Unauthenticated information disclosure in the MPCX Lightbox WordPress plugin (versions 1.2.2 through 1.2.5) lets any remote visitor call an AJAX action that exposes the title, content, or excerpt of posts they should not be able to read, including private, draft, pending, trashed, and password-protected entries. The flaw carries no authentication or privilege requirement and no user interaction is needed, and WPScan has published a proof-of-concept reference, so publicly available exploit code exists; the vendor has rated the issue as low severity (CVSS 3.1 base 3.7, AC:H), while our assessment scores it 3.1 with AC:L because exploiting the exposed action requires only a direct request to the site's admin-ajax.php endpoint, not special timing or conditions. Practical risk is bounded by data value rather than access difficulty: sites without sensitive unpublished content leak little, and impact is limited to reading post data with no write, privilege escalation, or site takeover.
Cleartext SMTP email transmission in sfturing hosp_order (MailUtil.getProperties) can expose sensitive email-related data to an attacker who already holds a network interception position between the application server and the mail server. Publicly available exploit code exists, but there is no confirmed active exploitation; the issue requires an unencrypted SMTP configuration and high-complexity adversary-in-the-middle access, and it produces only limited confidentiality impact. This is assessed as a low-real-risk issue despite the nominal CVSS 4.0 score of 6.3.
Hard-coded database credentials in sfturing hosp_order (file ssm_pro/src/main/resources/jdbc.properties) enable unauthenticated attackers who obtain the credentials from the public source repository to directly access the backing database, potentially reading and modifying data, provided the credentials remain unchanged and the database is network-reachable. Publicly available exploit code exists (GitHub issue #119), but the CVSS 4.0 base score is 2.9 and the independent assessment rates this as a low real-world priority because high attack complexity (AC:H) and deployment prerequisites-such as credential rotation or database network restrictions-neutralize the flaw. No confirmed active exploitation (CISA KEV) has been reported, and no vendor-released patch is identified.
Cross-site scripting in SourceCodester Smart Attendance System with QR Code Scanner 1.0 lets unauthenticated remote attackers inject arbitrary JavaScript through the full_name parameter of the Self-Registration page (student_signup.php), which then executes in the browser of any user or administrator who renders the affected name. Publicly available exploit code exists, but there is no confirmation of active exploitation. Impact is confined to the victim's browser context - session token theft, defacement, or redirection - with no server-side compromise, and the product is a niche hobby-grade PHP application with essentially no production deployment.
Reflected cross-site scripting in the public /forgotpasswd.html password-reset endpoint of onSite internet GmbH Auktion NG Auktionssoftware (versions up to 20260722) allows remote attackers to inject script into a victim's browser by manipulating the 'email' argument. The flaw is unauthenticated to deliver but requires user interaction - a victim must be lured into opening a crafted link - because the payload is reflected rather than stored and does not fire automatically for other users. Publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV); impact is confined to low client-side integrity manipulation with no confidentiality or availability effect, making this a genuinely low-priority issue despite the medium 5.3 CVSS 4.0 score.
Path traversal in weiqingwen spring-boot-forum lets an authenticated forum user escape the intended avatar storage path by manipulating the Username argument processed in NewUserFormValidator.validate during avatar upload. The issue is remotely reachable and, per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), requires a valid forum account while yielding only Low confidentiality and integrity impact because the traversal is scoped to the avatar file-handling path. Publicly available exploit code exists, the maintainer did not respond to the disclosure, and because the project ships rolling releases with no tagged versions there is no known fixed release to migrate to.
SQL injection in the AdithyaYelloju Restaurant-Management-System allows attackers to manipulate the underlying database through the `s1` search parameter processed by mysqli_query in admin/display_menu.php. Exploitation is gated by the CVSS vector's PR:L rating, meaning an attacker needs at least low-privilege authenticated access to the application's admin area rather than acting as an anonymous internet user. Publicly available exploit code exists (referenced via the project's GitHub issue tracker), but there is no confirmed active exploitation (not in CISA KEV), and the niche, hobby-oriented nature of the software limits real-world exposure. Overall this is a genuine CWE-89 injection but a low-priority finding across every signal.
Cross-site scripting in SEMCMS up to 4.2 allows remote unauthenticated attackers to inject arbitrary script via the imgFile parameter in the KindEditor upload interface (/Edit/php/upload_json.php), requiring a victim to trigger the crafted request (user interaction). Publicly available exploit code exists, though there is no confirmed active exploitation. The vendor was contacted but did not respond, and no official patch is available; the real-world risk is low-to-moderate given the niche deployment and the interaction requirement.
Stack-based buffer overflow in the get_alias_name function of the uhttpd web management service on the Fast FAC1900R SOHO router allows a low-privilege authenticated remote attacker to overwrite stack memory with a crafted request, resulting in limited loss of confidentiality, integrity, and availability (CVSS 4.0 base 5.3; vendor vector PR:L). Publicly available exploit code exists and is referenced from a GitHub proof-of-concept repository targeting the device's devDiscoverNotify handling, so the flaw is straightforward to reproduce for anyone who can reach the management interface. The vendor was contacted but did not respond and no vendor-released patch has been identified, leaving exposure reduction as the practical mitigation.
Cross-site request forgery in the sfturing hosp_order Java application allows an attacker to forge state-changing requests through CommonUserController.java while a logged-in user holds an active session, yielding a limited integrity impact. Publicly available exploit code exists and has been disclosed via upstream issue #122, but there is no KEV listing and no evidence of confirmed active exploitation; EPSS data was not provided. With a CVSS 4.0 base score of 2.1 and a very small deployment base for this obscure, unversioned project, this is a low real-world priority.
Deserialization of untrusted data in Microsoft Recommenders (recommenders-team/recommenders) up to and including version 1.2.1 lets an attacker who supplies a crafted MIND dictionary or vocabulary artifact execute arbitrary code when the newsrec iterator at recommenders/models/newsrec/io/mind_iterator.py calls pickle.load. The issue is gated on user interaction rather than a listening service: a developer or automated training pipeline must deliberately point the MIND iterator at the poisoned serialized dict, which is why the vendor's CVSS 4.0 rating is only 5.1/PR:L/UI:P while the independent assessment rates it CVSS:3.1 AV:N/AC:L/PR:N/UI:R with C:H/I:H/A:H. Publicly available exploit code exists (the public GitHub issue report recommenders-team/recommenders#2368), but there is no evidence of confirmed active exploitation and no KEV listing; the project was informed early via that issue but has not responded, and no vendor-released patch has been identified at time of analysis.
Deserialization in Dask's from_npy_stack() array loader (dask/array/core.py) allows an attacker who can supply or influence the npy-stack path/directory being loaded to trigger unsafe object deserialization, potentially yielding code execution in the victim's process with high confidentiality, integrity and availability impact (assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected are Dask versions through 2026.8.0; this is not exploitation of a listening network service, since successful abuse requires the victim application to deliberately call from_npy_stack() on the attacker-influenced data source (UI:R). Publicly available exploit code exists and the flaw was disclosed via a public GitHub issue, but there is no indication of confirmed active exploitation (CISA KEV) at time of analysis.
sfturing hosp_order stores sensitive information in cleartext in CommonUserServiceImpl.java, allowing a local attacker with a low-privilege authenticated account to read exposed data without user interaction. The issue is a low-severity local confidentiality-only flaw (CVSS 4.0 base score 1.9; independent CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) affecting all versions tracked by CPE cpe:2.3:a:sfturing:hosp_order:*:*:*:*:*:*:*:*; because the project uses rolling releases and has not responded, no fixed version is available. Publicly available exploit code exists, but there is no CISA KEV confirmation.
Broken access control in The Events Calendar WordPress plugin before 6.17.5 allows authenticated contributor-level users to modify, unpublish, trash, and take ownership of records belonging to other users, including administrators. The flaw is a missing per-object capability check on one family of REST write routes (CWE-863), and exploitation requires only a low-privilege WordPress account, consistent with the independent assessment's PR:L rating. No public exploit identified at time of analysis; the vendor patch is 6.17.5.
Unauthenticated attackers can view other customers' order details in NP Quote Request for WooCommerce versions 2.0 through 2.4.15 by supplying a valid order key, because the plugin fails to verify order ownership before rendering order details. Exploitation requires knowledge of a specific victim's order key (a pseudo-random token), which is the primary limiting factor and the reason for the high attack complexity (AC:H) in the CVSS vector; no authentication or user interaction is needed. This is a low-severity confidentiality flaw, and no public exploit code has been identified at time of analysis. The vendor has released version 2.4.16 to address the issue.
Incorrect authorization in the Paid Membership Subscriptions WordPress plugin before 3.1.0 allows an unauthenticated remote attacker to delete another member's in-flight checkout state by supplying that member's transient payment identifier to a payment action that is not bound to the requesting user. The attacker must already possess a valid, currently-active per-checkout payment identifier - a transient, non-enumerable value that must be obtained out-of-band - which is why the assessed CVSS is only 3.7 despite network reachability and no authentication requirement (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Impact is confined to integrity of one victim's checkout state: no data disclosure and no site-wide availability loss; there is no public exploit identified at time of analysis, and the vendor has released a patch fixing the issue in version 3.1.0.
Unauthenticated visitors can abuse the saved-draft notification feature in the Forminator Forms WordPress plugin before 1.57.2.1 to make the site send email from its own mail configuration to an arbitrary recipient, carrying an attacker-chosen link wrapped in the site's own message template; the plugin hands the anonymous caller the token that authorises the send and accepts that token for unlimited replay. Exploitation is limited by a non-default prerequisite: the target site must have a form using the save-and-continue (saved draft) feature together with a configured saved-draft notification email. Given that configuration, no authentication and no user interaction are required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, base score 3.7), impact is bounded to attacker-controlled outbound email (integrity only) rather than data theft or service disruption, no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and a vendor patch is available.
Unauthorized access to protected functionality affects Dell Secure Connect Gateway (SCG) Policy Manager installations running versions prior to 5.34.00.16, where authorization decisions are made against non-canonical URL paths (CWE-647). Remote unauthenticated attackers (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, base 3.7) must craft an alternate but equivalent path representation that the Policy Manager's authorization logic normalizes differently from its request routing, allowing them to reach functions intended to be restricted - with only a limited integrity impact and no confidentiality or availability impact claimed by the vendor. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the high attack complexity (AC:H) reflects that this is not a generic single-request attack against default configuration, which is why the issue is assessed as low priority despite being network-reachable and unauthenticated.
HTTP request desynchronization in Apache Tomcat allows an unauthenticated remote attacker to cause a single request belonging to another user to fail when Tomcat is deployed behind a reverse proxy. The flaw (CWE-444) arises because Tomcat processes the Transfer-Encoding header on HTTP/1.0 requests, and when a fronting proxy interprets that header differently, the two sides disagree about request boundaries on a shared upstream connection. Affected releases are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.47 through 9.0.121, and the end-of-life 8.5.67 through 8.5.100; standalone Tomcat with no fronting proxy is not affected. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) - no persistence, data exposure, or code execution is described - and no public exploit code was identified at time of analysis.
CVE-2026-95324 is currently an unresolved identifier attributed to Ubuntu by vendor reporting, with no description, no CVSS score or vector, no CWE classification, and no version or CPE data supplied in the record. Because the affected component, attack surface, and prerequisites are all unknown, the impact cannot be stated and risk cannot be meaningfully assessed from the provided data; no public exploit code has been identified at time of analysis, and neither EPSS nor CISA KEV status was supplied. Consumers should treat this entry as unenriched and re-query the Ubuntu Security Notices and Ubuntu CVE tracker before assigning severity or exposure.
Risk for CVE-2026-95308 cannot be meaningfully assessed from the intelligence supplied: the record carries no description, no CVSS score or vector, no CWE, and no CPE or package identifiers, and the sole source attribution is the Ubuntu security team. This indicates an issue tracked against some package within the Ubuntu/Debian ecosystem, but the affected component, the required privilege level, and whether user interaction or a non-default configuration is necessary all remain unconfirmed. No public exploit code has been identified at time of analysis, and there is no KEV listing, so there is currently no signal of active exploitation. The actionable next step is to obtain the corresponding Ubuntu Security Notice (USN) for CVE-2026-95308, which will establish the real exploitation conditions and severity.
Google Chrome desktop builds that have not yet received the September 2026 stable-channel update are affected by CVE-2026-95359, a flaw for which the vendor has published a fix in the Chrome Releases stable channel advisory (http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html). The advisory is the only substantive intelligence available: the CVE description is empty, and no CVSS score, CVSS vector, CWE, EPSS probability, or CPE data was supplied, so the exact component, attack vector, and privilege requirements cannot be confirmed from the available data. There is no KEV listing and no public exploit code identified at time of analysis, so exploitation is not confirmed to be occurring; however, because Chrome renders attacker-controlled web content by default, unpatched desktop installations should be treated as exposed until the stable-channel update is applied.
Broken access control in the WC Fields Factory WordPress plugin before 4.1.11 allows an authenticated user holding Contributor-level privileges or higher to invoke the plugin's post-cloning action without any capability check or nonce verification. By doing so, the attacker can duplicate posts of any type or status - including private posts and drafts belonging to other users - and then read the resulting copy, effectively bypassing WordPress's normal content-access controls. The impact is limited to unauthorized read access to duplicated content rather than modification, deletion, or code execution, which keeps this a genuinely low-severity, low-priority issue; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
CVE-2026-96283 is recorded only as a vendor-reported 'security update' from Ubuntu, with no accompanying product identification, CVSS score or vector, CWE classification, or CPE data, so the impacted Ubuntu package, the affected version range, and the conditions under which the issue can be triggered are all currently undefined. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing or EPSS signal provided, so active exploitation is unconfirmed. Risk cannot be meaningfully quantified from the available data, and consumers should treat this entry as a placeholder pending retrieval of the originating Ubuntu Security Notice (USN).
CVE-2026-96282 is an Ubuntu security update for which no affected source package, vulnerability class, or exploitability detail has been disclosed in the available record. Because no CVSS vector, CWE, CPE string, or advisory reference is supplied, it cannot be determined whether exploitation requires authentication or user interaction, or what the impact on confidentiality, integrity, or availability would be. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, and risk cannot be meaningfully assessed from the provided data.
Argument injection in the ad hoc command builder of Red Hat Ansible Automation Platform 2 lets an authenticated user who is permitted to run ad hoc commands smuggle ansible CLI options by passing a host-restriction (`limit`) value beginning with a hyphen, which ansible-core then parses as an option flag. Impact today is minimal (CVSS 3.1, CWE-88): because the injected token displaces the required `pattern` positional argument, only short-circuit flags such as `--version` and `--help` are reachable, so integrity impact is limited to low and no arbitrary option or command control is achievable. There is no public exploit identified at time of analysis, and the issue would only escalate if a future ansible-core release were to default or make optional the `pattern` positional - a hypothetical, non-default upstream change rather than current behavior.
Red Hat Ansible Automation Platform 2 (AWX) accepts leading-dash values in the scm_branch field processed by LaunchConfigurationBaseSerializer, allowing an authenticated user who can create or edit a Schedule or Workflow Job Template node to supply a value such as --upload-pack=/bin/id. The gap is a latent argument-injection issue (CWE-88) that is currently neutralized at runtime by the ValueError guard at jobs.py:1502, so no command execution occurs in shipping code; it would escalate to remote code execution only if that task-layer guard were refactored or removed in a future release. No public exploit code has been identified at time of analysis, and impact today is limited to a low-severity hardening gap (CVSS 3.1, integrity-only).
Any authenticated WordPress user - including a no-privilege Subscriber - can rewrite the saved field configuration of arbitrary forms, up to and including a live payment form, on sites running the Forminator Forms plugin before 1.57.2.1. The flaw is a one-time payment-field migration routine that executes during construction of a Forminator admin screen on every wp-admin request by a logged-in user, with no nonce, capability, or ownership check applied before it runs (CWE-862), giving an attacker integrity-only leverage over form field data. Rated CVSS 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N), the impact is bounded by the one-shot, state-dependent nature of the migration and the absence of any confidentiality or availability effect; no public exploit code or confirmed active exploitation was identified at time of analysis, and there is no CISA KEV listing.
GitLab CE/EE instances running the Model Context Protocol (MCP) search tool can return search results under the wrong user's context when concurrent searches collide, allowing one authenticated user to view another user's search output. The flaw is a race condition (CWE-362) that affects versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1, and carries a low CVSS 3.1 base score with only a confidentiality impact; the timing window is non-deterministic and cannot be forced reliably. There is no public exploit identified at time of analysis and no CISA KEV listing, and deployment exposure is limited to instances that actually expose the MCP search tool to authenticated users.
CVE-2026-95312 is currently an intelligence gap: the only available signal is a report attributed to vendor:ubuntu, with no description, CVSS score, CVSS vector, CWE classification, CPE mapping, or reference links supplied. Because the affected package, attack vector, and privilege requirements are all unknown, the practical impact on Ubuntu systems cannot be characterized at this time, and no public exploit code has been identified at time of analysis. Notably, EPSS scoring and CISA KEV status were not included in the input, so neither heightened exploitation likelihood nor confirmed actively exploited (CISA KEV) status can be asserted or ruled out; risk cannot be meaningfully assessed from the provided data, and the Ubuntu CVE tracker entry for CVE-2026-95312 should be retrieved as the first analyst action.
Risk for CVE-2026-95317 cannot be meaningfully assessed from the available data, and no impact statement should be relied upon until a description, CVSS vector, or affected component is published. The only intelligence associated with this identifier is a vendor attribution to Ubuntu; there is no description text, no CVSS score or vector, no CWE classification, no CPE data, and no reference set that would identify the vulnerable product, feature, protocol, or deployment mode. Exploitation status is likewise indeterminate: no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided to quantify likelihood. Treat this record as unresolved rather than benign - the absence of detail reflects missing publication data, not a confirmed low-severity finding.
Information disclosure in the MediaWiki WikiLambda extension - the software behind Wikifunctions - before version 1.47.0 lets remote, unauthenticated attackers reach functionality that should be constrained by access-control lists, exposing limited, low-sensitivity data. Exploitation requires a reachable wiki with WikiLambda installed and carries high attack complexity (CVSS v4.0 2.9; assessed CVSS v3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N), meaning it likely hinges on a specific request pattern, function state, or race that defeats the intended ACL check rather than working against arbitrary default requests. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; combined with confidentiality-only impact and the specialized, not-widely-deployed nature of the extension, this is a low-priority issue by every available signal.
CVE-2026-95316 is currently identifiable only as an Ubuntu-tracked CVE: the record carries no description, no CVSS score or vector, no CWE classification, and no CPE data, and its sole intelligence source is the reporting vendor (vendor:ubuntu). As a result, the affected component, the vulnerable version range, and the concrete attacker impact cannot be established from the available data, and this entry cannot be risk-assessed at this time. No public exploit code has been identified at time of analysis, and no exploitation activity is confirmed, so any severity or exploitability claim beyond 'undetermined' would be speculation.
CVE-2026-95302 is an identifier tracked by the Ubuntu security team, but at the time of analysis no description, CWE classification, CVSS score, or CVSS vector has been published for it, so the affected component, the attack surface, and the resulting impact are all undetermined. Because there is no affected feature or configuration documented, no exploitation prerequisites, authentication level, or user-interaction requirement can be stated. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis; risk cannot be meaningfully assessed from the provided data.
Information disclosure in Red Hat Ansible Automation Platform 2 allows an authenticated administrator (PR:H per the CVSS vector) to leak controller-side implementation details, including install paths, Python version, and source line numbers, into notification payloads delivered to an attacker-controlled webhook URL. A crafted Jinja notification template using a dynamic subscript such as job['job'+'_env'] slips past the static-Getattr AST whitelist, while a conditional gate like {% if job.id > 100 %} prevents the branch from firing during the small-job.id stub test-render, so the payload executes only against a real job whose exception produces a full traceback in the notification body. Impact is confined to low confidentiality loss (C:L) with no integrity or availability effect, and no public exploit has been identified at time of analysis.
Contributors on WordPress sites running The Events Calendar versions 6.15.0 through 6.17.4 can bypass editorial review and publish events or other content directly through the plugin's REST API. The flaw, a missing capability check (CWE-863), lets authenticated low-privilege users perform actions they are not authorized to do, though impact is limited to integrity without confidentiality or availability loss. No public exploit code has been identified, and the issue is not listed in CISA KEV; severity is low per the assessed vector.
IBM Guardium Data Protection 12.2 returns detailed technical error messages in the browser, allowing an authenticated administrative user to obtain sensitive information about the system. The issue is classified as CWE-209 (generation of error message containing sensitive information) with a CVSS 3.1 base score of 2.7 (Low) and a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, meaning exploitation requires a high-privileged account and yields only low confidentiality impact with no integrity or availability impact. No public exploit has been identified at time of analysis, and the vendor has published a patch advisory; the disclosed detail may be useful for follow-on attacks against the same system, but the prerequisites and limited impact make this a low-urgency issue.
Information disclosure in the Event Booking Manager for WooCommerce WordPress plugin (versions 5.3.6 through 5.7.2) lets authenticated users holding Contributor-level privileges or above enumerate and read other authors' private, draft, and trashed events, along with event detail that the normal listing view withholds. The flaw is an authorization/access-control defect (CWE-284) rather than remote code execution: it is read-only, requires an existing WordPress account with at least Contributor rights, and cannot be triggered by an anonymous visitor, so the practical risk depends heavily on how readily a site hands out contributor accounts. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the vendor has released a fix in version 5.7.3; our independent assessment rates this a genuinely low-priority issue and scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (the NVD vector's PR:H overstates the privilege bar relative to the contributor-level access described).
CVE-2026-96284 is an Ubuntu security update whose advisory record contains only the placeholder text 'security update', with no CVSS score, no CVSS vector, no CWE classification, and no stated affected package, so the concrete impact on Ubuntu hosts cannot be established from this dataset. The record is attributed solely to the vendor:ubuntu source, which indicates a distribution-level package fix rather than an upstream product disclosure. No public exploit identified at time of analysis, and there is no KEV or POC signal in the available intelligence. Given the absence of a vector, product scope, and root-cause class, there is insufficient data to perform a meaningful risk assessment; defenders should pull the specific Ubuntu Security Notice (USN) for this identifier to learn which package, version range, and exploitation prerequisites actually apply.
Opening a crafted uncompressed DDS image in GIMP triggers a one-byte heap out-of-bounds read in the file-dds plug-in, which can crash the plug-in process. The flaw requires a local user to open the malicious file (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L), and the crash is non-deterministic because it only occurs when the byte past the pixel buffer lands on an inaccessible memory page; no information disclosure or code execution has been demonstrated. No public exploit code has been identified at time of analysis, and while downstream tracking covers Red Hat Enterprise Linux 6 through 10, the availability-only impact keeps real-world risk low and the 'RCE', 'Buffer Overflow' and 'Information Disclosure' tags attached to this record are not supported by the assessed vector.
Authenticated RabbitMQ users that hold the 'monitoring' tag can erase a node's authentication-attempt counters by sending DELETE /api/auth/attempts/:node through the Management plugin HTTP API, removing a signal that operators would use to notice brute-force activity. Only deployments running RabbitMQ prior to 4.1.13, 4.2.7 or 4.3.0 with the Management plugin enabled and monitoring credentials issued to a non-administrative or untrusted account are exposed, and exploitation requires the attacker to already possess that valid account. The impact is limited to in-memory metrics (no log or audit-record deletion) and no public exploit code has been identified at time of analysis; EPSS data was not supplied and the issue is not in CISA KEV, consistent with its very low assessed severity.
Cross-tenant information disclosure in RabbitMQ's management HTTP API lets any authenticated user holding the 'management' tag read Raft quorum-queue status - leader, members, term, commit index - for queues in vhosts they cannot access, because the /api/queues/quorum/:vhost/:queue/status handler authorizes only the management tag rather than the target vhost. Affected are RabbitMQ deployments running the management plugin at versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, with impact confined to read-only exposure of queue names and cluster topology in multi-tenant setups. No public exploit identified at time of analysis; EPSS and KEV signals are absent, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) rates this low severity.
Authenticated CPU exhaustion in RabbitMQ Server prior to 4.2.7 and 4.3.1 lets an AMQP 1.0 consumer that holds both read and write permission on a stream queue drive substantial backtracking work in the broker's regex engine: a crafted LIKE filter built from roughly two thousand overlapping '%_' wildcard pairs, combined with long message property values, forces about 100-200 ms of CPU to be consumed per delivered message. The impact is bounded resource amplification rather than a node crash or hang, consistent with a low-severity denial-of-service rating (CVSS 4.0 base 2.3; independent assessment CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L), and no public exploit code has been identified at time of analysis. Exposure is limited to deployments that actually use AMQP 1.0 with stream queues and SQL filter expressions; systems not using that combination are unaffected.
Stack exhaustion in Qt's QXmlStreamReader::readElementText() lets a crafted XML document with deeply nested elements crash applications built on Qt 5.0.0 through 6.8.8 or 6.9.0 through 6.11.1 that parse attacker-influenced XML through that API. The flaw is reachable by unauthenticated remote attackers (CVSS 4.0 PR:N) but requires the application, or a user, to actually process the malicious document (UI:P), and its only demonstrated impact is a recoverable crash of the parsing application - no code execution, data disclosure, or integrity loss. No public exploit identified at time of analysis; the supplied CVSS 4.0 base score is 2.3, making this a genuinely low-priority issue despite Qt's massive install base, and the vendor has published a patch.
Broken access control in the RabbitMQ management HTTP API lets a user holding only the monitoring tag restart any federation link via DELETE /api/federation-links/.../restart, an operation that should require elevated (management/policymaker/administrator) privileges - thereby disrupting message flow between federated brokers. Affected are RabbitMQ server releases prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, but only deployments that enable both the rabbitmq_federation and rabbitmq_federation_management plugins and have at least one active federation link. Exploitation requires an authenticated account carrying the monitoring tag (CVSS v4.0 PR:L), impact is limited to availability of the restarted link, the assessed severity is CVSS 2.3 / CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Path traversal in the RabbitMQ tracing plugin lets a user holding the administrator tag write a file to an arbitrary filesystem location writable by the rabbitmq OS user, because the trace consumer builds its output path as filename:join(TraceDir, Name ++ ".log") from the unvalidated Name parameter of PUT /api/traces/:vhost/:name. Exploitation is an authenticated, administrator-only operation (CVSS vector PR:H) and requires that the rabbitmq_tracing plugin is explicitly enabled and that the target directory is already writable by the broker's OS account, so the realistic scenario is insider or post-compromise abuse rather than an externally reachable flaw. Impact is limited to integrity of local files (I:L, C:N/A:N) and is further constrained by the mandatory .log suffix, which restricts writes to .log-suffixed targets and makes any escalation to code execution opportunistic; no public exploit identified at time of analysis, and the issue is rated 2.1 (CVSS 4.0), consistent with a low-priority, high-privilege finding. Fixed versions are 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
Unrestricted file upload in Pixtream allows an authenticated low-privileged attacker to send arbitrary files through /post_upload.php because the media argument lacks effective file-type validation; uploaded files may execute as PHP if stored in a web-served directory. Publicly available exploit code exists, but no CISA KEV confirmation indicates active exploitation, and the authentication prerequisite plus the product's near-zero deployment footprint make urgent risk low. The vendor was contacted but did not respond, and no patched release or versioning scheme is available.
RabbitMQ stream-management HTTP API allows an authenticated user holding the management tag and vhost access - but no configure permission on any resource - to create super-streams, which consist of an exchange, N partition stream queues, and their bindings, without the per-resource authorization check the native stream protocol path enforces. This is a genuine but low-impact authorization flaw (CWE-862 missing authorization) rated CVSS 2.1 by the vendor and an assessed CVSS:3.1 of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, since the impact is confined to unauthorized integrity changes (persistent resource creation) with no data disclosure or denial of service. Exploitation requires the non-default rabbitmq_stream_management plugin to be enabled and a management-tagged account with vhost access; no KEV listing or public exploit was identified, and vendor fixes are available in 4.0.22, 4.1.11, 4.2.6, and 4.3.0.
SQL injection in itsourcecode Leave Management System 1.0 via the ID argument in /module/leavetype/index.php allows an authenticated low-privileged remote attacker to manipulate database queries; the independent assessment rates confidentiality impact High and integrity/availability None under CVSS 3.1, while the CNA CVSS 4.0 score is 2.1. Publicly available exploit code exists, but there is no evidence of active exploitation or KEV listing, and exploitation requires valid credentials plus network access to the vulnerable endpoint. This is a low real-world-priority issue despite the SQL injection classification because the target is a niche application and the attack is not unauthenticated.
Missing authorization in the ByteDance Coze Scraper Chrome extension (versions up to and including 2.0.2) allows any website to drive the extension's externally exposed message handler and make it scrape attacker-chosen URLs and extract page data along attacker-supplied XPath/pagination parameters. The flaw is in the chrome.runtime.onMessageExternal listener defined in static/background/index.js, which processes incoming messages without verifying the sender's origin; exploitation requires the victim to have this niche extension installed and to visit or interact with an attacker-controlled page, so real-world exposure is limited to that user base. A publicly available exploit write-up exists and the vendor was contacted but did not respond; CISA KEV does not list this issue, and the low EPSS/CVSS 4.0 score of 2.1 reflects limited confidentiality impact with no integrity or availability effect and no code execution.