CVE-2026-95288 is a security flaw tracked through the Ubuntu vendor feed, but its public description is listed as '[Unknown description]' and no CVSS score, CVSS vector, CWE identifier, affected package, or version range accompanies the record. Because exploitation prerequisites, attack vector, and required privilege level are all indeterminate from the supplied data, real-world risk cannot be assessed; defenders should treat this as an uncharacterized entry pending the corresponding Ubuntu Security Notice and NVD record. No CISA KEV listing, no public exploit reference, and no EPSS score were provided, so neither confirmed active exploitation nor publicly available exploit code can be asserted at this time.
The security impact of CVE-2026-95287 on Ubuntu cannot be determined from the intelligence currently available, because the vulnerability description is entirely missing and no CVSS score or vector, CWE classification, or CPE data was supplied. The only attributable data point is that the record was reported through the Ubuntu vendor feed (vendor:ubuntu), which means an Ubuntu source package is the presumed point of contact, but the specific package, affected versions, and attack surface remain unidentified. No public exploit identified at time of analysis, and no evidence of confirmed active exploitation (CISA KEV) is present in the provided data.
Ubuntu is the only product context associated with CVE-2026-95320, attributed solely through a vendor-coordination credit to the Ubuntu security team, and no description, affected package, version range, or vulnerable component has been published. Because the record carries no CVSS score or vector, no CWE assignment, no CPE identifiers, no EPSS estimate, no CISA KEV listing, and no public exploit code, the impact and attack prerequisites are entirely unknown and cannot be inferred. No public exploit has been identified at time of analysis, and no vendor-released patch has been identified at time of analysis; this entry should be treated as an unresolved placeholder to be re-triaged once the CVE record and the corresponding Ubuntu advisory are published.
Google Chrome desktop stable-channel installs are covered by a vendor fix for CVE-2026-95370 published in Google's Stable Channel Update for Desktop, but the supplied intelligence contains no description, CVSS score, vector, or CWE, so the concrete impact and attack path cannot be characterized here. No public exploit identified at time of analysis, and the CVE is not listed as confirmed actively exploited (CISA KEV), though exploitability cannot be ruled out given the absence of technical detail. Ubuntu is the reporting vendor, so Chromium packages on that distribution built from the same upstream fix should be treated as in scope alongside Chrome on Ubuntu systems.
Google Chrome desktop stable-channel builds are affected by a vulnerability that Google addressed in its September 2026 stable-channel release, with the specific triggering component, root cause, and severity not disclosed in the available intelligence. Realistic exploitation would require a victim to browse to or render attacker-controlled web content in a browser that has not yet applied the fix, making user interaction the primary limiting factor, while Chrome's silent auto-update mechanism confines exposure largely to installations that have not yet restarted or updated. There is no public exploit code identified at time of analysis and no CISA KEV listing, and with no CVSS vector, no CWE, and no EPSS probability available, the risk cannot be scored quantitatively from the supplied data.
Google Chrome's desktop stable channel is affected by an unspecified security defect that has been addressed in a vendor-released stable channel update (referenced via the Chrome Releases blog). Details of the underlying bug are not publicly characterized in the available data: the CVE carries no description, no CVSS score or vector, no CWE mapping, and no EPSS probability, so the precise attack surface, prerequisite configuration, and worst-case impact cannot be determined from the supplied intelligence. There is no CISA KEV listing and no public exploit identified at time of analysis, and because a patch is already available from the vendor and Chrome ships with an automatic update mechanism, real-world exposure is effectively bounded to installations that have not yet been updated.
No impact statement can be made for CVE-2026-95321: the record carries an empty description, no CVSS score or vector, no CWE, no references, and no EPSS, KEV, or POC signals, so neither the vulnerable component nor the consequence of exploitation is defined. The single attribution is a vendor:ubuntu report, which indicates the CVE was surfaced through Ubuntu's security tracking channel but does not identify the affected package, source component, or upstream project. Authentication requirements, deployment prerequisites, and attack vector are all unconfirmable from the available data, and no public exploit code has been identified at time of analysis. Analysts should treat this as an intelligence gap requiring verification against Ubuntu security notices rather than as a validated vulnerability with a known severity.
Risk cannot be meaningfully assessed for CVE-2026-95323 because the record contains no description, no CVSS score or vector, no CWE mapping, and no affected-product identifiers, leaving a vendor attribution to Ubuntu as the only intelligence available. With no information about the vulnerable component, its deployment mode, or the attacker's required position, no impact statement, authentication requirement, or exploitation precondition can be derived. There is no public exploit identified at time of analysis, and this should be handled as an unenriched placeholder record that is re-evaluated once NVD or the Ubuntu security team publishes a description and severity metrics.
Ubuntu Linux is the only attributed product for CVE-2026-95307, which reaches us solely through a vendor:ubuntu source with no description, CVSS vector, CWE, CPE, or reference data attached. Because the affected component, attack vector, authentication requirements, and user-interaction prerequisites are all missing, the impact an attacker could achieve cannot be stated and the overall risk cannot be meaningfully assessed from the provided data. There is no KEV listing, no public exploit code identified, and no EPSS score available at time of analysis, so no exploitation signal exists in either direction. Treat this identifier as an unresolved tracking item pending enrichment from the Ubuntu security tracker or NVD.
CVE-2026-95309 is recorded in this dataset only as reported by vendor:ubuntu, with an empty description, no CVSS score or vector, no CWE mapping, no references, no EPSS or KEV signal, and no patch metadata. Because the affected Ubuntu package, subsystem, and deployment context are all unknown, the impact cannot be characterized and risk cannot be meaningfully assessed from the provided data. No public exploit code has been identified at time of analysis, and there is no confirmed evidence of exploitation; this reflects absence of intelligence rather than confirmed safety. The originating Ubuntu Security Notice (USN) must be retrieved to establish whether the issue is a local privilege escalation, a remote service flaw, or a lower-severity hardening gap before any triage decision is made.
Server-side request forgery (SSRF) in iFlytek astron-agent through version 1.0.6 lets an authenticated console user steer server-side HTTP requests to internal or otherwise restricted destinations by supplying a crafted endPoint argument to the debugToolV2 API, which reaches UrlCheckTool.checkUrl. The weakness is a redirect-handling gap: the pre-patch validator followed only a single 301/302/303 hop and ignored 307/308, so a URL that passes the initial blacklist/whitelist check can still bounce the request to an internal target; the vendor fixed this in release reward-1575 with a bounded 5-hop chain that revalidates every hop and detects loops. Impact is limited (CVSS 4.0 score 5.3; independent assessment CVSS 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), requiring valid console credentials, and no public exploit identified at time of analysis.
SQL injection in the console component of iFlytek astron-agent (versions up to and including 1.0.7) lets an authenticated low-privilege user inject arbitrary SQL via the `sortDirection` parameter of the getBotList API, which is concatenated directly into the ORDER BY clause of ChatBotMarketMapper.xml. Because the vulnerable ORDER BY sink cannot return query results to the caller, exploitation is blind (time- or boolean-based), so an attacker with a valid console account and network access to the endpoint could progressively extract backend data - the independent assessment rates confidentiality impact as high (CVSS:3.1 C:H, PR:L, AV:N) with no integrity or availability effect. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS data was not supplied; the vendor addressed it in release reward-1575 by whitelisting the sort direction.
Red Hat Ansible Automation Platform 2 (automation-controller) lets an unauthenticated remote attacker enumerate which Job Template and Workflow Job Template IDs have a Bitbucket Data Center webhook configured, by abusing an observable response discrepancy in the Bitbucket DC webhook receiver. For diagnostics:ping events the receiver performs the template lookup before HMAC signature verification is skipped, so the endpoint returns HTTP 200 for a template with a Bitbucket DC webhook and HTTP 403 otherwise - an oracle that requires neither authentication (PR:N in the assessed vector) nor knowledge of the secret webhook_key. Assessed at CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), this is a low-impact information-disclosure and enumeration issue: no secrets, code execution, or elevated access are exposed; no public exploit identified at time of analysis and no confirmed actively exploited status.
Information disclosure in the automation-controller API of Red Hat Ansible Automation Platform 2 lets any remote unauthenticated party read the automation mesh topology from the health-check endpoint /api/v2/ping/ (CVSS 3.1: 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Because the ApiV2PingView view is declared with the AllowAny permission class and over-serializes RBAC-gated mesh data into its anonymous response, an attacker needs only network reachability to walk away with node hostnames, node types, UUIDs, heartbeats, capacities, exact software versions, instance-group names and membership, the deployment install UUID, and the identity of the active control node. The exposure is confidentiality-only - no secrets, credentials, or tenant data are involved - and there is no public exploit identified at time of analysis, so this is a genuine but modest reconnaissance-grade issue rather than an urgent one.
Path traversal in IBM Concert 1.0.0 through 3.0.0 permits unauthenticated remote attackers to read files accessible to the Concert service account by sending crafted URLs containing dot-dot-slash sequences. The flaw has a CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so impact is limited to confidentiality with no write or code execution. No public exploit code was identified at time of analysis, and IBM has made a patch available.
GoCD 20.2.0 through pre-26.1.0 allows any authenticated user to retrieve inter-pipeline dependency hierarchy details and user-defined pipeline, stage, job, and artifact plugin reference names via the internal fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream, bypassing per-pipeline view authorization. The endpoint is read-only, so impact is limited to information disclosure that matters primarily where pipeline visibility is restricted per user or team; single-team installations expose little extra. No public exploit code was identified at time of analysis, and the issue is fixed in version 26.1.0.
IBM Concert 1.0.0 through 3.0.0 can be induced to return detailed technical error messages to a requesting browser, leaking implementation detail to a remote, unauthenticated attacker (CVSS 3.1: AV:N/AC:L/PR:N/UI:N, C:L only, 5.3). Impact is limited to low-sensitivity information disclosure with no integrity or availability effect, so the practical value is reconnaissance for follow-on attacks, and only Concert instances whose web interface is reachable by the attacker are exposed. No public exploit identified at time of analysis, and IBM has published a vendor fix; the issue is a low-priority information-disclosure item rather than a standalone compromise vector.
Authenticated users holding the ERPNext Accounts Manager role can invoke arbitrary non-whitelisted server-side Python methods and read back their return values in Frappe ERPNext versions before 16.34.1. The flaw lives in Financial Report Template handling: a Custom API row's calculation_formula is passed straight to frappe.call() without verifying that the dotted path resolves to a whitelisted, GET-permitting method, so an attacker with rights to create or edit such templates can point the formula at internal methods that were never meant to be remotely callable. The assessed impact is limited information disclosure and limited integrity impact (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N; CVSS 4.0 5.3), exploitation requires a privileged non-default role, no public exploit code has been identified at time of analysis, and no EPSS or CISA KEV data indicates active exploitation. This is a genuine but modest-severity issue best treated as medium-low priority.
Google Chrome desktop installations are affected by a flaw corrected in a stable channel update, with vendor patch data indicating a fix is available but no description, CVSS score, CVSS vector, or CWE supplied to characterize the defect. Because neither the affected component nor the attack vector is specified in the available intelligence, the impact cannot be assessed beyond Chrome's general exploitation model, in which a victim would need to load attacker-controlled web content for an exploit attempt to succeed. No public exploit identified at time of analysis, and Chrome's automatic-update mechanism sharply limits exposure so that primarily outdated installations remain at risk; the linked Chrome Releases advisory is the authoritative source for the exact affected build and fix.
Google Chrome desktop on the stable channel is affected by a security defect tracked as CVE-2026-95360, which the vendor has corrected in a later stable-channel build documented on the Chrome Releases blog; the specific affected component, vulnerable version range, and impact are not confirmable because no description, CVSS score or vector, CWE, or CPE data was supplied. Based on the product identity (Chrome desktop stable channel) and typical browser-fix patterns, exploitation most plausibly requires the victim to load attacker-controlled web content in an unpatched Chrome build, making user interaction a likely limiting prerequisite that must be verified against the referenced advisory. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing indicating confirmed active exploitation; patch available per vendor advisory.
An out-of-bounds read in BusyBox's built-in TLS handshake parser (get_client_hello()) lets unauthenticated remote attackers trigger a limited memory over-read by sending a malformed, truncated TLS ClientHello to a BusyBox process that parses inbound handshake data. Impact is confined to low confidentiality loss (CVSS 5.3, C:L) with no integrity or availability effect, and exploitation requires the atypical configuration of BusyBox acting as a TLS server or handshake receiver, since BusyBox's TLS code is most often used client-side for wget/https. There is no public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and Red Hat tracks the issue for Red Hat Hardened Images (advisory: https://access.redhat.com/security/cve/CVE-2026-88840; Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2531354).
IP-based deny rules in BusyBox httpd can be silently bypassed: when an administrator configures an access-control rule with an invalid CIDR prefix length, the parser zeroes the netmask so the rule matches no clients and the intended block never takes effect. The flaw is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3), but it only manifests under that administrator-side precondition, so exposure is limited to deployments whose httpd configuration contains malformed deny entries - Red Hat Hardened Images are identified as affected via the published CPE. Impact is confined to confidentiality loss through bypass of the intended IP restriction, and no public exploit identified at time of analysis.
Unauthenticated attackers can forge PayPal payment and subscription-cancellation notifications against WordPress sites running the Premium Packages plugin before 7.2.1, because the plugin processes webhook/IPN payloads without verifying PayPal's signature. The transaction-id prerequisite makes attacks targeted rather than blind, and the impact is limited to payment and subscription state integrity (CVSS 5.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) with no data disclosure or availability loss. A vendor patch is available in 7.2.1; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers can write forged card-token records into arbitrary user accounts and enumerate registered users on WordPress sites running the Paymob for WooCommerce plugin before version 4.1.14, because the card-token branch of the plugin's payment webhook never validates the request signature. Exploitation requires only that the site runs the affected plugin with its webhook endpoint reachable - no credentials, user interaction, or non-default configuration are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, NVD 5.3) - and impact is limited to unauthorized data writes and account enumeration rather than account takeover or code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor-released patch (4.1.14) is available, so exposure is bounded by Paymob's regional (MENA) deployment footprint.
Unauthenticated information disclosure in the WPC Smart Compare for WooCommerce plugin before 6.6.1 allows remote attackers to read the descriptions of password-protected WooCommerce products, because the plugin's comparison handler returns product content without applying WordPress's post-password protection. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so it is limited to confidentiality with low impact and no integrity or availability effect, and no public exploit has been identified at time of analysis. A vendor patch is available in 6.6.1 and the exposure is confined to content that site owners intended to keep behind a password.
Unauthenticated information disclosure in the FluentBoards WordPress plugin (versions 1.95 through before 2.1.0) lets remote attackers retrieve the email addresses of a shared board's members - typically including site administrators - by querying the plugin's public, token-shared board endpoint. Exploitation requires only that a board has been exposed via the plugin's share-link feature; no credentials or user interaction are needed, consistent with the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector and a confidentiality-only impact (C:L). No public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV), but the low EPSS-relevant barrier and the administrative-email exposure make it a useful reconnaissance primitive for follow-on phishing or credential attacks against FluentBoards sites that use public board sharing.
Unauthenticated information disclosure in the Product Badge, Label, Countdown Timer for WooCommerce plugin (versions 7.0.0 up to but not including 7.5.2) lets remote attackers retrieve the title, description, and price of products that are in draft, pending, or private status. The plugin returns product details without first verifying that the product is published, so any user who can reach the affected front-end functionality can enumerate unpublished catalog content; no authentication, user interaction, or special configuration is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Impact is limited to confidentiality of product metadata - there is no write, code execution, or availability effect - and the practical exposure depends on whether the store actually holds sensitive unpublished products; no public exploit identified at time of analysis. A vendor patch is available in 7.5.2.
Unauthenticated information disclosure in the Post Grid Gutenberg Blocks WordPress plugin (all versions before 5.0.41) lets any remote attacker read the custom field key names of arbitrary posts by calling an unprotected REST API route. Because the route enforces neither an authorization check nor a post-visibility check, keys belonging to private, draft, pending, scheduled and password-protected posts are disclosed alongside those of published content; the only prerequisite is knowing or enumerating valid post IDs. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3, capped by the fact that only key names - not values or post content - are returned, making this reconnaissance-grade metadata leakage rather than direct sensitive data exposure.
Unauthenticated information disclosure in The Events Calendar WordPress plugin (versions 4.5 through before 6.17.5) allows remote attackers to read the stored details of linked records-such as draft, pending, or private events and their associated venues/organizers-that were never intended to be public. The flaw stems from missing post-status checks when embedding linked record data into a public REST API response. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 6.17.5.
The Easy Hide Login WordPress plugin before 1.7 leaves the standard login page reachable when an attacker supplies certain password-reset request parameters, and the resulting page discloses the site's configured secret login slug. Any site running the plugin for its intended purpose (hidden custom login URL) is affected, and exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) with no public exploit code identified at time of analysis. Impact is limited to disclosure of the obscurity secret - the flaw does not bypass authentication on its own, so follow-on value requires valid credentials or a separate login flaw, making this a low-priority, defense-in-depth-defeating information disclosure rather than a direct compromise.
Unauthenticated information disclosure in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 allows any remote attacker to retrieve registered users' private contact details by querying a REST endpoint that lacks an access-control check. The only prerequisite is a WordPress site running an affected version (8.1 through 8.9.4) with its REST API reachable, which is the default configuration, and no authentication or user interaction is required. Impact is bounded to confidentiality - contact data of registered users, with no write access, privilege escalation, or system compromise - and the vendor has released a fix in version 8.9.5; no public exploit code has been identified at time of analysis.
Missing authorization checks in the Social Commerce for WooCommerce WordPress plugin (versions through 2.5.4) leave several of its REST API endpoints reachable by unauthenticated users, allowing anyone who can reach the site to overwrite plugin configuration and product-synchronisation state. The flaw is CWE-862 (missing authorization) with a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning exploitation requires no credentials or user interaction but is limited to partial integrity impact - no data disclosure and no denial of service. Exposure is restricted to WordPress sites running this specific niche plugin at a vulnerable version, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Missing authorization in the WordPress plugin Email Subscribers & Newsletters (versions before 5.9.35) lets unauthenticated remote attackers force-unsubscribe or force-confirm an arbitrary subscriber simply by supplying that subscriber's email address, because the plugin never validates the per-subscriber management token that should gate the subscription-status change. Exploitation requires no authentication, no user interaction, and no special configuration - only knowledge of a target email address on the mailing list. Impact is confined to integrity manipulation of subscription state (silent removal or confirmation of subscribers), with no data disclosure, code execution, or site takeover; only a single reference (WPScan advisory) is available, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
WordPress sites running the Better Payment plugin before 2.3.4 can be tricked into accepting an arbitrary, reduced payment for a fixed-price item, because the plugin builds the gateway charge from a client-submitted amount without re-validating it server-side against the merchant's configured price. The flaw is exploitable remotely and without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), but impact is confined to integrity of the transaction - attackers can underpay, they cannot read data or disrupt availability (C:N/I:L/A:N, base score 5.3). No public exploit code and no confirmed active exploitation were identified at time of analysis, and realistic risk is bounded to merchants who actually sell fixed-price items through this plugin's checkout flow.
Cross-Site WebSocket Hijacking (CWE-1385) in RabbitMQ's Web-MQTT and Web-STOMP plugins allows attacker-controlled JavaScript running in a victim's browser to open an authenticated WebSocket connection to the broker, because the WebSocket upgrade handlers at rabbit_web_mqtt_handler.erl:104 and rabbit_web_stomp_handler.erl:102 never validate the Origin header. The flaw is only reachable under non-default configuration - Web-STOMP with use_http_auth=true, or either plugin with ssl_cert_login=true - where the browser automatically presents the victim's TLS client certificate, letting the attacker inherit the victim's identity; the issue is harmless under the default in-band CONNECT credential setup, so default deployments are unaffected. No public exploit has been identified at time of analysis, but the CVSS:3.1 assessment (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) rates the confidentiality and integrity impact as high where a vulnerable configuration is in use.
Cross-site request forgery (CSRF) in the EasyStore extension for Joomla (versions 1.0.0 through 3.0.0) allows a remote unauthenticated attacker to trick a logged-in victim into submitting unauthorized product reviews or review spam via the product.addReview endpoint. The flaw stems from commented-out anti-CSRF token verification, and exploitation requires the victim to visit attacker-controlled content while authenticated. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to low integrity (unauthorized reviews) without confidentiality or availability loss.
Unauthenticated sensitive data exposure in the TrustedLogin Connector WordPress plugin (versions 2.0.3 and earlier) allows any remote attacker to read information that should not be publicly accessible. The vulnerability is rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning it is network-reachable, requires no authentication, no privileges and no user interaction, but the impact is confined to a LOW-severity confidentiality leak with no integrity or availability effect. Exploitation status is no public exploit identified at time of analysis, and no CISA KEV listing or public proof-of-concept was reported by the source (Patchstack) or by EUVD-2026-85503; the practical limiter on risk is the narrow scope of the leak rather than the difficulty of reaching it.
Unauthenticated insecure direct object reference in the RadiusTheme 'TLP Team' WordPress plugin (versions 6.0.0 and earlier, CPE cpe:2.3:a:oleh_radiustheme:team) lets remote attackers retrieve team-member record data without logging in or interacting with the site, because a user-controlled object key is trusted without an ownership or capability check. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N vector, the flaw is confidentiality-only: an attacker can read limited object data but cannot alter content, escalate privileges, or cause denial of service, so realistic impact is disclosure of individual team entries rather than full site compromise. No public exploit code was identified at time of analysis and the plugin is not listed in CISA KEV; exploitation requires only that the plugin be installed on a network-reachable WordPress instance, making this a moderate, patch-when-convenient exposure rather than an urgent one.
Unauthenticated attackers can bypass an access-control mechanism in the WordPress plugin WP User Frontend at version 4.3.11 and earlier, allowing a constrained unauthorized action against any site where the plugin is installed and active. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are required - the only meaningful limit is impact scope, since the flaw carries low integrity impact only (C:N/I:L/A:N) and does not expose confidentiality or availability. Exploitation status: no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; CVSS base 5.3 places this as a moderate-but-bounded risk, and operators should confirm the exact affected endpoint against the Patchstack advisory before assuming a specific feature is required.
Unauthenticated bypass in the Netgsm WordPress plugin (versions up to and including 2.10.0) lets remote attackers bypass an access-control check and make limited unauthorized changes to site state (C:N/I:L/A:N), with no confidentiality or availability impact. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N - network-remote, no authentication and no user interaction required on a default WordPress install with the plugin active. No public exploit identified at time of analysis, no CISA KEV entry, and the plugin has a small real-world install base, so overall risk is moderate rather than urgent despite the unauthenticated attack path.
Unauthenticated broken access control in MarketKing (Multivendor Marketplace for WooCommerce) 2.1.70 and earlier allows remote attackers to invoke a privileged plugin action without any authorization check, resulting in unauthorized integrity changes on affected WordPress sites. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning no credentials or user interaction are required but the impact is confined to low-integrity modification with no confidentiality or availability effect. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; risk is further limited because the description does not identify the specific unprotected endpoint, so an attacker must first discover it, and the plugin is a niche commercial marketplace add-on with limited deployment.
WP User Manager, a WordPress plugin for front-end user profiles, registration, and login, up to and including version 2.9.19 contains an unauthenticated broken access control flaw (CWE-862) that lets a remote attacker perform an action or modify data that should require authorization. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (base 5.3) means the endpoint is reachable over the network with no credentials, no victim interaction, and no special configuration, but the impact is capped at a partial integrity loss - there is no data disclosure and no denial of service, and the exact restricted action protected by the missing check is not specified in the available data. No public exploit code was identified and there is no evidence of confirmed active exploitation (not listed in CISA KEV) at time of analysis, and Patchstack's advisory is the originating report.
Unauthenticated insecure direct object reference (IDOR) in the WordPress plugin AI Engine at version 3.7.8 and earlier allows any remote attacker who can reach the site to read plugin-managed objects by manipulating object references, with no authentication and no user interaction required, as reflected in the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3 MEDIUM). Impact is deliberately narrow: only low confidentiality loss is possible, with integrity and availability explicitly unaffected, and successful extraction generally depends on the attacker being able to guess or enumerate valid object identifiers. Based on the available data there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the flaw was reported through Patchstack and tracked in the EU as EUVD-2026-85465. Sites are exposed only if the AI Engine plugin is installed, active, and running a version at or below 3.7.8.
An insecure direct object reference (IDOR) in the WEBCON BPS Gantt vacation-chart REST endpoint (/api/vacations/{path}) lets any authenticated user read vacation and scheduling data belonging to other employees by supplying arbitrary logins in the selectedPeople parameter. The server fails to verify that the requesting user is authorized to view the targeted accounts, so attackers can enumerate managers and staff from other offices and bypass the workflow's business-logic access rules. Rated CVSS 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N), it is a genuine but low-severity information-disclosure flaw; exploitation requires valid credentials, and there is no public exploit identified at time of analysis. Vendor-released patches are available in versions 2025.2.1.177 and 2026.1.1.20.
Google Chrome desktop (stable channel) is affected by a vulnerability that is documented only through Google's stable-channel release advisory, with no accompanying description, CVSS score or vector, CWE mapping, EPSS probability, or KEV listing available at time of analysis. Because the technical details of the underlying flaw are absent, the concrete impact on confidentiality, integrity, or availability cannot be characterized, and the only independently confirmed facts are the affected product (Chrome desktop stable) and that a vendor patch exists. There is no public exploit identified at time of analysis, and authentication requirements are not confirmed from available data; as with most Chrome browser issues, the practical limiting factor is that exploitation typically requires the victim to load attacker-controlled web content rather than being reachable without interaction. Organizations should treat this as a patch-management item and apply the current stable-channel update rather than as an immediate emergency, while acknowledging that the risk assessment is based on very limited signal.
Authenticated but unprivileged users of Red Hat Ansible Automation Platform 2 can read platform-wide job event information through the JobJobEventsChildrenSummary endpoint, which performs no object-level authorization check. Because the view declares no model or parent_model, ModelAccessPermission.check_get_permissions() falls through and returns True for every authenticated principal, and the handler substitutes a raw get_object_or_404(Job, pk), exposing event tree structure, event_processing_finished status, and the existence of arbitrary Job IDs via a 200/404 oracle. Exploitation requires only a valid zero-privilege account on the controller and no user interaction, making this a confidentiality-only information disclosure (assessed CVSS 5.0, AV:N/AC:L/PR:L/UI:N); no public exploit code has been identified at time of analysis, and the sibling endpoint /jobs/{id}/job_events/ correctly returns 403, confirming the defect is endpoint-specific.
Server-side request forgery in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin (versions before 8.9.5) lets any authenticated user with subscriber-level access or above supply a URL that the server then fetches without validation, causing the WordPress host to issue requests to internal addresses and services. Exploitation requires only a low-privilege account, which is realistic on directory and classified-ad sites that typically enable open registration, and the request succeeds without any victim interaction. Impact is limited to confidentiality (CVSS 5.0, C:L), there is no public exploit identified at time of analysis, and updating to 8.9.5 remediates the issue.
Information disclosure in Red Hat Ansible Automation Platform 2 allows an authenticated low-privilege user to enumerate named resources - organizations, credentials, inventories, and hosts - across tenants, including internal hostnames, by observing a response-discrepancy in the URLModificationMiddleware. The middleware resolves named-URL lookups against unfiltered Model.objects before RBAC enforcement, and its 403→404 shim only rewrites 403 responses, so the pk=0 miss path remains distinguishable via 'Not found.' versus 'No <Model> matches...'. Exploitation requires an authenticated account (PR:L per CVSS) and is only meaningful on multi-tenant deployments; it yields existence information only, with no modification or availability impact. No public exploit identified at time of analysis and no CISA KEV status is indicated (no EPSS score was provided).
CVE-2026-95300 is currently an unpopulated record: the supplied intelligence contains no description, no CVSS score or vector, no CWE classification, and no CPE data, so the flaw's nature and impact cannot be characterized at this time. The single attribution available is that the record was reported by the Ubuntu vendor source, which suggests Ubuntu may be the coordinating or affected vendor, but no package, version, or component is identified. With no KEV listing and no public exploit code referenced in the input, there is no public exploit identified at time of analysis, and risk cannot be meaningfully assessed from the provided data.
Parsing a crafted PE file with a malformed IMAGE_BASE_RELOCATION BlockSize field can crash or disrupt JusticeRage Manalyze 1.0.0 through an integer underflow in PE::_parse_relocations, a low-severity denial-of-service condition confined to the analysis tool itself. The attack is local only: the victim must run Manalyze (manually as a malware analyst, or automatically in a triage/sandbox pipeline) against the attacker-supplied sample, and there is no code execution, confidentiality loss, or integrity loss - only the parsing routine misbehaves. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the upstream commit c372b6bbca9d8c63812be50596fefa4a79c65fd0 adds the missing BlockSize validation; the EPSS signal for this niche tooling bug is consistent with a low real-world priority.