Risk cannot be meaningfully assessed for CVE-2026-95323 because the record contains no description, no CVSS score or vector, no CWE mapping, and no affected-product identifiers, leaving a vendor attribution to Ubuntu as the only intelligence available. With no information about the vulnerable component, its deployment mode, or the attacker's required position, no impact statement, authentication requirement, or exploitation precondition can be derived. There is no public exploit identified at time of analysis, and this should be handled as an unenriched placeholder record that is re-evaluated once NVD or the Ubuntu security team publishes a description and severity metrics.
Ubuntu Linux is the only attributed product for CVE-2026-95307, which reaches us solely through a vendor:ubuntu source with no description, CVSS vector, CWE, CPE, or reference data attached. Because the affected component, attack vector, authentication requirements, and user-interaction prerequisites are all missing, the impact an attacker could achieve cannot be stated and the overall risk cannot be meaningfully assessed from the provided data. There is no KEV listing, no public exploit code identified, and no EPSS score available at time of analysis, so no exploitation signal exists in either direction. Treat this identifier as an unresolved tracking item pending enrichment from the Ubuntu security tracker or NVD.
CVE-2026-95309 is recorded in this dataset only as reported by vendor:ubuntu, with an empty description, no CVSS score or vector, no CWE mapping, no references, no EPSS or KEV signal, and no patch metadata. Because the affected Ubuntu package, subsystem, and deployment context are all unknown, the impact cannot be characterized and risk cannot be meaningfully assessed from the provided data. No public exploit code has been identified at time of analysis, and there is no confirmed evidence of exploitation; this reflects absence of intelligence rather than confirmed safety. The originating Ubuntu Security Notice (USN) must be retrieved to establish whether the issue is a local privilege escalation, a remote service flaw, or a lower-severity hardening gap before any triage decision is made.
Exploitation and impact for CVE-2026-95294 cannot be established from the available intelligence: the description is empty, no CVSS score or vector was assigned, no CWE mapping was provided, and no EPSS or KEV signal accompanies the record. The single traceable data point is the reporter field, which designates Ubuntu as the reporting vendor, meaning the affected component is most likely an Ubuntu-maintained package with a corresponding Ubuntu Security Notice (USN) that has not yet been surfaced in this dataset. No public exploit code has been identified at time of analysis and there is no confirmation of active exploitation (no CISA KEV entry), so any characterization of severity - remote versus local, authenticated versus unauthenticated, code execution versus denial of service - would be speculation until the USN and NVD entry are reviewed.
Server-side request forgery (SSRF) in iFlytek astron-agent through version 1.0.6 lets an authenticated console user steer server-side HTTP requests to internal or otherwise restricted destinations by supplying a crafted endPoint argument to the debugToolV2 API, which reaches UrlCheckTool.checkUrl. The weakness is a redirect-handling gap: the pre-patch validator followed only a single 301/302/303 hop and ignored 307/308, so a URL that passes the initial blacklist/whitelist check can still bounce the request to an internal target; the vendor fixed this in release reward-1575 with a bounded 5-hop chain that revalidates every hop and detects loops. Impact is limited (CVSS 4.0 score 5.3; independent assessment CVSS 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), requiring valid console credentials, and no public exploit identified at time of analysis.
SQL injection in the console component of iFlytek astron-agent (versions up to and including 1.0.7) lets an authenticated low-privilege user inject arbitrary SQL via the `sortDirection` parameter of the getBotList API, which is concatenated directly into the ORDER BY clause of ChatBotMarketMapper.xml. Because the vulnerable ORDER BY sink cannot return query results to the caller, exploitation is blind (time- or boolean-based), so an attacker with a valid console account and network access to the endpoint could progressively extract backend data - the independent assessment rates confidentiality impact as high (CVSS:3.1 C:H, PR:L, AV:N) with no integrity or availability effect. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS data was not supplied; the vendor addressed it in release reward-1575 by whitelisting the sort direction.
Red Hat Ansible Automation Platform 2 (automation-controller) lets an unauthenticated remote attacker enumerate which Job Template and Workflow Job Template IDs have a Bitbucket Data Center webhook configured, by abusing an observable response discrepancy in the Bitbucket DC webhook receiver. For diagnostics:ping events the receiver performs the template lookup before HMAC signature verification is skipped, so the endpoint returns HTTP 200 for a template with a Bitbucket DC webhook and HTTP 403 otherwise - an oracle that requires neither authentication (PR:N in the assessed vector) nor knowledge of the secret webhook_key. Assessed at CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), this is a low-impact information-disclosure and enumeration issue: no secrets, code execution, or elevated access are exposed; no public exploit identified at time of analysis and no confirmed actively exploited status.
Information disclosure in the automation-controller API of Red Hat Ansible Automation Platform 2 lets any remote unauthenticated party read the automation mesh topology from the health-check endpoint /api/v2/ping/ (CVSS 3.1: 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Because the ApiV2PingView view is declared with the AllowAny permission class and over-serializes RBAC-gated mesh data into its anonymous response, an attacker needs only network reachability to walk away with node hostnames, node types, UUIDs, heartbeats, capacities, exact software versions, instance-group names and membership, the deployment install UUID, and the identity of the active control node. The exposure is confidentiality-only - no secrets, credentials, or tenant data are involved - and there is no public exploit identified at time of analysis, so this is a genuine but modest reconnaissance-grade issue rather than an urgent one.
Path traversal in IBM Concert 1.0.0 through 3.0.0 permits unauthenticated remote attackers to read files accessible to the Concert service account by sending crafted URLs containing dot-dot-slash sequences. The flaw has a CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so impact is limited to confidentiality with no write or code execution. No public exploit code was identified at time of analysis, and IBM has made a patch available.
GoCD 20.2.0 through pre-26.1.0 allows any authenticated user to retrieve inter-pipeline dependency hierarchy details and user-defined pipeline, stage, job, and artifact plugin reference names via the internal fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream, bypassing per-pipeline view authorization. The endpoint is read-only, so impact is limited to information disclosure that matters primarily where pipeline visibility is restricted per user or team; single-team installations expose little extra. No public exploit code was identified at time of analysis, and the issue is fixed in version 26.1.0.
IBM Concert 1.0.0 through 3.0.0 can be induced to return detailed technical error messages to a requesting browser, leaking implementation detail to a remote, unauthenticated attacker (CVSS 3.1: AV:N/AC:L/PR:N/UI:N, C:L only, 5.3). Impact is limited to low-sensitivity information disclosure with no integrity or availability effect, so the practical value is reconnaissance for follow-on attacks, and only Concert instances whose web interface is reachable by the attacker are exposed. No public exploit identified at time of analysis, and IBM has published a vendor fix; the issue is a low-priority information-disclosure item rather than a standalone compromise vector.
Authenticated users holding the ERPNext Accounts Manager role can invoke arbitrary non-whitelisted server-side Python methods and read back their return values in Frappe ERPNext versions before 16.34.1. The flaw lives in Financial Report Template handling: a Custom API row's calculation_formula is passed straight to frappe.call() without verifying that the dotted path resolves to a whitelisted, GET-permitting method, so an attacker with rights to create or edit such templates can point the formula at internal methods that were never meant to be remotely callable. The assessed impact is limited information disclosure and limited integrity impact (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N; CVSS 4.0 5.3), exploitation requires a privileged non-default role, no public exploit code has been identified at time of analysis, and no EPSS or CISA KEV data indicates active exploitation. This is a genuine but modest-severity issue best treated as medium-low priority.
Google Chrome desktop installations are affected by a flaw corrected in a stable channel update, with vendor patch data indicating a fix is available but no description, CVSS score, CVSS vector, or CWE supplied to characterize the defect. Because neither the affected component nor the attack vector is specified in the available intelligence, the impact cannot be assessed beyond Chrome's general exploitation model, in which a victim would need to load attacker-controlled web content for an exploit attempt to succeed. No public exploit identified at time of analysis, and Chrome's automatic-update mechanism sharply limits exposure so that primarily outdated installations remain at risk; the linked Chrome Releases advisory is the authoritative source for the exact affected build and fix.
Google Chrome desktop on the stable channel is affected by a security defect tracked as CVE-2026-95360, which the vendor has corrected in a later stable-channel build documented on the Chrome Releases blog; the specific affected component, vulnerable version range, and impact are not confirmable because no description, CVSS score or vector, CWE, or CPE data was supplied. Based on the product identity (Chrome desktop stable channel) and typical browser-fix patterns, exploitation most plausibly requires the victim to load attacker-controlled web content in an unpatched Chrome build, making user interaction a likely limiting prerequisite that must be verified against the referenced advisory. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing indicating confirmed active exploitation; patch available per vendor advisory.
An out-of-bounds read in BusyBox's built-in TLS handshake parser (get_client_hello()) lets unauthenticated remote attackers trigger a limited memory over-read by sending a malformed, truncated TLS ClientHello to a BusyBox process that parses inbound handshake data. Impact is confined to low confidentiality loss (CVSS 5.3, C:L) with no integrity or availability effect, and exploitation requires the atypical configuration of BusyBox acting as a TLS server or handshake receiver, since BusyBox's TLS code is most often used client-side for wget/https. There is no public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and Red Hat tracks the issue for Red Hat Hardened Images (advisory: https://access.redhat.com/security/cve/CVE-2026-88840; Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2531354).
IP-based deny rules in BusyBox httpd can be silently bypassed: when an administrator configures an access-control rule with an invalid CIDR prefix length, the parser zeroes the netmask so the rule matches no clients and the intended block never takes effect. The flaw is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3), but it only manifests under that administrator-side precondition, so exposure is limited to deployments whose httpd configuration contains malformed deny entries - Red Hat Hardened Images are identified as affected via the published CPE. Impact is confined to confidentiality loss through bypass of the intended IP restriction, and no public exploit identified at time of analysis.
Unauthenticated attackers can forge PayPal payment and subscription-cancellation notifications against WordPress sites running the Premium Packages plugin before 7.2.1, because the plugin processes webhook/IPN payloads without verifying PayPal's signature. The transaction-id prerequisite makes attacks targeted rather than blind, and the impact is limited to payment and subscription state integrity (CVSS 5.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) with no data disclosure or availability loss. A vendor patch is available in 7.2.1; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers can write forged card-token records into arbitrary user accounts and enumerate registered users on WordPress sites running the Paymob for WooCommerce plugin before version 4.1.14, because the card-token branch of the plugin's payment webhook never validates the request signature. Exploitation requires only that the site runs the affected plugin with its webhook endpoint reachable - no credentials, user interaction, or non-default configuration are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, NVD 5.3) - and impact is limited to unauthorized data writes and account enumeration rather than account takeover or code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor-released patch (4.1.14) is available, so exposure is bounded by Paymob's regional (MENA) deployment footprint.
Unauthenticated information disclosure in the WPC Smart Compare for WooCommerce plugin before 6.6.1 allows remote attackers to read the descriptions of password-protected WooCommerce products, because the plugin's comparison handler returns product content without applying WordPress's post-password protection. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so it is limited to confidentiality with low impact and no integrity or availability effect, and no public exploit has been identified at time of analysis. A vendor patch is available in 6.6.1 and the exposure is confined to content that site owners intended to keep behind a password.
Unauthenticated information disclosure in the FluentBoards WordPress plugin (versions 1.95 through before 2.1.0) lets remote attackers retrieve the email addresses of a shared board's members - typically including site administrators - by querying the plugin's public, token-shared board endpoint. Exploitation requires only that a board has been exposed via the plugin's share-link feature; no credentials or user interaction are needed, consistent with the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector and a confidentiality-only impact (C:L). No public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV), but the low EPSS-relevant barrier and the administrative-email exposure make it a useful reconnaissance primitive for follow-on phishing or credential attacks against FluentBoards sites that use public board sharing.
Unauthenticated information disclosure in the Product Badge, Label, Countdown Timer for WooCommerce plugin (versions 7.0.0 up to but not including 7.5.2) lets remote attackers retrieve the title, description, and price of products that are in draft, pending, or private status. The plugin returns product details without first verifying that the product is published, so any user who can reach the affected front-end functionality can enumerate unpublished catalog content; no authentication, user interaction, or special configuration is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Impact is limited to confidentiality of product metadata - there is no write, code execution, or availability effect - and the practical exposure depends on whether the store actually holds sensitive unpublished products; no public exploit identified at time of analysis. A vendor patch is available in 7.5.2.
Unauthenticated information disclosure in the Post Grid Gutenberg Blocks WordPress plugin (all versions before 5.0.41) lets any remote attacker read the custom field key names of arbitrary posts by calling an unprotected REST API route. Because the route enforces neither an authorization check nor a post-visibility check, keys belonging to private, draft, pending, scheduled and password-protected posts are disclosed alongside those of published content; the only prerequisite is knowing or enumerating valid post IDs. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3, capped by the fact that only key names - not values or post content - are returned, making this reconnaissance-grade metadata leakage rather than direct sensitive data exposure.
Unauthenticated information disclosure in The Events Calendar WordPress plugin (versions 4.5 through before 6.17.5) allows remote attackers to read the stored details of linked records-such as draft, pending, or private events and their associated venues/organizers-that were never intended to be public. The flaw stems from missing post-status checks when embedding linked record data into a public REST API response. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 6.17.5.
The Easy Hide Login WordPress plugin before 1.7 leaves the standard login page reachable when an attacker supplies certain password-reset request parameters, and the resulting page discloses the site's configured secret login slug. Any site running the plugin for its intended purpose (hidden custom login URL) is affected, and exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) with no public exploit code identified at time of analysis. Impact is limited to disclosure of the obscurity secret - the flaw does not bypass authentication on its own, so follow-on value requires valid credentials or a separate login flaw, making this a low-priority, defense-in-depth-defeating information disclosure rather than a direct compromise.
Unauthenticated information disclosure in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 allows any remote attacker to retrieve registered users' private contact details by querying a REST endpoint that lacks an access-control check. The only prerequisite is a WordPress site running an affected version (8.1 through 8.9.4) with its REST API reachable, which is the default configuration, and no authentication or user interaction is required. Impact is bounded to confidentiality - contact data of registered users, with no write access, privilege escalation, or system compromise - and the vendor has released a fix in version 8.9.5; no public exploit code has been identified at time of analysis.
Missing authorization checks in the Social Commerce for WooCommerce WordPress plugin (versions through 2.5.4) leave several of its REST API endpoints reachable by unauthenticated users, allowing anyone who can reach the site to overwrite plugin configuration and product-synchronisation state. The flaw is CWE-862 (missing authorization) with a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning exploitation requires no credentials or user interaction but is limited to partial integrity impact - no data disclosure and no denial of service. Exposure is restricted to WordPress sites running this specific niche plugin at a vulnerable version, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Missing authorization in the WordPress plugin Email Subscribers & Newsletters (versions before 5.9.35) lets unauthenticated remote attackers force-unsubscribe or force-confirm an arbitrary subscriber simply by supplying that subscriber's email address, because the plugin never validates the per-subscriber management token that should gate the subscription-status change. Exploitation requires no authentication, no user interaction, and no special configuration - only knowledge of a target email address on the mailing list. Impact is confined to integrity manipulation of subscription state (silent removal or confirmation of subscribers), with no data disclosure, code execution, or site takeover; only a single reference (WPScan advisory) is available, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
WordPress sites running the Better Payment plugin before 2.3.4 can be tricked into accepting an arbitrary, reduced payment for a fixed-price item, because the plugin builds the gateway charge from a client-submitted amount without re-validating it server-side against the merchant's configured price. The flaw is exploitable remotely and without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), but impact is confined to integrity of the transaction - attackers can underpay, they cannot read data or disrupt availability (C:N/I:L/A:N, base score 5.3). No public exploit code and no confirmed active exploitation were identified at time of analysis, and realistic risk is bounded to merchants who actually sell fixed-price items through this plugin's checkout flow.
Cross-Site WebSocket Hijacking (CWE-1385) in RabbitMQ's Web-MQTT and Web-STOMP plugins allows attacker-controlled JavaScript running in a victim's browser to open an authenticated WebSocket connection to the broker, because the WebSocket upgrade handlers at rabbit_web_mqtt_handler.erl:104 and rabbit_web_stomp_handler.erl:102 never validate the Origin header. The flaw is only reachable under non-default configuration - Web-STOMP with use_http_auth=true, or either plugin with ssl_cert_login=true - where the browser automatically presents the victim's TLS client certificate, letting the attacker inherit the victim's identity; the issue is harmless under the default in-band CONNECT credential setup, so default deployments are unaffected. No public exploit has been identified at time of analysis, but the CVSS:3.1 assessment (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) rates the confidentiality and integrity impact as high where a vulnerable configuration is in use.
Cross-site request forgery (CSRF) in the EasyStore extension for Joomla (versions 1.0.0 through 3.0.0) allows a remote unauthenticated attacker to trick a logged-in victim into submitting unauthorized product reviews or review spam via the product.addReview endpoint. The flaw stems from commented-out anti-CSRF token verification, and exploitation requires the victim to visit attacker-controlled content while authenticated. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to low integrity (unauthorized reviews) without confidentiality or availability loss.
Unauthenticated sensitive data exposure in the TrustedLogin Connector WordPress plugin (versions 2.0.3 and earlier) allows any remote attacker to read information that should not be publicly accessible. The vulnerability is rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning it is network-reachable, requires no authentication, no privileges and no user interaction, but the impact is confined to a LOW-severity confidentiality leak with no integrity or availability effect. Exploitation status is no public exploit identified at time of analysis, and no CISA KEV listing or public proof-of-concept was reported by the source (Patchstack) or by EUVD-2026-85503; the practical limiter on risk is the narrow scope of the leak rather than the difficulty of reaching it.
Unauthenticated insecure direct object reference in the RadiusTheme 'TLP Team' WordPress plugin (versions 6.0.0 and earlier, CPE cpe:2.3:a:oleh_radiustheme:team) lets remote attackers retrieve team-member record data without logging in or interacting with the site, because a user-controlled object key is trusted without an ownership or capability check. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N vector, the flaw is confidentiality-only: an attacker can read limited object data but cannot alter content, escalate privileges, or cause denial of service, so realistic impact is disclosure of individual team entries rather than full site compromise. No public exploit code was identified at time of analysis and the plugin is not listed in CISA KEV; exploitation requires only that the plugin be installed on a network-reachable WordPress instance, making this a moderate, patch-when-convenient exposure rather than an urgent one.
Unauthenticated attackers can bypass an access-control mechanism in the WordPress plugin WP User Frontend at version 4.3.11 and earlier, allowing a constrained unauthorized action against any site where the plugin is installed and active. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are required - the only meaningful limit is impact scope, since the flaw carries low integrity impact only (C:N/I:L/A:N) and does not expose confidentiality or availability. Exploitation status: no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; CVSS base 5.3 places this as a moderate-but-bounded risk, and operators should confirm the exact affected endpoint against the Patchstack advisory before assuming a specific feature is required.
Unauthenticated bypass in the Netgsm WordPress plugin (versions up to and including 2.10.0) lets remote attackers bypass an access-control check and make limited unauthorized changes to site state (C:N/I:L/A:N), with no confidentiality or availability impact. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N - network-remote, no authentication and no user interaction required on a default WordPress install with the plugin active. No public exploit identified at time of analysis, no CISA KEV entry, and the plugin has a small real-world install base, so overall risk is moderate rather than urgent despite the unauthenticated attack path.
Unauthenticated broken access control in MarketKing (Multivendor Marketplace for WooCommerce) 2.1.70 and earlier allows remote attackers to invoke a privileged plugin action without any authorization check, resulting in unauthorized integrity changes on affected WordPress sites. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning no credentials or user interaction are required but the impact is confined to low-integrity modification with no confidentiality or availability effect. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; risk is further limited because the description does not identify the specific unprotected endpoint, so an attacker must first discover it, and the plugin is a niche commercial marketplace add-on with limited deployment.
WP User Manager, a WordPress plugin for front-end user profiles, registration, and login, up to and including version 2.9.19 contains an unauthenticated broken access control flaw (CWE-862) that lets a remote attacker perform an action or modify data that should require authorization. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (base 5.3) means the endpoint is reachable over the network with no credentials, no victim interaction, and no special configuration, but the impact is capped at a partial integrity loss - there is no data disclosure and no denial of service, and the exact restricted action protected by the missing check is not specified in the available data. No public exploit code was identified and there is no evidence of confirmed active exploitation (not listed in CISA KEV) at time of analysis, and Patchstack's advisory is the originating report.
Unauthenticated insecure direct object reference (IDOR) in the WordPress plugin AI Engine at version 3.7.8 and earlier allows any remote attacker who can reach the site to read plugin-managed objects by manipulating object references, with no authentication and no user interaction required, as reflected in the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3 MEDIUM). Impact is deliberately narrow: only low confidentiality loss is possible, with integrity and availability explicitly unaffected, and successful extraction generally depends on the attacker being able to guess or enumerate valid object identifiers. Based on the available data there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the flaw was reported through Patchstack and tracked in the EU as EUVD-2026-85465. Sites are exposed only if the AI Engine plugin is installed, active, and running a version at or below 3.7.8.
An insecure direct object reference (IDOR) in the WEBCON BPS Gantt vacation-chart REST endpoint (/api/vacations/{path}) lets any authenticated user read vacation and scheduling data belonging to other employees by supplying arbitrary logins in the selectedPeople parameter. The server fails to verify that the requesting user is authorized to view the targeted accounts, so attackers can enumerate managers and staff from other offices and bypass the workflow's business-logic access rules. Rated CVSS 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N), it is a genuine but low-severity information-disclosure flaw; exploitation requires valid credentials, and there is no public exploit identified at time of analysis. Vendor-released patches are available in versions 2025.2.1.177 and 2026.1.1.20.
Google Chrome desktop (stable channel) is affected by a vulnerability that is documented only through Google's stable-channel release advisory, with no accompanying description, CVSS score or vector, CWE mapping, EPSS probability, or KEV listing available at time of analysis. Because the technical details of the underlying flaw are absent, the concrete impact on confidentiality, integrity, or availability cannot be characterized, and the only independently confirmed facts are the affected product (Chrome desktop stable) and that a vendor patch exists. There is no public exploit identified at time of analysis, and authentication requirements are not confirmed from available data; as with most Chrome browser issues, the practical limiting factor is that exploitation typically requires the victim to load attacker-controlled web content rather than being reachable without interaction. Organizations should treat this as a patch-management item and apply the current stable-channel update rather than as an immediate emergency, while acknowledging that the risk assessment is based on very limited signal.
Authenticated but unprivileged users of Red Hat Ansible Automation Platform 2 can read platform-wide job event information through the JobJobEventsChildrenSummary endpoint, which performs no object-level authorization check. Because the view declares no model or parent_model, ModelAccessPermission.check_get_permissions() falls through and returns True for every authenticated principal, and the handler substitutes a raw get_object_or_404(Job, pk), exposing event tree structure, event_processing_finished status, and the existence of arbitrary Job IDs via a 200/404 oracle. Exploitation requires only a valid zero-privilege account on the controller and no user interaction, making this a confidentiality-only information disclosure (assessed CVSS 5.0, AV:N/AC:L/PR:L/UI:N); no public exploit code has been identified at time of analysis, and the sibling endpoint /jobs/{id}/job_events/ correctly returns 403, confirming the defect is endpoint-specific.
Server-side request forgery in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin (versions before 8.9.5) lets any authenticated user with subscriber-level access or above supply a URL that the server then fetches without validation, causing the WordPress host to issue requests to internal addresses and services. Exploitation requires only a low-privilege account, which is realistic on directory and classified-ad sites that typically enable open registration, and the request succeeds without any victim interaction. Impact is limited to confidentiality (CVSS 5.0, C:L), there is no public exploit identified at time of analysis, and updating to 8.9.5 remediates the issue.
Information disclosure in Red Hat Ansible Automation Platform 2 allows an authenticated low-privilege user to enumerate named resources - organizations, credentials, inventories, and hosts - across tenants, including internal hostnames, by observing a response-discrepancy in the URLModificationMiddleware. The middleware resolves named-URL lookups against unfiltered Model.objects before RBAC enforcement, and its 403→404 shim only rewrites 403 responses, so the pk=0 miss path remains distinguishable via 'Not found.' versus 'No <Model> matches...'. Exploitation requires an authenticated account (PR:L per CVSS) and is only meaningful on multi-tenant deployments; it yields existence information only, with no modification or availability impact. No public exploit identified at time of analysis and no CISA KEV status is indicated (no EPSS score was provided).
CVE-2026-95300 is currently an unpopulated record: the supplied intelligence contains no description, no CVSS score or vector, no CWE classification, and no CPE data, so the flaw's nature and impact cannot be characterized at this time. The single attribution available is that the record was reported by the Ubuntu vendor source, which suggests Ubuntu may be the coordinating or affected vendor, but no package, version, or component is identified. With no KEV listing and no public exploit code referenced in the input, there is no public exploit identified at time of analysis, and risk cannot be meaningfully assessed from the provided data.
Parsing a crafted PE file with a malformed IMAGE_BASE_RELOCATION BlockSize field can crash or disrupt JusticeRage Manalyze 1.0.0 through an integer underflow in PE::_parse_relocations, a low-severity denial-of-service condition confined to the analysis tool itself. The attack is local only: the victim must run Manalyze (manually as a malware analyst, or automatically in a triage/sandbox pipeline) against the attacker-supplied sample, and there is no code execution, confidentiality loss, or integrity loss - only the parsing routine misbehaves. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the upstream commit c372b6bbca9d8c63812be50596fefa4a79c65fd0 adds the missing BlockSize validation; the EPSS signal for this niche tooling bug is consistent with a low real-world priority.
Integer overflow in the ALSA topology decoder of alsa-lib through 1.2.16.1 lets a crafted .tplg topology file wrap the combined control-element size calculation, so the decoder passes its bounds check and reads past the end of the topology buffer, potentially disclosing process memory or crashing the application. Exploitation is local (AV:L) and requires the victim to load an attacker-supplied topology file (UI:P/UI:R, PR:N); no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. Independent assessment rates the real-world risk as low-to-moderate: topology files are normally trusted, system-provided sound-card configuration data, so the flaw is only practically reachable where alsa-lib processes topology input from an untrusted source, and the demonstrated impact is limited to low confidentiality and low availability loss.
Local denial of service in alsa-lib through 1.2.16.1 allows a local user with low privileges to crash applications that use the multi PCM plugin by supplying a crafted ALSA configuration file containing sparse binding indices. The flaw is an improper validation of array index (CWE-129) that leads to an out-of-bounds read and an assertion failure, aborting the process. No public exploit code has been identified, and the issue is assessed as low severity with availability-only impact; patching is available via upstream PR 527.
CAPTCHA verification bypass in the WordPress plugin Captcha Code (by webfactory) version 3.32 and earlier allows unauthenticated remote attackers to submit protected forms without solving the challenge, weakening the anti-automation control on any form the plugin guards. The assessed CVSS v3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, base 4.8) confirms no authentication or user interaction is required, but its high attack complexity indicates the bypass is not guaranteed on every attempt and the outcome is confined to defeating the CAPTCHA itself - it does not yield WordPress account access or site compromise. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a genuinely low-priority issue despite the 'authentication bypass' framing; its real-world value depends entirely on how sensitive the forms the CAPTCHA was protecting happen to be.
CVE-2026-95305 cannot be meaningfully risk-assessed because the record is a near-total data void: the description is '[Unknown description]', and no CVSS score, CVSS vector, CWE, references, CPE data, EPSS score, KEV status, or POC data accompanies it. The single intelligence signal available is the reporting source - vendor:ubuntu - which indicates an Ubuntu-associated report or packaged component but does not establish the upstream project, the vulnerable feature, the affected version range, or the attacker's required position. Consequently, whether exploitation requires authentication, user interaction, or a non-default configuration is unknown, and no public exploit code has been identified at time of analysis - a statement that reflects missing evidence rather than a confirmed negative.
CVE-2026-95292 is tracked against Ubuntu, identified here only through the vendor:ubuntu reporting source, with no description, CVSS vector, CWE classification, CPE data, or affected package name supplied in the available intelligence. Because the vulnerability class, attack vector, and impacted component are all unknown, the exploitable impact on any Ubuntu release cannot be characterized, and remediation cannot name a fixed package version. No public exploit code has been identified at time of analysis, and no CISA KEV entry is present, so there is no indication of confirmed active exploitation; first-sentence risk cannot be meaningfully assessed from the provided data.
Google Chrome desktop users on the stable channel are affected by CVE-2026-95346, a flaw that Google addressed through a Stable Channel Update for Desktop documented on the Chrome Releases blog. The supplied advisory is the only reference, and no description, CVSS score, CWE, or CPE data accompanies this CVE, so the specific vulnerability class, affected build range, and impact cannot be confirmed from the available intelligence; exploitation prerequisites are likewise unconfirmed. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but a vendor patch is available per the Chrome Releases advisory, so the primary exposure is the window between patch publication and the user restarting the browser. Because the CVSS vector is absent, authentication requirements cannot be confirmed from available data, and remote unauthenticated default-configuration exploitation should not be assumed.