Unauthenticated file disclosure in Caddy 2.11.3 and earlier allows remote attackers to bypass the file_server `hide` directive by requesting case variants of hidden files. This affects deployments on case-insensitive filesystems (Windows, default macOS/APFS) or where mixed-case path variants coexist; standard case-sensitive Linux filesystems (ext4/xfs) are not affected. Impact is limited to information disclosure of files intended to be hidden, with no integrity or availability impact. Caddy 2.11.4 contains the fix. No public exploit code or active exploitation has been identified at time of analysis.
Weak, reversible password encoding in Dell Secure Connect Gateway (SCG) Policy Manager lets a local, low-privileged user who already holds an account on the host recover stored credentials and abuse them for information disclosure, information tampering, protection-mechanism bypass and unauthorized access. The flaw affects versions prior to 5.34.00.16 and prior to 5.36 and is scored CVSS 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) - it is not remotely reachable and requires no user interaction, but it does require local access to the host plus a pre-existing low-privileged account, with the high attack complexity reflecting the work needed to locate and reverse the weak encoding. No public exploit identified at time of analysis, and this is a moderate, defense-in-depth issue rather than a front-line priority.
Any Bluetooth device within radio range of a Reachy Mini robot can send CMD_ commands by piggybacking on another operator's completed PIN authentication, because the Bluetooth service keeps its authenticated state in a single shared flag on the service instance rather than binding it to the calling device - the WriteValue handler ignores the BlueZ options argument that carries the caller's identity. The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (6.3, Medium) reflects that Bluetooth proximity and a genuine user completing the PIN exchange are both required, and that standalone impact is limited to command access; root code execution only follows from chaining with CVE-2026-55419 (unrestricted file upload) and CVE-2026-62661 (path traversal in the Bluetooth command handler). No CISA KEV listing, no EPSS score, and no independently published standalone exploit code were identified at time of analysis - the only public documentation is JFrog's description of this as the second step in a three-step attack chain, with no public exploit identified at time of analysis for this issue alone.
Google Chrome desktop stable-channel builds are covered by a vendor security update that addresses CVE-2026-95375, a defect for which no description, CVSS score or vector, CWE mapping, EPSS probability, or CISA KEV entry is present in the available intelligence. Because the record is essentially a data void, the concrete attack impact, the prerequisite configuration, and the required user interaction cannot be confirmed from the supplied data; the only reliable signal is that Google published a Stable Channel update for Desktop (http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html) and that the Ubuntu security team is tracking the CVE against its Chromium packaging, which indicates a Linux distribution impact in addition to the upstream browser. No public exploit code exists in the provided data (no POC reference, no KEV listing), so exploitation status is assessed as no public exploit identified at time of analysis, and no EPSS-based likelihood estimate can be cited. Treat this entry as patch-now hygiene rather than as a demonstrated emergency until NVD and the Chrome Releases advisory are populated with the affected component and severity.
Risk cannot be meaningfully assessed for Ubuntu Linux security update CVE-2026-96281 because the affected package, vulnerability type, and impact are undisclosed. The CVE is reported by the Ubuntu vendor with a generic 'security update' description, but no CVSS score, CWE, CPE, or advisory details are available, leaving the attack vector, authentication requirements, and exploitation status unknown. No public exploit has been identified at time of analysis, and no KEV status is indicated.
Unauthenticated local invocation of the Business Rules Manager commands REST endpoint in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an actor who already has a foothold in the hosting environment exhaust resources and halt business-rule management functions. The flaw is a missing authentication check (CWE-306) in CommandsResource.java:31; the CVSS 3.1 vector (AV:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2) confirms that no credentials or user interaction are required, but also that the attack path is local and that the only impact is availability - there is no data disclosure or modification. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the local attack vector is the primary factor keeping this a low-to-moderate priority issue despite the 6.2 base score. A vendor patch is available per the IBM advisory.
Improper access control in IBM Concert 1.0.0 through 3.0.0 lets a local attacker who already has access to the host modify application files that should be protected, yielding an integrity-only impact with no data disclosure or denial of service. The vendor CVSS vector is 6.2 with AV:L/PR:N, while the independent assessment rates PR:L because exploiting this flaw in practice typically requires at least a local account or a compromised co-resident process; IBM has released a vendor patch. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied. This is a genuine integrity risk but not a top-priority emergency, given the local attack vector and the product's limited deployment.
Arbitrary command execution in Acer NitroSense v5 (all versions up to and including 5.2.62) is reachable by any process already running on the laptop: the application's MQTT broker exposes an unauthenticated localhost WebSocket endpoint through which an attacker can invoke exposed ddsc RPC functions, including child_process.execSync(), and run commands in the application's context. Because the endpoint binds to localhost, this is a local-only escalation primitive - no network attack surface, no credentials and no user interaction required once a local foothold exists (CVSS 4.0 6.1; our assessed CVSS 3.1 7.8, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CISA KEV does not list this CVE and no public exploit code has been identified at time of analysis, so the flaw is a genuine code-execution issue with a self-limiting attack surface rather than an actively exploited one.
Cross-site scripting in Apache Sling XSS before 2.4.12 allows remote attackers to inject script that executes in a victim's browser when an application relying on the library's output encoding and sanitization renders attacker-influenced input through a code path where neutralization is incomplete. Exploitation is conditional: it requires a reflected or stored injection point in the consuming application and victim interaction (loading the affected page) for script execution, and applications that apply their own independent output encoding are not exposed. The vendor-released fix is version 2.4.12; no public exploit code identified at time of analysis, no EPSS data was supplied, and no public CVSS score or vector (Apache and NVD both N/A) exists, so severity must be inferred from the independently assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Cross-site scripting in the Apache Sling XSS Protection API before version 2.4.12 allows unauthenticated remote attackers to have attacker-supplied script execute in a victim's browser session when an application built on the library routes untrusted, attacker-influenced input through the flawed sanitization/encoding routines and reflects it into an HTML response. Because the affected artifact is a shared library rather than a standalone server, exposure depends entirely on the consuming application - most commonly Apache Sling-based sites and Adobe Experience Manager - and exploitation requires the victim to load the crafted page or click a malicious link (user interaction). Neither NVD nor Apache published a CVSS score for this issue, so severity must be inferred from the library-level flaw and the deployed context; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (unauthenticated, user-interaction dependent, scoped impact affecting the embedding application), and no public exploit identified at time of analysis.
Cross-site scripting in Apache Sling XSS versions before 2.4.12 allows unauthenticated remote attackers to defeat the library's input-neutralization logic, so that crafted input passed through the affected encoding/filtering API is rendered unsafely in a victim's browser (user interaction required per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The impact is indirect but broad: this library is the component downstream applications call to sanitize untrusted input, so a bypass silently re-exposes every consuming application to reflected or stored XSS. No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) is reported, and the vendor has released a fix in version 2.4.12.
Reflected cross-site scripting in the Apache Sling XSS library 2.4.10 and earlier arises because the XSSAPI.getValidHref() helper fails to properly neutralize certain attacker-supplied values, returning an href that a consuming application may then render into a page. Remote, unauthenticated attackers can exploit this only where a downstream application actually uses getValidHref() as its sanitizer for attacker-influenced link values and reflects that value back to users, and a victim must click a crafted link for the script to execute (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and overall risk is low because reachability depends entirely on how an embedding application wires up this method.
Denial of service in Apache Sling XSS (before 2.4.12) allows remote unauthenticated attackers to exhaust server resources by passing XML content with recursively defined DTD entities through the Sling XSS protection module, which expands them without bound. This CWE-776 XML entity expansion flaw only affects availability (no data compromise) and requires the application to route attacker-controlled XML to the vulnerable parser. No public exploit code or active exploitation has been identified, and the vendor recommends upgrading to 2.4.12.
Local code execution in Acer NitroSense v5 (versions up to and including 5.2.63) allows an attacker who already has shell access on the host to run arbitrary code in the privileged context of the application by connecting to an Electron/Chromium DevTools endpoint left enabled in the production build and bound to localhost TCP port 9993. No authentication or user interaction is required against that debug port, and the assessed CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity and availability impact once local access exists, but the exposure is confined to loopback and is therefore not remotely reachable. No public exploit code was identified and there is no CISA KEV listing at time of analysis; this is a moderate, locally-scoped risk rather than a remote emergency, and its main value to an attacker is as a privilege-escalation or persistence primitive on an already-compromised endpoint.
Credential-hash disclosure in Foxit PDF Editor and Foxit PDF Reader occurs when a crafted PDF triggers outbound SMB authentication without a security prompt, bypassing the missing permission check in secure reading mode. An attacker can lure a user into opening the file, causing the victim's NTLM credential hash to be sent to an attacker-controlled SMB/UNC endpoint; no authentication or elevated privileges are required on the target, but user interaction is mandatory. The independent assessment scores this as network-vector credential disclosure (AV:N/AC:L/PR:N/UI:R/C:H/I:N/A:N), and no public exploit has been identified at time of analysis; real-world impact is greatest where outbound SMB/port 445 is permitted, and egress filtering substantially reduces risk.
Opening a specially crafted PDF in Foxit PDF Reader or Foxit PDF Editor can trigger an arithmetic underflow while the application parses an image soft-mask, leading to a heap-based out-of-bounds read that discloses limited memory contents and terminates the application in a crash. The attack is file-based and requires the victim to open the malicious document (AV:L, UI:R); no authentication is needed (PR:N), but there is no network-remote or automatic trigger, and the impact is capped at a crash plus limited information disclosure rather than code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, and this is assessed as a genuine but low-priority issue for most environments.
Heap-based out-of-bounds read in Foxit PDF Reader and Foxit PDF Editor is triggered when a crafted PDF contains image objects whose compression metadata is inconsistent with the actual image data, causing an undersized buffer and a crash during rendering. The flaw has a CVSS 3.1 base score of 6.1 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, meaning an unauthenticated local attacker must deliver a malicious PDF and convince a user to open it; the realistic outcome is application crash with possible minor memory disclosure, not remote code execution. No public exploit identified at time of analysis, and no active exploitation is reported in the provided data.
Heap-based out-of-bounds read in Foxit PDF Reader and Foxit PDF Editor is triggered when a user opens a crafted PDF containing a malformed image mask whose metadata is inconsistent with its actual pixel and alpha data, causing incorrect alpha-channel processing during rendering and resulting in an application crash with a limited read of adjacent heap memory. The issue is local and requires user interaction - the victim must open the file - with no authentication required (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, score 6.1), and the impact ceiling is denial of service plus minor information exposure rather than code execution. No public exploit code or active exploitation has been identified at time of analysis, and the CVE is not listed in CISA KEV; CPE data marks both Foxit PDF Editor and Foxit PDF Reader as affected across all versions.
Heap-based out-of-bounds read in Foxit PDF Editor and Foxit PDF Reader can crash the application and may disclose limited heap memory contents when a user opens a crafted PDF containing embedded JavaScript that triggers an integer underflow during a wide-string deletion operation. Exploitation is local and requires user interaction: the victim must open the malicious PDF and JavaScript execution must be enabled, and the CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) indicates no privileges are required but no remote network path. No public exploit identified at time of analysis; confidentiality impact is low and availability impact is high, making this a modest-severity issue that primarily causes denial of service.
An out-of-bounds heap read in BusyBox's dpkg applet (read_package_field()) allows a local attacker who supplies a malformed .deb package to crash the dpkg process and potentially expose a small amount of heap memory, since the assessed vector rates availability impact as High and confidentiality impact as Low (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, 6.1 Medium). Exploitation is constrained: it requires a BusyBox build with the dpkg applet compiled in (a non-default option in many minimal configurations, though it is present in the Red Hat Hardened Images builds tracked under the associated CPE) and requires the victim or an automated pipeline to actively invoke BusyBox dpkg against the crafted package. No public exploit identified at time of analysis, and no EPSS data was provided for this CVE; Red Hat is tracking the defect for Red Hat Hardened Images.
Authenticated tenants can bypass operator-configured per-user and per-vhost connection limits in RabbitMQ by connecting to the stream protocol listener on port 5552 instead of the AMQP listener on port 5672, allowing resource-exhaustion conditions that the operator believed were prevented. The flaw affects RabbitMQ Server releases prior to 4.2.7 and 4.3.1 when the rabbitmq_stream plugin is enabled, and the code path was fixed in those two maintenance releases. Exploitation requires valid stream-protocol credentials and an environment where per-user or per-vhost connection caps are actually relied upon as a tenant-isolation control; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Denial of service in RabbitMQ (all server releases prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6 and 4.3.0) allows an authenticated user holding the management tag to burn broker CPU through the supported use_regex=true option on management list endpoints. The caller-supplied ?name= pattern is passed to Erlang/OTP's re:run without a match_limit and executed once per resource in the result set, so on a broker with roughly 5000 queues a single request can consume 12 or more minutes of scheduler time, and parallel requests can saturate the schedulers and degrade availability for all clients. There is no confidentiality or integrity impact, no public exploit code identified at time of analysis, and the risk is bounded by the management-tag requirement, no user interaction being needed but a resource-rich deployment being necessary for the effect to be felt.
An authenticated denial-of-service condition in RabbitMQ Server allows a stream-protocol user with read access to any stream to crash the broker node by exhausting the Erlang atom table. The flaw affects RabbitMQ Server releases prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, but only when the rabbitmq_stream plugin is enabled - deployments without that plugin are not exposed. Exploitation requires valid stream credentials (CVSS 4.0 vector shows PR:L, and the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and the repeated submission of many frames carrying distinct chunk_selector values, which is why the severity is scored as a moderate-priority availability issue rather than a critical remote-code flaw. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Atom-table exhaustion in RabbitMQ's x-jms-topic exchange lets an authenticated low-privilege AMQP user crash an entire broker node in fewer than 100 binding declarations, turning a vhost-confined account into a cross-tenant denial of service. The flaw is reachable only when the bundled rabbitmq_jms_topic_exchange plugin is enabled - standard in any JMS deployment - and the attacker holds read permission on an x-jms-topic exchange plus write permission on a queue, or configure rights to declare both; it also requires a raw AMQP client, because the broker does not enforce the client-side selector compilation that the Java JMS client performs. Fixed in RabbitMQ 3.13.15, 4.0.20, 4.1.11, 4.2.6 and 4.3.0; no public exploit identified at time of analysis and no CISA KEV listing, though the attack needs no user interaction and is network-reachable, with an assessed CVSS 3.1 score of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Memory exhaustion in the RabbitMQ consistent-hash exchange plugin lets an authenticated user with ordinary binding permissions drive broker-wide memory allocation from a single binding. Prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6 and 4.3.0, validate_binding/2 accepts an unbounded integer weight N from the binding routing key and expands it with lists:seq/2; a weight of 100000000 allocates roughly 800 MB on every node, and because the resulting list is written into the exchange's Khepri record it is replicated cluster-wide and reloaded on restart, so a restart does not clear the condition. Exploitation requires the rabbitmq_consistent_hash_exchange plugin to be enabled (it is not enabled by default) plus a low-privilege account holding write on a consistent-hash exchange and read on a queue; no public exploit identified at time of analysis.
kube-controller-manager through v1.34.11, v1.35.8, v1.36.4, and v1.37.0 allows an authenticated principal with namespace-scoped write permissions on both StatefulSet and ControllerRevision objects to cause a pod to be created in a different namespace, because the StatefulSet controller restores more than just the spec field from ControllerRevisions in a confused-deputy flaw. The attacker controls the created pod's metadata and namespace selection, but the pod is immediately removed by the garbage collector unless the attacker also supplies a valid StatefulSet OwnerReference using the UID of an existing StatefulSet in the victim namespace, which is the limiting condition that drives the high attack complexity. Rated Medium (5.9) as CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N; the provided data shows no public exploit identified at time of analysis and no confirmed active exploitation, and vendor patches are available in v1.34.12, v1.35.9, v1.36.5, and v1.37.1.
Unbounded CPU consumption in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to monopolize the pooler's single process by returning an arbitrarily large SCRAM key-derivation iteration count during PgBouncer's own outbound authentication, denying service to every database and client it pools. The prerequisite is a hostile or compromised backend combined with SCRAM-based backend authentication (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H? - assessed as A:H, C:N/I:N, 5.9), so an ordinary external client cannot trigger it, and the derivation cannot be interrupted in frontend builds such as PgBouncer. No public exploit code has been identified and there is no confirmed active exploitation; remediation is to upgrade past 1.25.2 per the vendor changelog.
Reflected cross-site scripting in the Microweber administration panel lets an attacker inject JavaScript through the 'group' parameter of the /admin/settings endpoint, which executes in the browser of an administrator who opens a crafted URL. Exploitation is constrained: the attacker must first trick a logged-in administrator (PR:H) into clicking a malicious link (UI:A), and there is no impact on the server itself - any damage is confined to the victim's browser session, where session hijacking or unauthorized actions in the admin context become possible. An independent assessment rates this as a moderate, low-priority issue, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Memory exhaustion in RabbitMQ Server (versions prior to 4.1.11, 4.2.6, and 4.3.0) lets a caller holding the management tag crash or severely degrade a broker by submitting a stream partition request whose count is unbounded - validate_partitions only enforces a lower bound of 1, so a value such as lists:seq(0, 500000000) drives roughly 8GB of allocation. Exploitation requires three conditions to hold simultaneously: the rabbitmq_stream_management plugin must be enabled (it is off by default), the caller must carry the management tag, and the caller must have access to the target vhost; with those met, impact is availability-only (CVSS 5.9, PR:H, no confidentiality or integrity effect) and can cross tenant boundaries on a shared broker. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, keeping this a genuine but bounded availability risk rather than an emergency.
Tauri applications that use the tauri-plugin-updater crate with auto-update enabled can be forced to downgrade to an older, authentically signed release, because the update manifest is fetched over TLS but is never itself signed or authenticated. An attacker who can serve a crafted manifest response - through a man-in-the-middle position on the update channel or by controlling/compromising the update server or CDN - can pair an inflated version field with the URL and minisign signature of an older release, and the plugin's only anti-rollback check compares that unsigned version field against the currently installed version. The assessment scores this as an integrity flaw (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) that is genuinely exploitable but conditional on defeating or terminating TLS or already owning the update endpoint, and it is limited to downgrading to releases that carry a valid developer signature - it does not permit signing arbitrary code. No public exploit was identified at time of analysis and the flaw is not known to be actively exploited (no CISA KEV listing); a vendor patch (updater 2.12.0) is available but the hardening option it introduces defaults to off.
RabbitMQ's Shovel plugin leaks broker credentials on deployments that configure AMQP 1.0 shovels with the username and password embedded directly in the connection URI: in versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 the plugin persists the raw URI instead of sanitizing it the way the AMQP 0-9-1 shovel does via amqp_uri:remove_credentials. Any authenticated user holding the 'monitoring' management tag can read those plaintext credentials from GET /api/shovels or rabbitmqctl shovel_status, and can then reuse them against the remote AMQP 1.0 endpoint. There is no public exploit code identified at time of analysis and no confirmed active exploitation (no CISA KEV listing); the exposure is a passive, read-only credential disclosure whose practical severity is narrowed by the non-default URI-embedded-credential configuration and the monitoring-tag requirement. This is a genuine but modest-priority information-disclosure issue rather than a high-urgency flaw.
Subpath symlink resolution in the Kubernetes kubelet on Windows nodes fails to reject symbolic-link targets that resolve to a UNC network path, so a pod whose volumeMounts subPath is crafted as such a symlink causes the kubelet to transparently authenticate to an attacker-controlled SMB share using NTLM (CVE-2026-76654, rated Medium, CVSS 5.8). Affected deployments are Windows worker nodes running kubelet <= v1.34.11, <= v1.35.8, <= v1.36.4, or v1.37.0; Linux nodes are not affected. An authenticated attacker with sufficient cluster access to schedule a pod and seed the symlink can capture the NetNTLMv2 hash of the kubelet service account and either crack it offline or relay it to impersonate the node if that node is domain-joined; exploitation requires an attacker-operated SMB endpoint and, for the highest-impact relay outcome, a domain-joined node, and there is no public exploit identified at time of analysis.
RabbitMQ brokers running the Shovel plugin can write decrypted shovel URIs - including credentials embedded directly in the URI (amqp://user:password@host/) - into the broker log file when DEBUG-level logging is enabled and a shovel configured with src-delete-after=N (autodelete) completes and is torn down. The exposure is confined to log files: anyone who already holds read access to the broker log or a downstream log aggregation pipeline can recover working AMQP credentials, which they can then use to authenticate to the message broker. Exploitation is not remote or unauthenticated (the vendor-adjacent assessment rates it CVSS:3.1 AV:L/AC:L/PR:H/UI:N with high confidentiality impact only), and it requires a chain of non-default conditions: the Shovel plugin enabled, credentials embedded in shovel URIs, DEBUG logging explicitly turned on, and an autodelete shovel. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); no EPSS score was supplied with the source data.
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets a remote attacker supply crafted input in the difficulty_id argument of /reviewer_0/admins/assessments/databank/btn_functions.php?action=update and have it executed as part of the backend SQL query, exposing or altering assessment and reviewer data. The disclosure is rated 5.5 (CVSS 4.0) with only low-level confidentiality, integrity and availability impact, and publicly available exploit code exists via the linked GitHub issue; there is no CISA KEV entry confirming active exploitation. Authentication requirements are not confirmed from available data: the CNA vector records PR:N (unauthenticated) while our independent assessment scores PR:L (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) because the vulnerable endpoint sits under an /admins/ administrative path, which strongly suggests a valid session is normally needed, and this discrepancy is the main factor governing real-world exploitability.
Unauthenticated remote retrieval of the Mifi_config.bin configuration backup from an LB-Link BL-CPE600EU running firmware 5.8.13 exposes stored device settings and credentials to anyone who can reach the device's management interface, an information-disclosure weakness (CWE-200) rooted in the Configuration Backup Handler's lack of access control. Exploitation requires only network reachability to the affected endpoint - no credentials, user interaction, or non-default configuration - but the real-world exposure window is narrow because NAT-bound units and devices with WAN-side management disabled cannot be reached from the internet, leaving LAN-adjacent or deliberately internet-exposed CPE units as the practical targets. Publicly available exploit code exists for this CVE, and the vendor was contacted but never responded, so no vendor-released patch has been identified at time of analysis; our independent assessment classifies this as a genuine but low-to-moderate priority issue rather than an urgent one.
Heap-based out-of-bounds write in Foxit PDF Editor/Reader allows attackers to corrupt memory when a victim opens a PDF containing a crafted WebP image, potentially leading to code execution or a crash. The flaw stems from improper handling of bitmap stride and target buffer formats (CWE-787) and requires user interaction to open the malicious file (CVSS 7.8, AV:L/PR:N/UI:R). No public exploit code or active exploitation has been identified at time of analysis.
Opening a maliciously crafted PDF in Foxit PDF Reader or Foxit PDF Editor can crash the application through a use-after-free of an internal page object, because JavaScript that triggers reentrant page-event processing during annotation enumeration can free the page while a reference to it is still held. The vendor-approved CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is local, requires no authentication, and mandates user interaction - the victim must open the file - while our independent assessment scores the demonstrated impact as availability-only (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), i.e. a denial-of-service/crash rather than demonstrated code execution. Exposure depends on PDF JavaScript being enabled in the reader, a common default but a configurable setting; no public exploit code has been identified and the issue has not been added to CISA KEV, so this is not confirmed active exploitation.
Google Chrome desktop builds are the subject of a stable-channel security release documented in Google's Chrome Releases advisory, referenced under CVE-2026-95363, which was reported by the Ubuntu vendor channel. The record is effectively a data void: no description, CVSS score or vector, CWE, or CPE data were supplied, so raw severity cannot be computed and the affected feature, attack vector, and whether user interaction is required remain unconfirmed. There is no public exploit identified at time of analysis and no CISA KEV listing, while a vendor patch is available per the vendor-reported patch data; treat this as an undetermined-severity item until the advisory and NVD record are populated, and apply the Chrome stable-channel update as the primary action.
Ubuntu Linux is the only identified touchpoint for CVE-2026-95290, which was reported through the vendor's own security channel but arrives with an empty description, no CVSS score or vector, no CWE mapping, and no listed affected versions. Because neither the affected package nor the exploitation prerequisites can be derived from the available data, the actual impact - whether local privilege escalation, denial of service, or remote code execution - remains undetermined, and no public exploit identified at time of analysis. Defenders should treat this as an intelligence gap rather than evidence of low severity, and pull the authoritative record from the Ubuntu Security tracker before making any exposure or patching decision.
Missing ownership verification in the Directorist WordPress plugin before 8.9.5 allows any authenticated user with subscriber-level access to read and modify other users' saved favorites by calling a plugin REST route with a victim's user identifier. Exploitation requires only a valid low-privileged account on an affected site and needs no interaction from the victim, but is limited to favorites data (CVSS 5.4, low confidentiality and integrity impact, no availability impact); there is no public exploit identified at time of analysis and real-world risk is assessed as moderate-low.
Open redirect in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated remote attacker craft a request with a manipulated Host header so that authenticated operators who follow an attacker-supplied link are bounced to an attacker-controlled site for credential phishing. The weakness resides in the PMP HostHeaderFilter (HostHeaderFilter.java:151) and is rated CVSS 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), meaning there is no direct code execution, data modification, or service disruption and success depends entirely on social-engineering the operator into clicking the redirect. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Improper authorization in GitLab CE/EE (all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1) lets an authenticated user who holds an MCP-scoped token perform actions outside that token's intended scope, resulting in low confidentiality and low integrity impact with no availability effect (CVSS 5.4). The flaw is only reachable by a remote attacker who already possesses a valid MCP-scoped token (PR:L per the assessed vector), and GitLab states the over-scoping occurs only 'under certain conditions,' implying a specific MCP request path or feature usage rather than arbitrary API calls. This is a moderate-severity, real-but-not-urgent issue: no public exploit code was identified at time of analysis, no CISA KEV entry exists, and deployments that do not use MCP token integrations are unlikely to be exposed.
Dell Secure Connect Gateway (SCG) Policy Manager versions earlier than 5.34.00.16 render their web interface without anti-framing protections, allowing a remote attacker to embed the authenticated UI inside an attacker-controlled page and overlay decoy content to trick an operator into unintended clicks, yielding session theft and elevation of privileges. Dell rates the issue CVSS 5.4 (AV:N/AC:L/PR:L/UI:N, C:L/I:L/A:N), while the assessed vector raises the user-interaction requirement to UI:R because clickjacking-style UI redressing practically depends on the victim clicking the framed content while holding a valid, low-privileged session. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; the vendor has released a fixed build, 5.34.00.16, so this is a moderate-severity, low-real-priority issue.
Missing authorization in the Fluent Support WordPress plugin 2.3.2 and earlier lets an authenticated Subscriber-level user perform helpdesk actions beyond their role, resulting in partial unauthorized read and modification of support data. The assessed CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, so exploitation requires a valid low-privilege WordPress account, such as one obtained through open self-registration or already present on the site, and no user interaction. No public exploit identified at time of analysis, and the independent assessment rates this as a low-to-moderate, non-priority issue with no availability impact.
An open redirect (CWE-601) in Abis Technology Ltd. Co.'s AVESİS platform allows remote attackers with no credentials to craft a link whose redirect parameter points to an arbitrary attacker-controlled site, so a victim who is lured into clicking it lands on malicious content while the navigation appears to originate from the trusted AVESİS instance. The defect affects builds from 202608201331 up to, but not including, 202608240351. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the mandatory victim interaction (UI:R) makes it an effective phishing-enablement primitive rather than a path to direct data or system compromise; the vendor-assigned CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), which matches the independent assessment.
Exploitation and impact for CVE-2026-95294 cannot be established from the available intelligence: the description is empty, no CVSS score or vector was assigned, no CWE mapping was provided, and no EPSS or KEV signal accompanies the record. The single traceable data point is the reporter field, which designates Ubuntu as the reporting vendor, meaning the affected component is most likely an Ubuntu-maintained package with a corresponding Ubuntu Security Notice (USN) that has not yet been surfaced in this dataset. No public exploit code has been identified at time of analysis and there is no confirmation of active exploitation (no CISA KEV entry), so any characterization of severity - remote versus local, authenticated versus unauthenticated, code execution versus denial of service - would be speculation until the USN and NVD entry are reviewed.
Unspecified security defects in the Google Chrome desktop browser (stable channel) are addressed by the September 2026 stable-channel update, which is the only substantive technical anchor available for CVE-2026-95364. Affected parties are organizations and users running pre-update Chrome desktop stable builds, including Ubuntu-packaged deployments given that the issue was reported by vendor:ubuntu; the vulnerability class, attack vector, and authentication requirements cannot be confirmed because no description, CVSS vector, or CWE was supplied. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status; EPSS and NVD data are unavailable, so severity cannot be independently graded.
Risk cannot be meaningfully assessed from the provided data for CVE-2026-95279, which arrives with no description, no CVSS vector, no CWE, and no affected-product detail. The only signal is that the record was reported by the Ubuntu security team, implying an affected open-source package distributed with Ubuntu (and likely Debian-derived distributions), but the specific component, attack vector, and impact remain unconfirmed. There is no confirmed actively exploited (CISA KEV) status, no publicly available exploit code, and no EPSS score in the available input, so triage depends on retrieving the underlying Ubuntu Security Notice or NVD entry before any technical conclusion can be drawn.
An unidentified security weakness affects software distributed as part of Ubuntu Linux, based on a report filed by the vendor (Canonical/Ubuntu). Because the description, CVSS metrics, CWE, and CPE data are all absent, the specific impact, attack vector, and authentication requirements cannot be determined; exploitation prerequisites are unknown, and no public exploit code has been identified at time of analysis. Risk cannot be meaningfully assessed from the provided data, and the affected package, feature, or deployment mode must be confirmed through the forthcoming Ubuntu Security Notice or NVD entry before any exposure judgment is made.
Google Chrome's desktop stable channel is affected by an unspecified security defect that Google resolved in its September 2026 stable-channel release; no CVSS score, vector, CWE, EPSS probability, or technical description is available in the provided intelligence. Because the flaw is undocumented, the attack vector, required privileges, and user-interaction prerequisites cannot be confirmed from this data, though the affected product implies a browser-processing context in which a user would have to handle attacker-controlled content. A vendor-released patch is available and no public exploit code has been identified at time of analysis, so residual risk is effectively confined to unpatched installations.