Risk for CVE-2026-95308 cannot be meaningfully assessed from the intelligence supplied: the record carries no description, no CVSS score or vector, no CWE, and no CPE or package identifiers, and the sole source attribution is the Ubuntu security team. This indicates an issue tracked against some package within the Ubuntu/Debian ecosystem, but the affected component, the required privilege level, and whether user interaction or a non-default configuration is necessary all remain unconfirmed. No public exploit code has been identified at time of analysis, and there is no KEV listing, so there is currently no signal of active exploitation. The actionable next step is to obtain the corresponding Ubuntu Security Notice (USN) for CVE-2026-95308, which will establish the real exploitation conditions and severity.
Google Chrome desktop builds that have not yet received the September 2026 stable-channel update are affected by CVE-2026-95359, a flaw for which the vendor has published a fix in the Chrome Releases stable channel advisory (http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html). The advisory is the only substantive intelligence available: the CVE description is empty, and no CVSS score, CVSS vector, CWE, EPSS probability, or CPE data was supplied, so the exact component, attack vector, and privilege requirements cannot be confirmed from the available data. There is no KEV listing and no public exploit code identified at time of analysis, so exploitation is not confirmed to be occurring; however, because Chrome renders attacker-controlled web content by default, unpatched desktop installations should be treated as exposed until the stable-channel update is applied.
Broken access control in the WC Fields Factory WordPress plugin before 4.1.11 allows an authenticated user holding Contributor-level privileges or higher to invoke the plugin's post-cloning action without any capability check or nonce verification. By doing so, the attacker can duplicate posts of any type or status - including private posts and drafts belonging to other users - and then read the resulting copy, effectively bypassing WordPress's normal content-access controls. The impact is limited to unauthorized read access to duplicated content rather than modification, deletion, or code execution, which keeps this a genuinely low-severity, low-priority issue; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
CVE-2026-96283 is recorded only as a vendor-reported 'security update' from Ubuntu, with no accompanying product identification, CVSS score or vector, CWE classification, or CPE data, so the impacted Ubuntu package, the affected version range, and the conditions under which the issue can be triggered are all currently undefined. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing or EPSS signal provided, so active exploitation is unconfirmed. Risk cannot be meaningfully quantified from the available data, and consumers should treat this entry as a placeholder pending retrieval of the originating Ubuntu Security Notice (USN).
CVE-2026-96282 is an Ubuntu security update for which no affected source package, vulnerability class, or exploitability detail has been disclosed in the available record. Because no CVSS vector, CWE, CPE string, or advisory reference is supplied, it cannot be determined whether exploitation requires authentication or user interaction, or what the impact on confidentiality, integrity, or availability would be. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, and risk cannot be meaningfully assessed from the provided data.
Argument injection in the ad hoc command builder of Red Hat Ansible Automation Platform 2 lets an authenticated user who is permitted to run ad hoc commands smuggle ansible CLI options by passing a host-restriction (`limit`) value beginning with a hyphen, which ansible-core then parses as an option flag. Impact today is minimal (CVSS 3.1, CWE-88): because the injected token displaces the required `pattern` positional argument, only short-circuit flags such as `--version` and `--help` are reachable, so integrity impact is limited to low and no arbitrary option or command control is achievable. There is no public exploit identified at time of analysis, and the issue would only escalate if a future ansible-core release were to default or make optional the `pattern` positional - a hypothetical, non-default upstream change rather than current behavior.
Red Hat Ansible Automation Platform 2 (AWX) accepts leading-dash values in the scm_branch field processed by LaunchConfigurationBaseSerializer, allowing an authenticated user who can create or edit a Schedule or Workflow Job Template node to supply a value such as --upload-pack=/bin/id. The gap is a latent argument-injection issue (CWE-88) that is currently neutralized at runtime by the ValueError guard at jobs.py:1502, so no command execution occurs in shipping code; it would escalate to remote code execution only if that task-layer guard were refactored or removed in a future release. No public exploit code has been identified at time of analysis, and impact today is limited to a low-severity hardening gap (CVSS 3.1, integrity-only).
Any authenticated WordPress user - including a no-privilege Subscriber - can rewrite the saved field configuration of arbitrary forms, up to and including a live payment form, on sites running the Forminator Forms plugin before 1.57.2.1. The flaw is a one-time payment-field migration routine that executes during construction of a Forminator admin screen on every wp-admin request by a logged-in user, with no nonce, capability, or ownership check applied before it runs (CWE-862), giving an attacker integrity-only leverage over form field data. Rated CVSS 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N), the impact is bounded by the one-shot, state-dependent nature of the migration and the absence of any confidentiality or availability effect; no public exploit code or confirmed active exploitation was identified at time of analysis, and there is no CISA KEV listing.
GitLab CE/EE instances running the Model Context Protocol (MCP) search tool can return search results under the wrong user's context when concurrent searches collide, allowing one authenticated user to view another user's search output. The flaw is a race condition (CWE-362) that affects versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1, and carries a low CVSS 3.1 base score with only a confidentiality impact; the timing window is non-deterministic and cannot be forced reliably. There is no public exploit identified at time of analysis and no CISA KEV listing, and deployment exposure is limited to instances that actually expose the MCP search tool to authenticated users.
CVE-2026-95312 is currently an intelligence gap: the only available signal is a report attributed to vendor:ubuntu, with no description, CVSS score, CVSS vector, CWE classification, CPE mapping, or reference links supplied. Because the affected package, attack vector, and privilege requirements are all unknown, the practical impact on Ubuntu systems cannot be characterized at this time, and no public exploit code has been identified at time of analysis. Notably, EPSS scoring and CISA KEV status were not included in the input, so neither heightened exploitation likelihood nor confirmed actively exploited (CISA KEV) status can be asserted or ruled out; risk cannot be meaningfully assessed from the provided data, and the Ubuntu CVE tracker entry for CVE-2026-95312 should be retrieved as the first analyst action.
Risk for CVE-2026-95317 cannot be meaningfully assessed from the available data, and no impact statement should be relied upon until a description, CVSS vector, or affected component is published. The only intelligence associated with this identifier is a vendor attribution to Ubuntu; there is no description text, no CVSS score or vector, no CWE classification, no CPE data, and no reference set that would identify the vulnerable product, feature, protocol, or deployment mode. Exploitation status is likewise indeterminate: no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided to quantify likelihood. Treat this record as unresolved rather than benign - the absence of detail reflects missing publication data, not a confirmed low-severity finding.
Information disclosure in the MediaWiki WikiLambda extension - the software behind Wikifunctions - before version 1.47.0 lets remote, unauthenticated attackers reach functionality that should be constrained by access-control lists, exposing limited, low-sensitivity data. Exploitation requires a reachable wiki with WikiLambda installed and carries high attack complexity (CVSS v4.0 2.9; assessed CVSS v3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N), meaning it likely hinges on a specific request pattern, function state, or race that defeats the intended ACL check rather than working against arbitrary default requests. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; combined with confidentiality-only impact and the specialized, not-widely-deployed nature of the extension, this is a low-priority issue by every available signal.
CVE-2026-95302 is an identifier tracked by the Ubuntu security team, but at the time of analysis no description, CWE classification, CVSS score, or CVSS vector has been published for it, so the affected component, the attack surface, and the resulting impact are all undetermined. Because there is no affected feature or configuration documented, no exploitation prerequisites, authentication level, or user-interaction requirement can be stated. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis; risk cannot be meaningfully assessed from the provided data.
CVE-2026-95316 is currently identifiable only as an Ubuntu-tracked CVE: the record carries no description, no CVSS score or vector, no CWE classification, and no CPE data, and its sole intelligence source is the reporting vendor (vendor:ubuntu). As a result, the affected component, the vulnerable version range, and the concrete attacker impact cannot be established from the available data, and this entry cannot be risk-assessed at this time. No public exploit code has been identified at time of analysis, and no exploitation activity is confirmed, so any severity or exploitability claim beyond 'undetermined' would be speculation.
Information disclosure in Red Hat Ansible Automation Platform 2 allows an authenticated administrator (PR:H per the CVSS vector) to leak controller-side implementation details, including install paths, Python version, and source line numbers, into notification payloads delivered to an attacker-controlled webhook URL. A crafted Jinja notification template using a dynamic subscript such as job['job'+'_env'] slips past the static-Getattr AST whitelist, while a conditional gate like {% if job.id > 100 %} prevents the branch from firing during the small-job.id stub test-render, so the payload executes only against a real job whose exception produces a full traceback in the notification body. Impact is confined to low confidentiality loss (C:L) with no integrity or availability effect, and no public exploit has been identified at time of analysis.
Contributors on WordPress sites running The Events Calendar versions 6.15.0 through 6.17.4 can bypass editorial review and publish events or other content directly through the plugin's REST API. The flaw, a missing capability check (CWE-863), lets authenticated low-privilege users perform actions they are not authorized to do, though impact is limited to integrity without confidentiality or availability loss. No public exploit code has been identified, and the issue is not listed in CISA KEV; severity is low per the assessed vector.
IBM Guardium Data Protection 12.2 returns detailed technical error messages in the browser, allowing an authenticated administrative user to obtain sensitive information about the system. The issue is classified as CWE-209 (generation of error message containing sensitive information) with a CVSS 3.1 base score of 2.7 (Low) and a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, meaning exploitation requires a high-privileged account and yields only low confidentiality impact with no integrity or availability impact. No public exploit has been identified at time of analysis, and the vendor has published a patch advisory; the disclosed detail may be useful for follow-on attacks against the same system, but the prerequisites and limited impact make this a low-urgency issue.
Information disclosure in the Event Booking Manager for WooCommerce WordPress plugin (versions 5.3.6 through 5.7.2) lets authenticated users holding Contributor-level privileges or above enumerate and read other authors' private, draft, and trashed events, along with event detail that the normal listing view withholds. The flaw is an authorization/access-control defect (CWE-284) rather than remote code execution: it is read-only, requires an existing WordPress account with at least Contributor rights, and cannot be triggered by an anonymous visitor, so the practical risk depends heavily on how readily a site hands out contributor accounts. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the vendor has released a fix in version 5.7.3; our independent assessment rates this a genuinely low-priority issue and scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (the NVD vector's PR:H overstates the privilege bar relative to the contributor-level access described).
CVE-2026-96284 is an Ubuntu security update whose advisory record contains only the placeholder text 'security update', with no CVSS score, no CVSS vector, no CWE classification, and no stated affected package, so the concrete impact on Ubuntu hosts cannot be established from this dataset. The record is attributed solely to the vendor:ubuntu source, which indicates a distribution-level package fix rather than an upstream product disclosure. No public exploit identified at time of analysis, and there is no KEV or POC signal in the available intelligence. Given the absence of a vector, product scope, and root-cause class, there is insufficient data to perform a meaningful risk assessment; defenders should pull the specific Ubuntu Security Notice (USN) for this identifier to learn which package, version range, and exploitation prerequisites actually apply.
Opening a crafted uncompressed DDS image in GIMP triggers a one-byte heap out-of-bounds read in the file-dds plug-in, which can crash the plug-in process. The flaw requires a local user to open the malicious file (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L), and the crash is non-deterministic because it only occurs when the byte past the pixel buffer lands on an inaccessible memory page; no information disclosure or code execution has been demonstrated. No public exploit code has been identified at time of analysis, and while downstream tracking covers Red Hat Enterprise Linux 6 through 10, the availability-only impact keeps real-world risk low and the 'RCE', 'Buffer Overflow' and 'Information Disclosure' tags attached to this record are not supported by the assessed vector.
Authenticated RabbitMQ users that hold the 'monitoring' tag can erase a node's authentication-attempt counters by sending DELETE /api/auth/attempts/:node through the Management plugin HTTP API, removing a signal that operators would use to notice brute-force activity. Only deployments running RabbitMQ prior to 4.1.13, 4.2.7 or 4.3.0 with the Management plugin enabled and monitoring credentials issued to a non-administrative or untrusted account are exposed, and exploitation requires the attacker to already possess that valid account. The impact is limited to in-memory metrics (no log or audit-record deletion) and no public exploit code has been identified at time of analysis; EPSS data was not supplied and the issue is not in CISA KEV, consistent with its very low assessed severity.
Cross-tenant information disclosure in RabbitMQ's management HTTP API lets any authenticated user holding the 'management' tag read Raft quorum-queue status - leader, members, term, commit index - for queues in vhosts they cannot access, because the /api/queues/quorum/:vhost/:queue/status handler authorizes only the management tag rather than the target vhost. Affected are RabbitMQ deployments running the management plugin at versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, with impact confined to read-only exposure of queue names and cluster topology in multi-tenant setups. No public exploit identified at time of analysis; EPSS and KEV signals are absent, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) rates this low severity.
Authenticated CPU exhaustion in RabbitMQ Server prior to 4.2.7 and 4.3.1 lets an AMQP 1.0 consumer that holds both read and write permission on a stream queue drive substantial backtracking work in the broker's regex engine: a crafted LIKE filter built from roughly two thousand overlapping '%_' wildcard pairs, combined with long message property values, forces about 100-200 ms of CPU to be consumed per delivered message. The impact is bounded resource amplification rather than a node crash or hang, consistent with a low-severity denial-of-service rating (CVSS 4.0 base 2.3; independent assessment CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L), and no public exploit code has been identified at time of analysis. Exposure is limited to deployments that actually use AMQP 1.0 with stream queues and SQL filter expressions; systems not using that combination are unaffected.
Stack exhaustion in Qt's QXmlStreamReader::readElementText() lets a crafted XML document with deeply nested elements crash applications built on Qt 5.0.0 through 6.8.8 or 6.9.0 through 6.11.1 that parse attacker-influenced XML through that API. The flaw is reachable by unauthenticated remote attackers (CVSS 4.0 PR:N) but requires the application, or a user, to actually process the malicious document (UI:P), and its only demonstrated impact is a recoverable crash of the parsing application - no code execution, data disclosure, or integrity loss. No public exploit identified at time of analysis; the supplied CVSS 4.0 base score is 2.3, making this a genuinely low-priority issue despite Qt's massive install base, and the vendor has published a patch.
Broken access control in the RabbitMQ management HTTP API lets a user holding only the monitoring tag restart any federation link via DELETE /api/federation-links/.../restart, an operation that should require elevated (management/policymaker/administrator) privileges - thereby disrupting message flow between federated brokers. Affected are RabbitMQ server releases prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, but only deployments that enable both the rabbitmq_federation and rabbitmq_federation_management plugins and have at least one active federation link. Exploitation requires an authenticated account carrying the monitoring tag (CVSS v4.0 PR:L), impact is limited to availability of the restarted link, the assessed severity is CVSS 2.3 / CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Path traversal in the RabbitMQ tracing plugin lets a user holding the administrator tag write a file to an arbitrary filesystem location writable by the rabbitmq OS user, because the trace consumer builds its output path as filename:join(TraceDir, Name ++ ".log") from the unvalidated Name parameter of PUT /api/traces/:vhost/:name. Exploitation is an authenticated, administrator-only operation (CVSS vector PR:H) and requires that the rabbitmq_tracing plugin is explicitly enabled and that the target directory is already writable by the broker's OS account, so the realistic scenario is insider or post-compromise abuse rather than an externally reachable flaw. Impact is limited to integrity of local files (I:L, C:N/A:N) and is further constrained by the mandatory .log suffix, which restricts writes to .log-suffixed targets and makes any escalation to code execution opportunistic; no public exploit identified at time of analysis, and the issue is rated 2.1 (CVSS 4.0), consistent with a low-priority, high-privilege finding. Fixed versions are 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
Unrestricted file upload in Pixtream allows an authenticated low-privileged attacker to send arbitrary files through /post_upload.php because the media argument lacks effective file-type validation; uploaded files may execute as PHP if stored in a web-served directory. Publicly available exploit code exists, but no CISA KEV confirmation indicates active exploitation, and the authentication prerequisite plus the product's near-zero deployment footprint make urgent risk low. The vendor was contacted but did not respond, and no patched release or versioning scheme is available.
RabbitMQ stream-management HTTP API allows an authenticated user holding the management tag and vhost access - but no configure permission on any resource - to create super-streams, which consist of an exchange, N partition stream queues, and their bindings, without the per-resource authorization check the native stream protocol path enforces. This is a genuine but low-impact authorization flaw (CWE-862 missing authorization) rated CVSS 2.1 by the vendor and an assessed CVSS:3.1 of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, since the impact is confined to unauthorized integrity changes (persistent resource creation) with no data disclosure or denial of service. Exploitation requires the non-default rabbitmq_stream_management plugin to be enabled and a management-tagged account with vhost access; no KEV listing or public exploit was identified, and vendor fixes are available in 4.0.22, 4.1.11, 4.2.6, and 4.3.0.
SQL injection in itsourcecode Leave Management System 1.0 via the ID argument in /module/leavetype/index.php allows an authenticated low-privileged remote attacker to manipulate database queries; the independent assessment rates confidentiality impact High and integrity/availability None under CVSS 3.1, while the CNA CVSS 4.0 score is 2.1. Publicly available exploit code exists, but there is no evidence of active exploitation or KEV listing, and exploitation requires valid credentials plus network access to the vulnerable endpoint. This is a low real-world-priority issue despite the SQL injection classification because the target is a niche application and the attack is not unauthenticated.
Missing authorization in the ByteDance Coze Scraper Chrome extension (versions up to and including 2.0.2) allows any website to drive the extension's externally exposed message handler and make it scrape attacker-chosen URLs and extract page data along attacker-supplied XPath/pagination parameters. The flaw is in the chrome.runtime.onMessageExternal listener defined in static/background/index.js, which processes incoming messages without verifying the sender's origin; exploitation requires the victim to have this niche extension installed and to visit or interact with an attacker-controlled page, so real-world exposure is limited to that user base. A publicly available exploit write-up exists and the vendor was contacted but did not respond; CISA KEV does not list this issue, and the low EPSS/CVSS 4.0 score of 2.1 reflects limited confidentiality impact with no integrity or availability effect and no code execution.
Unsalted MD5 password hashing in sfturing hosp_order (code through commit 627f426331da8086ce8fff2017d65b1ddef384f8) leaves stored user credentials cheaply crackable if the hash store is ever exposed. The defect is not a remotely reachable primitive: per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) an attacker with low privileges must first obtain the password digests - through a separate vulnerability, a database compromise, or a backup leak - before the missing salt provides any advantage, which is why impact is limited and complexity is high. Publicly available exploit code exists that demonstrates the weak hashing, but there is no confirmed active exploitation (no CISA KEV listing), and the project has not responded to the issue report, so no vendor-released patch is identified at time of analysis.
Qt Quick's SVG path parsers (Context2D.path in Canvas/Context2D and the QML PathSvg.path element) perform an out-of-bounds read when processing crafted SVG path strings, which can crash or destabilize the hosting application. The issue is reachable only when a Qt Quick/QML application actually feeds attacker-controlled SVG path data into these APIs - applications that render only trusted, bundled SVG assets are not exposed - and the vendor's CVSS 4.0 vector rates it local with low privileges required and passive user interaction, while the independent assessment lands at CVSS 3.1 4.9-equivalent severity with no confidentiality or integrity impact and only limited availability loss. No public exploit code or confirmed active exploitation has been identified at time of analysis (exploit maturity Unreported), and a vendor patch is available.
Impact for CVE-2026-95507 cannot be characterized because the record carries no description, no CVSS vector, no CWE, and no CPE data; the only signal is that the issue was reported through Ubuntu's vendor channel. Nothing in the available intelligence establishes what an attacker could do, which component or version is affected, or whether the flaw is remotely or locally reachable. Exploitation status is likewise unknown: no CISA KEV listing or public proof-of-concept is present in the supplied data, and authentication requirements cannot be confirmed from the available information.
Peer-identity verification bypass in the mdtls DTLS library causes a failed certificate/peer-identity check to be treated exactly like a successful one, allowing a man-in-the-middle to impersonate the intended peer to any client that relies on mdtls for authentication. The assessed impact is high for confidentiality and integrity with no availability impact (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), but exploitation is conditional: the attacker must already hold an active interception position between the mdtls client and its peer, such as an adjacent-network foothold, a hostile Wi-Fi or gateway, or DNS/ARP/BGP redirection, and must present a substitute certificate. There is no public exploit identified at time of analysis and no vendor-released patch identified in the available data; the issue was reported through the Ubuntu vendor channel, and authentication requirements are not confirmed from available data.
Memory corruption and potential code execution in rsyslog's mmpstrucdata plugin allow remote attackers who can send crafted RFC5424 structured-data messages to a reachable syslog input to execute code with the privileges of the rsyslog process. The module is not enabled by default; exploitation requires that mmpstrucdata be explicitly loaded and referenced in a ruleset. No public exploit has been identified at time of analysis, and authentication requirements are not confirmed from available data.
Impact, attack vector, and affected component for CVE-2026-95516 remain undetermined: the CVE has no published description, no CVSS score or vector, no CWE assignment, and no CPE data, and the only sourcing signal is that it was reported by vendor:ubuntu. Because no affected package, protocol, or configuration detail was supplied, it is not possible to state whether this is a local or remote issue, whether authentication is required, or what an attacker could achieve; authentication requirements are not confirmed from available data. There is no KEV listing and no public exploit identified at time of analysis, and the practical reference point for both impact and remediation is the corresponding Ubuntu Security Notice (USN) and the NVD entry once populated.