Privilege escalation in Red Hat Ansible Automation Platform 2 (built on the AWX upstream project) lets an authenticated AAP platform administrator escape the container-group sandbox and obtain OpenShift namespace-level access, including the ability to read and exfiltrate namespace secrets. The flaw is reachable over the network (AV:N) with no user interaction (UI:N) and changes scope across the container/namespace boundary (S:C), but it is gated on the highest AAP privilege tier (PR:H), so it is an insider or compromised-admin scenario rather than an unauthenticated attack; only deployments that use container groups backed by OpenShift/Kubernetes are exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); no vendor-released patch has been identified at time of analysis, so mitigation depends on restricting the vulnerable field or the administrators who can reach it.
TLS client-authentication bypass in the RabbitMQ trust-store plugin lets a remote unauthenticated attacker whose forged self-signed certificate carries the issuer DN and serial number of any whitelisted certificate pass mutual-TLS authentication. Only deployments that have the rabbitmq_trust_store plugin enabled and wired in as the TLS verify_fun for a client-certificate listener are affected, and an attacker must first learn or guess at least one whitelisted certificate's {Issuer, Serial} pair, which is non-secret and is exposed by the plugin's list command, logs, or any copy of the certificate. All RabbitMQ server releases prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 are vulnerable; vendor-released patches exist in those versions, and no public exploit identified at time of analysis.
FileMaker Server deployments that expose the Web Publishing Engine can be driven into serving the XML Web Publishing interface even when an administrator has explicitly disabled the Custom Web Publishing with XML option, because a request-supplied extended privilege header is trusted without validating it against the configured publishing state. The bypass carries a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), so unauthenticated remote attackers reach high confidentiality and integrity impact with no user interaction, but only against servers where the Web Publishing Engine is actually deployed and network-reachable; installations that do not run Web Publishing are unaffected. No public exploit code and no confirmed active exploitation have been identified at time of analysis (EPSS 0.15%, 3rd percentile; CISA SSVC exploitation: none), and Claris remediated the issue in FileMaker Server 26.0.3.
Server-side thumbnail generation in FileMaker Server for Linux can be forced to over-read process memory when an attacker uploads a specially crafted image into a container field reachable through FileMaker WebDirect, leaking contents of the server's process memory and potentially crashing the worker process. Only the Linux server variant is affected; exploitation requires WebDirect to be enabled and a hosted solution that exposes a writable container field, which in most deployments implies a WebDirect guest or low-privilege authenticated session (the assessed vector is PR:L, while NVD's published vector claims PR:N - a discrepancy worth noting when scoring). No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is a low 0.14% (3rd percentile); Claris has released a fix in FileMaker Server 26.0.3, so this is a genuine but not urgent priority - patch on a normal cycle rather than under emergency change.
HTTP/2 request smuggling in Apache Tomcat can mix up request headers between concurrent streams, allowing unauthenticated remote attackers to potentially read or alter other users' request data when the connector has HTTP/2 explicitly enabled. The flaw is a regression from the fix for CVE-2026-41293 and affects only Tomcat 11.0.22 through 11.0.25, 10.1.55 through 10.1.59, and 9.0.118 through 9.0.121; exploitation is rated high complexity (AC:H) with limited confidentiality and integrity impact (C:L/I:L). No public exploit code has been identified at time of analysis, and the independent assessment rates this as a moderate-priority, genuine protocol-layer flaw rather than a critical emergency.
Unauthenticated remote code execution in the YAHMAN Add-ons WordPress plugin affects all versions before 0.9.31 when the plugin's remote-file caching feature is explicitly enabled. The plugin stores remotely fetched files in a publicly accessible cache directory without validating their type, so an attacker can plant arbitrary PHP content there and have the web server execute it, yielding code execution with full confidentiality, integrity, and availability impact (CVSS 9.0, CRITICAL; AV:N/AC:H/PR:N/UI:N). Exploitation is unauthenticated and requires no user interaction, but it is gated by the non-default cache feature and rated high complexity (AC:H), and no public exploit code was identified at time of analysis. There is no confirmed active exploitation (no CISA KEV listing).
Identity-assertion confusion in the WP OAuth Server (Login with WordPress) plugin before 6.4.0 allows a user holding a Subscriber-level account or above to obtain a validly signed OpenID Connect identity assertion belonging to another user - including an administrator - and use it to authenticate as that victim at any relying application that trusts the WordPress site as an SSO identity provider. The plugin fails to bind the assertion it issues to the authorization grant being exchanged, instead returning the assertion of whichever user authenticated most recently, so exploitation depends on a race/interaction window (assessed vector AC:H, UI:R) in which the targeted higher-privileged user is the most recently authenticated identity. No public exploit code was identified at time of analysis, and there is no CISA KEV entry indicating active exploitation.
Insecure-by-default OpenSSL options in Apache Tomcat Native (versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8) silently weaken the TLS layer used by the APR/OpenSSL connector, enabling insecure client-initiated renegotiation, disabling the Extended Master Secret extension, ignoring unexpected EOF (truncation), and permitting key exchanges without (EC)DHE forward secrecy. The vendor scored this 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N), but our independent assessment rates it substantially lower - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - because meaningful abuse requires an on-path/man-in-the-middle attacker who can actively position themselves between client and server, and because the four options are only applied when the deployment has not explicitly overridden them. Only Tomcat instances configured with the Apache Tomcat Native (APR) TLS connector at an affected version are exposed; JSSE/NIO-based connectors are unaffected, and no public exploit code or CISA KEV entry was identified at time of analysis. Vendors/users should upgrade to Tomcat Native 2.0.16 or 1.3.9.
Authentication can succeed when it should have been rejected in Apache Tomcat deployments that use CLIENT_CERT (mutual-TLS) authentication with soft fail disabled, allowing network attackers to reach resources that the mutual-TLS configuration was meant to protect. The affected range is broad - 9.0.92 through 9.0.121, 10.1.22 through 10.1.59, and 11.0.0-M14 through 11.0.25 - but the flaw is gated on two non-default conditions (the CLIENT_CERT authenticator in use and soft fail turned off) and, per the vendor, only manifests in some scenarios, so it is not universally reproducible even on correctly configured vulnerable instances. No public exploit code has been identified at time of analysis, and no evidence of active exploitation is present; the attacker needs network reachability to the mTLS-protected listener.