Integer overflow in the ALSA topology decoder of alsa-lib through 1.2.16.1 lets a crafted .tplg topology file wrap the combined control-element size calculation, so the decoder passes its bounds check and reads past the end of the topology buffer, potentially disclosing process memory or crashing the application. Exploitation is local (AV:L) and requires the victim to load an attacker-supplied topology file (UI:P/UI:R, PR:N); no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. Independent assessment rates the real-world risk as low-to-moderate: topology files are normally trusted, system-provided sound-card configuration data, so the flaw is only practically reachable where alsa-lib processes topology input from an untrusted source, and the demonstrated impact is limited to low confidentiality and low availability loss.
Local denial of service in alsa-lib through 1.2.16.1 allows a local user with low privileges to crash applications that use the multi PCM plugin by supplying a crafted ALSA configuration file containing sparse binding indices. The flaw is an improper validation of array index (CWE-129) that leads to an out-of-bounds read and an assertion failure, aborting the process. No public exploit code has been identified, and the issue is assessed as low severity with availability-only impact; patching is available via upstream PR 527.
CAPTCHA verification bypass in the WordPress plugin Captcha Code (by webfactory) version 3.32 and earlier allows unauthenticated remote attackers to submit protected forms without solving the challenge, weakening the anti-automation control on any form the plugin guards. The assessed CVSS v3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, base 4.8) confirms no authentication or user interaction is required, but its high attack complexity indicates the bypass is not guaranteed on every attempt and the outcome is confined to defeating the CAPTCHA itself - it does not yield WordPress account access or site compromise. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a genuinely low-priority issue despite the 'authentication bypass' framing; its real-world value depends entirely on how sensitive the forms the CAPTCHA was protecting happen to be.
CVE-2026-95292 is tracked against Ubuntu, identified here only through the vendor:ubuntu reporting source, with no description, CVSS vector, CWE classification, CPE data, or affected package name supplied in the available intelligence. Because the vulnerability class, attack vector, and impacted component are all unknown, the exploitable impact on any Ubuntu release cannot be characterized, and remediation cannot name a fixed package version. No public exploit code has been identified at time of analysis, and no CISA KEV entry is present, so there is no indication of confirmed active exploitation; first-sentence risk cannot be meaningfully assessed from the provided data.
CVE-2026-95305 cannot be meaningfully risk-assessed because the record is a near-total data void: the description is '[Unknown description]', and no CVSS score, CVSS vector, CWE, references, CPE data, EPSS score, KEV status, or POC data accompanies it. The single intelligence signal available is the reporting source - vendor:ubuntu - which indicates an Ubuntu-associated report or packaged component but does not establish the upstream project, the vulnerable feature, the affected version range, or the attacker's required position. Consequently, whether exploitation requires authentication, user interaction, or a non-default configuration is unknown, and no public exploit code has been identified at time of analysis - a statement that reflects missing evidence rather than a confirmed negative.
Google Chrome desktop users on the stable channel are affected by CVE-2026-95346, a flaw that Google addressed through a Stable Channel Update for Desktop documented on the Chrome Releases blog. The supplied advisory is the only reference, and no description, CVSS score, CWE, or CPE data accompanies this CVE, so the specific vulnerability class, affected build range, and impact cannot be confirmed from the available intelligence; exploitation prerequisites are likewise unconfirmed. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but a vendor patch is available per the Chrome Releases advisory, so the primary exposure is the window between patch publication and the user restarting the browser. Because the CVSS vector is absent, authentication requirements cannot be confirmed from available data, and remote unauthenticated default-configuration exploitation should not be assumed.
Authenticated users holding only contributor-level access on WordPress sites running the Paymob for WooCommerce plugin before 4.1.14 can delete, wipe, or modify the plugin's payment-gateway configuration, including stored Paymob payment credentials, because several admin-AJAX handlers omit a capability check (CWE-862 missing authorization). The affected site must have the plugin installed and active, and the attacker must first obtain a low-privilege account - via open registration or a compromised contributor user - after which no administrator interaction and no non-default configuration are required, yielding low confidentiality and availability impact but high integrity impact on the gateway configuration. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in version 4.1.14; despite the 'Authentication Bypass' tag applied by the reporter, the assessed nature of the flaw is an authorization gap, not a credential-free bypass.
A crafted PDF opened in Foxit PDF Editor or Foxit PDF Reader can read content from other documents loaded in the same application process and transmit it to an external destination, because Foxit's JavaScript interface omits the attribute authorization checks required by the specification. The attack is local and requires the victim to open the file (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, base 4.7): a second sensitive PDF must already be open in the same process for the cross-document read to succeed, and the malicious document must run with the elevated privileges of a trusted document. There is no memory corruption, so the impact is confined to confidentiality (C:H/I:N/A:N); no public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV). Reported by Foxit and mapped to CWE-668 (Exposure of Resource to Wrong Sphere), this is a genuine but constrained information-disclosure flaw rather than a remotely reachable compromise vector.
Impact from CVE-2026-95293 cannot be characterized: the record concerns an unnamed package in the Ubuntu Linux distribution, reported by the Ubuntu security team, with no description, no CVSS score or vector, no CWE classification, and no affected version range supplied. Because the vulnerable component, its deployment mode, and its authentication requirements are all unknown, the attacker capability enabled by this flaw cannot be stated, and authentication requirements are not confirmed from available data. There is no public exploit identified at time of analysis, and the record should be treated as incomplete pending the Ubuntu Security Notice for CVE-2026-95293; risk of real-world exploitation is currently assessed as insufficient data to assess real-world risk.
Google Chrome desktop on the stable channel is the affected product behind CVE-2026-95332, a defect significant enough that Google shipped the fix in a stable-channel update rather than holding it for a routine release, yet the entry carries no description, no CVSS base score or vector, and no CWE, so the precise attack surface and technical impact cannot be named from available data. The practical consequence is therefore indeterminate: an unpatched Chrome desktop build is potentially exposed, but whether the flaw yields memory corruption, sandbox escape, information disclosure, or something else cannot be confirmed, and the only reasonable exposure model is the generic browser one in which a victim loads attacker-controlled web content with user interaction. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, so the dominant risk factor is simply the population of users running unpatched builds, which Chrome's automatic-update mechanism continually shrinks.
Stored HTML injection in the MasterStudy LMS WordPress plugin before 3.7.50 allows authenticated users with subscriber-level accounts or above to embed arbitrary markup - for example iframes - into user-submitted content that is later rendered to other users, enabling phishing and content spoofing. The prerequisite is trivially met on LMS sites that allow open self-registration, though it remains a real gate since the attacker must hold an account (PR:L, not unauthenticated), and the payload only fires when another user views the injected content (UI:R). Impact is bounded to markup-level abuse rather than script execution or account takeover, the CVSS 3.1 base score is 4.6, and no public exploit identified at time of analysis. This is a genuine but low-priority issue that is resolved by upgrading to 3.7.50.
Impact for CVE-2026-95295 cannot be determined from the available data: the record is tracked by the Ubuntu security team against a package distributed with Ubuntu Linux, but it carries no description, no CVSS vector, and no CWE classification, so the attack vector, required privileges, and user interaction requirements are all unconfirmed. Because no exploitation evidence, KEV listing, or public proof-of-concept is provided, there is no public exploit identified at time of analysis, and the EPSS-style risk signal is absent. The practical consequence is that prioritization must be deferred until the Ubuntu CVE tracker and the corresponding upstream advisory are consulted to identify the specific package, the affected release(s), and whether default installations are exposed.
Out-of-bounds heap read in GIMP's TIM image loader is triggered when a user opens a crafted 4bpp TIM image that is promoted to an RGBA layer, causing the file-tim plug-in to allocate an undersized row buffer and then process it with the larger RGBA row size. The result is disclosure of adjacent heap memory into the decoded image and a possible plug-in crash, with exploitation requiring local access and victim user interaction (CVSS 4.4, CWE-125). No public exploit is identified at time of analysis, and impact is bounded to partial confidentiality loss and availability loss rather than code execution.
Google Chrome on the desktop stable channel is the only affected product identified by the supplied intelligence, which consists of a single Chrome Releases stable-channel advisory, and the specific vulnerability class, affected component, and impact are not disclosed in the available data. No CVSS score or vector, CWE, EPSS probability, or KEV listing accompanies this record, so severity cannot be quantified and the exploitation prerequisites remain unconfirmed; there is no public exploit identified at time of analysis. Because a fixed build is already published, residual risk is chiefly a patch-rollout problem - users remain exposed only until they move to the patched stable-channel version - and no exploitation activity, in-the-wild evidence, or proof-of-concept has been reported in the data provided.
Local privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an attacker who already holds a low-privileged foothold inside a running FTM container - such as a compromised service account or code execution gained through a separate flaw - elevate their privileges within that container. The issue is rated CVSS 3.1 base 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and stems from improper privilege management (CWE-250), meaning the component runs with more authority than it needs; the scope is unchanged, so the flaw by itself does not provide a path to the host node or to other containers. No public exploit identified at time of analysis, and exploitation requires local authenticated access with no remote or unauthenticated vector.
Authenticated REDAXO backend users can exploit improper validation of the 'sort' parameter in rex_list::getSortColumn() (redaxo/core before 5.21.2) to inject unauthorized column names into SQL ORDER BY clauses, enabling error-based enumeration of columns in joined tables and ordering by sensitive fields such as rex_user.password. This low-to-moderate severity information-disclosure issue requires valid backend credentials (PR:L) and yields inference-based leaks-schema enumeration and ordering oracles-rather than direct data dumps. The vendor fixed it in 5.21.2 by validating the requested column against registered sortable columns; no public exploit code or active exploitation is identified at time of analysis.
Google Chrome on the stable desktop channel is the affected product in CVE-2026-95361, an entry for which a vendor fix is indicated as available via a Chrome Releases stable-channel update. The intelligence record is unusually thin: no description, no CVSS score or vector, no CWE, no CPE, no EPSS probability and no CISA KEV listing were supplied, so the specific defect class, attack vector and privilege requirements cannot be stated. No public exploit code has been identified at time of analysis, and the Ubuntu vendor attribution plus the Chrome Releases advisory reference indicate this is a coordinated upstream-then-distributor patch flow rather than an actively exploited event.
CVE-2026-95342 cannot be characterized beyond its origin: the record is attributed to the Ubuntu vendor source, but no description, CVSS vector, CWE, or CPE data has been published, leaving the affected package, affected versions, and achievable attacker impact entirely unidentified. No CISA KEV entry and no public exploit code are associated with this identifier, so there is no public exploit identified at time of analysis; equally, no EPSS-style likelihood can be derived without a description or score. Ubuntu administrators should treat this as an intelligence gap rather than a confirmed threat and monitor the vendor advisory channel for the first substantive disclosure.
Ubuntu is tracking CVE-2026-95340, but the intelligence available for this analysis contains no description, CVSS vector, CWE class, affected package name, or version range, so neither the impact nor the attack surface can be characterised at this time. No public exploit code and no evidence of active exploitation were identified at time of analysis, which reflects an absence of data rather than a confirmed low risk. The Ubuntu Security tracker entry for this CVE is the authoritative source and must be retrieved before any exposure or prioritisation decision is made.
GoCD versions 20.2.0 through 26.0.x disclose the complete list of configured usernames and role names to any authenticated user through the internal pipeline-structure autocompletion API, even when that user has no administrator privileges. The endpoint is reached remotely over HTTP (AV:N) and requires only a valid low-privileged account (PR:L), so a regular GoCD user can enumerate tenant user and role identifiers to support follow-on credential-stuffing, phishing, or targeted attacks, though the response never maps users to roles and cannot modify any data. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the disclosure is limited to names, which is why the independently assessed severity remains low. GoCD 26.1.0 contains the vendor fix.
Information disclosure in the automation-controller component of Red Hat Ansible Automation Platform 2 lets any authenticated user of any privilege level extract internal database and ORM structure by sending crafted values through the host_filter query parameter of the Host list REST API. Because HostList.list() catches a bare Exception and returns str(e) verbatim, a malformed relation lookup such as credential__search=x raises a Django FieldError that exposes the complete Host model relation graph (including internal reverse accessors), while a malformed pattern such as name__regex=[bad raises a PostgreSQL DataError that reflects the raw database error string. The flaw is rated CVSS 4.3 (MEDIUM) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N; exploitation requires valid credentials but no user interaction, impact is limited to low-confidentiality schema and error-text leakage with no modification or code execution, and no public exploit was identified at time of analysis.
Missing authorization in the WP Recipe Maker WordPress plugin before 10.8.2 lets any authenticated user, including a subscriber-level account, retrieve the IDs and titles of other users' unpublished recipe lists through an AJAX action that performs no capability check. Exploitation is remote, requires no user interaction, and needs only low-privilege credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so exposure depends on whether the target site allows self-registration or the attacker otherwise holds an account. Impact is confined to disclosure of unpublished list metadata with no modification or service disruption; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Authenticated information disclosure in WP Recipe Maker for WordPress (versions 10.3.0 through before 10.8.2) lets any logged-in user, including a low-privilege subscriber, read the full content of unpublished recipes through an AJAX action that omits a capability check. Rated CVSS 4.3 with a low confidentiality impact and no integrity or availability impact, the flaw is modest in scope; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-released patch 10.8.2 is available. The practical risk depends on whether the target site allows open registration, since that would let an attacker self-provision the required subscriber account.
Subscriber-level users of the WordPress zportals plugin before version 6.4.2 can harvest the display name and email address of every registered account, including administrators, by calling an AJAX action that performs neither a capability check nor a nonce check. The requirement for a low-privileged authenticated account (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N vector) is the only real barrier, and it largely disappears on sites with open registration enabled; no user interaction is needed. Impact is confined to confidentiality of directory-style user data - no data modification or service disruption - and no public exploit code was identified at time of analysis, with the vendor having shipped a fix in 6.4.2.
Missing authorization in the Points and Rewards for WooCommerce WordPress plugin before 2.10.4 allows an authenticated user holding only a Subscriber-level account to call the Win Wheel claim handler and credit their own account with an arbitrary, unlimited number of loyalty points; if the companion wallet plugin (same version line) is active, the fraudulently credited balance also extends to wallet funds. The flaw is remote and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N per independent assessment - note this rates integrity impact as High, above the 4.3 base score published with the CVE), and the only practical prerequisite is that the store has enabled the Win Wheel reward feature and permits open customer registration, which is typical for WooCommerce storefronts. Impact is integrity-only - loyalty point and wallet-balance fraud rather than site compromise or data disclosure. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, and a vendor-released patch (2.10.4) is available.
Authenticated users with only subscriber-level access can overwrite the Booking Manager per-user settings of any other account, including administrators, in WordPress plugin versions before 2.1.21, because the settings-update handler accepts an attacker-supplied target user identifier without checking that it belongs to the requester (CWE-639). The flaw is rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N): it needs only a valid low-privilege session - trivially obtained wherever self-registration is open - and its impact is confined to unauthorized modification of per-user plugin settings, with no confidentiality or availability loss. Vendor patched versions are available (2.1.21 is the first unaffected release), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated users holding only the WordPress subscriber role - or any higher role - can forge paid order and payment records with arbitrary amounts and assign them to other accounts in the Directorist WordPress plugin (AI-Powered Business Directory, Listings & Classified Ads) versions 8.9.1 through before 8.9.5. The REST API order-creation endpoint performs no capability check, so any logged-in low-privilege account on a site that permits self-registration (a common configuration for directory and classifieds sites) can inject fraudulent billing and payment data, resulting in integrity-only impact with no confidentiality or availability loss. This is a moderate, genuine authorization gap rather than a high-severity compromise: there is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV), and the vendor has released a fix in version 8.9.5.
Authenticated users holding only the subscriber role on WordPress sites running the MasterStudy LMS plugin before version 3.7.50 can read other students' quiz attempt data - grades, pass/fail status and attempt timestamps - by referencing an attempt identifier that belongs to another account, because the quiz-attempt result path lacks a per-object ownership check. Rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the impact is confidentiality-only with no ability to modify or delete data, and no public exploit identified at time of analysis. A vendor-released patch is available: version 3.7.50.
Subscriber-level WordPress users can read every customer's order and payment records on sites running the Directorist business-directory plugin 8.9.1 through 8.9.4, because one of its REST collection endpoints is not scoped to the requesting user. The flaw is an authenticated insecure-direct-object-reference / broken-object-level-authorization issue (CWE-639) that is remotely reachable and needs no user interaction - exploitation requires a low-privilege account, which is realistic on directory and classifieds sites that allow open or self-service registration, but is blocked where registration is closed. The vendor has released a patch in 8.9.5; no public exploit identified at time of analysis, and there is no CISA KEV listing or other confirmation of active exploitation.
Missing capability and nonce checks in the zportals WordPress plugin before 6.4.2 allow an authenticated subscriber-level user to rewrite the plugin's stored integration settings by calling unprotected AJAX actions; the flaw is a classic broken-access-control issue rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) with impact limited to integrity of the plugin's configuration. Exploitation requires a valid low-privilege WordPress account, so the practical risk hinges on whether the target site permits open registration or the attacker has otherwise obtained subscriber credentials. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this should be treated as a low-severity, credentialed configuration-tampering bug rather than an imminent remote-compromise threat.
Authentication bypass in GitLab Enterprise Edition lets an authenticated user holding developer-role permissions evade administrator-configured AI tool governance controls for workflows operating in namespaces they do not own or administer. The flaw affects GitLab EE versions from 19.1 up to (but not including) 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1, while GitLab Community Edition and the patched releases are unaffected. Impact is confined to integrity of AI governance policy enforcement, with no confidentiality or availability loss, and no public exploit code has been identified at time of analysis; GitLab notes exploitation is only possible under certain conditions, making this a low-severity, low-priority issue despite being network-reachable.
Log injection in IBM Concert 1.0.0 through 3.0.0 allows an authenticated low-privileged user to insert forged or misleading entries into application log files by supplying input that is written without neutralization of special characters such as CRLF sequences. The vulnerability is a CWE-117 improper output neutralization flaw with only a low integrity impact (C:N/I:L/A:N); it cannot be used to read data, execute code, or cause denial of service, and exploitation requires a valid low-privileged account (PR:L). No public exploit code exists and no active exploitation has been identified at time of analysis, and IBM has released a vendor patch.
Source-IP spoofing in Ansible Automation Platform 2's automation-controller allows an authenticated remote attacker to forge the client IP recorded in audit and access logs when the application runs its shipped production reverse-proxy configuration and trusts the client-supplied X-Forwarded-For header. The flaw is CWE-348 and only affects log integrity (CVSS 3.1 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), with no access, confidentiality, or availability gain. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Merge request authorship spoofing in GitLab CE/EE 19.1 through 19.4.0 lets an authenticated user who can perform a Direct Transfer import attribute merge request content to arbitrary existing users on the target instance. Exploitation requires a valid account with the ability to run a direct-transfer migration and depends on a timing/state condition in ephemeral cache handling, so it is not deterministic; the assessed impact is integrity-only with no confidentiality or availability effect, and no public exploit identified at time of analysis. GitLab has shipped fixed releases 19.2.7, 19.3.3, and 19.4.1.
Authenticated users of Red Hat Ansible Automation Platform 2 can read sensitive commercial license metadata - account number, subscription ID, pool ID, SKU, support level, and instance counts - from the /api/v2/config/ endpoint, which is guarded only by Django REST Framework's IsAuthenticated permission class. The superuser/auditor gate that protects other configuration keys such as project_base_dir, project_local_paths, and custom_virtualenvs does not extend to the license_info block, so any logged-in account of any privilege level can retrieve it without user interaction or non-default configuration. Per the independent assessment this is a genuinely low-priority, information-disclosure issue (CVSS 4.3, PR:L) - no public exploit has been identified at time of analysis, and the practical risk is reconnaissance and social-engineering enablement against Red Hat support rather than direct compromise.
Insecure direct object reference (IDOR) in the SiteSkite WordPress plugin versions up to 2.1.7 allows authenticated attackers with Contributor-level privileges to modify arbitrary objects on the site. The vulnerability is network-reachable with low attack complexity and requires no user interaction, but it only impacts data integrity (no confidentiality or availability impact). No public exploit code or active exploitation has been identified at time of analysis.
Prototype pollution in the scim-patch SCIM PATCH library (all versions before 0.9.2) lets an authenticated caller who can submit SCIM PATCH operations - remote reachable, no user interaction, consistent with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - write attacker-controlled properties onto shared built-in function objects such as Object.prototype.toString by supplying a path or dotted value key that begins with an inherited property name. Impact is modest and integrity-only (CVSS 4.3): the mutation is process-global and may influence application logic that reads inherited-method properties, but meaningful harm requires the consuming application to later consult the polluted property in a security-relevant code path; otherwise the write is largely inert. No public exploit identified at time of analysis, although the upstream fix PR and its regression tests publicly document the exact triggering path patterns, and this issue is not confirmed actively exploited (CISA KEV).
CVE-2026-95296 currently has no published description, no CVSS score, no CWE classification, and no CPE identifiers; the only intelligence signal available is that it was reported through the Ubuntu vendor channel, indicating the flaw resides in a component packaged, shipped, or maintained within an Ubuntu release. Because the affected package, version range, exposed feature, and attack path are all unidentified, no impact statement can be made and risk cannot be meaningfully assessed from the provided data. There is no evidence of active exploitation (no CISA KEV entry was supplied) and no public exploit identified at time of analysis.
CVE-2026-95289 is an Ubuntu-tracked security issue whose impact on Ubuntu systems cannot currently be characterized, because no description, CVSS vector, CVSS score, or CWE classification accompanies the record. The only confirmed attribute is provenance: the entry was reported through the Ubuntu vendor channel, which means an Ubuntu Security Notice and a corresponding upstream advisory should exist but were not supplied in the available intelligence. No affected versions, CPE identifiers, references, EPSS score, or KEV status are present, so this analysis cannot state who is exposed, what an attacker gains, or whether exploitation is practical; no public exploit identified at time of analysis, and patch status is likewise undetermined. Per the independent assessment, risk cannot be meaningfully assessed from the available data, and teams should treat this as an unenriched record pending retrieval of the authoritative Ubuntu advisory.
Google Chrome desktop (stable channel) is the affected product in CVE-2026-95368, a security fix shipped in the September 2026 Chrome releases stable-channel update. The entry is a data void: no description, no CVSS score, no CVSS vector, and no CWE are available from the supplied intelligence, so the specific impact class - memory corruption, sandbox escape, information disclosure, or otherwise - cannot be determined from open sources at this time. Vendor-released patch: available per the referenced Chrome Releases advisory, though no exact fixed version string is provided; there is no public exploit code and no CISA KEV confirmation, so exploitation status is no public exploit identified at time of analysis, and authentication requirements are not confirmed from available data.
Keycloak's Pushed Authorization Request implementation can allow an authenticated OAuth client to reuse a previously pushed request_uri when the prompt=none silent-authentication path is used, resulting in multiple authorization codes for an already signed-in user. Exploitation requires a live victim session, PAR enabled, and an authenticated low-privilege client (PR:L), with high attack complexity and limited impact; CVSS is 4.2. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
Limited unauthorized device access can occur on Canon multifunction devices running NT-ware uniFLOW Online when a prior authenticated session is retained after logout in the Legacy UI Reduced Function Login feature during Service Offline Emergency Mode. Exploitation requires physical access, use of the legacy UI, emergency/offline mode, and a narrow timing race, so the independent assessment treats this as a low-priority session-management issue. No public exploit identified at time of analysis.
An authenticated tenant superuser on Red Hat Ansible Automation Platform 2 can use the automation-controller API to confirm the existence of arbitrary absolute filesystem paths inside the controller-web pod, because StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied input and the 200-versus-400 response difference acts as an existence oracle. The issue is rated CVSS 4.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) and only reads existence, not content, but it lets a tenant admin probe paths such as /etc/tower/SECRET_KEY, Kubernetes service-account tokens, receptor sockets and ConfigMap mount points. It is materially impactful only in managed AAP deployments (ansiblecloud.com) where the tenant administrator is not the host administrator; there is no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
Symlink-following during ld.so cache regeneration in Flatpak before 1.18.1 lets a malicious sandboxed application replace its per-app ~/.var/app/$appid/.ld.so path with a symlink so that Flatpak's regenerate_ld_cache writes cache files at an arbitrary attacker-chosen location. The impact is limited to low-integrity file writes on the local host: the written filenames and content are generated by Flatpak and are not attacker-controlled, so this cannot deliver arbitrary code or leak data, and CVSS 3.1 is 4.0 (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L per independent reassessment). Exploitation requires a user to have installed and run an untrusted Flatpak app from a non-trusted source; there is no public exploit code identified at time of analysis, and the vendor's own advisory characterizes it as hard to exploit.
Impact, attack vector, and affected component for CVE-2026-95516 remain undetermined: the CVE has no published description, no CVSS score or vector, no CWE assignment, and no CPE data, and the only sourcing signal is that it was reported by vendor:ubuntu. Because no affected package, protocol, or configuration detail was supplied, it is not possible to state whether this is a local or remote issue, whether authentication is required, or what an attacker could achieve; authentication requirements are not confirmed from available data. There is no KEV listing and no public exploit identified at time of analysis, and the practical reference point for both impact and remediation is the corresponding Ubuntu Security Notice (USN) and the NVD entry once populated.
Peer-identity verification bypass in the mdtls DTLS library causes a failed certificate/peer-identity check to be treated exactly like a successful one, allowing a man-in-the-middle to impersonate the intended peer to any client that relies on mdtls for authentication. The assessed impact is high for confidentiality and integrity with no availability impact (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), but exploitation is conditional: the attacker must already hold an active interception position between the mdtls client and its peer, such as an adjacent-network foothold, a hostile Wi-Fi or gateway, or DNS/ARP/BGP redirection, and must present a substitute certificate. There is no public exploit identified at time of analysis and no vendor-released patch identified in the available data; the issue was reported through the Ubuntu vendor channel, and authentication requirements are not confirmed from available data.
Impact for CVE-2026-95507 cannot be characterized because the record carries no description, no CVSS vector, no CWE, and no CPE data; the only signal is that the issue was reported through Ubuntu's vendor channel. Nothing in the available intelligence establishes what an attacker could do, which component or version is affected, or whether the flaw is remotely or locally reachable. Exploitation status is likewise unknown: no CISA KEV listing or public proof-of-concept is present in the supplied data, and authentication requirements cannot be confirmed from the available information.
Memory corruption and potential code execution in rsyslog's mmpstrucdata plugin allow remote attackers who can send crafted RFC5424 structured-data messages to a reachable syslog input to execute code with the privileges of the rsyslog process. The module is not enabled by default; exploitation requires that mmpstrucdata be explicitly loaded and referenced in a ruleset. No public exploit has been identified at time of analysis, and authentication requirements are not confirmed from available data.