Unrestricted file upload in JosephChuks php-file-manager-with-code-editor through 3.0 lets an attacker with low privileges upload arbitrary files via the move_uploaded_file call in filemanager.php, potentially achieving PHP code execution if the uploaded file lands in a web-executable directory. The flaw is CWE-434 and carries an upstream CVSS 4.0 score of 6.9, while the independent CVSS 3.1 assessment rates PR:L with high confidentiality/integrity/availability impact and cautions that reachability without authentication and final execution location are unconfirmed. No public exploit code has been identified, and the vendor did not respond to disclosure.
MISP installer scripts for Debian 12/13, Ubuntu 24.04, and RHEL 9.4 write all installation output - including the generated admin password, database passwords, GPG passphrase, and supervisor password - into /var/log/misp_install.log, which is created world-readable (typically 0644) under the system default umask, with a companion world-readable FIFO at /var/log/misp_install.log.pipe. Any local unprivileged user on the host can read these credentials, and because the log persists after installation, the exposure is durable rather than limited to the install window; a pre-existing symlink in /var/log could also have redirected the write to an arbitrary location since the file was not removed before creation. The flaw affects MISP versions below 2.5.47 and requires a local account on a machine where an administrator has run one of the affected installer scripts; no public exploit code was identified at time of analysis. A vendor patch is available via upstream commit d5d72ab38, which forces root-only 0600 permissions on both the log and the FIFO.
Cross-site request forgery in MISP (Malware Information Sharing Platform) before v2.5.47 lets an unauthenticated attacker cause an authenticated administrator's browser to execute arbitrary workflow modules on the victim instance. Because the WorkflowsController's moduleStatelessExecution action was listed in CakePHP's unlockedActions, both the CSRF token check and the form field-hash validation were disabled, so an attacker-crafted cross-site form post submitted by a logged-in admin runs a module's exec() method with attacker-chosen input and parameters - including action modules that write blocklist and warninglist entries. The result is a high-integrity, low-complexity compromise of security-relevant data with no confidentiality or availability impact, and no public exploit code identified at time of analysis; this is a genuine but moderate-priority integrity flaw rather than an inflated high-CVSS finding, requiring the victim admin to be authenticated and induced to submit the crafted request.
Path traversal in changedetection.io 0.60.7 and earlier allows remote attackers to read limited files outside the intended screenshot directory by manipulating the filename argument in the Screenshot Handler's static_content route in changedetectionio/flask_app.py, with no authentication or user interaction required per the vector (PR:N/UI:N). Exploitation is meaningfully constrained by high attack complexity (AC:H) and a 'difficult' exploitability rating, and the impact is confidentiality-only and low (VC:L), so this is a moderate-priority issue rather than a critical one. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the vendor was contacted early about the disclosure but did not respond.
A timing side-channel in the password comparison routine (check_password in changedetectionio/flask_app.py) of dgtlmoon changedetection.io through version 0.60.7 allows remote, unauthenticated attackers to infer the shared application password character-by-character by measuring response-time differences. Exploitation is rated difficult (CVSS AC:H) and publicly available exploit code exists, though the practical signal is heavily degraded by network jitter, TLS/reverse-proxy overhead, and interpreter noise; only confidentiality of the single shared login secret is at risk, with no integrity or availability impact. No vendor patch has been identified at time of analysis, and the vendor did not respond to the disclosure.
Authentication bypass in the Keycloak (Red Hat Build of Keycloak) Kerberos federation provider lets an attacker on the same or adjacent network impersonate the Key Distribution Center and bypass Kerberos password authentication, potentially gaining unauthorized access to user accounts. The flaw only manifests in the specific, non-default configuration where Kerberos PASSWORD authentication is used while SPNEGO is disabled, because that mode never requests a server ticket to verify the KDC's identity. Rated CVSS 3.1 6.8 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), exploitation requires network adjacency and an active on-path spoofing operation; no public exploit code has been identified and the CVE has not been listed as confirmed actively exploited (CISA KEV).
Out-of-bounds read in the Core Libraries of RTI Connext Professional allows a locally positioned attacker with low-level privileges on a host running the middleware to trigger an overread that can crash or destabilize the affected process, producing a denial-of-service condition. Affected builds span 7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the 6.1.x, 6.0.x, 5.3.x, 5.2.x and 5.0.0-5.1.x branches; systems already on the fixed builds are not exposed. The impact is availability-only with no confidentiality or integrity effect, and because the attack requires local access and valid credentials rather than network reachability, realistic exposure is limited to insider or already-foothold scenarios causing service disruption. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Out-of-bounds reads in the Core Libraries of RTI Connext Professional can be triggered by local attackers who already hold low-privilege access to a host running the RTI Connext data bus, causing the middleware process to crash and disrupting availability. The flaw affects Connext Professional versions 7.4.0 through 7.7.0.0, 7.3.0 through 7.3.1.5, and 6.1.2.21 onward within the 6.1.* line, and stems from a combination of type confusion, a function called with an incorrect number of arguments, and resulting buffer over-reads in the Core Libraries. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), and because exploitation requires local access plus valid low-privilege credentials while the sole impact is a process crash, the realistic priority is low-to-medium rather than matching the raw 6.8 CVSS 4.0 base score.
An out-of-bounds read combined with type confusion in the Core Libraries of RTI Connext Professional (versions 7.4.0 before 7.7.0.1, and 7.3.0 before 7.3.1.6) lets a local attacker with low privileges feed a crafted malformed data type or message that the library misinterprets, producing buffer overreads and a high-availability impact such as a crash of the affected process. The vendor's CVSS 4.0 vector (6.8, MEDIUM: AV:L/AC:L/AT:N/PR:L/UI:N, VC:N/VI:N/VA:H) describes a strictly availability-impacting flaw with no confidentiality or integrity compromise claimed, and the independently assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) agrees. Exploitation requires local access to the host running the Core Libraries rather than remote reach into a DDS domain, and at time of analysis no public exploit code or confirmed active exploitation was identified.
Downgrade attacks against the Tauri updater plugin (tauri-plugin-updater) 2.8.0 through 2.11.x are possible because the plugin's `check` IPC command accepts an `allowDowngrades` boolean directly from frontend JavaScript, letting any code running in the app webview flip the version check from "update must be newer" to "update must be different." Where the default permission set grants allow-check to the webview, an attacker who already has an XSS foothold in the application frontend can invoke this command unauthenticated and, if they also control or compromise the update endpoint to serve an older but still validly signed release, force the app to roll back to a vulnerable version. Exploitation is conditional - it requires a pre-existing XSS, the default permission set, no custom Rust-side version comparator, and influence over the update feed - and carries a user-interaction requirement (UI:R); no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV. The practical impact is an integrity and access-control failure (our assessment scores it C:N/I:H/A:N) rather than a confidentiality compromise.
Session fixation in web.py 0.76 allows a remote attacker who can plant a known session_id in a victim's browser cookie to inherit that victim's authenticated session, because the built-in Session component never regenerates the identifier after login. The flaw is unauthenticated from the attacker's perspective (PR:N) but requires user interaction (UI:R) and a working cookie-fixation vector (AC:H), yielding a CVSS 3.1 base score of 6.8 with high confidentiality and integrity impact scoped to the individual victim's account rather than the server. No public exploit code and no confirmed active exploitation were identified at time of analysis; impact is limited to web.py 0.76 applications that use the framework's native Session handling for authenticated sessions.
Improper input validation in Adobe CAI Content Credentials (the Rust SDK and the command-line tool) lets remote, unauthenticated attackers bypass integrity protections and gain unauthorized write access to Content Credentials data when a victim processes attacker-controlled content - a maliciously crafted URL or a compromised web page. Affected organizations are those embedding the Content Credentials Rust SDK or running the command-line tool in content pipelines; the impact is limited to integrity (C:N/I:H/A:N), meaning tampered provenance/manifest data rather than data theft, denial of service, or code execution. No public exploit identified at time of analysis and the issue is not reported as actively exploited; Adobe has published advisory APSB26-147, so patched builds should be applied as routine hygiene.
Information disclosure in LibreOffice allows a crafted document containing hyperlinks to cause local environment-variable and INI-file values to be expanded into the URL and exfiltrated to a remote server when the victim opens the file. The flaw is an incomplete fix for CVE-2024-12426: the earlier guard matched only some ways of naming the package content provider, so a URL naming it differently still reached the expansion logic, whereas fixed builds match the provider during URL checking. Exploitation requires the victim to open an attacker-supplied document (UI:R / UI:P) on the local attack vector, there is no public exploit identified at time of analysis, and the primary impact is confidentiality only (no integrity or availability loss).
Cross-environment integration tampering in Novu before 3.18.0 lets an authenticated caller who holds an environment-scoped API key or a dashboard (JWT) session for one environment act on an integration that belongs to a different environment within the same organization, deleting it, rewriting its provider credentials, promoting it to primary, or triggering auto-configuration by supplying the target environment's integrationId. The advisory-defined scope covers both environment API keys and dashboard sessions, but the v3.18.0 release closes only the environment-scoped API-key path (HTTP 403, 'is scoped to a single environment') while its own tests deliberately preserve cross-environment dashboard-session behavior, so 3.18.0 is a partial remediation and installations at or above that version remain exposed through the JWT/dashboard vector. Severity is moderate (CVSS 6.5, CWE-639): integrity and availability are fully impacted while confidentiality is not, no cross-organization access is possible, exploitation requires existing authenticated access plus knowledge or enumeration of a target integrationId, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Denial of service in the Python icalendar library (versions 6.1.0 through 7.2.1) allows unauthenticated attackers to exhaust CPU and heap memory by supplying iCalendar content whose VALARM REPEAT property carries an extremely large value. Parsing the file is harmless on its own; the resource exhaustion fires only when an application then reads alarm-expansion properties such as Alarms.times, Alarms.active (affected since 6.1.0) or Alarm.triggers (affected since 7.0.0), which eagerly materialize the repeated alarm occurrences because no application-level cap existed before the fix. The assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so the sole impact is availability - this is a CWE-400 resource-exhaustion flaw, not code execution or data compromise, and no public exploit code was identified at time of analysis. Vendor-released patch: 7.2.2.
A denial of service in Netdata Agent versions prior to 2.10.4 lets an authenticated streaming child agent crash the parent Netdata agent that collects its metrics, repeatedly disabling centralized monitoring. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5), the attacker must already be an accepted child in the parent-child streaming topology and then sends an oversized CHART SLOT value in the plugins.d streaming protocol; the parent parses it as a chart-cache index, attempts an approximately 16 GiB allocation for the chart-pointer array, fails, and aborts via fatal(). There is no confidentiality or integrity impact, and no public exploit code has been identified at time of analysis (the vulnerability is not in CISA KEV); the real risk is bounded and operational, concentrated in deployments that accept streaming children and in multitenant or partially trusted streaming setups.
An authenticated Netdata child agent can crash its parent agent by streaming an oversized DIMENSION SLOT value in the plugins.d protocol, triggering an integer overflow that leads to a heap out-of-bounds write and termination of the parent process. Affected deployments are Netdata parent-child streaming setups running versions prior to 2.10.4 (including nightly builds earlier than 2.10.0-782-nightly); the attacker must already control or have compromised a child agent that is authenticated to the parent, so exploitation is limited to denial of service with no confidentiality or integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; risk is moderate rather than urgent, and it is fully closed by upgrading to the fixed release.
Arbitrary file read in BM Content Builder plugin for WordPress versions before 3.17.1 allows authenticated attackers with at least Subscriber-level access to read the contents of files on the server. The flaw is a directory traversal issue in the ux_cb_page_customize_save_layout_ajax() AJAX handler, and it requires only an authenticated request, with no additional user interaction. No public exploit code was identified at time of analysis, and the impact is confidentiality-only, making this a moderate-priority authenticated vulnerability rather than an actively exploited one.
Denial of service in NVIDIA Infrastructure Controller for Linux affects versions 0 through 1.9, where an attacker who already holds valid low-privilege credentials on the controller can trigger uncontrolled resource consumption that degrades or halts the service (CWE-400). The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects a remotely reachable flaw with low attack complexity and no user interaction, but impact is confined to availability - there is no data disclosure or modification. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, so real-world risk is bounded primarily by the requirement for authenticated access to the controller.
Denial of service in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated, low-privileged user with network reach to the management interface exhaust resources and degrade or halt the controller. The flaw is a CWE-400 uncontrolled resource consumption issue rated vendor CVSS 3.1 base 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning availability-only impact, no confidentiality or integrity loss, low attack complexity, and no user interaction, with the credential requirement being the principal barrier to exploitation. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, no EPSS score was provided, and the exact triggering request or feature is not disclosed in the vendor description.
Unauthenticated writes to the Netdata settings store are possible in versions 2.0.0 through 2.10.x because the /api/v3/settings endpoint was registered with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, letting remote callers send PUT requests that bypass the operator-configured 'allow dashboard from' IP allowlist. An attacker with network reachability to the agent's HTTP/dashboard listener (default TCP 19999) can persist attacker-controlled JSON into {varlib}/settings/default.json, tamper with its version counter, and repeatedly push near-20 MiB payloads to exhaust disk space, though the file does not govern data collection or security policy. Impact is capped at low integrity and low availability (CVSS 3.1 base 6.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L); no public exploit code was identified at time of analysis and there is no evidence of confirmed active exploitation. The issue is fixed in Netdata 2.11.0.
An authenticated remote user of IBM Concert versions 1.0.0 through 3.0.0 can degrade or deny service availability by driving storage consumption past the limits the product is supposed to enforce. The vulnerability is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning the attacker needs a valid account and network reachability to the Concert service but no user interaction; the only impacted security property is availability, with no confidentiality or integrity loss. Exploitation requires the improperly enforced storage limits tracked as CWE-400 to be exhausted, so the practical effect is resource exhaustion leading to denial of service. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and a vendor patch is published, which materially lowers the urgency of this availability-only issue.
Authenticated path traversal in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a remote attacker holding a valid FTM account manipulate file paths in a file-handling operation so that files are written or modified outside the intended directory. Because the flaw requires authentication and yields only limited integrity and availability impact - with no confidentiality exposure and no user interaction - it scores 5.4 and represents a medium-severity, low-priority issue rather than a high-urgency one. A vendor patch is available via IBM support node 7288641, and no public exploit code has been identified at time of analysis (no CISA KEV listing).
Authorization-boundary bypass in MCP Atlassian (sooperset/mcp-atlassian) versions prior to 0.22.0 lets an authorized MCP caller search Jira projects and Confluence spaces that fall outside the administrator-configured allowlist, by supplying caller-controlled projects_filter/spaces_filter arguments that replace the operator's restriction or by embedding an explicit project/space clause that suppresses it. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), exploitation requires an already-authorized MCP caller plus a shared Atlassian credential whose access extends beyond the allowlist; the result is read-only information exposure with no integrity or availability impact. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); vendor-released patch: 0.22.0.
Memory exhaustion denial of service in Mattermost 11.7.x through 11.10.x allows an authenticated user to send oversized request bodies to plugin endpoints because the CSRF-validation path fails to enforce a request body size limit. The affected ranges are 11.7.x up to and including 11.7.10, 11.8.x up to and including 11.8.5, 11.9.x up to and including 11.9.1, and 11.10.x up to and including 11.10.1. This is an availability-only issue rated CVSS 6.5, with authentication required (PR:L) and no public exploit identified at time of analysis.
Improper authorization controls in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let an authenticated, low-privilege user forge identities and act as another user across the network, bypassing the platform's security checks. Only integrity is affected - an attacker can perform unauthorized actions under a spoofed identity, but there is no exposure of confidential data and no denial-of-service impact, and a valid account on the FTM instance is a prerequisite (PR:L, so the flaw is not exploitable pre-authentication). No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; with a CVSS base of 6.5 and a narrow deployment footprint in financial transaction environments, it is a genuine but moderate-priority issue.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift contains an XML external entity (XXE) flaw that lets an authenticated, low-privilege user who can reach an XML-accepting endpoint coerce the application's XML parser into resolving attacker-supplied external entity references, resulting in disclosure of sensitive information such as local files or internal service responses. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) the attack is network-reachable but requires a valid low-privilege account and an application code path that parses untrusted XML with external entity/DTD resolution left enabled, and our independent assessment scores the impact as confidentiality-only (C:H/I:N/A:N) rather than the vendor's mixed confidentiality/integrity rating. Exploitation is gated by authentication and by the presence of a suitable XML-processing entry point, and no public exploit identified at time of analysis; a vendor patch is available, which together keep this a mid-severity, configuration-dependent information-disclosure issue rather than an urgent priority.
Remote unauthenticated attackers can perform unlimited password guessing against the pH7Builder (pH7 Social Dating CMS) administration login through version 19.2.0 by bypassing the CAPTCHA, which is only rendered when the PHP session flag captcha_admin_enabled is set. Publicly available exploit code exists, and the bypass chain is detailed in a third-party blog, though the EPSS score is low at 0.38% (31st percentile) and CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). The practical impact is limited to enabling brute-force attempts; strong admin passwords or an external rate limiter materially reduce risk.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift ships with missing server-side authorization checks on payment-mutation functions, letting a low-privileged authenticated user invoke actions reserved for higher-privileged roles. The flaw is network-reachable and low-complexity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5 Medium), with the damage confined to integrity - unauthorized modification or execution of payment transactions - and no confidentiality or availability impact. Exploitation requires a valid FTM for Red Hat OpenShift account (PR:L) plus reachability of the affected payment endpoints; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has published a fix.
Unauthenticated remote attackers can authenticate to the password-reset workflow of OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 using a hardcoded, shared recovery credential (CWE-798) that cannot be changed, disabled, or rotated. This flaw has been present since at least firmware 2.2.3.4 and grants only access to the password-reset workflow, not normal administrator privileges; full admin takeover requires chaining additional vulnerabilities. The CVSS 3.1 score is 6.5 (MEDIUM) with LOW confidentiality and integrity impact, and no public exploit code has been identified at time of analysis. Upgrade to firmware 3.5.4 to remediate.
Unauthenticated attackers can defeat the IP-based administrative login throttling in pH7Software pH7Builder (pH7 Social Dating CMS) through version 18.2.0 by sending a different X-Forwarded-For or Client-IP header with every request, allowing unlimited password-guessing attempts against the admin login. The CMS derives the client address from those attacker-controlled headers without verifying that the request came from a trusted proxy, so the per-IP failed-attempt counter and lockout never trigger. Exploitation requires only network reachability to the admin login endpoint and a standard HTTP client; the flaw is not confirmed actively exploited (not in CISA KEV), EPSS is low at 0.34% (27th percentile), and no public exploit code has been identified at time of analysis, although a third-party blog documents the bypass chain. The CNA-assigned CVSS 9.8 (C:H/I:H/A:H) substantially overstates the direct impact - the vulnerability only removes a brute-force control, so real-world risk hinges on whether valid admin credentials (weak or default passwords, no MFA) can subsequently be guessed.
Resource exhaustion in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows unauthenticated attackers on an adjacent network segment to force a denial-of-service condition by driving endpoint behavior that allocates resources without limits or throttling (CWE-770). The assigned CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) confines the attack surface to callers who can already reach a vulnerable FTM endpoint from the same network segment or cluster network, and limits the outcome to availability loss - service crash or hang - with no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and IBM has published a vendor advisory with remediation guidance, making this a mid-severity availability issue rather than an urgent priority.
Server-side request forgery in IBM Concert 1.0.0 through 3.0.0 allows an attacker who holds valid credentials to make the application issue HTTP requests to URLs of their choosing, which can be used to enumerate internal network services and set up follow-on attacks. The impact is bounded: the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, 6.5 by the vendor) reflects limited confidentiality and integrity loss rather than code execution or arbitrary file read, and exploitation requires a reachable Concert feature that dispatches server-side requests to a user-influenced URL. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (it is not in CISA KEV); IBM has published a fix via its support advisory.
HTTP response splitting in the Dancer2 Perl web framework before version 2.2.0 allows an attacker to inject arbitrary response headers and split an HTTP response when an application derives a response header NAME from request-controlled data: Dancer2's headers_to_array routine strips CR and LF from header values but not from names, so a crafted name reaches the PSGI server intact and, if that server does not validate header keys, the bytes following the CRLF are written to the wire as their own header line. The issue is unauthenticated and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, 6.5 Medium), but exploitation is gated by two concrete application-specific preconditions - the app must reflect attacker input into a header key rather than a value, and the underlying PSGI server must fail to reject malformed keys - so default deployments are generally not vulnerable. No CISA KEV entry exists and no public exploit code was identified at time of analysis; EPSS is 0.19% (9th percentile) and CISA SSVC records exploitation as none and automatable exploitation as no, so all signals converge on low real-world priority despite the Medium CVSS.
Out-of-bounds read in the XS encoder of Perl's Net::IDN::Punycode (all versions before 2.590) lets a remote attacker who can influence a string passed to encode_punycode push a single byte from outside the module's 36-entry punycode digit table into the encoded result, or crash the calling process. The flaw is a signed-integer overflow of the punycode delta accumulator in the compiled XS backend; the pure-Perl PP backend is not affected, so exposure is limited to applications that have the XS module installed and feed it attacker-controlled labels, such as IDN/domain-to-ASCII conversion pipelines. Rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), impact is bounded to a one-byte information leak or a denial-of-service crash with no code execution or integrity impact, and no public exploit code has been identified at time of analysis; the vendor has shipped a fix in 2.590.
Local attackers with a low-privileged account on the host or container running IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can read insufficiently protected credentials, potentially enabling lateral movement or further compromise. No public exploit was identified at time of analysis, and exploitation requires an existing local foothold-remote or unauthenticated access is not possible. Despite the MEDIUM 6.5 base score, this is a genuinely LOW-priority issue because it only affects confidentiality and benefits an attacker post-compromise.
Server-side request forgery in Cloudreve prior to 4.18.0 allows an authenticated user with remote-download privileges to bypass the ValidateExternalURL guard and make the server fetch loopback, private, link-local, or cloud-metadata IPv4 addresses that are wrapped inside IPv4-in-IPv6 transition forms - NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32, or the deprecated IPv4-compatible ::a.b.c.d - because the guard classifies the wrapper rather than the address actually reached. The vulnerability is reachable through SrcUri in RemoteDownloadTask.createDownloadTask and requires authentication (CVSS PR:L), so it is not remotely exploitable by an anonymous attacker; exploitation also depends on the fetch host's network actually routing the chosen transition form to the embedded IPv4, making NAT64, dual-stack, and cloud-hosted deployments the realistic targets. Where a cloud metadata service is reachable, a successful request can return internal service responses and expose instance credentials; no public exploit code has been identified at time of analysis, and the issue is fixed in version 4.18.0.
Privilege escalation in Amazon's amazon-connect-salesforce-lambda integration (all versions before 5.26) allows any authenticated AWS IAM principal that already holds lambda:InvokeFunction permission on the sfExecuteAWSService function to invoke it with caller-supplied service and API parameters, causing the function's own privileged execution role to perform AWS API operations that the caller's own identity is explicitly denied (CVSS 3.1: 8.1 High, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; CWE-862 Missing Authorization). This is a confused-deputy flaw: it requires a pre-existing authenticated AWS foothold with invoke rights, cannot be reached anonymously, and needs no user interaction, and it only affects organizations that have deployed this specific Salesforce CTI integration. No public exploit code has been identified at time of analysis and there is no KEV listing; the vendor-released fix is v5.26, which introduces a SalesforceExecuteAWSServiceUser parameter to restrict who may invoke the function.
Stored cross-site scripting in the Contextual Related Posts WordPress plugin, affecting all versions up to and including 4.4.1, allows an authenticated user with author-level capabilities or above to inject arbitrary JavaScript into a page through the 'other_attributes' block parameter. The injected script is persisted and then executes in the browser of any visitor who later views the affected page, which is reflected in the CVSS 3.1 score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) where the scope change captures the impact spreading beyond the vulnerable component into the hosting site's origin. Exploitation is gated by the author-level account requirement and by the site using the Gutenberg block editor with the plugin active; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Stored cross-site scripting in the Live Composer - Free WordPress Website Builder plugin affects all versions up to and including 2.1.21, allowing an authenticated attacker with contributor-level access or above to inject arbitrary JavaScript that executes for any user viewing the affected page. The flaw is rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and stems from the dslc_module_downloads_output shortcode re-emitting attacker-controlled module fields without output escaping; the save-time wp_kses_post filter is evaded because the payload is persisted as a serialized string containing no HTML tags for kses to tokenize. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the practical constraint is that the attacker needs a contributor+ account and a victim must subsequently load the injected page.
Server-side request forgery in FastGPT versions prior to 4.15.2 lets an authenticated user with access to any server-side URL-consuming feature - a safe-Axios-backed HTTP tool, workflow HTTP node, external file-fetch integration, or similar integration - bypass the platform's built-in private-address block and reach loopback, private, link-local, or cloud instance-metadata services. The bypass works because the safe Axios interceptor in packages/service/common/api/axios.ts validates the hostname with isInternalAddress() before a separate HTTP connection performs its own DNS lookup, opening a time-of-check/time-of-use (DNS rebinding) window in which an attacker-controlled hostname resolves publicly during validation and to an internal address at connection time; the same independent re-resolution occurs after each manual redirect hop. Exploitation requires authentication, attacker-controlled authoritative DNS, and winning the resolution race, so while impact is high (read access to internal services and metadata, scope-changed), practical exploitation is non-trivial; no public exploit code or confirmed active exploitation was identified at time of analysis.
Memory corruption in the Primary Bootloader (PBL) of Qualcomm Snapdragon chipsets lets an attacker who has physical possession of a device feed a crafted ELF file during the early boot sequence and corrupt bootloader memory, with the scope change indicating a possible escape from the normal boot context into the secure/TrustZone world. Exploitation is highly constrained: CVSS 3.1 scores it 6.9 under a vector of AV:P/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, meaning physical access, low-level privileges, high attack complexity (specific timing or hardware state) and user interaction are all required; the practical exposure is limited to lost or stolen devices, supply-chain interdiction, or forensic scenarios rather than remote or default network-reachable attacks. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); Qualcomm has published a security bulletin (May 2026) covering the issue.
Privilege escalation in GNU C Library (glibc) 2.14 through 2.44 stems from a TOCTOU race in ld.so when expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs. A local low-privileged (PR:L) attacker can exploit this only where fs.protected_hardlinks is disabled and a suitable setuid/setgid binary exists, by hard-linking the binary and winning a race to swap an intermediate path component for a symlink so the loader loads an attacker-controlled shared object with the program's elevated privileges. No public exploit identified at time of analysis; major Linux distributions enable fs.protected_hardlinks by default, sharply limiting exposure.
Administrator password takeover in OpenEye Apex Network Video Recorder (NVR) firmware up to 3.2.9.376 is possible because the password-reset unlock-code scheme lacks a per-device secret or any server-side cryptographic material, allowing an attacker who reaches the privileged reset workflow to compute a valid unlock code entirely offline and reset the administrator password. Exploitation is not remote: it requires physical console access to the device and use of the privileged password-reset workflow (CVSS:3.1/AV:P/AC:L/PR:H/UI:N, score 6.2), so it is neither remotely reachable nor automatically triggered. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor has released firmware 3.5.4 as the fix, and the vulnerable design has been present since at least firmware 2.2.3.4.
Stored cross-site scripting in Adobe Connect (server/web) and the Adobe Connect Android mobile app allows an attacker to plant persistent malicious JavaScript in vulnerable form fields, which then executes in a victim's browser when they view the page rendering that field. The vendor's vector rates it unauthenticated (PR:N), but our assessment holds that a practical attacker needs an account or role permitted to submit content into those fields, and the victim must actively browse to the affected page (UI:R). Impact stays confined to the victim's browser session (S:C with C:L/I:L - session/cookie theft, spoofed content, or actions as the victim), there is no server-side code execution or data-store compromise, no public exploit identified at time of analysis, and no CISA KEV listing; overall this is a genuine but modest, moderate-severity issue rather than a top-priority emergency.
Integer overflow in MPack 1.1.1's mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc() helpers causes the allocation size computation (node.data->len + 1) to wrap to zero when a parsed MessagePack node advertises a length of SIZE_MAX, yielding an undersized buffer allocation and, in the officially scored path, a denial-of-service/crash. Exploitation requires the consuming application to use MPack's node/tree reader API and to call one of these helpers on a node whose length is attacker-controlled; it is realistically reachable on 32-bit platforms where SIZE_MAX equals UINT32_MAX (~4 GB) and generally infeasible on 64-bit platforms. The assessed vector is local (AV:L) with high attack complexity (AC:H) and no authentication or user interaction requirement (PR:N/UI:N), so remote reachability depends entirely on whether the host application exposes the parser to untrusted network input; there is no public exploit identified at time of analysis and EPSS is low at 0.20% (10th percentile).
Session fixation in Mstfakts College-Management-System (Front-end/server.php) allows a remote unauthenticated attacker to plant a session identifier that the application fails to regenerate at login, so the attacker inherits the victim's authenticated session once the victim signs in. Exploitation hinges on user interaction - the victim must complete an authenticated login through the attacker-influenced session - which is the main limiting factor in an otherwise trivially reachable flaw, and the assessed impact is limited to low confidentiality and integrity loss with no availability effect (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N; vendor/NVD base 2.1). Publicly available exploit code exists (referenced from the project's GitHub issue #8), but there is no evidence of active exploitation; this is a low-priority, high-noise finding.
Build-context directories belonging to IBM Concert 1.0.0 through 3.0.0 are recursively copied into produced container images, so any sensitive files sitting in that context (credentials, config files, keys, environment files) are baked into the image layers and disclosed to anyone who can pull the image or read its filesystem. The issue is local in nature (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 6.2): an attacker must already be able to obtain or access the built image, and no authentication or user interaction is involved, but the confidentiality impact on whatever was left in the build context is high, with no integrity or availability effect. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, so this is a genuine but low-urgency information-disclosure hygiene defect that matters most where images are pushed to shared or externally reachable registries.
Reflected cross-site scripting (CWE-79) in sfturing's hosp_order open-source hospital ordering project, affecting commits up to 627f426331da8086ce8fff2017d65b1ddef384f8, allows remote unauthenticated attackers to execute arbitrary script in a victim's browser by crafting a malicious 'Search' argument to Public Search Handlers in HospitalController.java. Exploitation requires the victim to open a crafted request or URL (user interaction), and publicly available exploit code exists via the project's GitHub issue #118. The project has not responded to the report, so no vendor patch is available; real-world risk is tempered by the project's near-zero deployment footprint.
Unleash deployments prior to 8.0.3 render the change-request approval email template with Mustache triple-stash syntax, so the attacker-controlled changeRequestTitle, requesterName, and requesterEmail values are inserted into notification emails as raw, unescaped HTML. An authenticated project member who can create change requests (CVSS 4.0 vector AV:N/AC:L/PR:L; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:R) can therefore place forged links, tracking content, or visually altered text into an approver's inbox, although the approver must open the email and mail clients block script execution, so the realistic outcome is HTML content spoofing rather than code execution. No evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the vendor advisory documents manual reproduction steps; severity is genuinely low (CVSS 2.1) and the vendor-released patch is Unleash 8.0.3.