Arbitrary file read is possible on CyberPanel 1.9.1 hosts: an authenticated panel user who owns at least one configured domain can call readFileContents on /filemanager/controller with a valid domainName of their own plus an arbitrary absolute or out-of-scope path in the fileName JSON property, and the server returns that file's contents. Because the CyberPanel process typically runs as root, disclosure is bounded only by the execution identity's file permissions, yielding high confidentiality impact (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) while integrity and availability are unaffected. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited (not in CISA KEV).
Missing authorization checks in the Advanced Contact Form 7 DB WordPress plugin through version 2.0.9 allow any authenticated user holding Contributor-level access or higher to read every Contact Form 7 submission stored by the site by having the plugin render its 'acf7db' shortcode, exposing logged names, email addresses and message bodies (CWE-862; assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5). The attacker must already hold a low-privileged account, so multi-author sites and sites with open registration are the most exposed, and the assessed impact is confidentiality-only with no integrity, availability or code-execution effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the underlying Contact Form 7 submission data is what is disclosed rather than credentials or site control.
Information disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated user to read sensitive data, because namespace-wide secrets are exposed through file mounts that are reachable from the DataStage workload. The vulnerability is rated CVSS 8.8 by the vendor, but our independent assessment re-scores it as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - a confidentiality-only issue with a scope change, reflecting that the exposed secrets belong to other tenants/services in the same Kubernetes/OpenShift namespace rather than to the vulnerable component itself; the source vector's claims of high integrity and availability impact are not supported by the CWE-200 description. Exploitation requires a valid authenticated account on the affected 5.4.0.0 build and no user interaction; there is no public exploit identified at time of analysis, and no EPSS or CISA KEV signal was provided. Organizations running this release should treat any credentials present in the affected namespace as potentially compromised.
Arbitrary file disclosure in CyberPanel v1.9.1 via a path traversal flaw in the file manager's compress method exposed at the /filemanager/controller endpoint, which lets an authenticated attacker who owns at least one configured domain package out-of-scope files into a downloadable zip/tar archive. The application checks only that the requester owns the referenced domain and never canonicalizes the attacker-supplied listOfFiles, basePath, or compressedFileName values, so absolute or traversal paths are appended to the archive command and executed as the site's externalApp OS user (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5). Impact is confidentiality-only and bounded by the file permissions of that per-site user, with no write, code execution, or availability effect; no public exploit identified at time of analysis, and this is best handled as a defense-in-depth/hardening priority rather than an emergency patch-now item.
CVE-2026-95297 cannot be scoped from the intelligence supplied: the record contains no description, no CVSS score or vector, no CWE classification, and no CPE data. The only attributable signal is that the entry was reported by the Ubuntu vendor source, indicating the CVE is tracked within Ubuntu's vulnerability management process, but neither the affected package nor the vulnerability class is identified, so the impacted versions, attack surface, and required access level are all unknown. No public exploit identified at time of analysis, and no EPSS, KEV, or proof-of-concept signal is present in the input. Risk cannot be meaningfully assessed from the provided data, and re-enrichment from the Ubuntu CVE tracker and NVD is required before any exposure determination can be made.
Authenticated users of any privilege level on Red Hat Ansible Automation Platform 2 automation-controller deployments can extract other tenants' notification secrets-PagerDuty service keys and Slack, Mattermost, RocketChat, and generic Webhook bearer-token URLs-by abusing the API filter backend as a boolean count-oracle. The attack requires only a low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5), is network-reachable and low in complexity, and yields high confidentiality impact with no integrity or availability effect. Impact is greatest in multi-tenant installations where recovered secrets break organization isolation and permit notification-channel impersonation; exploitation is inherently slow, requiring many iterative requests that may be visible in API logs. No public exploit code has been identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Google Chrome desktop (stable channel) builds predating the September 2026 stable-channel update carry a flaw that the vendor has already fixed, but the available intelligence contains no description, CWE, or CVSS vector, so the precise impact cannot be characterized from the supplied data. The affected component is the Google Chrome stable desktop browser, and exploitation would require the victim to run an unpatched build and, in most realistic scenarios, to load attacker-controlled web content, meaning user interaction is likely a prerequisite. There is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided to quantify exploitation likelihood; the principal mitigating factor is that the fix is already shipping through Chrome's automatic update mechanism, which sharply limits the exposure window for most managed and consumer deployments.
Google Chrome for desktop on the stable channel received a vendor security fix shipped in the September 2026 stable channel update, and the Chrome Releases advisory is the only substantive reference in this record. The defect itself is undocumented here: no description, no CVSS vector or score, no CWE, and no CPE data are available, so the attack vector, complexity, privileges required, and technical impact are unverified; the record is attributed to the Ubuntu vulnerability tracker. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) signal, but risk cannot be quantified from vulnerability-specific data and should be treated as unresolved until the referenced Chrome advisory is read directly.
Secret values that playbook authors explicitly marked with no_log can be recovered from Red Hat Ansible Automation Platform 2 (automation-controller) through the REST filter backend, because the WorkflowJobNode.ancestor_artifacts column is not wrapped in prevent_search() and therefore remains queryable even though it is omitted from the API serializer. An authenticated user - one with only read access to a workflow, or any authenticated user with no roles at all by abusing a regular-expression lookup that bypasses the JSON cross-relation filter guard via the world-readable credential-types endpoint - can use the result count as a boolean/count oracle to extract secrets character by character, potentially across organizations. The issue is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-639); no public exploit code or confirmed active exploitation was identified at time of analysis, and because recovery requires an account plus many incremental requests per character, the practical risk is a bounded confidentiality exposure rather than a top-tier emergency.
SQL injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote authenticated attacker to read sensitive data from the underlying database, with impact confined to confidentiality (CVSS 6.5, C:H/I:N/A:N). The flaw is network-reachable with low attack complexity and no user interaction, but exploitation is gated behind a valid authenticated account (PR:L) on the FTM deployment. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fix; practical risk is tempered by the product's restricted financial-sector deployment footprint, making this a moderate-severity, real-but-not-urgent issue.
Remote code execution on the Apache Doris Frontend (FE) is achievable when a privileged, already-authenticated user supplies a crafted JDBC driver URL that the FE loads without sufficient validation, a case of inclusion of functionality from an untrusted control sphere (CWE-829). The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) shows the flaw is network-reachable but gated behind high privileges, meaning only accounts that can define or modify JDBC catalogs or external resources can reach the vulnerable code path; anonymous or low-privilege actors are out of scope, and no user interaction or default-configuration vector exists for an external unauthenticated attacker. No CVSS score, EPSS value, KEV entry, or proof-of-concept was supplied in the source data, so there is no confirmation of active exploitation and no public exploit identified at time of analysis, leaving quantitative prioritization signals absent.
Risk cannot be meaningfully assessed from the available data - CVE-2026-95275 exists only as a bare record attributed to the Ubuntu vendor source, with no description, no CVSS vector, no CWE classification, and no affected-product identification. Because neither the vulnerable component nor the attack surface is known, it is impossible to state what an attacker could accomplish, which Ubuntu release or package is implicated, or whether exploitation would require authentication, local access, or user interaction. The record carries no CISA KEV listing, no publicly available exploit code, and no EPSS signal, so the only defensible posture is to treat the identifier as unverified and pending enrichment from NVD or the Ubuntu security advisory before any risk statement is issued.
Impact cannot be characterized for CVE-2026-95303 because the record supplies no description, no CVSS score or vector, no CWE mapping, and no CPE or version identifiers - the only usable signal is a reporting attribution to the Ubuntu vendor source. Because neither the affected component nor the attack prerequisites are known, no exploitability determination is possible; no public exploit is identified at time of analysis, and this should not be read as evidence that none exists. Treat this entry as unresolved and retrieve the authoritative Ubuntu Security Notice or the upstream NVD record before making any exposure, prioritization, or remediation decision.
Unauthenticated remote attackers can clear active chat sessions in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift because the component handling chat sessions performs improper authorization, rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Any network-reachable deployment of the FTM chat-session feature is exposed, and exploitation requires no credentials or user interaction - but the impact is deliberately narrow: no data can be read (C:N) and the only effect is disruption of in-progress chat sessions (I:L/A:L), making this a genuinely lower-tier issue despite the MEDIUM score. No public exploit identified at time of analysis, and CISA KEV does not list this CVE.
Google Chrome desktop stable channel builds released before the September 2026 stable-channel update are affected by CVE-2026-95374, a security issue that Google addressed in that release. The entry is data-sparse: no description, no CVSS score, no CVSS vector, and no CWE classification have been published by the vendor or any other source in the provided intelligence, so the precise flaw class, attack surface, and impact cannot be characterized from the available data - exploitation conditions are unconfirmed, and by analogy to typical Chrome desktop stable-channel fixes the issue would most likely be reachable through a user rendering attacker-controlled web content, though this remains an assumption rather than an assessed fact. No public exploit identified at time of analysis; CVE-2026-95374 is not listed in CISA KEV in the provided data, and no proof-of-concept, EPSS value, or active-exploitation reporting accompanies this record. Anyone running a Chrome desktop stable build older than the September 2026 update should treat the release note as the authoritative source and patch promptly.
Google Chrome desktop builds prior to the September 2026 stable-channel release referenced in the Chrome Releases advisory are affected by a vulnerability whose technical details have not been disclosed, so its precise impact cannot be independently characterized. Based on the affected product class, exploitation would most plausibly require a victim to run an unpatched Chrome build and interact with attacker-controlled web content, but this is an inference from the product class rather than a confirmed exploitation precondition. No public exploit code or CISA KEV listing has been identified at time of analysis, and with no CVSS score, vector, CWE, or EPSS probability provided, no independent risk score can be assigned.
Authentication bypass in BusyBox httpd occurs when the server is configured with HTTP Basic Authentication backed by yescrypt ($y$-prefixed) password hashes, which the daemon fails to recognize as hashes and instead compares literally as plaintext - inverting the auth check so the stored hash string itself becomes a usable credential. The flaw is network-reachable and requires no prior authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, 6.5), with high attack complexity reflecting the dependency on the non-universal yescrypt configuration and the attacker's need to know or obtain the stored hash; impact skews to confidentiality (C:H) with limited integrity effect (I:L). Exposure is concentrated in Red Hat Hardened Images and other deployments where BusyBox httpd actually fronts authentication; there is no public exploit identified at time of analysis and no CISA KEV listing, so this is a configuration-gated weakness rather than a demonstrated in-the-wild attack.
Content-Disposition enforcement bypass in Apache Sling Security Bundle before 1.3.12 allows remote attackers to circumvent the ContentDispositionFilter by accessing attacker-influenced resources through an alternate URL/API shape not mediated by the filter, potentially causing resources to be served inline rather than as attachments. This protection-mechanism failure (CWE-693) can lead to low confidentiality and integrity impacts, such as information disclosure or client-side script execution, and requires user interaction to open a crafted link. Deployments that rely on this filter for content-disposition protection are affected; no public exploit identified at time of analysis.
Unauthenticated attackers can capture another buyer's approved-but-uncaptured PayPal payment against a WooCommerce order of their own choosing in Payment Plugins for PayPal WooCommerce versions before 2.0.27. The plugin fails to confirm that the PayPal order supplied in a payment request actually belongs to the WooCommerce order being paid unless that PayPal order is already completed, so any store running the vulnerable plugin with the PayPal gateway active is exposed. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) but gated by a timing prerequisite - a different buyer must have an approved, not-yet-captured PayPal order whose identifier the attacker can supply - yielding a conditional integrity impact (C:L/I:H/A:N, CVSS 6.5) rather than a high-urgency emergency; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV). A vendor patch is available in 2.0.27.
Authenticated attackers with nothing more than a Subscriber-level account can delete arbitrary business listings - including listings owned by other users - on WordPress sites running the Directorist directory/classifieds plugin from version 3.1.0 up to (but not including) 8.9.5. The root cause is a listing-deletion code path that does not verify ownership, a route that the earlier fixes for CVE-2023-1889 and CVE-2023-35052 failed to close, making this an incomplete-fix regression rather than a novel bug class. Scoring 6.5 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), the issue is purely an integrity problem with no confidentiality loss and no availability impact, and no public exploit code has been identified at time of analysis. Exposure is highest on directory and classified-ad sites that leave WordPress 'Anyone can register' enabled, since a self-registered Subscriber is sufficient to weaponize the flaw.
Unauthenticated attackers can read and overwrite any subscriber's personal data - including changing their email address - on WordPress sites running the Newsletters plugin at any version before 4.18.1. Because the plugin hands out a management session to unauthenticated visitors on request and then omits an ownership check on several subscriber-management actions, no credentials, user interaction, or non-default configuration are needed; the attacker simply requests a session and then references another subscriber's record directly. The impact is bounded to the plugin's subscriber dataset (PII disclosure plus record/email tampering) rather than full WordPress takeover, and this is a moderate-priority issue: no public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none while marking the flaw automatable, so mass scanning should be expected even without a published PoC. A vendor patch is available in 4.18.1; EPSS data was not provided in the source set.
Broken access control in Cinnamon's Kotaemon (all versions up to and including v0.12.0) allows any authenticated user on a shared, multi-user deployment to read, rename, delete, or overwrite the chat suggestion list of another user's conversations simply by supplying a victim's conversation ID, because four handler methods in libs/ktem/ktem/pages/chat/control.py load Conversation records without comparing the requester's user_id to Conversation.user. Exploitation requires a valid account on a multi-user instance where tenants share the same conversation store, needs no victim interaction, and is limited to accounts that can supply or enumerate valid conversation IDs (independent assessment: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, a moderate-priority broken-access-control/IDOR issue). There is no public exploit identified at time of analysis, EPSS is low at 0.14% (3rd percentile), and CISA SSVC records Exploitation: none with partial technical impact.
Apache Tomcat's OpenSSL and OpenSSL-FFM TLS connectors ignore certificate revocation lists when the certificate is loaded from a keystore, so a client certificate that has already been revoked can still be accepted for mutual-TLS authentication. Affected releases are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.58, and 9.0.0-M1 through 9.0.121, with end-of-life 8.5.0 through 8.5.100 also known to be affected; fixed versions are 11.0.26, 10.1.59, and 9.0.122. No vendor CVSS score, EPSS value, CISA KEV entry, or public proof-of-concept was supplied, and our internal assessment rates the issue CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, reachable unauthenticated but only in the non-default combination of an OpenSSL or OpenSSL-FFM TLS connector, keystore-based certificates, mutual-TLS client-certificate authentication, and CRL-based revocation checking; no public exploit identified at time of analysis.
Authorization bypass through a user-controlled key (CWE-639 IDOR) in the YITH WooCommerce Request A Quote plugin for WordPress allows remote attackers to act on quote-request objects they should not control, on any site running a version before 4.46.1. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms exploitation is remote, low complexity, unauthenticated and requires no user interaction, though damage is bounded to low integrity impact with no confidentiality or availability effect stated. No public exploit code identified at time of analysis, with no KEV or EPSS signals supplied, but the vendor has released a fixed version (4.46.1) and the issue was reported by Patchstack, so sites exposing the request-a-quote endpoints should treat patching as urgent housekeeping rather than a theoretical concern.
Stored cross-site scripting in Ultimate Addons for Contact Form 7 (all versions through 3.5.50) allows an authenticated user with Contributor-level access to inject script into plugin-rendered content that later executes in the browser of a higher-privileged user such as an administrator or editor who views that content. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 6.5 per the vendor score) requires both a low-privileged account and victim interaction, so realistic exposure is limited to WordPress sites that grant Contributor accounts to untrusted parties; there is no identified pre-authentication path. No public exploit code and no CISA KEV entry were identified at time of analysis, making this a moderate-priority rather than high-priority issue, though the scope-change characteristic means injected script can act outside the plugin's own origin context within the site.
Authenticated Subscriber-level cross-site scripting in PixelYourSite - Your smart PIXEL (TAG) Manager versions 11.4.1 and earlier allows a user with a WordPress Subscriber account or higher to inject script that executes in the browser of a privileged administrator when the injected content is viewed. Exploitation requires two conditions: the attacker must be able to register or obtain a Subscriber-level account (PR:L per the assessed vector), and a victim administrator must interact with the page rendering the payload (UI:R); there is no unauthenticated or fully automated path against a default configuration. No public exploit identified at time of analysis, and the independent assessment rates this as a genuine but moderate-priority issue rather than an inflated high-CVSS finding.
Unauthenticated broken access control in the Conekta Payment Gateway WordPress plugin (all versions up to and including 6.2.4) lets a remote attacker reach a plugin endpoint that is missing a proper authorization check and perform a limited integrity-impacting action without logging in and without any victim interaction. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the consequence is confined to tampering - no confidentiality loss and no availability impact - and no public exploit has been identified at time of analysis, so real-world priority is moderate at best. The exposure is further limited by the plugin's niche footprint as a regional (Latin American) payment gateway rather than a broadly deployed platform component.
Arbitrary file deletion in WP User Frontend (weDevs) versions up to and including 4.3.11 allows an authenticated Subscriber-level user to delete arbitrary files on the server via a path traversal flaw (CWE-22), degrading availability. The vulnerability is network-reachable with low complexity (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and because the plugin is commonly deployed on sites with open self-registration, an attacker can typically obtain the required low-privilege account themselves. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
WP User Frontend versions up to and including 4.3.11 contain an authentication bypass by spoofing that allows an authenticated Subscriber-level user to exceed their intended authorization and modify protected data (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Exploitation is remote, low-complexity, and requires no user interaction, but the attacker must first hold a valid low-privilege account; this is realistic on WordPress sites that enable open self-registration for the plugin. No public exploit identified at time of analysis and no CISA KEV active exploitation is reported in the supplied data, and the exact vulnerable endpoint should be confirmed against the Patchstack advisory.
Stored cross-site scripting in the WordPress plugin Podcast Importer SecondLine affects versions up to and including 1.5.6, allowing an authenticated user with Contributor-level access or higher to inject script content that executes in a higher-privileged user's browser. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects a cross-privilege, moderate-severity issue rated 6.5: the attacker needs a Contributor foothold (self-registration or granted authorship) and an administrator must subsequently view the poisoned content in the dashboard, so there is no anonymous or drive-by execution against default visitors. No public exploit code has been identified at time of analysis and the plugin is not listed as confirmed actively exploited (CISA KEV); Patchstack is credited with the report and the ENISA EUVD entry (EUVD-2026-85486) tracks it as well.
Stored cross-site scripting in the WordPress plugin The Post Grid (RadiusTheme), affecting all versions through 7.9.5, allows an authenticated attacker holding Contributor-level access to persist malicious script that executes in a higher-privileged user's session. The independent assessment confirms a CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N vector: exploitation requires a Contributor account and additionally depends on an administrator or editor subsequently viewing the attacker-supplied content, and no unauthenticated path exists. No public exploit identified at time of analysis, and the vendor-supplied vector's availability component (A:L) is not corroborated by the assessed vector, which reports A:N. Risk is moderate in practice because sites that do not grant Contributor-or-higher roles to untrusted users are not exposed.
Stored cross-site scripting in The Post Grid WordPress plugin (RadiusTheme) affects versions up to and including 7.9.5, allowing an authenticated user with Contributor-level access to inject script content that executes in the browser of a higher-privileged user - typically an administrator or editor reviewing the submission in wp-admin. The issue is rated 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N per our assessment), and exploitation requires both an authenticated Contributor account and subsequent victim interaction, so this is a moderate-severity, low-real-world-priority issue rather than a mass-exploitation threat. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vulnerability was reported through Patchstack and is tracked as EUVD-2026-85483.
ElementsKit Elementor addons Lite through version 4.0.5 contains a Cross-Site Scripting flaw (CWE-79) that lets a low-privileged user plant script content which executes in a higher-privileged user's browser session. Exploitation requires an authenticated WordPress account with at least Contributor-level privileges (CVSS vector PR:L), and the payload only fires when an administrator or other privileged user views the attacker-controlled content, making victim interaction a hard prerequisite (UI:R). The scope is rated Changed because the injected script runs in the victim's session rather than the attacker's own context, so it can act with the victim's privileges; no KEV listing or public exploit code was identified at time of analysis, and Patchstack is the reporting source. Impact is bounded to low confidentiality, integrity, and availability effects under the assessed vector, but the Changed scope means an administrator session could be abused for further actions inside the WordPress dashboard.
Unauthenticated broken access control in the AppMySite WordPress plugin (all versions up to and including 3.15.4) lets remote attackers trigger privileged plugin functionality without any credentials or user interaction, degrading site integrity. Reported by Patchstack and mirrored as EUVD-2026-85481, the issue carries a published CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L (base 6.5); our independent assessment agrees the attack path is remote, low-complexity, and unauthenticated, but caps the impact at low integrity (C:N/I:L/A:N) because no confidentiality or availability impact was demonstrated. The attack surface is limited to sites where the plugin is installed and active, and no public exploit code or confirmed active exploitation has been identified at time of analysis, although the trivial attack complexity means exploitation is straightforward once the specific unprotected endpoint is located.
Stored cross-site scripting in the Ditty WordPress plugin (versions through 3.1.69) allows an authenticated attacker holding at least Contributor-level privileges on a site to plant script that later executes in the browser of a higher-privileged user, such as an administrator, who views the affected content. Exploitation requires both a low-privileged foothold account and victim interaction, which keeps this a modest-priority issue (CVSS 6.5, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Ultimate FAQ through version 2.4.14 allows an authenticated attacker with Contributor-level access to inject script content that executes when a higher-privileged user views the affected FAQ. The supplied CVSS 3.1 base score is 6.5 with CWE-79, but the independent assessment treats availability impact as none and frames real-world urgency as moderate because the attacker needs a Contributor account and a privileged victim must interact with the poisoned content. No public exploit code or confirmed active exploitation was identified in the available intelligence.
Authenticated cross-site scripting in Premium Addons for Elementor, affecting versions up to and including 4.11.105, allows a WordPress user with Contributor-level access to inject script into widget content that executes in the browser of a higher-privileged user (administrator or editor) who views or previews the affected content. Because exploitation requires PR:L and UI:R with a scope-changing (S:C) impact, exposure is meaningfully narrowed to sites that grant Contributor accounts to untrusted parties and whose privileged users render the untrusted content; the affected population is further limited to WordPress installs that also run Elementor. Reported severity is moderate (CVSS 6.5), and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the Premium Blocks - Gutenberg Blocks for WordPress plugin (versions up to and including 2.3.17) lets an authenticated Contributor-level user inject persistent JavaScript into block content that executes when a higher-privileged editor or administrator later views or previews that content in wp-admin. Exploitation requires a foothold account with Contributor privileges and victim interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 6.5), with low confidentiality and integrity impact and no availability impact; sites that do not accept untrusted author accounts are largely insulated. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch version is specified in the available intelligence.
Stored cross-site scripting in wpForo Forum 3.1.5 and earlier lets an authenticated Subscriber-level user inject script that runs in a moderator or administrator's browser when they view the crafted forum content. Exploitation requires a registered account on a WordPress site with the plugin and open registration, plus victim interaction; it does not provide direct server access or unauthenticated code execution. Patchstack rates it CVSS 6.5, and no public exploit code or confirmed active exploitation is identified in the provided data.
Unauthenticated broken access control in the PayPlus Payment Gateway WordPress plugin (versions 8.2.5 and earlier) lets remote attackers reach plugin functionality that lacks proper authorization checks, yielding partial confidentiality and integrity impact. Per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, 6.5 Medium), exploitation requires no authentication, no user interaction, and no non-default configuration, so any WordPress site running this niche payment plugin at a vulnerable version is exposed over the network. Exposure is limited to sites with the plugin installed and active, availability is unaffected, and no public exploit code or confirmed active exploitation was identified at time of analysis; Patchstack is credited with the report.
Stored cross-site scripting in the JetTricks WordPress plugin through version 2.0.1 lets an authenticated attacker with low-privilege content-contribution rights (PR:L) inject persistent script that executes in the browser of any user - typically an administrator - who later views the affected page (UI:R). The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N for a base score of 6.5, a moderate rather than high priority, and the scope-change component reflects that the payload runs in the viewing user's session context, which may carry more privileges than the injector. No public exploit code was identified at the time of analysis and the issue is not listed in CISA KEV, so the main practical barrier for an attacker is the need for an authenticated account rather than anonymous access.
Broken access control in the WordPress plugin WSP MCP - AI Agents Connector (versions up to and including 2.7.0) allows any authenticated user holding a Contributor-level account or higher to invoke a plugin action that lacks a proper capability check, modifying plugin state or configuration without authorization. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) confirms this is network-reachable, low complexity, requires low privileges, and needs no user interaction, with high integrity impact but no loss of confidentiality or availability. Exploitation depends on the site running this niche AI-agent connector plugin and permitting Contributor-level registration or account access; no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Server-side request forgery (SSRF) in the Weoll collaboration platform (Global IT Informatics Technology Services Inc.) allows remote attackers to coerce the server into making crafted outbound requests against internal or back-end resources. Only deployments running Weoll before 3.2.45.44 are affected; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) places the flaw at 6.5 with a high confidentiality impact but no integrity or availability effect and no scope change. Exploitation requires the application to expose a server-side URL-fetching or resource-retrieval feature and, per UI:R, depends on a user being induced to trigger the crafted request rather than fully autonomous attacker action; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Google Chrome desktop (stable channel) installations are affected by CVE-2026-95327, a security defect for which Google has published a stable-channel update and a patch is available from the vendor. Because no description, CVSS score or vector, or CWE was supplied with this CVE, the precise impact, attack vector, and affected version range cannot be established from the available intelligence; the only concrete signal is that a vendor fix exists, so residual exposure is confined to unpatched installations. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score or CISA KEV entry was provided to indicate elevated real-world risk.
Google Chrome desktop builds are affected by a security weakness corrected in a Chrome Releases stable-channel update, but the vulnerability's description, CVSS score, CVSS vector, and CWE are all absent from the available intelligence, so the precise impact class (for example memory corruption, type confusion, or a sandbox escape) cannot be confirmed from this dataset. Consistent with the affected product and the referenced advisory, the most plausible exploitation path requires a victim to run an unpatched Chrome desktop build and load attacker-controlled web content, with user interaction via visiting a malicious or compromised page; authentication requirements are not confirmed from available data. No public exploit identified at time of analysis and no CISA KEV entry is present, while a vendor patch is available, which confines practical risk to installations that have not yet applied the stable-channel update.
Google Chrome on desktop is the confirmed affected product, with the fix delivered through the September 2026 stable-channel update documented on the Chrome Releases blog, yet the underlying flaw cannot be characterized from the available record because no description, CVSS vector, or CWE was provided. Exploitation status is unconfirmed: there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS signal was supplied, so no public exploit identified at time of analysis. Because the affected component, version range, and any required user interaction or sandbox-escaping prerequisites are unknown, severity remains unquantified and defenders should treat the vendor advisory as the authoritative source rather than inferring impact from this entry.
Google Chrome (desktop stable channel) is affected by a security defect for which the vendor has published a fix as part of its September 2026 Stable Channel Update, the single reference attached to this CVE. The record contains no description, no CVSS vector, and no CWE, so the specific vulnerable component, the attack vector, and any required user interaction are undetermined from the available data; based only on the product identity, the most plausible exploitation path would be a victim rendering attacker-controlled web content in the browser, but that is an inference rather than a stated condition. Authentication requirements are not confirmed from available data, and no public exploit identified at time of analysis; the vendor patch is available and Chrome's auto-update mechanism deploys it without user action.
Stored cross-site scripting in the Getwid - Gutenberg Blocks WordPress plugin (all versions up to and including 2.1.3) allows authenticated attackers holding Contributor-level privileges or higher to inject arbitrary JavaScript through the Google Maps block's 'customStyle' attribute, because the frontend mapStyles() function passes that user-controlled value to eval(). The injected script is persisted in the post/block content and executes automatically in the browser of any visitor who renders the affected page, enabling session theft, content injection, or redirection under the site's origin (CVSS 6.4, Medium, with a Scope-Changed vector reflecting code execution outside the plugin's intended boundary). Exploitation requires a posting-capable account and no special non-default configuration; no public exploit code has been identified at time of analysis, and the issue is documented in a public Wordfence advisory.
Server-side request forgery in Red Hat Ansible Automation Platform 2's automation-controller email notification backend lets an authenticated user holding organization notification-admin permission point an email notification template's SMTP host and port at arbitrary internal, loopback, link-local or reserved addresses; the controller task process then opens a raw TCP connection to that target when the notification test is triggered. Because the resulting connection error is surfaced through the notification record, an attacker gains a three-state internal port-scan oracle (open, closed, filtered) over the control-plane cluster network, including the in-cluster Kubernetes API, and if a shared organization template stores an SMTP password, redirecting the host can leak that credential to an attacker-controlled server. Impact is moderate (vendor CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and requires a privileged, already-authenticated role rather than anonymous access; no public exploit code has been identified at time of analysis and CISA KEV does not list this CVE.
Privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager allows a low-privileged attacker positioned on the adjacent network to reuse a session token that the application fails to expire, bypassing protection mechanisms and gaining unauthorized access to resources beyond their authorization level. Exploitation is constrained: it requires adjacent-network access rather than internet reachability, an existing low-privileged account, victim user interaction, and high attack complexity, which limits reliability. Affected are versions prior to 5.34.00.16 per the Dell advisory (EUVD lists the boundary as <5.36.00.16, a discrepancy that should be verified against the vendor document). There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited; at a vendor CVSS of 6.4 the real-world urgency is low, though the confidentiality and integrity impact of a successful session-reuse attack is high.