Authenticated users holding only contributor-level access on WordPress sites running the Paymob for WooCommerce plugin before 4.1.14 can delete, wipe, or modify the plugin's payment-gateway configuration, including stored Paymob payment credentials, because several admin-AJAX handlers omit a capability check (CWE-862 missing authorization). The affected site must have the plugin installed and active, and the attacker must first obtain a low-privilege account - via open registration or a compromised contributor user - after which no administrator interaction and no non-default configuration are required, yielding low confidentiality and availability impact but high integrity impact on the gateway configuration. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in version 4.1.14; despite the 'Authentication Bypass' tag applied by the reporter, the assessed nature of the flaw is an authorization gap, not a credential-free bypass.
A crafted PDF opened in Foxit PDF Editor or Foxit PDF Reader can read content from other documents loaded in the same application process and transmit it to an external destination, because Foxit's JavaScript interface omits the attribute authorization checks required by the specification. The attack is local and requires the victim to open the file (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, base 4.7): a second sensitive PDF must already be open in the same process for the cross-document read to succeed, and the malicious document must run with the elevated privileges of a trusted document. There is no memory corruption, so the impact is confined to confidentiality (C:H/I:N/A:N); no public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV). Reported by Foxit and mapped to CWE-668 (Exposure of Resource to Wrong Sphere), this is a genuine but constrained information-disclosure flaw rather than a remotely reachable compromise vector.
Google Chrome desktop on the stable channel is the affected product behind CVE-2026-95332, a defect significant enough that Google shipped the fix in a stable-channel update rather than holding it for a routine release, yet the entry carries no description, no CVSS base score or vector, and no CWE, so the precise attack surface and technical impact cannot be named from available data. The practical consequence is therefore indeterminate: an unpatched Chrome desktop build is potentially exposed, but whether the flaw yields memory corruption, sandbox escape, information disclosure, or something else cannot be confirmed, and the only reasonable exposure model is the generic browser one in which a victim loads attacker-controlled web content with user interaction. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, so the dominant risk factor is simply the population of users running unpatched builds, which Chrome's automatic-update mechanism continually shrinks.
Impact from CVE-2026-95293 cannot be characterized: the record concerns an unnamed package in the Ubuntu Linux distribution, reported by the Ubuntu security team, with no description, no CVSS score or vector, no CWE classification, and no affected version range supplied. Because the vulnerable component, its deployment mode, and its authentication requirements are all unknown, the attacker capability enabled by this flaw cannot be stated, and authentication requirements are not confirmed from available data. There is no public exploit identified at time of analysis, and the record should be treated as incomplete pending the Ubuntu Security Notice for CVE-2026-95293; risk of real-world exploitation is currently assessed as insufficient data to assess real-world risk.
Stored HTML injection in the MasterStudy LMS WordPress plugin before 3.7.50 allows authenticated users with subscriber-level accounts or above to embed arbitrary markup - for example iframes - into user-submitted content that is later rendered to other users, enabling phishing and content spoofing. The prerequisite is trivially met on LMS sites that allow open self-registration, though it remains a real gate since the attacker must hold an account (PR:L, not unauthenticated), and the payload only fires when another user views the injected content (UI:R). Impact is bounded to markup-level abuse rather than script execution or account takeover, the CVSS 3.1 base score is 4.6, and no public exploit identified at time of analysis. This is a genuine but low-priority issue that is resolved by upgrading to 3.7.50.
Impact for CVE-2026-95295 cannot be determined from the available data: the record is tracked by the Ubuntu security team against a package distributed with Ubuntu Linux, but it carries no description, no CVSS vector, and no CWE classification, so the attack vector, required privileges, and user interaction requirements are all unconfirmed. Because no exploitation evidence, KEV listing, or public proof-of-concept is provided, there is no public exploit identified at time of analysis, and the EPSS-style risk signal is absent. The practical consequence is that prioritization must be deferred until the Ubuntu CVE tracker and the corresponding upstream advisory are consulted to identify the specific package, the affected release(s), and whether default installations are exposed.
Out-of-bounds heap read in GIMP's TIM image loader is triggered when a user opens a crafted 4bpp TIM image that is promoted to an RGBA layer, causing the file-tim plug-in to allocate an undersized row buffer and then process it with the larger RGBA row size. The result is disclosure of adjacent heap memory into the decoded image and a possible plug-in crash, with exploitation requiring local access and victim user interaction (CVSS 4.4, CWE-125). No public exploit is identified at time of analysis, and impact is bounded to partial confidentiality loss and availability loss rather than code execution.
Google Chrome on the desktop stable channel is the only affected product identified by the supplied intelligence, which consists of a single Chrome Releases stable-channel advisory, and the specific vulnerability class, affected component, and impact are not disclosed in the available data. No CVSS score or vector, CWE, EPSS probability, or KEV listing accompanies this record, so severity cannot be quantified and the exploitation prerequisites remain unconfirmed; there is no public exploit identified at time of analysis. Because a fixed build is already published, residual risk is chiefly a patch-rollout problem - users remain exposed only until they move to the patched stable-channel version - and no exploitation activity, in-the-wild evidence, or proof-of-concept has been reported in the data provided.
Local privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an attacker who already holds a low-privileged foothold inside a running FTM container - such as a compromised service account or code execution gained through a separate flaw - elevate their privileges within that container. The issue is rated CVSS 3.1 base 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and stems from improper privilege management (CWE-250), meaning the component runs with more authority than it needs; the scope is unchanged, so the flaw by itself does not provide a path to the host node or to other containers. No public exploit identified at time of analysis, and exploitation requires local authenticated access with no remote or unauthenticated vector.
Authenticated REDAXO backend users can exploit improper validation of the 'sort' parameter in rex_list::getSortColumn() (redaxo/core before 5.21.2) to inject unauthorized column names into SQL ORDER BY clauses, enabling error-based enumeration of columns in joined tables and ordering by sensitive fields such as rex_user.password. This low-to-moderate severity information-disclosure issue requires valid backend credentials (PR:L) and yields inference-based leaks-schema enumeration and ordering oracles-rather than direct data dumps. The vendor fixed it in 5.21.2 by validating the requested column against registered sortable columns; no public exploit code or active exploitation is identified at time of analysis.
CVE-2026-95342 cannot be characterized beyond its origin: the record is attributed to the Ubuntu vendor source, but no description, CVSS vector, CWE, or CPE data has been published, leaving the affected package, affected versions, and achievable attacker impact entirely unidentified. No CISA KEV entry and no public exploit code are associated with this identifier, so there is no public exploit identified at time of analysis; equally, no EPSS-style likelihood can be derived without a description or score. Ubuntu administrators should treat this as an intelligence gap rather than a confirmed threat and monitor the vendor advisory channel for the first substantive disclosure.
Ubuntu is tracking CVE-2026-95340, but the intelligence available for this analysis contains no description, CVSS vector, CWE class, affected package name, or version range, so neither the impact nor the attack surface can be characterised at this time. No public exploit code and no evidence of active exploitation were identified at time of analysis, which reflects an absence of data rather than a confirmed low risk. The Ubuntu Security tracker entry for this CVE is the authoritative source and must be retrieved before any exposure or prioritisation decision is made.
Google Chrome on the stable desktop channel is the affected product in CVE-2026-95361, an entry for which a vendor fix is indicated as available via a Chrome Releases stable-channel update. The intelligence record is unusually thin: no description, no CVSS score or vector, no CWE, no CPE, no EPSS probability and no CISA KEV listing were supplied, so the specific defect class, attack vector and privilege requirements cannot be stated. No public exploit code has been identified at time of analysis, and the Ubuntu vendor attribution plus the Chrome Releases advisory reference indicate this is a coordinated upstream-then-distributor patch flow rather than an actively exploited event.
GoCD versions 20.2.0 through 26.0.x disclose the complete list of configured usernames and role names to any authenticated user through the internal pipeline-structure autocompletion API, even when that user has no administrator privileges. The endpoint is reached remotely over HTTP (AV:N) and requires only a valid low-privileged account (PR:L), so a regular GoCD user can enumerate tenant user and role identifiers to support follow-on credential-stuffing, phishing, or targeted attacks, though the response never maps users to roles and cannot modify any data. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the disclosure is limited to names, which is why the independently assessed severity remains low. GoCD 26.1.0 contains the vendor fix.
Information disclosure in the automation-controller component of Red Hat Ansible Automation Platform 2 lets any authenticated user of any privilege level extract internal database and ORM structure by sending crafted values through the host_filter query parameter of the Host list REST API. Because HostList.list() catches a bare Exception and returns str(e) verbatim, a malformed relation lookup such as credential__search=x raises a Django FieldError that exposes the complete Host model relation graph (including internal reverse accessors), while a malformed pattern such as name__regex=[bad raises a PostgreSQL DataError that reflects the raw database error string. The flaw is rated CVSS 4.3 (MEDIUM) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N; exploitation requires valid credentials but no user interaction, impact is limited to low-confidentiality schema and error-text leakage with no modification or code execution, and no public exploit was identified at time of analysis.
Missing authorization in the WP Recipe Maker WordPress plugin before 10.8.2 lets any authenticated user, including a subscriber-level account, retrieve the IDs and titles of other users' unpublished recipe lists through an AJAX action that performs no capability check. Exploitation is remote, requires no user interaction, and needs only low-privilege credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so exposure depends on whether the target site allows self-registration or the attacker otherwise holds an account. Impact is confined to disclosure of unpublished list metadata with no modification or service disruption; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Authenticated information disclosure in WP Recipe Maker for WordPress (versions 10.3.0 through before 10.8.2) lets any logged-in user, including a low-privilege subscriber, read the full content of unpublished recipes through an AJAX action that omits a capability check. Rated CVSS 4.3 with a low confidentiality impact and no integrity or availability impact, the flaw is modest in scope; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-released patch 10.8.2 is available. The practical risk depends on whether the target site allows open registration, since that would let an attacker self-provision the required subscriber account.
Subscriber-level users of the WordPress zportals plugin before version 6.4.2 can harvest the display name and email address of every registered account, including administrators, by calling an AJAX action that performs neither a capability check nor a nonce check. The requirement for a low-privileged authenticated account (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N vector) is the only real barrier, and it largely disappears on sites with open registration enabled; no user interaction is needed. Impact is confined to confidentiality of directory-style user data - no data modification or service disruption - and no public exploit code was identified at time of analysis, with the vendor having shipped a fix in 6.4.2.
Missing authorization in the Points and Rewards for WooCommerce WordPress plugin before 2.10.4 allows an authenticated user holding only a Subscriber-level account to call the Win Wheel claim handler and credit their own account with an arbitrary, unlimited number of loyalty points; if the companion wallet plugin (same version line) is active, the fraudulently credited balance also extends to wallet funds. The flaw is remote and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N per independent assessment - note this rates integrity impact as High, above the 4.3 base score published with the CVE), and the only practical prerequisite is that the store has enabled the Win Wheel reward feature and permits open customer registration, which is typical for WooCommerce storefronts. Impact is integrity-only - loyalty point and wallet-balance fraud rather than site compromise or data disclosure. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, and a vendor-released patch (2.10.4) is available.
Authenticated users with only subscriber-level access can overwrite the Booking Manager per-user settings of any other account, including administrators, in WordPress plugin versions before 2.1.21, because the settings-update handler accepts an attacker-supplied target user identifier without checking that it belongs to the requester (CWE-639). The flaw is rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N): it needs only a valid low-privilege session - trivially obtained wherever self-registration is open - and its impact is confined to unauthorized modification of per-user plugin settings, with no confidentiality or availability loss. Vendor patched versions are available (2.1.21 is the first unaffected release), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated users holding only the WordPress subscriber role - or any higher role - can forge paid order and payment records with arbitrary amounts and assign them to other accounts in the Directorist WordPress plugin (AI-Powered Business Directory, Listings & Classified Ads) versions 8.9.1 through before 8.9.5. The REST API order-creation endpoint performs no capability check, so any logged-in low-privilege account on a site that permits self-registration (a common configuration for directory and classifieds sites) can inject fraudulent billing and payment data, resulting in integrity-only impact with no confidentiality or availability loss. This is a moderate, genuine authorization gap rather than a high-severity compromise: there is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV), and the vendor has released a fix in version 8.9.5.
Authenticated users holding only the subscriber role on WordPress sites running the MasterStudy LMS plugin before version 3.7.50 can read other students' quiz attempt data - grades, pass/fail status and attempt timestamps - by referencing an attempt identifier that belongs to another account, because the quiz-attempt result path lacks a per-object ownership check. Rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the impact is confidentiality-only with no ability to modify or delete data, and no public exploit identified at time of analysis. A vendor-released patch is available: version 3.7.50.
Subscriber-level WordPress users can read every customer's order and payment records on sites running the Directorist business-directory plugin 8.9.1 through 8.9.4, because one of its REST collection endpoints is not scoped to the requesting user. The flaw is an authenticated insecure-direct-object-reference / broken-object-level-authorization issue (CWE-639) that is remotely reachable and needs no user interaction - exploitation requires a low-privilege account, which is realistic on directory and classifieds sites that allow open or self-service registration, but is blocked where registration is closed. The vendor has released a patch in 8.9.5; no public exploit identified at time of analysis, and there is no CISA KEV listing or other confirmation of active exploitation.
Missing capability and nonce checks in the zportals WordPress plugin before 6.4.2 allow an authenticated subscriber-level user to rewrite the plugin's stored integration settings by calling unprotected AJAX actions; the flaw is a classic broken-access-control issue rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) with impact limited to integrity of the plugin's configuration. Exploitation requires a valid low-privilege WordPress account, so the practical risk hinges on whether the target site permits open registration or the attacker has otherwise obtained subscriber credentials. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this should be treated as a low-severity, credentialed configuration-tampering bug rather than an imminent remote-compromise threat.
Authentication bypass in GitLab Enterprise Edition lets an authenticated user holding developer-role permissions evade administrator-configured AI tool governance controls for workflows operating in namespaces they do not own or administer. The flaw affects GitLab EE versions from 19.1 up to (but not including) 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1, while GitLab Community Edition and the patched releases are unaffected. Impact is confined to integrity of AI governance policy enforcement, with no confidentiality or availability loss, and no public exploit code has been identified at time of analysis; GitLab notes exploitation is only possible under certain conditions, making this a low-severity, low-priority issue despite being network-reachable.
Log injection in IBM Concert 1.0.0 through 3.0.0 allows an authenticated low-privileged user to insert forged or misleading entries into application log files by supplying input that is written without neutralization of special characters such as CRLF sequences. The vulnerability is a CWE-117 improper output neutralization flaw with only a low integrity impact (C:N/I:L/A:N); it cannot be used to read data, execute code, or cause denial of service, and exploitation requires a valid low-privileged account (PR:L). No public exploit code exists and no active exploitation has been identified at time of analysis, and IBM has released a vendor patch.
Source-IP spoofing in Ansible Automation Platform 2's automation-controller allows an authenticated remote attacker to forge the client IP recorded in audit and access logs when the application runs its shipped production reverse-proxy configuration and trusts the client-supplied X-Forwarded-For header. The flaw is CWE-348 and only affects log integrity (CVSS 3.1 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), with no access, confidentiality, or availability gain. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Merge request authorship spoofing in GitLab CE/EE 19.1 through 19.4.0 lets an authenticated user who can perform a Direct Transfer import attribute merge request content to arbitrary existing users on the target instance. Exploitation requires a valid account with the ability to run a direct-transfer migration and depends on a timing/state condition in ephemeral cache handling, so it is not deterministic; the assessed impact is integrity-only with no confidentiality or availability effect, and no public exploit identified at time of analysis. GitLab has shipped fixed releases 19.2.7, 19.3.3, and 19.4.1.
Authenticated users of Red Hat Ansible Automation Platform 2 can read sensitive commercial license metadata - account number, subscription ID, pool ID, SKU, support level, and instance counts - from the /api/v2/config/ endpoint, which is guarded only by Django REST Framework's IsAuthenticated permission class. The superuser/auditor gate that protects other configuration keys such as project_base_dir, project_local_paths, and custom_virtualenvs does not extend to the license_info block, so any logged-in account of any privilege level can retrieve it without user interaction or non-default configuration. Per the independent assessment this is a genuinely low-priority, information-disclosure issue (CVSS 4.3, PR:L) - no public exploit has been identified at time of analysis, and the practical risk is reconnaissance and social-engineering enablement against Red Hat support rather than direct compromise.
Insecure direct object reference (IDOR) in the SiteSkite WordPress plugin versions up to 2.1.7 allows authenticated attackers with Contributor-level privileges to modify arbitrary objects on the site. The vulnerability is network-reachable with low attack complexity and requires no user interaction, but it only impacts data integrity (no confidentiality or availability impact). No public exploit code or active exploitation has been identified at time of analysis.
Prototype pollution in the scim-patch SCIM PATCH library (all versions before 0.9.2) lets an authenticated caller who can submit SCIM PATCH operations - remote reachable, no user interaction, consistent with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - write attacker-controlled properties onto shared built-in function objects such as Object.prototype.toString by supplying a path or dotted value key that begins with an inherited property name. Impact is modest and integrity-only (CVSS 4.3): the mutation is process-global and may influence application logic that reads inherited-method properties, but meaningful harm requires the consuming application to later consult the polluted property in a security-relevant code path; otherwise the write is largely inert. No public exploit identified at time of analysis, although the upstream fix PR and its regression tests publicly document the exact triggering path patterns, and this issue is not confirmed actively exploited (CISA KEV).
Google Chrome desktop (stable channel) is the affected product in CVE-2026-95368, a security fix shipped in the September 2026 Chrome releases stable-channel update. The entry is a data void: no description, no CVSS score, no CVSS vector, and no CWE are available from the supplied intelligence, so the specific impact class - memory corruption, sandbox escape, information disclosure, or otherwise - cannot be determined from open sources at this time. Vendor-released patch: available per the referenced Chrome Releases advisory, though no exact fixed version string is provided; there is no public exploit code and no CISA KEV confirmation, so exploitation status is no public exploit identified at time of analysis, and authentication requirements are not confirmed from available data.
CVE-2026-95289 is an Ubuntu-tracked security issue whose impact on Ubuntu systems cannot currently be characterized, because no description, CVSS vector, CVSS score, or CWE classification accompanies the record. The only confirmed attribute is provenance: the entry was reported through the Ubuntu vendor channel, which means an Ubuntu Security Notice and a corresponding upstream advisory should exist but were not supplied in the available intelligence. No affected versions, CPE identifiers, references, EPSS score, or KEV status are present, so this analysis cannot state who is exposed, what an attacker gains, or whether exploitation is practical; no public exploit identified at time of analysis, and patch status is likewise undetermined. Per the independent assessment, risk cannot be meaningfully assessed from the available data, and teams should treat this as an unenriched record pending retrieval of the authoritative Ubuntu advisory.
CVE-2026-95296 currently has no published description, no CVSS score, no CWE classification, and no CPE identifiers; the only intelligence signal available is that it was reported through the Ubuntu vendor channel, indicating the flaw resides in a component packaged, shipped, or maintained within an Ubuntu release. Because the affected package, version range, exposed feature, and attack path are all unidentified, no impact statement can be made and risk cannot be meaningfully assessed from the provided data. There is no evidence of active exploitation (no CISA KEV entry was supplied) and no public exploit identified at time of analysis.
Keycloak's Pushed Authorization Request implementation can allow an authenticated OAuth client to reuse a previously pushed request_uri when the prompt=none silent-authentication path is used, resulting in multiple authorization codes for an already signed-in user. Exploitation requires a live victim session, PAR enabled, and an authenticated low-privilege client (PR:L), with high attack complexity and limited impact; CVSS is 4.2. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
Limited unauthorized device access can occur on Canon multifunction devices running NT-ware uniFLOW Online when a prior authenticated session is retained after logout in the Legacy UI Reduced Function Login feature during Service Offline Emergency Mode. Exploitation requires physical access, use of the legacy UI, emergency/offline mode, and a narrow timing race, so the independent assessment treats this as a low-priority session-management issue. No public exploit identified at time of analysis.
An authenticated tenant superuser on Red Hat Ansible Automation Platform 2 can use the automation-controller API to confirm the existence of arbitrary absolute filesystem paths inside the controller-web pod, because StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied input and the 200-versus-400 response difference acts as an existence oracle. The issue is rated CVSS 4.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) and only reads existence, not content, but it lets a tenant admin probe paths such as /etc/tower/SECRET_KEY, Kubernetes service-account tokens, receptor sockets and ConfigMap mount points. It is materially impactful only in managed AAP deployments (ansiblecloud.com) where the tenant administrator is not the host administrator; there is no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
Symlink-following during ld.so cache regeneration in Flatpak before 1.18.1 lets a malicious sandboxed application replace its per-app ~/.var/app/$appid/.ld.so path with a symlink so that Flatpak's regenerate_ld_cache writes cache files at an arbitrary attacker-chosen location. The impact is limited to low-integrity file writes on the local host: the written filenames and content are generated by Flatpak and are not attacker-controlled, so this cannot deliver arbitrary code or leak data, and CVSS 3.1 is 4.0 (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L per independent reassessment). Exploitation requires a user to have installed and run an untrusted Flatpak app from a non-trusted source; there is no public exploit code identified at time of analysis, and the vendor's own advisory characterizes it as hard to exploit.
Apache Tomcat's HTTP/2 connector harbors a race condition (CWE-362) that allows unauthenticated remote attackers to inject trailer fields into another user's concurrent HTTP/2 request, resulting in high confidentiality and integrity impact without affecting availability. Affected versions are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.39 through 9.0.121, and the end-of-life 8.5.59 through 8.5.100; exploitation is conditional on winning a concurrency race and only applies when the HTTP/2 upgrade protocol is enabled and actively serving traffic. No public exploit code or active exploitation has been identified at time of analysis, and the overall threat is considered credible but conditional.
Origin-validation bypass in the Apache Sling Security Bundle before 1.3.2 allows a remote attacker to defeat the ReferrerFilter when that filter is relied upon as the cross-site request protection control, so cross-site requests that should have been blocked are accepted, yielding low-level confidentiality, integrity, and availability impact. Exploitation requires the victim to be lured into a crafted request carrying an authenticated session (CSRF-style user interaction), and only deployments that depend on ReferrerFilter for origin validation are exposed. Apache rates this 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), while our independent assessment adjusts the vector to UI:R given the required session-riding interaction; EPSS is only 0.13% (3rd percentile) and there is no public exploit identified at time of analysis.
WebSocket message smuggling in Apache Tomcat allows a remote, unauthenticated attacker to inject or reorder messages within a compressed WebSocket stream, corrupting application-level message boundaries and undermining integrity of data exchanged over the connection. The flaw affects the 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121 release lines, plus the end-of-support 8.5.0-8.5.100 and 7.0.56-7.0.109 branches, but it only triggers when the per-message-deflate compression extension has been negotiated on the WebSocket connection; deployments that serve only standard HTTP or that run WebSocket endpoints without compression are not exposed. There is no confirmed active exploitation (CISA KEV does not list this issue), no public exploit code identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none', making this a genuine but conditionally-gated integrity flaw rather than a drop-everything emergency.
Apache Tomcat 11.0.19 through 11.0.25, 10.1.53 through 10.1.59, and 9.0.116 through 9.0.121 can cause an unrelated user's request to fail when a malformed request triggers incomplete cleanup of request-processing state on a reachable HTTP connector. No authentication or user interaction is required, but the effect is fundamentally gated by a race window - the advisory itself states the failure occurs only 'depending on timing' - so it is non-deterministic and cannot be reliably triggered on demand, and the realistic worst case is intermittent failure of another user's individual request rather than sustained denial of service, data disclosure, or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis; the 7.3 base score reflects low impact across confidentiality, integrity, and availability, though our assessment rates attack complexity as High rather than Low.
Cross-application authentication realm leakage in Apache Tomcat's Jakarta Authentication integration causes requests to be validated against the realm established by whichever co-hosted web application authenticated first, breaking per-application authentication boundaries. The flaw (CWE-287, improper authentication) affects Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M4 through 9.0.121, plus end-of-life 8.5.0 through 8.5.100. Exploitation is gated by a non-default deployment - SimpleAuthConfigProvider as the default Jakarta Authentication provider with two or more applications sharing it - and the independent assessment rates the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (unauthenticated, high attack complexity, low impact); no public exploit identified at time of analysis, the issue is not in CISA KEV, and the vulnerable configuration is not Tomcat's default.
Broken access control in The Events Calendar WordPress plugin before 6.17.5 allows authenticated contributor-level users to modify, unpublish, trash, and take ownership of records belonging to other users, including administrators. The flaw is a missing per-object capability check on one family of REST write routes (CWE-863), and exploitation requires only a low-privilege WordPress account, consistent with the independent assessment's PR:L rating. No public exploit identified at time of analysis; the vendor patch is 6.17.5.
Unauthenticated attackers can view other customers' order details in NP Quote Request for WooCommerce versions 2.0 through 2.4.15 by supplying a valid order key, because the plugin fails to verify order ownership before rendering order details. Exploitation requires knowledge of a specific victim's order key (a pseudo-random token), which is the primary limiting factor and the reason for the high attack complexity (AC:H) in the CVSS vector; no authentication or user interaction is needed. This is a low-severity confidentiality flaw, and no public exploit code has been identified at time of analysis. The vendor has released version 2.4.16 to address the issue.
Incorrect authorization in the Paid Membership Subscriptions WordPress plugin before 3.1.0 allows an unauthenticated remote attacker to delete another member's in-flight checkout state by supplying that member's transient payment identifier to a payment action that is not bound to the requesting user. The attacker must already possess a valid, currently-active per-checkout payment identifier - a transient, non-enumerable value that must be obtained out-of-band - which is why the assessed CVSS is only 3.7 despite network reachability and no authentication requirement (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Impact is confined to integrity of one victim's checkout state: no data disclosure and no site-wide availability loss; there is no public exploit identified at time of analysis, and the vendor has released a patch fixing the issue in version 3.1.0.
Unauthenticated visitors can abuse the saved-draft notification feature in the Forminator Forms WordPress plugin before 1.57.2.1 to make the site send email from its own mail configuration to an arbitrary recipient, carrying an attacker-chosen link wrapped in the site's own message template; the plugin hands the anonymous caller the token that authorises the send and accepts that token for unlimited replay. Exploitation is limited by a non-default prerequisite: the target site must have a form using the save-and-continue (saved draft) feature together with a configured saved-draft notification email. Given that configuration, no authentication and no user interaction are required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, base score 3.7), impact is bounded to attacker-controlled outbound email (integrity only) rather than data theft or service disruption, no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and a vendor patch is available.
Unauthorized access to protected functionality affects Dell Secure Connect Gateway (SCG) Policy Manager installations running versions prior to 5.34.00.16, where authorization decisions are made against non-canonical URL paths (CWE-647). Remote unauthenticated attackers (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, base 3.7) must craft an alternate but equivalent path representation that the Policy Manager's authorization logic normalizes differently from its request routing, allowing them to reach functions intended to be restricted - with only a limited integrity impact and no confidentiality or availability impact claimed by the vendor. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the high attack complexity (AC:H) reflects that this is not a generic single-request attack against default configuration, which is why the issue is assessed as low priority despite being network-reachable and unauthenticated.
HTTP request desynchronization in Apache Tomcat allows an unauthenticated remote attacker to cause a single request belonging to another user to fail when Tomcat is deployed behind a reverse proxy. The flaw (CWE-444) arises because Tomcat processes the Transfer-Encoding header on HTTP/1.0 requests, and when a fronting proxy interprets that header differently, the two sides disagree about request boundaries on a shared upstream connection. Affected releases are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.47 through 9.0.121, and the end-of-life 8.5.67 through 8.5.100; standalone Tomcat with no fronting proxy is not affected. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) - no persistence, data exposure, or code execution is described - and no public exploit code was identified at time of analysis.
CVE-2026-95324 is currently an unresolved identifier attributed to Ubuntu by vendor reporting, with no description, no CVSS score or vector, no CWE classification, and no version or CPE data supplied in the record. Because the affected component, attack surface, and prerequisites are all unknown, the impact cannot be stated and risk cannot be meaningfully assessed from the provided data; no public exploit code has been identified at time of analysis, and neither EPSS nor CISA KEV status was supplied. Consumers should treat this entry as unenriched and re-query the Ubuntu Security Notices and Ubuntu CVE tracker before assigning severity or exposure.