Duplicate and misappropriate other vendors' product listings in the MarketKing WordPress plugin before 2.1.72 by exploiting a missing authorization check in the marketking_duplicate_product AJAX action; this requires only subscriber-level access or higher and lets the attacker assign copied products, including private metadata, to their own vendor account. The vulnerability is remotely exploitable but low impact (confidentiality and integrity only, no availability impact), and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released version 2.1.72 as a fix.
Remote unauthenticated attackers can redirect payments on WordPress sites using the Handily plugin (versions up to and including 1.0.3) by modifying Stripe payment settings because of missing authorization checks (CWE-862). They can change publishable keys, secret keys, email addresses, success URLs, and cancel URLs to point to their own Stripe accounts. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 score is 5.3 (Medium).
Unauthenticated attackers can modify the Pixabay, Unsplash, and Pexels API keys configured in the Image Buzz WordPress plugin (versions up to and including 1.0.3) due to missing authorization checks. The flaw, rated CVSS 5.3, allows remote modification of site-wide API key settings without login or user interaction, though it does not enable data theft or code execution. No public exploit or active exploitation has been identified at time of analysis.
Unauthenticated attackers can delete administrator-configured third-party API keys (Pixabay, Unsplash, Pexels, and OpenAI) from WordPress sites running the PixelPlay plugin through version 1.0.2, by sending a request that sets the 'clear_api_type' parameter. The flaw is a missing authorization check (CWE-862) on an endpoint that should be restricted to privileged users, rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - a network-reachable, low-complexity attack with integrity-only impact and no data disclosure or code execution. No public exploit code has been identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); exploitation is only meaningful where an administrator has already stored API keys, and Wordfence is credited with the report.
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input, so an unauthenticated attacker can craft a malicious link that, once clicked by a logged-in user, makes the victim's browser pull attacker-controlled content from an external location and potentially expose data from the active session, producing a high confidentiality impact with no effect on integrity or availability. The issue is network-reachable (AV:N) but requires specific crafting conditions (AC:H) plus victim interaction (UI:R), while the attacker needs no credentials (PR:N); the assessed base score is 5.3 (Medium) on vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. No public exploit code was identified at time of analysis, and the weakness class (CWE-95) points to injection into dynamically evaluated code rather than a default-configuration remote compromise, so the realistic risk is a targeted phishing-style data-theft attempt against authenticated launchpad users with sensitive in-session data.
Layout template disclosure in Dancer2, the Perl web application framework, allows an unauthenticated remote requester to retrieve one of an application's layout templates by requesting a path that is spelled differently from, but resolves identically to, the layout directory. Versions before 2.2.0 are affected, and the flaw is reachable only when the AutoPage handler is explicitly turned on via the auto_page setting, which is off by default; the attacker exploits the gap between the handler's literal text comparison of the request path and the canonicalising lookup that follows, using a doubled slash, a dot segment, a percent-encoded slash, or a differently-cased path on a case-insensitive filesystem. Impact is confined to reading another layout template - no code execution, no credentials, no write access - and no public exploit code has been identified at time of analysis, with EPSS at 0.19% (8th percentile).
LightRAG API server versions prior to 1.5.5 return raw Python exception text to network clients through error handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and lightrag_server.py, leaking server filesystem paths, database host/port/user/name, LLM provider diagnostics, and library internals. Exploitation is unauthenticated (CVSS PR:N) because the server ships with an open default configuration, and it requires only that the API be network-reachable plus a request that triggers a server-side exception; deployments using URI-configured backends whose drivers embed connection strings can also leak credentials. Scored CVSS 3.1 5.3 MEDIUM with confidentiality-only impact, and no public exploit code was identified at time of analysis.
An authorization-check weakness in the Malware Information Sharing Platform (MISP) can allow an authenticated, low-privileged user to reach the previewEventAttributes endpoint because a typo in ACLComponent.php registers the required permission as 'theming_enabled*' - with a trailing asterisk - a string that matches no valid permission identifier in the ACL system. The issue affects MISP instances that ship the affected ACLComponent.php revision (CPE cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*); the practical outcome depends on the ACL evaluator's behavior on an unmatched key, failing open (exposing event attribute data to users who should not see it) or failing closed (denying access to legitimate theming_enabled users). Rated CVSS 4.0 base 5.3 (and CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N in independent review), this is a low-to-moderate-risk authorization flaw rather than an emergency; no public exploit code was identified at time of analysis and no KEV listing or EPSS data was provided.
Path traversal in the MISP OrgImgHelper (findOrgImage) lets an authenticated user who can create or import events craft an organisation name containing '../' sequences so that a filesystem path is built and tested with PHP's file_exists() outside the intended org-image directory. This yields an arbitrary file-existence oracle for any path the web process can read, plus read of files that end in .png or .svg whose resolved name is then rendered or served back to the requester. Exploitation requires an authenticated account with event create/import rights (PR:L) and is confidentiality-only and low impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published an upstream fix (commit e00986075).
Authenticated MISP users holding at least a sharing-group editor role can overwrite organization metadata that should be reserved for site administrators or accounts with sync permissions, because Organisation::captureOrg applies the $force branch without checking perm_site_admin or perm_sync. The result is an integrity-only issue: organization records and the sharing-group and blueprint configurations derived from them can be altered, but no data disclosure or service disruption is possible and the attacker must already have a valid account with elevated (SG editor) privileges on the instance. Vendor fix code exists in upstream commit f3ec974ee, and no public exploit identified at time of analysis.
MISP versions prior to commit 9a2a4acfe allow an authenticated user with the perm_add permission to probe arbitrary filesystem paths through the EventReport::uploadPicture method, leaking file existence and file type via distinct validation error responses. Exploitation requires a valid MISP account with event or attribute creation rights but not administrative access, and it cannot read file contents, write files, or execute code. This is a low-severity information disclosure issue; no public exploit was identified at time of analysis, and the vendor fix is available in commit 9a2a4acfe.
An authenticated user without the perm_add permission can modify suggestion content in MISP event reports via the replaceSuggestionInReport endpoint, due to an ACLComponent wildcard mapping error fixed in MISP 2.5.47. The flaw is limited to authenticated instances, causes only low integrity impact to shared threat-intelligence report data, and no public exploit identified at time of analysis; independent assessment rates it as a genuine but low-severity authorization flaw.
Information disclosure in MISP versions before 2.5.47 lets an authenticated user who holds at least read access to an event view the most recent report attached to that event even when the report's own distribution/ACL setting is more restrictive than the parent event's - or when the report has been soft-deleted. The Overmind event view automatically enriches an event with its latest attached report, and the enrichment query filtered only on the event ID, omitting the report ACL conditions and the deleted flag, so a legitimately authorized but not report-authorized user can read threat-intelligence content they should not see. Exploitation requires an authenticated MISP account with existing read access to the target event (CVSS PR:L), no user interaction beyond opening the Overmind view, and is meaningful only where a more-restricted or soft-deleted report actually exists; the issue is a low-severity confidentiality leak rather than an emergency, and no public exploit identified at time of analysis.
Missing authorization in the MarketKing multivendor marketplace plugin for WordPress (versions before 2.1.72) allows any authenticated user with subscriber-level access or higher to file refund requests against arbitrary orders through the marketking_send_refund AJAX action, simply by supplying someone else's order ID. The flaw is rated CVSS 5.3 / CVSS:3.1 5.3 (AV:N/AC:L/PR:L/UI:N, integrity-only impact) because the attacker needs a valid low-privilege session - a bar that is low on marketplace sites that permit open user self-registration - but gains no data disclosure or privilege escalation. Exploitation is bounded to creating spurious refund requests and marketplace disruption; there is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and a vendor patch is available in 2.1.72.
An authenticated access-control and input-validation weakness in MISP's EventsController.php allows any logged-in user with access to enrichment/analysis functionality to supply a module name that is not in the instance's enabled-modules list, causing queryEnrichment to silently proceed with default parameters (format='simplified', no module-specific configuration) instead of rejecting the request. Successful abuse does not grant code execution or alter data; the assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning confidentiality-only, low impact, with no scope change, so this is a low-severity issue rather than a high-priority emergency. No public exploit code has been identified, and the vendor has published an upstream fix via commit 7dfcc4d32, which should be applied to close the missing-validation gap.
Authenticated MISP users can bypass sharing-group authorization when creating collections by issuing a PUT request to the collections/add endpoint instead of the expected POST. Although the controller applies the sharing-group usability check only for POST, the underlying CRUDComponent::add() persists data on both verbs, letting a low-privileged account set distribution=4 and associate a collection with a sharing group it is not authorized to use. This is a low-severity authorization flaw (CWE-862) requiring a valid session and knowledge of the target sharing-group ID; no public exploit identified at time of analysis, and there is no CISA KEV listing. The vendor fix is available in upstream commit c20f5a836.
Checkmk versions before 2.5.0p14 allow authenticated users with access to the monitoring host and service list APIs to inject newline characters into filter values, which are improperly neutralized. This leads to injection of additional Livestatus query headers, bypassing contact-group-based object visibility in count queries to infer information about hosts and services outside the attacker's authorized groups, and can occupy web server and Livestatus workers for an attacker-controlled duration. The issue is fixed in Checkmk 2.5.0p14, and no public exploit identified at time of analysis.
Parsing a crafted, malformed YAML document with yaml-cpp 0.9.0 can underflow the scanner's indentation stack, crashing the parser and potentially leaking small amounts of process memory. The trigger is an unverified simple key - for example a plain scalar that spans a line break - which leaves a stale reference to an indent level that is subsequently popped, driving Scanner::PopAllIndents() past the bottom of the stack (CWE-822, untrusted pointer dereference); the practical outcome is a denial-of-parse/crash with at most Low confidentiality impact. Only yaml-cpp 0.9.0 is implicated, the consuming application must actually parse untrusted YAML for the bug to be reachable, and the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, 5.1) reflects that local access requirement; EPSS is a low 0.28% (21st percentile) and there is no public exploit code identified at time of analysis, only a crash reproducer documented in upstream issue #1475 and fixed by pull request #1476.
Authenticated file deletion via directory traversal in the CTX Feed (Product Feed Manager for WooCommerce - 220+ Shopping & Social Channels) WordPress plugin affects all versions up to and including 6.6.43: a user holding shop-manager capability or above can abuse the 'provider' parameter to walk out of the intended feed directory and force an unlink() against files whose extensions match the plugin's own whitelist (csv, xml, tsv, xls, xlsx, json, txt). Exploitation is a deliberate two-call REST sequence - first POST to /wp-json/ctxfeed/v1/make_feed/save_feed_config to persist the traversal string in wp_options, then a call to /wp-json/ctxfeed/v1/manage_feeds/delete_feed to trigger the deletion - so there is no unauthenticated path and no victim interaction beyond the attacker's own privileged session. Our independent assessment rates this a moderate, not high-priority, issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L); the frequently repeated 'leads to RCE' framing is sharply constrained because .php files such as wp-config.php cannot be deleted, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated MISP site administrators can abuse the organisation logo-upload handler (OrganisationsController::__uploadLogo) as a filesystem oracle, learning whether arbitrary server paths exist and, for image files, what image type is detected. The flaw affects versions prior to upstream fix commit 12eaadc9e and requires the highest privilege tier (site-admin), which is why it carries a moderate CVSS 4.0 score of 5.1 but low real-world risk. It exposes no file contents and provides no write, execution, or modification primitive, and no public exploit code has been identified at time of analysis.
Path traversal (CWE-22) in MISP's __statisticsOrgs handler in UsersController.php allows an authenticated user holding the privilege to create or rename an organisation (org-admin or site-admin, consistent with the vendor's PR:H) to embed directory traversal sequences in an organisation name and turn the resulting file_exists() call into a boolean oracle for arbitrary file existence on the server. Impact is limited to low-confidentiality information disclosure: no file contents are read, written, or executed, and the vulnerable code path is effectively dead in current MISP deployments because the hard-coded directory app/webroot/img/orgs no longer exists (org logos were relocated to files/img/orgs), so the check never fires. No public exploit code has been identified at time of analysis, there is no CISA KEV entry indicating confirmed active exploitation, and the vendor has published an upstream fix in commit a2f7cba6e.
Reflected cross-site scripting in the MISP attribute histogram view can execute arbitrary JavaScript in the browser of an authenticated MISP user, allowing session cookie theft, actions on behalf of the victim, or exfiltration of data accessible through the MISP interface. The issue stems from the URL-derived type parameter being placed unescaped into a JavaScript array literal inside an inline onClick handler; exploitation requires the authenticated victim to click an attacker-supplied link, and no public exploit identified at time of analysis. The flaw is fixed by upstream commit 95b8f21f6, which replaces manual quoting with JSON encoding and hex escaping.
MISP's event REST search export confirmation form reflects a URL-supplied event ID list into a single-quoted JavaScript string without escaping single quotes, allowing arbitrary JavaScript execution in an authenticated victim's browser. The attacker needs no MISP account, but exploitation requires the victim to be logged in and to open a crafted URL; only unpatched builds using the Default or UiBeta theme are affected, while the Overmind theme's form already uses an escaped data attribute and is not vulnerable to this sink. No public exploit identified at time of analysis, and the impact is bounded to the victim's web session rather than the MISP server itself.
Information disclosure in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a locally authenticated attacker who already holds high privileges read sensitive system information that remains in memory or logs because debug data was not cleared. The assessed vector is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N (4.1), meaning the attacker must already have local access and high privileges, and exploitation additionally depends on uncleared debug artifacts actually being present - a condition outside the attacker's direct control. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS signal provided, so this is best treated as a post-compromise information-gathering weakness rather than an initial-access threat.
Stored cross-site scripting in MISP's admin email composition screen allows a high-privileged user who can modify the MISP.org organization name to inject JavaScript that executes for another authenticated user who later opens that admin email page. Exploitation requires both the privileged configuration change and victim interaction with the affected view, and no public exploit has been identified at time of analysis. A vendor fix is available via upstream commit, though a tagged release version is not independently confirmed.
Reflected cross-site scripting in MISP before 2.5.47 lets an authenticated user craft a URL against the AnalystDataController::viewForObject (__hub) action whose parent object-type parameter is echoed unencoded into the Overmind theme's AnalystData thread element, so an authenticated victim who clicks the link has arbitrary JavaScript executed in their browser within the MISP origin. The attacker must hold a valid MISP account (CVSS PR:L) and the instance must be running the Overmind theme, while the victim must actively follow the crafted URL (UI:A); impact is scoped to the victim's session and page, not the server. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available in the 2.5.47 release line via commit 23b879073. This is a genuine but low-to-moderate priority issue given the authentication, theme, and user-interaction prerequisites.
Arbitrary shell command execution is possible in ProjectDiscovery Nuclei versions 3.0.0 through 3.9.x when DAST mode (-dast) loads an attacker-supplied, unsigned multiprotocol template that combines an HTTP fuzzing: block with a code: block, allowing the embedded unsigned code request to bypass the code-template signature check and run shell commands on the scanning host. The flaw is a signature-verification bypass (CWE-78 command injection) and is constrained in practice: it requires the operator to enable DAST and to point the scanner at a malicious template, and it does not affect users who scan only with trusted, signed first-party templates or who do not use DAST. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); it is fixed in Nuclei 3.10.0. Note that the independent assessment rates the vector at CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, treating confidentiality, integrity, and availability as fully impacted once the payload executes, which is a higher impact picture than the vendor-published 4.7 Medium score.
Reflected cross-site scripting in the x-ui management panel 0.3.2 lets an attacker run arbitrary JavaScript in the browser of an authenticated panel operator who follows a crafted URL, enabling same-origin data theft and unauthorized actions under the victim's session. The attacker requires no authentication (PR:N in the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base score 4.7) - the real precondition is social engineering a logged-in operator into clicking a malicious link, and the scope-changed rating reflects execution inside the panel's own origin with low confidentiality and integrity impact and no availability impact. No public exploit code and no CISA KEV entry were identified at the time of analysis, and the impact stays confined to the victim's already-authenticated browser session rather than affecting unauthenticated visitors or the server itself.
Improper input validation in Adobe Content Credentials - covering both the Content Credentials Rust SDK and the Content Credentials command-line tool - lets a remote attacker bypass security checks and obtain limited unauthorized write access when a victim visits a maliciously crafted URL or interacts with a compromised web page that supplies malformed input. It carries a 4.3 score (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), an on-the-low-end rating driven by the required victim interaction and the integrity-only, limited impact with no confidentiality or availability loss. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the Adobe advisory cited as the reference does not state a fixed version.
Improper input validation in Adobe Content Credentials - specifically the Content Credentials Rust SDK and its companion command-line tool - allows remote, unauthenticated attackers to bypass a security check and obtain limited unauthorized write access when a victim visits a maliciously crafted URL or interacts with a compromised web page. The flaw is network-delivered (AV:N/AC:L/PR:N) but is gated by mandatory user interaction (UI:R), and its impact is confined to limited integrity loss (C:N/I:L/A:N) with no confidentiality or availability effect, giving it a CVSS base score of 4.3. This is a genuine but low-priority issue: no public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status, and it is not exploitable against a purely passive or non-interacting deployment.
Stored cross-site scripting in the Hostel plugin for WordPress (all versions up to and including 1.1.8) lets an authenticated attacker with Administrator-level access inject arbitrary web scripts through the 'custom_currency' parameter or the 'locale_url' setting, which then execute for any user viewing the injected page. Exploitation is gated by layered prerequisites: the actor must already hold Administrator rights and the site must be a WordPress multi-site network or have the unfiltered_html capability explicitly disabled, so the issue does not apply to standard single-site installations where Administrators can already post unfiltered HTML. No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; assessed severity is low (CVSS 4.4) consistent with the high privileges and non-default configuration required.
A local out-of-bounds read in radare2 6.0 and earlier (fixed in 6.2.0) can crash or corrupt the analysis session when an analyst opens a crafted Mach-O binary containing Swift type or class metadata. The CVSS 3.1 score is 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), reflecting a 4-byte read immediately before the allocated field-metadata buffer that yields at most a process termination or incorrect metadata processing - no attacker-observable memory disclosure has been demonstrated, and the 'Information Disclosure' tag on this record is not substantiated by the advisory. Exploitation requires the victim to deliberately load an untrusted Mach-O file (user interaction), and there is no remote or unauthenticated path; no public exploit identified at time of analysis and the issue is not in CISA KEV.
Authenticated Mattermost users can drive excessive database load by submitting an oversized post ID array to the bulk reactions endpoint POST /api/v4/posts/ids/reactions, because Mattermost does not enforce a server-side length cap on that array (CWE-770). The flaw affects 11.7.x through 11.7.10, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.1, requires only a valid account with API access (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 4.3), and has availability-only impact, meaning a single crafted request causes transient load rather than a persistent outage. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a low-to-moderate operational risk rather than a critical priority.
Authenticated remote users of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can forge entries in the transaction audit log by supplying a crafted HTTP header that the application fails to validate properly. Successful abuse requires only valid low-privilege credentials (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the practical consequence is limited to the integrity of the audit trail - no data disclosure, no service disruption, and no unauthenticated attack path. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided; combined with the narrow, specialized deployment footprint of the platform, this is a genuinely low-priority issue whose signals are consistent rather than conflicting.
Authenticated Instructor-level users on WordPress sites running the Tutor LMS plugin 4.0.7 or earlier can overwrite, re-parent, or delete quiz question and answer rows belonging to other instructors and administrators by abusing broken ownership checks in the tutor_quiz_builder_save AJAX action. The handler validates only the top-level course_id/topic_id and payload['ID'], then passes attacker-supplied nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values straight into $wpdb->update and DELETE statements, so an Instructor who controls one course can reach rows owned by others. Impact is limited to integrity of quiz content (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and is only meaningful on multi-instructor or multi-tenant course sites; there is no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and the Instructor privilege prerequisite is the main factor bounding realistic risk. A vendor fix is available in Tutor LMS 4.0.8.
Authorization bypass in the wpForo Forum plugin for WordPress (all versions up to and including 3.1.5) lets an authenticated attacker with subscriber-level access or higher take over another guest author's forum post and rewrite its title, body, author name, and stored owner email address. Exploitation is conditional rather than automatic: the forum must be configured with BOTH guest posting AND guest editing enabled (a non-default deployment choice), and the attacker must already know the specific target guest author's email address, which functions as the record selector. Impact is integrity-only on a single post (vendor CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and no public exploit has been identified at time of analysis; CISA KEV does not list this issue.
Authenticated users with contributor-level access or higher on WordPress sites running the WP-CRM System plugin (all versions up to and including 3.4.6) can enumerate the contact_id parameter to read PII belonging to arbitrary CRM contact records, including full names, email addresses, phone, mobile and fax numbers, and physical addresses. The flaw is a CWE-200 sensitive information exposure reachable over the network with low privileges (CVSS 4.3, AV:N/AC:L/PR:L/UI:N) and requires only a valid contributor account plus a populated CRM address book; no user interaction or special configuration is needed beyond the plugin being installed. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no KEV listing), so the practical risk is a low-severity, read-only privacy disclosure whose real-world exposure scales with how freely contributor accounts are granted on the site.
Authenticated users with contributor-level access or above can permanently delete arbitrary media attachments site-wide on any WordPress installation running the Custom Field Template plugin up to and including version 2.7.8, because the edit_meta_value function trusts an attacker-supplied numeric attachment ID in the file-field parameter without verifying ownership. The attack precondition is the plugin's default behavior - a post governed by a template containing at least one file-type field where the mediaRemove option is not enabled - so exposure is common rather than exotic, and exploitation is remote, low-complexity and requires no user interaction. Impact is limited to integrity (deletion of media, causing content loss and broken pages) with no data disclosure or code execution; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor changeset exists although a corrected plugin version could not be independently confirmed.
Any authenticated WordPress user holding only Subscriber-level access can remotely deactivate the ThumbPress plugin on versions 6.2.1 and earlier, because the send_deactivation_survey() handler registered to the wp_ajax_pl-plugin-deactivation action performs no capability check and no nonce verification. The impact is deliberately narrow - a low-privilege account can only turn the plugin off, with no path to data disclosure, code execution, or persistence - which aligns with the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N score of 4.3. No public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is limited to sites that actually allow low-privilege user registration; the upstream code change is visible in the public Trac changeset referenced by the advisory.
Missing authorization in the RW Elephant Rental Inventory plugin for WordPress (all versions up to and including 2.3.13) lets an authenticated attacker with only Subscriber-level access flip the plugin's cache setting on or off by sending a single POST of the toggle_cache action to /wp-admin/admin-ajax.php. The AJAX handler performs neither a capability check nor a nonce check, so the same endpoint can additionally be driven by cross-site request forgery against a higher-privileged logged-in user. The impact is confined to a low-integrity configuration change (no confidentiality or availability effect), no public exploit code has been identified at time of analysis, and the assessed CVSS 4.3 reflects a genuinely low-severity issue.
Authenticated Stripe integration hijacking in WP User Manager (User Profile Builder & Membership) versions up to and including 2.9.18 lets any logged-in user at Subscriber level or above overwrite the site's stored Stripe credentials, causing future payments to be routed to an attacker-controlled Stripe account. The flaw is a missing authorization check (CWE-862): Connect::complete() runs on admin_init without any current_user_can() or nonce verification, so merely reaching a /wp-admin/ page is enough to trigger it. Exploitation requires a low-privilege account on the target site plus a completed attacker-side Stripe Connect OAuth flow, and it only has impact where WPUM's Stripe Connect integration is actively in use; CVSS 3.1 base is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting integrity-only impact, and no public exploit code was identified at time of analysis.
Unsafe reflection in Apache Calcite Avatica before 1.29.0 allows an attacker who can influence plugin-instantiation parameters to force the loading and static initialization of arbitrary classes on the server classpath. Exploitation requires low privileges (PR:L per the assessed CVSS vector) and a dangerous static-initializer gadget already present on the classpath; the vendor states no well-known class currently satisfies this, so real-world risk is low despite the RCE tag. No public exploit code or active exploitation has been identified at time of analysis.
Cloudreve instances running versions prior to 4.18.0 fail to enforce write-scope authorization on two admin tool routes, so an attacker who already holds a valid OAuth application or API key scoped to Admin.Read can exceed that token's read-only boundary. Concretely, the misconfigured wopi GET and mail POST endpoints let such an authenticated token holder (PR:H in the CVSS vector) probe configured WOPI service endpoints and send arbitrary test email through the server's SMTP configuration, with no user interaction required. Impact is bounded to information probing and SMTP misuse - confidentiality and integrity are each rated Low, availability is unaffected, and the overall CVSS base score is 3.8; no public exploit code has been identified at time of analysis and there is no indication of active exploitation. The exposure is realistic only in deployments that provision narrowly-scoped admin API tokens and treat Admin.Read as a true read-only boundary.
Improper enforcement of mutual TLS client-certificate verification in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can let an unauthenticated remote attacker who already holds a position on the network path obtain sensitive information from the service. The flaw (CWE-295) is rated CVSS 3.1 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning exploitation is remotely reachable yet constrained by high attack complexity and yields only limited confidentiality impact with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the overall risk is genuinely low-priority despite remote reachability, and a vendor patch is available.
The GNU C Library dynamic loader (ld.so) in glibc 2.14 through 2.44 mishandles DT_RPATH/DT_RUNPATH values that begin with the literal string $ORIGIN immediately followed by a NUL byte or a '/' character, producing a stack-based buffer overflow (CWE-121) when such a path is parsed in a setuid or setgid (AT_SECURE) program. A local attacker who can execute an affected privileged binary causes the loader to read past the end of the path buffer and write past the end of a stack-allocated internal buffer, resulting in a loader crash (denial of service) and limited disclosure of process memory, with a low CVSS 3.6 score reflecting the local, high-complexity, non-privilege-escalating nature of the flaw. There is no public exploit identified at time of analysis and no CISA KEV listing; exploitation requires local access (PR:L) plus the pre-existing, non-universal condition that a specially-linked setuid/setgid binary exists on the host and is executable by the attacker, which is why all signals converge on this being a LOW real-world priority despite the ubiquity of glibc.
Information disclosure in the Dark Reader browser extension allows an attacker-controlled website to trigger the extension's image-inversion pipeline into fetching an unauthenticated icon-like bitmap from a server on the victim's local network or localhost, leaking limited information about that resource. Affected users are those running Dark Reader in Firefox before 4.9.126, or in other browsers before 4.9.128 - the issue is unauthenticated (CVSS PR:N) but requires the victim to visit a malicious page (UI:R) and depends on a locally reachable server actually listening, with high attack complexity given the need for the resource to sit at a known public-like HTTPS URL and be classified as requiring inversion. Vendor-released patches are available as version 4.9.126 (Firefox) and 4.9.128 (other browsers), and no public exploit code was identified at time of analysis; EPSS-style exploitation likelihood was not provided, and the overall risk is low (CVSS 3.4).
Out-of-bounds read in radare2's Lua 5.3 bytecode function parser affects all versions prior to 6.2.0, allowing a crafted input file to push parser reads past the end of the allocated buffer. Exploitation is local and requires user interaction: an analyst must open or inspect an attacker-supplied Lua 5.3 bytecode file whose function-name string ends exactly at the input-buffer boundary, after which the parser reads two integers and three one-byte metadata fields beyond the allocation, producing invalid parser results or terminating the process. Per the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) there is no memory disclosure, no code execution, and no privilege escalation - the realistic outcome is a crash of the analyst's own radare2 instance - and there is no public exploit identified at time of analysis and no confirmed active exploitation. The flaw is fixed in radare2 6.2.0.
Opening a crafted Mach-O file in radare2 versions prior to 6.2.0 can trigger a heap out-of-bounds read in the LC_DATA_IN_CODE parser, potentially terminating the process. The flaw is only reachable when the non-default bin.verbose option is enabled and the crafted file declares an LC_DATA_IN_CODE datasize that is not a multiple of the data_in_code_entry structure size, causing the parser's final loop iteration to read past the allocated buffer. Impact is limited to a denial-of-service style crash (CVSS 2.5, AV:L/AC:H/PR:N/UI:R, availability-only); no attacker-observable memory disclosure has been demonstrated, and no public exploit code or confirmed active exploitation was identified at time of analysis.
OpenBao Agent's exec rendering mode leaks secrets to stdout when an error condition occurs, primarily when the configured num_retries is exhausted, exposing credentials supplied via env_template to anyone who can read the agent's output stream or aggregated logs. All OpenBao versions before v2.6.0 are affected; the defect is inherited from the original Vault codebase and the fix is a one-line change that discards the template runner's output stream during failures. The assessed CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a local, non-default deployment prerequisite - exec rendering mode combined with env_template - and there is no public exploit identified at time of analysis, making this a genuine but low-priority information-disclosure issue.
API token disclosure in the Weblate wlc command-line client before 2.0.1 allows an attacker-controlled project configuration to redirect an unscoped API token to a server the attacker controls. When wlc is run inside an untrusted repository, pull-request checkout, or a directory with an untrusted ancestor whose .weblate, .weblate.ini, or weblate.ini sets an API url, and the operator supplies a token through WLC_KEY or --key without also pinning WLC_URL or --url, the client transmits that token to the project-configured destination. Exploitation requires local execution of wlc, all three configuration preconditions to hold simultaneously, and user interaction; no public exploit was identified at time of analysis, and the overall risk is low (CVSS 2.3 / assessed CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).