low-privilege local user to read insufficiently protected credentials and then use them to perform unauthorized actions against the environment, yielding high confidentiality and integrity impact with no availability impact. Only deployments running FTM for Red Hat OpenShift 4.0.6.0 through 4.0.10.0 (including the 0.6.0 Refresh build with Operator 4.4.6+20260807.081800 and 4.0.10.0 Interim Fix 064) are affected. Exploitation requires local access plus a valid low-privilege identity; no public exploit code has been identified at time of analysis (EPSS 0.14%, 4th percentile), and CISA SSVC records no known exploitation.
Hard-coded credentials embedded in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let a local, low-privileged attacker - someone with at least an account, shell, pod, or container context in the deployment - reach a privileged FTM interface or data store and both read sensitive information and modify transaction data. Impacted releases include FTM for OpenShift 4.0.6.0 through the 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800), plus 4.0.7.0, 4.0.8.0, 4.0.9.0, and 4.0.10.0 Interim Fix 064. The issue is not remotely exploitable (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 7.1), is not listed in CISA KEV, has no public exploit identified at time of analysis, and carries an EPSS of 0.14% (3rd percentile), keeping realistic risk moderate and largely confined to insiders or attackers who already hold a local foothold.
Privilege escalation in the Adobe Premiere Pro desktop application is achievable through a server-side request forgery flaw (CWE-918) that Adobe's own PSIRT self-reported in advisory APSB26-157, carrying a CVSS 3.1 base score of 7.1 (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N). Because the attack vector is Local, successful exploitation requires the victim's installed copy of Premiere Pro to process attacker-supplied content - in practice a crafted project or media file - and the changed scope (S:C) indicates the forged request reaches a component outside Premiere Pro's own security authority, yielding integrity and privilege-escalation impact with no confidentiality or availability loss. No public exploit code and no CISA KEV entry are associated with this CVE, so no public exploit is identified at time of analysis; note also that the vendor's UI:N claim conflicts with the ordinary desktop file-open workflow, which our assessment scores as UI:R, and this discrepancy is the environment mismatch flagged in the source description and should be verified against APSB26-157 before external publication.
Missing authentication on Postiz's enterprise/reseller organisation provisioning endpoint lets an authenticated low-privilege user escalate into full control of a newly minted top-tier organisation. Because the enterprise controller was omitted from the authentication middleware's allow-list, the route is network-reachable without any session, and its sole gate - a signature check on a token in the request body - is satisfied by the attacker's own ordinary login token, since login tokens are signed with the same instance secret and carry no purpose, audience or expiry claim. The endpoint then creates an organisation on the highest subscription tier flagged lifetime with an oversized channel allowance, provisions an owner account for the attacker, and returns a working API key for the public API in the response body (CVSS 3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L; CWE-306). No public exploit code has been identified at time of analysis, but the attacker only needs any valid account on the instance, which on self-registration-enabled deployments means anyone. Vendor-released patch: v2.24.0.
Missing authorization in the MarketKing multivendor marketplace plugin for WordPress (before 2.1.72) lets any authenticated user with subscriber-level access or higher read other vendors' payout pages, financial reports, and dashboard content by submitting an arbitrary vendor user ID to the marketking_get_page_content AJAX action. Exploitation is a single parameter-tampering request over the network with no victim interaction, but it requires a valid low-privilege session on a site that runs the plugin as an active marketplace with vendor accounts holding financial data, as reflected in the assessed CVSS vector (PR:L, UI:N). Impact is limited to confidentiality - no modification or denial of service is possible - and no public exploit code has been identified at time of analysis; the vendor has released a fix in 2.1.72.
ZenHive mpp versions 0.14.0 through 0.16.1 fail to charge clients that hold an open payment channel, allowing an authenticated client to obtain an unbounded number of paid units from a single signed voucher. The flaw sits in MPP.Session.Actions.accept_voucher/3, which returns the channel unchanged when a voucher's cumulativeAmount equals the already-accepted cumulative amount, so the credential verifies, the protected resource is served, and no spend is recorded; because the server issues a fresh challenge per request and the replay store keys only on challenge id plus payload, the same voucher can be re-presented under every new challenge. The result is a high-integrity billing/accounting bypass (CVSS 4.0 7.1, PR:L) reachable over the network through the Plug, MCP, JSON-RPC and WebSocket transports; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though a vendor patch is available.
Local privilege escalation in the Netdata Windows Agent (versions 2.0.0 through 2.10.3) lets an authenticated low-privileged local user obtain SYSTEM-level code execution by interacting with or hijacking the elevated interactive process windows that the MSI repair action spawns in that user's own desktop session. Carrying a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-269 improper privilege management, exploitation is genuinely constrained: it is local-only, requires the ability to trigger an MSI repair under the host's Windows Installer elevation policy, and depends on a timing/UI race against transient elevated windows, so it is a bounded privilege-escalation issue rather than a remotely reachable emergency. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; the vendor has shipped a fix in stable release 2.10.4.
An off-by-one error in the RTI Connext Professional Core Libraries (CWE-193) produces an out-of-bounds write that can overflow a buffer when a crafted DDS/RTPS message is parsed, affecting Connext Professional 7.4.0 up to (but not including) 7.7.0.1 and 7.0.0 up to (but not including) 7.3.1.6. Per the CVSS 4.0 vector the flaw is remotely reachable over the network with low complexity and requires no authentication and no user interaction, but impact is bounded: there is no confidentiality loss (VC:N) and only partial integrity and availability impact (VI:L/VA:L), giving a medium-severity 6.9 rather than a code-execution-class outcome. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; practical exposure is further limited because DDS middleware is normally deployed on segmented operational networks in robotics, autonomous systems, and aerospace/defense environments rather than being directly internet-facing.
Double free in the Core Libraries of RTI Connext Professional 7.4.0 to 7.7.0.0 and 7.1.0 to 7.3.1.5 allows a local authenticated attacker to manipulate files and cause denial of service. The issue requires local access and low-level privileges, is not remotely reachable, and no public exploit code has been identified. Patches are available in versions 7.7.0.1 and 7.3.1.6.
MISP's pre-authentication TOTP login path can reveal that a disabled account is TOTP-enrolled because the database query omits User.disabled, causing the disabled-account check to evaluate as false and present a TOTP prompt instead of an immediate rejection. This affects unauthenticated remote attackers who can reach UsersController::login(), but no authenticated access is granted because the downstream identify() call re-validates and rejects the disabled account. The practical impact is negligible: a small login-response information leak and a PHP undefined-array-key warning; no public exploit was identified at time of analysis, and the independent assessment rates the issue as low confidentiality impact only.
Blind server-side request forgery in MISP allows unauthenticated remote attackers to coerce the MISP server into making outbound HTTPS requests to arbitrary internal or external targets by POSTing a crafted XML body containing a bare HTTPS URL to the unauthenticated cspReport endpoint. The flaw arises because PHP operator precedence in Xml::build()'s readFile guard (`readFile && http || https`) leaves the HTTPS locator fetch path ungated, and RequestHandlerComponent automatically decodes XML request bodies on write requests. Exploitation is constrained to blind SSRF with no response body returned to the attacker, so it primarily enables probing, timing-based reconnaissance, and triggering GET-style actions on reachable HTTPS services; no public exploit code was identified at time of analysis, and a vendor patch commit is available.