Unauthenticated remote attackers can reach internal Apache Doris Frontend (FE) metadata service endpoints in affected 2.0.x through 4.1.x releases and read sensitive cluster information, because those endpoints authenticate callers using client-supplied node information rather than verifying the requesting party (CWE-287, header trust). Exploitation is gated by deployment: it only succeeds 'under certain network configurations' where the FE meta interfaces are reachable by the attacker, so clusters with the FE meta service kept off attacker-reachable networks are not exposed. The vulnerability is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with confidentiality-only impact - no integrity or availability effect - and no public exploit has been identified at time of analysis; there is no CISA KEV listing. Vendor-released patches exist in Apache Doris 4.0.8 and 4.1.4.
Deeply nested JSON arrays and objects drive JVM heap exhaustion in Typelevel Jawn versions before 1.7.0, where the thrown java.lang.OutOfMemoryError is a fatal Scala/JVM error that neither scala.util.Try nor cats.effect.IO routinely intercepts, turning untrusted JSON into a denial-of-service condition. The assessed impact is availability-only (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so remote unauthenticated attackers need only reach an endpoint that feeds attacker-controlled input into a pre-1.7.0 Jawn parse call, directly or transitively through circe; services that only parse trusted or internal JSON are not exposed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but this is a genuine, middle-tier priority for any internet-facing JSON API on an affected version; fixed in 1.7.0, which introduces a configurable depth cap.
Ubuntu package maintainers have published a security update tracked as CVE-2026-96280, reported through the vendor:ubuntu intelligence feed. The advisory is described only by the placeholder text 'security update', and the input provides no CVSS score or vector, no CWE classification, no CPE identifiers, no affected version ranges, and no reference URLs, so the specific package, component, and deployment mode in scope cannot be identified. Whether the issue is remotely or locally triggerable, what privilege level an attacker requires, and what the resulting impact would be are all undetermined; no public exploit code has been identified and there is no CISA KEV designation or EPSS score to indicate active exploitation, therefore risk cannot be meaningfully assessed from the provided data and should be treated as unquantified pending NVD or Ubuntu Security Notice enrichment.
Denial of service in the Jawn JSON parser for Scala (all artifacts prior to 1.7.0) lets a remote, unauthenticated attacker exhaust CPU by feeding JSON through the streaming AsyncParser in many tiny chunks, forcing repeated rescans of a single incomplete token. Exploitation is bounded by two preconditions: the target must parse attacker-influenced input incrementally via AsyncParser rather than parsing a fully buffered document, and the attacker must be able to influence chunk boundaries so that one token is split across many small reads - hence the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, an availability-only (HIGH) impact with no confidentiality or integrity effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fixed the issue in version 1.7.0.
Denial of service in FasterXML jackson-core 2.8.0 and later: an unauthenticated remote attacker who can supply a malformed JSON token to a parser created via JsonFactory.createParser(DataInput) causes UTF8DataInputJsonParser._reportInvalidToken() to accumulate the entire offending token into an exception message without ever applying ErrorReportConfiguration.getMaxErrorTokenLength(). The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token (versus 367 characters for identical input on the InputStream path), and because the StringBuilder also incurs byte-to-char expansion and internal array doubling, scaling the payload can exhaust heap and trigger a JVM-wide OutOfMemoryError. Only the DataInput parser path is reachable, impact is availability-only, and no public exploit identified at time of analysis; the 7.5 base score captures the theoretical worst case rather than the narrow real-world reachability.
Unauthenticated time-based blind SQL injection in the WordPress plugin 'Rename wp-login.php to anything you want' (all versions up to and including 2.0.1) allows remote attackers to inject arbitrary SQL through the 'log' username parameter processed by the plugin's wp_login_failed handler, enabling extraction of sensitive data from the underlying WordPress database. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and requires no authentication, user interaction, or non-default configuration - only that the vulnerable plugin is installed and active. Impact is confined to database reads with no write or availability effect, and exploitation is time-based blind, meaning extraction is timing-dependent and slower than direct-return injection; no public exploit code was identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
OpenC3 COSMOS versions 5.0.6 through 7.2.x contain a stored cross-site scripting flaw in the shared-screen BUTTON widget, allowing an authenticated actor with the system_set permission to persist a malicious action through POST /openc3-api/screen that is later evaluated in a different operator's browser when they open the shared screen and click the button. Successful execution runs attacker-controlled script in the COSMOS origin, reads localStorage.openc3Token, and steals the victim operator's bearer token, enabling account takeover and any action the victim could perform. The assessed vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, 7.6 High) reflects that a privileged authoring account plus a second operator's click are both required, and no public exploit code or confirmed active exploitation has been identified at time of analysis. The default permissive content security policy (which allowed inline script) made execution easier, but the root cause is the unsanitized button action; the issue is fixed in version 7.3.0.
Authenticated SQL injection in the WordPress plugin Ultimeter (versions through 3.0.8) lets a high-privileged account - Editor or Administrator level - inject arbitrary SQL through the plugin's editor functionality, exposing data held in the site's WordPress database. The flaw is scored CVSS 3.1 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), where the changed scope and high confidentiality impact reflect that the database is a security authority separate from the vulnerable plugin. No public exploit identified at time of analysis; because the vector requires PR:H, realistic risk is confined to malicious insiders or attackers who have already taken over a privileged WordPress account on a site running the affected plugin version.
SQL injection in the Easy Digital Downloads WordPress plugin through version 3.7.0 lets an authenticated account with the Shop Manager role or higher inject arbitrary SQL into an admin-side database query reachable over the network, exposing sensitive stored data such as customer records, order and payment metadata, and user password hashes, while requiring no victim interaction. The real-world barrier is the credential requirement noted in the assessed vector (PR:H), so this is chiefly a compromised- or over-privileged-account and insider risk rather than an anonymous mass-exploitation path; confidentiality impact is high, integrity impact is none, and availability impact is low. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was included in the source reporting, so exploitation signal remains limited to the advisory disclosure by Patchstack.
SQL injection in the WordPress plugin Email Log (versions ≤2.63) lets an authenticated site Administrator execute crafted SQL against the underlying database through an admin-side parameter that is concatenated into a query without sanitization. Successful abuse is primarily a confidentiality problem - exfiltration of subscriber addresses, message contents and other stored WordPress data (C:H) - with some availability risk (A:L) and no demonstrated integrity impact; the independent assessment retains scope unchanged (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L) rather than the scope-changed 7.6 originally reported, and rates it a genuine but low-urgency issue because exploitation presupposes Administrator credentials. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV entry; no EPSS data supplied by the sources reviewed), so the practical threat is a malicious or compromised admin account rather than mass remote exploitation.
Broken scope enforcement in ZohoCorp ManageEngine Applications Manager (versions 182200 and below) lets an authenticated, low-privileged user trigger administrator-configured MBean actions against monitors that lie outside that user's assigned scope, resulting in high integrity impact with limited confidentiality and availability effects (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, 7.6 HIGH). Exploitation requires a valid low-privileged Applications Manager account and the prior existence of administrator-configured MBean actions on the target instance; no user interaction is needed, and authentication requirements are confirmed as authenticated (PR:L) by the published vector. No public exploit code was identified and the flaw is not listed in CISA KEV, so there is no public exploit identified at time of analysis; the absence of a public exploit and the PR:L prerequisite are the main factors limiting immediate mass exploitation.
Server-side template injection in the Configlet processing feature of ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager (versions 12.8.667 and below) allows a low-privileged authenticated user to inject template expressions that the server evaluates, leading to remote code execution in the application's process context. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; the source data lists 7.6) confirms network reachability, low privileges, and no victim interaction, but valid application credentials plus access to the Configlet/template capability are prerequisites, so real-world exposure is reduced where the console is network-restricted or where accounts lack configuration-template rights. No public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; this is a genuine mid-to-upper priority issue but not an emergency.
Denial of service in FasterXML jackson-databind allows unauthenticated remote attackers to exhaust CPU resources by submitting crafted JSON that triggers quadratic complexity in forward-reference resolution for @JsonIdentityInfo object IDs. The attack requires the application to deserialize attacker-influenced JSON into a collection or map configured with @JsonIdentityInfo; a shallow document with N forward references defined in reverse order causes O(N^2) identity comparisons during deserialization. This is a conditional availability risk-only applications using identity-enabled deserialization on untrusted input are exposed-and no public exploit code has been identified at time of analysis, though a vendor patch is available.
Memory exhaustion in FasterXML jackson-databind allows unauthenticated remote attackers to grow an internal deserializer cache without bound by submitting JSON payloads that carry ever-changing, unrecognized polymorphic type IDs. TypeDeserializerBase caches each fallback resolution keyed by the raw attacker-supplied ID string, the map has no configurable size limit, and it lives for the lifetime of the long-lived ObjectMapper, so distinct unknown IDs translate directly into permanently retained heap - the reporter measured 10,000 retained entries from 10,000 distinct unknown IDs versus a single entry for 10,000 repetitions of one unknown ID. Exploitation requires a non-default configuration (name-based polymorphism via @JsonTypeInfo(use = Id.NAME) with a defaultImpl/fallback deserializer, an endpoint that accepts attacker-influenced type IDs, and a shared application-scoped mapper), so the affected population is substantially narrower than the 7.5 base score suggests; no public exploit has been identified at time of analysis and a vendor patch is available.
A crafted oversized input to the PgBouncer connection pooler (versions through 1.25.2) triggers an integer overflow in packet buffer growth logic, leaving the growth loop unable to terminate and pinning a CPU core permanently because all clients are served from a single process. Per the assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) this is reachable by an unauthenticated remote attacker with only network access to the pooler's listening port, and both unauthenticated and authenticated code paths can reach the flawed computation; there is no confidentiality or integrity impact, but the pooler stalls every pooled connection until the process is killed. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied; the practical risk is therefore availability-only and depends on whether the PgBouncer port is exposed to untrusted networks rather than firewalled to trusted application hosts.
Denial of service via JVM crash affects Apache Tomcat Native versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8, where a buffer over-read (CWE-126) during the TLS handshake lets a malicious client terminate the server process, rated CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The flaw is reachable remotely and unauthenticated with no user interaction, but only where the APR/OpenSSL-based native TLS connector is actually deployed and handling TLS connections; Tomcat instances using the pure-Java JSSE/NIO connector are not affected. Impact is confined to availability - no confidentiality or integrity loss, no data exposure and no code execution - and no public exploit was identified at time of analysis, with no CISA KEV entry.
Unauthenticated remote attackers can crash PgBouncer through 1.25.2 by sending a malformed SCRAM client-final-message that triggers a NULL pointer dereference. The crash occurs before credential verification and terminates all pooled connections because PgBouncer uses a single process. No public exploit identified at time of analysis; exploitation requires PgBouncer configured with SCRAM authentication (auth_type=scram-sha-256) and network access to the listener port.
Denial of service in JLine's built-in less viewer affects all 3.x releases from 3.0.0 before 3.30.15 and 4.x releases before 4.3.1: a user-supplied search or display-filter pattern containing nested quantifiers is handed straight to Java's backtracking regex engine and applied repeatedly across file content, so a pattern run against non-matching lines can consume excessive CPU and block the session thread indefinitely. The practical risk profile is multi-user Telnet or SSH deployments that embed the less viewer, where repeated sessions can exhaust a bounded worker pool and deny service to other users; the independent assessment scores this as availability-only (CVSS 3.1 A:H, no confidentiality or integrity impact) and notes that an interactive session foothold and viewable file content are prerequisites, which the published vector's PR:N rating does not reflect. No public exploit code and no confirmed active exploitation were identified at time of analysis, so exploitation is opportunistic rather than observed. The fix is the SafeRegex wrapper plus regex timeouts shipped in 3.30.15 and 4.3.1.
Unauthenticated path traversal in the OpenShift console's /locales/resource.json endpoint allows remote attackers to read arbitrary *.json files from the console pod filesystem by manipulating the lng and ns query parameters, exposing plugin manifests and configuration files, and potentially enabling traversal against registered dynamic-plugin backends. The flaw is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) and affects Red Hat OpenShift Container Platform 4; no public exploit code has been identified at time of analysis and there is no CISA KEV telemetry, but per the independent assessment this remains a credible remote-attack priority because the endpoint is reachable without credentials and yields high-confidentiality reads. Impact is limited to information disclosure - integrity and availability are not affected per the assessed vector.
Information exposure in Dell Secure Connect Gateway (SCG) Policy Manager affects all deployments running versions prior to 5.34.00.16, where sensitive data is embedded directly in shipped source or client-delivered code (CWE-540) and can be recovered and read by a remote party that obtains those artifacts. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5 HIGH, describing a network-reachable, low-complexity, unauthenticated confidentiality-only flaw with no integrity or availability impact (PR:N in the vector confirms no authentication is required). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so risk is driven by the value of whatever secrets are baked into the code and by the product's niche enterprise/appliance footprint rather than by observed attack activity.
Imprivata Enterprise Access Management at version 26.2.6 and earlier ships with no capability to rotate the RSA key pair it uses when generating X.509 certificates, so the same static private key can remain in service indefinitely. An attacker cannot exploit this over the network to steal data on its own; the exposure only materializes if that long-lived key is separately obtained through theft, insider access, or eventual cryptanalysis, after which past and future certificate-based trust relationships could be undermined. There is no public exploit identified at time of analysis and no evidence of active exploitation, and EPSS rates the issue at roughly 0.07 percent (0th percentile), consistent with this being a cryptographic lifecycle and hygiene deficiency rather than a directly exploitable remote flaw.
Unauthenticated remote attackers can read protected data from WordPress sites running the Tangible Loops & Logic plugin at version 4.2.4 or earlier, because the plugin fails to enforce proper authorization on a reachable feature (CWE-862 broken access control). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 HIGH) confirms the flaw is network-reachable with no authentication, no privileges, and no user interaction, and the impact is limited to confidentiality - no modification or availability effect is possible. Exploitation requires only that the plugin be installed and active; there is no public exploit identified at time of analysis, and exposure is bounded because the plugin is a niche, developer-oriented templating tool rather than a widely deployed one.
Unauthenticated broken access control in the Online Booking & Scheduling Calendar for WordPress by vcita plugin (slug meeting-scheduler-by-vcita) through version 4.6.0 lets remote attackers reach protected plugin functionality without logging in and use it to modify data or settings, with the assessed vector (AV:N/AC:L/PR:N/UI:N) showing no privileges or user interaction required. Impact is limited to integrity (C:N/I:H/A:N) - booking, scheduler, or configuration data can be altered, while confidentiality and availability are not reported as affected. No CISA KEV entry is present and no public exploit identified at time of analysis; the advisory does not disclose the specific endpoint or action, which currently raises the effort of exploitation even though the vulnerability is remotely reachable.
Pre-authentication heap memory corruption in BusyBox's built-in TLS implementation can be triggered by a remote, unauthenticated attacker who sends a single crafted ClientKeyExchange handshake message to a BusyBox process acting as a TLS server, corrupting the heap and crashing the process (CVSS 3.1 base 7.5, availability-only with no confidentiality or integrity impact rated). Exploitation requires a BusyBox binary compiled with TLS support and reachable in a server role, a deployment pattern that is the exception rather than the norm since BusyBox TLS is most often used outbound (for example by wget https), which sharply narrows the realistically exposed population. No public exploit code or confirmed active exploitation (CISA KEV) was identified in the available intelligence; the issue is tracked by Red Hat via its CVE page and Bugzilla, with no public exploit identified at time of analysis.
Unauthenticated path traversal in ManageEngine OpManager and ManageEngine Network Configuration Manager versions before 12.8.671 allows remote attackers to read arbitrary files from the appliance. Because the CVSS vector is PR:N/UI:N (7.5, AV:N/AC:L), no credentials or user interaction are required against a default-reachable deployment - an attacker with network access to the web console can directly request files outside the intended document root and expose configuration, credential, or key material. Impact is confidentiality-only (C:H with I:N/A:N), so the flaw does not permit modification of data or cause denial of service. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); the main limiting factor is exposure, since these are typically internal management consoles rather than internet-facing services.
Denial of service in Apache Tomcat's asynchronous WebSocket write path allows remote, unauthenticated attackers to exhaust server resources by triggering lost write timeouts, so non-blocking WebSocket sends are never released after their effective lifetime. All maintained branches are affected - 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121, plus the end-of-life 8.5.0-8.5.100 and 7.0.43-7.0.109 lines - although exposure is bounded to instances whose deployed applications actually perform asynchronous (non-blocking) WebSocket writes; servers with no WebSocket endpoints or only synchronous writes are not exposed. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only) and CISA's SSVC assessment records no observed exploitation, with no public exploit code identified at time of analysis; the primary risk is sustained resource pressure that degrades or halts the affected connector rather than data compromise.
Denial of service in Apache Tomcat allows an attacker to pin an AJP processing thread through a single AJP request, exhausting the connector's limited thread pool (CWE-770, allocation of resources without limits or throttling). The affected range is broad: 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, plus the end-of-life branches 8.5.0-8.5.100 and 7.0.0-7.0.109, which remain affected even though they are no longer supported. There is no public exploit identified at time of analysis, no KEV listing, and no EPSS score in the input; the independent assessment rates the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (availability-only impact), but exploitation requires the AJP connector to be enabled and network-reachable, which has not been the default configuration since Tomcat 9.0.31.
Uncontrolled resource consumption in Apache Tomcat's WebSocket close-message handling allows unauthenticated remote attackers to exhaust server resources and degrade availability on instances that expose WebSocket endpoints. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), the impact is limited to availability (Low) with no confidentiality or integrity effect, and no user interaction is required. Affected releases are 11.0.0-M5 through 11.0.25, 10.1.8 through 10.1.59, 9.0.74 through 9.0.121, plus the end-of-life 8.5.88 through 8.5.100 line; fixes are available in 11.0.26, 10.1.60, and 9.0.122. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, but the low attack complexity and unauthenticated network reachability make prompt patching advisable for any deployment using WebSockets.
Google Chrome stable builds earlier than 154.0.8037.57 contain a race condition (CWE-362) that a remote attacker can trigger by getting a victim to load attacker-controlled web content, yielding high confidentiality, integrity, and availability impact within the browser's renderer sandbox. No authentication or special browser configuration is required (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), though user interaction - visiting or rendering hostile content - is the primary exploitation prerequisite, and a separate sandbox escape would be needed to reach the host. Exploitation status: no public exploit identified at time of analysis, and there is no CISA KEV listing; the vendor has shipped a fixed release.
WatchGuard AuthPoint Gateway contains a missing authentication check in its LDAP Sync first-factor authentication that allows unauthenticated remote attackers to bypass single-factor password verification under non-default conditions. Exploitation requires the gateway to be configured with LDAP Sync as the first-factor method and involves some user interaction, but default deployments are unaffected; only the first factor is bypassed, so any additional MFA factors still apply and prevent full account compromise. No public exploit has been identified at time of analysis, and the vendor (WatchGuard PSIRT) rates this as CVSS 4.0 7.4 High with vector AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N.
Cross-site scripting in LimeSurvey's administrative survey-import workflow lets an attacker run arbitrary JavaScript in a logged-in administrator's session by getting that administrator to import a crafted .lss survey file, allowing theft of session context and modification of survey or administrative data. The issue is rated 7.4 (HIGH) under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N) - the attacker needs no LimeSurvey account (PR:N), but success depends entirely on a privileged admin actively importing the malicious file (UI:A), making this a social-engineering-gated attack rather than direct remote exploitation. There is no indication of CISA KEV listing and no public exploit code was identified at time of analysis; an upstream fix is available from the vendor.
Malformed 3G/UMTS RRC signalling messages delivered to the ASR Crane/Falcon cellular baseband trigger a NULL pointer dereference in the as_rrc module (file 3g.mod/lib/src/urrsir.c), crashing the modem and denying cellular service to the affected device. ASR's self-assigned CVSS 3.1 score is 7.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L), whereas independent assessment rates it AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - a radio-proximity availability attack against 3G-capable ASR modem platforms, with no demonstrated code execution or data compromise. Exploitation requires the victim handset to be camped on or processing signalling from a hostile 3G cell (rogue base station or air-interface man-in-the-middle), and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV and the sole reference is the vendor PSIRT advisory.
Address bar spoofing in Arc Browser lets remote, unauthenticated attackers paint a convincing fake address bar over the genuine browser chrome by embedding a <select> element on an attacker-controlled page that invokes the Fullscreen API; because Arc fails to display the expected fullscreen notification, the victim never gets the visual cue that would normally reveal the browser is in a special display state. Exploitation is gated on user interaction - the victim must open the malicious page and engage with the select element - and the outcome is deception/phishing rather than code execution or direct data access, which is why the authoritative assessment lowers the integrity impact to I:L instead of the I:H in the widely-cited 7.4 vector. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing authentication for a critical function in Dell Secure Connect Gateway (SCG) Policy Manager before version 5.34.00.16 allows remote attackers to reach functionality that should require a credential check, resulting in unauthorized access with high confidentiality and integrity impact. The assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (7.4) confirms no privileges and no user interaction are required, while the high attack-complexity rating indicates a non-trivial precondition must be satisfied rather than a guaranteed single-request compromise. Real-world risk is bounded by exposure: the Policy Manager interface must be network-reachable, and SCG is a specialized enterprise gateway typically deployed in restricted management networks; no public exploit was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
XML external entity (XXE) injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an unauthenticated attacker positioned on an adjacent network segment to submit crafted XML that the product's parser resolves against external entities, resulting in disclosure of server-side files or server-side request forgery against internal services. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) requires no credentials and no user interaction, but the adjacent-network attack vector and the confidentiality-only impact mean exploitation depends heavily on whether an XML-accepting endpoint is reachable from an untrusted same-segment network and on what sensitive files or internal services are reachable from the server context. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), and IBM has published a patch advisory; despite the High score this is a moderate-priority issue that should not be over-prioritized relative to internet-reachable, integrity- or availability-impacting flaws.
UI spoofing in Arc Search for Android before 1.12.10 lets an unauthenticated remote attacker use a crafted webpage that enters fullscreen while the app is backgrounded to suppress the return-from-background fullscreen notification and render fake browser UI, such as a spoofed address bar. The victim must visit the attacker-controlled page and be deceived by the spoofed origin, so exploitation requires user interaction and carries no confidentiality or availability impact, though integrity impact is high for phishing. No CISA KEV listing or public exploit code was identified at time of analysis; CVSS 3.1 base score is 7.4 (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).
Apache Tomcat Native 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15 can, under a narrow timing window, down-grade the client-certificate verification requirement for connections, weakening mutual-TLS authentication for deployments that enforce client-cert auth through the APR/OpenSSL-based connector. The flaw is a CWE-366 race condition within a thread (CVSS 3.1 base 7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), so an unauthenticated network attacker must win a non-deterministic race to succeed, making exploitation probabilistic rather than guaranteed. Only Tomcat instances that actually use Tomcat Native and are configured for client-certificate verification are exposed; no public exploit identified at time of analysis, and no CISA KEV confirmation of active exploitation. Vendor-released fixes are available in 2.0.16 and 1.3.9.
Local privilege escalation to root in Flatpak before 1.18.1 lets an unprivileged user holding an active local session abuse the revokefs writer used by flatpak-system-helper: by opening two concurrent revokefs sessions and planting a symlink from one session directory into the other, the attacker retains a file descriptor into a peer session and keeps modifying its files after the system helper has already validated and imported them. The practical payoff is tampering with ostree commit objects in the system repository after signature verification, which translates into root-controlled writes to attacker-chosen paths. Exploitation requires local access and winning a TOCTOU race against the dual-session setup (CVSS AV:L/AC:H/PR:N), and no public exploit code has been identified at time of analysis; the issue is not confirmed as actively exploited (not in CISA KEV).
Reflected cross-site scripting (XSS) in LimeSurvey Community Edition 7.0.14 allows an attacker to execute arbitrary JavaScript in an authenticated administrator's browser when the admin imports a crafted CSV file of survey participants. The payload is reflected on the import result page via unencoded invalid attribute field names or duplicate record fields (firstname, lastname, email), requiring the attacker to social-engineer an admin into importing the malicious file. No public exploit code has been identified at time of analysis, and this is not confirmed as actively exploited; the impact is bounded to code execution within the victim admin's browser context, potentially enabling session hijacking or actions on behalf of the admin.
Data exposure in ManageEngine Firewall Analyzer - and in the co-listed ManageEngine OpManager - version 12.8.709 and below allows an unauthenticated attacker positioned on the same network segment as the Firewall Analyzer syslog collector to read sensitive information, including data belonging to the monitored firewall and network devices, which is why the vendor score carries a scope change despite the confidentiality-only impact. No authentication or user interaction is required and complexity is low (CVSS 3.1 7.4, AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N); the adjacent-network requirement is the principal limiting factor, since the collector is not reachable directly from the internet unless its syslog service has been exposed beyond the local segment. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) in the supplied intelligence, which consists solely of a vendor advisory and CPE mappings, and no EPSS score was provided.
Stored cross-site scripting in the RabbitMQ management UI allows an attacker who can obtain a TLS client certificate signed by a CA the broker trusts to embed JavaScript in the certificate's Subject DN, which is rendered unescaped in the connection detail page and executes in an administrator's browser session when that connection is viewed. Success enables full administrative account takeover within the management UI - creating users, exporting definitions, and performing any action the viewing admin can perform. Exploitation is heavily gated: the TLS listener must be configured with ssl_options.verify = verify_peer (not the default), the certificate must be signed by a CA in the broker's trust store (self-signed certificates do not work), and an administrator must open the affected connection page; the management UI's CSP includes 'unsafe-inline', so inline script is not blocked. Patched versions are 3.13.15, 4.0.20, 4.1.11, and 4.2.6; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing authentication for a critical function in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote, unauthenticated attacker to read sensitive information and modify system configurations on an affected deployment. With CVSS 7.3 (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are required, so any network-reachable FTM instance with the vulnerable function exposed is at risk; exploitation is limited chiefly by FTM's narrow enterprise-payments install base and whether that endpoint is actually reachable. No public exploit code has been identified at time of analysis, and IBM has released a patch.
Unauthenticated insertion of malicious runbook content into the vector database backing IBM Financial Transaction Manager (FTM) for Red Hat OpenShift's AI agent allows retrieval-augmented generation (RAG) poisoning that can steer AI-driven MCP tool calls toward unauthorized payment actions or exfiltration of payment data. IBM self-rates the issue CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting unauthenticated network reachability and low attack complexity rather than high per-impact severity, since the realized effect is mediated by LLM behavior and is probabilistic rather than deterministic. The flaw is rooted in CWE-74 at api.vectordb.runbooks.js:51; no public exploit code identified at time of analysis and the issue is not tied to confirmed active exploitation, with exposure limited to deployments where the FTM AI agent endpoint is network-accessible and the agent has MCP tools wired to payment-affecting actions.
Local privilege escalation in Claris FileMaker Pro for Windows lets a low-privileged local user drop a malicious DLL into the directory used by the product's installer and thereby execute arbitrary code in the administrator context once a privileged user runs that installer. Only Windows installer builds prior to 26.0.3 are affected (EUVD records the range as 0 through 26.0.3); the installed application at runtime is not impacted. Exploitation requires local host access plus an admin-initiated installer run (CVSS:3.1/AV:L/AC:L/PR:L/UI:R), so it is neither remotely reachable nor automatable - CISA's SSVC rates Exploitation as none and Automatable as no - and no public exploit code exists, with EPSS at 0.15% (3rd percentile) reflecting the narrow local-use precondition. This is a local privilege-escalation issue with realistic but constrained risk; a vendor fix is available.
A heap buffer overflow in BusyBox's romfs filesystem image parsing path can be triggered when the utility processes an attacker-crafted romfs image whose volume ID metadata is read with an unbounded strlen, producing an out-of-bounds heap write (CWE-787) rated CVSS 3.1 base 7.3. Because the attack vector is local (AV:L), the malicious image must be delivered to the target system - for example via removable media, a downloaded archive, a firmware/container image, or a package - and some process or user must then parse or mount it (UI:R); it is not remotely triggerable over a network. Under the assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) no privileges are required, and successful corruption could yield code execution in the context of the parsing process with high impact to confidentiality, integrity, and availability; no public exploit or POC was identified in the supplied intelligence and there is no confirmed active exploitation.
Command injection in the automation controller's external logging (rsyslog) configuration of Red Hat Ansible Automation Platform 2 allows a superuser to achieve arbitrary command execution inside the control-plane rsyslog component, exposing the controller SECRET_KEY and database credentials and enabling decryption of all stored credentials. Exploitation requires authenticated superuser privileges (CVSS 3.1 7.2, PR:H, no user interaction) and only takes effect when external logging is in use, so the malicious RainerScript configuration is actually generated and loaded. No public exploit code was identified and there is no CISA KEV listing indicating active exploitation, meaning real-world risk is strongly gated by the elevated privilege requirement even though the post-exploitation impact is a full control-plane compromise.
Improper authentication in the OpenShift Console's CatalogdHandler allows unauthenticated remote attackers to forward the openshift-session-token cookie and send requests to the in-cluster catalogd service, disclosing the internal operator-catalog index and providing a relay into the openshift-catalogd namespace (CVE-2026-75886, CVSS 7.2). This affects Red Hat OpenShift Container Platform 4. No public exploit identified at time of analysis; exploitation requires network reachability to the exposed console endpoint.
EasyStore for Joomla versions 1.0.0 through 3.0.0 does not enforce CSRF token verification across most administrator AJAX endpoints, enabling an attacker to trick a logged-in Joomla administrator into changing store data such as orders, coupons, media, customers, settings, tags, categories, reviews, and collections. Only the products() action checked tokens; the vendor fix moves verification into ApiController::execute() and applies Session::checkToken() to POST, PUT, PATCH, and DELETE requests. No public exploit code was identified at time of analysis, and exploitation requires an active admin session plus user interaction, so this is a moderate-risk CSRF issue despite the potential for high integrity and availability impact.
CSRF in JoomShaper EasyStore for Joomla versions 1.0.0 through 3.0.0 allows an attacker to silently modify the core Joomla mail sender name and address (fromname, mailfrom) in configuration.php by tricking a logged-in administrator into visiting a malicious web page. The vulnerable endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration lacks anti-CSRF token validation and administrative authorization checks. Exploitation requires an authenticated admin session (UI:R) but no attacker credentials (PR:N); impact is limited to altering mail sender identity, and no public exploit was identified at time of analysis.
PHP Object Injection in the Reycob Product Import Export plugin (versions up to and including 2.3.0) allows an authenticated attacker with the WooCommerce 'Shop manager' role or higher to submit crafted serialized data, potentially achieving arbitrary code execution if a suitable POP gadget chain is present in the loaded PHP codebase. The vulnerability is network-exploitable (CVSS 3.1: 7.2 HIGH, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction, but the high-privilege requirement limits exploitation to trusted roles. No public exploit code or active exploitation has been identified at the time of analysis.