Reflected cross-site scripting (XSS) in the Ninja Forms WordPress plugin through version 3.15.3 allows unauthenticated attackers to inject and execute arbitrary script in a victim's browser when the victim is tricked into loading a crafted link (UI:R). Reported by Patchstack, no public exploit identified at time of analysis, and the assessed impact is limited to client-side script execution within the site origin due to required user interaction and no server-side code execution. The CVE record assigns a CVSS score of 7.1, but our independent assessment notes no availability impact (A:N) and characterizes the issue as moderate severity.
Reflected cross-site scripting in the Razorpay Payment Button WordPress plugin (versions ≤ 2.4.9) allows unauthenticated attackers to inject arbitrary web script or HTML via a crafted link that a victim must click. The vulnerability requires user interaction (UI:R) and impacts the victim's browser session, with no server-side compromise. Despite a vendor CVSS score of 7.1, the real-world risk is modest due to the mandatory user interaction and limited scope of impact; no public exploit code or active exploitation is reported at this time.
Reflected cross-site scripting in Mang Board WP, a WordPress plugin, affects version 2.4.1 and earlier and allows an unauthenticated attacker to get arbitrary script executed in a victim's browser session by persuading that victim to open a crafted URL. Exploitation is not server-side or automatic: it requires the plugin to be installed and active on a WordPress site and requires the victim to click the malicious link (UI:R, PR:N per the assessed vector), which limits this to targeted or social-engineering delivery rather than mass exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis, and our independent assessment rates this a genuine but low-priority issue with low confidentiality and integrity impact and no availability impact.
WP Photo Album Plus versions up to and including 9.3.02.002 contain a reflected cross-site scripting (XSS) flaw that allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by tricking them into clicking a crafted link. Successful exploitation requires user interaction and results in low confidentiality and integrity impact within the victim's session, potentially enabling cookie theft or content manipulation. Despite a CVSS base score of 7.1, the real-world risk is considered low-priority because the attack is non-persistent and depends on social engineering; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated reflected cross-site scripting in the WordPress plugin WPS Limit Login (versions up to and including 1.5.9.3) lets a remote attacker craft a URL that injects script into a page served by the affected site, executing in the browser of any victim who loads the link. Because the injected script runs in the site's origin, an attacker could hijack an authenticated administrator's session, perform actions as that user, or redirect visitors, though exploitation is not automatic - it requires the victim to interact with the crafted link, and impact is confined to the client-side browser session rather than the WordPress server. The flaw carries a CVSS 3.1 base score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and no public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported through Patchstack's vulnerability disclosure program.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin through version 5.29.4 enables remote attackers to inject malicious scripts into pages viewed by victims, potentially allowing session hijacking or defacement if a privileged user is tricked into interacting with a crafted link. The vulnerability requires victim interaction (UI:R) and is exploitable without authentication (PR:N), but impact is limited to the victim's browser context (C:L/I:L, S:C). No public exploit code or active exploitation has been identified at time of analysis, and this is assessed as a moderate-priority issue that should be patched but does not represent an urgent, mass-exploitation threat based on current signals.
Authenticated low-privileged users can delete service monitors outside their assigned scope in ZohoCorp ManageEngine Applications Manager versions 182000 and below due to improper permission validation (CWE-20). This network-reachable flaw (CVSS 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) requires valid credentials and no user interaction, causing high integrity impact and partial availability loss for monitoring coverage. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in ZohoCorp ManageEngine OpManager and ManageEngine Firewall Analyzer 12.8.710 and earlier lets an authenticated low-privilege console user create alert notifications for firewalls that fall outside their assigned scope. The weakness (CWE-639, authorization bypass through a user-controlled key) only matters in deployments that actually enforce separate scopes - multi-user, multi-team, or multi-tenant setups - since a flat single-administrator installation has no boundary to cross. Exploitation requires a valid, even minimal, console account (CVSS vector PR:L, no user interaction) and there is no public exploit identified at time of analysis: no CISA KEV listing, no EPSS score, and no POC were provided.
Broken access control in ZohoCorp ManageEngine OpManager and Firewall Analyzer 12.8.710 and below allows an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope. The vendor CVSS 3.1 vector is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), but independent assessment adjusts confidentiality to Low (C:L/I:L), because impact is limited to cross-scope report scheduling data and requires a pre-existing low-privilege account plus a multi-scope/RBAC deployment. No public exploit or CISA KEV listing was identified at time of analysis.
Blind SQL injection in Isotope eCommerce through 2.9.10 allows authenticated Contao backend users with Isotope module permissions to manipulate backend SQL queries and extract arbitrary database contents, including password hashes from the tl_user table. Exploitation requires a legitimate backend session with Isotope permissions and is limited to blind conditional or time-based techniques; no public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data. The independent assessment rates confidentiality impact as high, integrity impact as low, and availability impact as none, emphasizing that this is a genuine but access-gated vulnerability and not a mass-exploitation threat.
Missing BLS public key validation in Klever-Go prior to 1.7.20 allows a remote authenticated party with validator-registration capability (PR:L) to submit a CreateValidatorContract (Register) or ValidatorConfig update (UpdateValidator) containing a malformed BLSPublicKey that the runtime never checks for curve membership, prime-order subgroup, or nonzero value. Impact is delayed and conditional: the malformed-key validator must first become eligible and then be selected into a consensus group, at which point MultiSigner.Reset and the signature-verification creation path fail to deserialize the group key and cancel the slot, causing repeated missed consensus rounds and throughput degradation; a complete halt occurs only when the consensus group equals the eligible validator set. This is an availability-only, conditional risk - no public exploit identified at time of analysis, no KEV listing, and genesis-path validation is unaffected because it already calls CheckPublicKeyValid.
Denial of service in Caddy Server 2.11.3 and earlier allows remote unauthenticated attackers to exhaust server memory by sending large request bodies when the site configuration resolves the http.request.body placeholder. The unbounded io.Copy in replacer.go reads the entire body before request-body size-limit middleware can apply, leading to process termination. This is not exploitable in default configurations; it requires an operator-defined Caddyfile that uses the placeholder. No public exploit identified at time of analysis, and the attack only affects availability (CVSS 3.1 A:L).
Insecure-by-default OpenSSL options in Apache Tomcat Native (versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8) silently weaken the TLS layer used by the APR/OpenSSL connector, enabling insecure client-initiated renegotiation, disabling the Extended Master Secret extension, ignoring unexpected EOF (truncation), and permitting key exchanges without (EC)DHE forward secrecy. The vendor scored this 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N), but our independent assessment rates it substantially lower - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - because meaningful abuse requires an on-path/man-in-the-middle attacker who can actively position themselves between client and server, and because the four options are only applied when the deployment has not explicitly overridden them. Only Tomcat instances configured with the Apache Tomcat Native (APR) TLS connector at an affected version are exposed; JSSE/NIO-based connectors are unaffected, and no public exploit code or CISA KEV entry was identified at time of analysis. Vendors/users should upgrade to Tomcat Native 2.0.16 or 1.3.9.
Denial of service in RabbitMQ prior to versions 4.2.7 and 4.3.1 allows a remote, authenticated user holding the 'policymaker' tag to crash a broker node by exhausting the Erlang atom table. The runtime-parameters API lookup path coerces the attacker-controlled :component URL segment into a brand-new atom on every request, and because the atom table is bounded and atoms are never garbage collected, roughly one million requests with distinct component values are enough to fill it and bring the node down. Impact is availability-only (no data exposure or modification), exploitation requires high privileges and a very large request volume, and no public exploit code has been identified at time of analysis - the independent assessment rates this a moderate, low-urgency issue and the vendor has released fixed versions 4.2.7 and 4.3.1.
Denial of service in RabbitMQ affects every server release prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, where importing a crafted definitions file can exhaust the Erlang atom table and crash the node. The issue is reachable only by an authenticated user holding the RabbitMQ administrator tag: a definitions import containing a vhosts entry with roughly one million unique metadata keys slips under the 20 MB management body limit and is passed by add_vhost/2 into the unsafe rabbit_data_coercion:atomize_keys/1 path (binary_to_atom) with no whitelist or cap, killing the node that processes the request. Impact is limited to availability loss on a single node (no disclosure or tampering), exploitation is gated behind administrator privileges, and no public exploit code was identified at time of analysis; vendor-released fixes are available in the versions listed above.
Cleartext SMTP email transmission in sfturing hosp_order (MailUtil.getProperties) can expose sensitive email-related data to an attacker who already holds a network interception position between the application server and the mail server. Publicly available exploit code exists, but there is no confirmed active exploitation; the issue requires an unencrypted SMTP configuration and high-complexity adversary-in-the-middle access, and it produces only limited confidentiality impact. This is assessed as a low-real-risk issue despite the nominal CVSS 4.0 score of 6.3.
Hard-coded database credentials in sfturing hosp_order (file ssm_pro/src/main/resources/jdbc.properties) enable unauthenticated attackers who obtain the credentials from the public source repository to directly access the backing database, potentially reading and modifying data, provided the credentials remain unchanged and the database is network-reachable. Publicly available exploit code exists (GitHub issue #119), but the CVSS 4.0 base score is 2.9 and the independent assessment rates this as a low real-world priority because high attack complexity (AC:H) and deployment prerequisites-such as credential rotation or database network restrictions-neutralize the flaw. No confirmed active exploitation (CISA KEV) has been reported, and no vendor-released patch is identified.
Unauthenticated JCR-SQL2 injection in Sulu CMS 2.6 (before 2.6.25) and 3.0 (before 3.0.8) allows an anonymous visitor to manipulate the content-repository query generated by category-filtered Smart Content blocks, disclosing or enumerating nodes they should not see - including unpublished content - and degrading availability with malformed or expensive query fragments. No authentication, no user interaction, and no configuration beyond a publicly reachable page containing a category-filtered Smart Content element is required, though exploitation is contingent on that deployment-specific feature being exposed. The flaw is fixed in 2.6.25 and 3.0.8 via an integer cast on category, tag, and audience-target-group IDs; no public exploit code has been identified at time of analysis and no EPSS data was supplied, and the impact is confined to read/enumeration and denial-of-service since this path cannot modify repository data.
Authentication can succeed when it should have been rejected in Apache Tomcat deployments that use CLIENT_CERT (mutual-TLS) authentication with soft fail disabled, allowing network attackers to reach resources that the mutual-TLS configuration was meant to protect. The affected range is broad - 9.0.92 through 9.0.121, 10.1.22 through 10.1.59, and 11.0.0-M14 through 11.0.25 - but the flaw is gated on two non-default conditions (the CLIENT_CERT authenticator in use and soft fail turned off) and, per the vendor, only manifests in some scenarios, so it is not universally reproducible even on correctly configured vulnerable instances. No public exploit code has been identified at time of analysis, and no evidence of active exploitation is present; the attacker needs network reachability to the mTLS-protected listener.
Second-factor authentication bypass in Keycloak's Conditional OTP authenticator allows an attacker who already possesses a user's password to skip OTP verification by sending a crafted HTTP header, provided the realm is configured to evaluate headers for OTP-skipping without validating their source. This flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7, has a CVSS score of 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), and requires a non-default configuration plus a compromised first factor, meaning it is an account-targeted MFA bypass rather than unauthenticated remote compromise. No public exploit has been identified at the time of analysis.
SQL injection in the WordPress plugin Booking Manager versions before 2.1.21 allows an authenticated user holding Author-level privileges or higher to read arbitrary data from the site's database by importing an external iCalendar (.ics) feed whose field values the plugin passes unsanitized into a SQL query. Exploitation is constrained: the attacker must already hold the Author role (or above) and must be able to point the plugin's feed import at an attacker-controlled calendar source, and no victim interaction is required. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV), so risk is assessed as genuine but constrained rather than broadly exploitable, with confidentiality of database contents as the primary impact.
Stored cross-site scripting in the Subscribe Forms WordPress plugin before 1.6.3 allows an authenticated user with the Author role or higher to inject JavaScript into a form setting that is later rendered without sanitisation, so the payload executes in the browser of any visitor - including logged-out users and administrators - who loads a page that embeds that form. Exploitation is gated by two conditions: the attacker must hold a privileged WordPress account on the target site, and a victim must actually view a page containing the affected form (user interaction is required for the payload to fire). No public exploit code or CISA KEV entry has been identified at time of analysis, and the practical risk is moderate rather than top-tier because a valid Author+ credential is a prerequisite and the outcome is client-side script execution rather than direct server compromise.
Improper privilege management in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 lets an attacker who already holds a low-privileged authenticated account on the management interface escalate to unauthorized access with high confidentiality and integrity impact (CVSS 6.8, AV:N/AC:H/PR:L/UI:N). The weakness maps to CWE-269 and requires network reachability plus a non-trivial precondition (AC:H), so it is not triggerable by a fully unauthenticated remote attacker. No public exploit code has been identified and the flaw is not confirmed actively exploited (CISA KEV), so urgency is moderate and driven primarily by the mandatory low-privilege foothold; the vendor-released fix is version 5.34.00.16.
Stored cross-site scripting in the JSM Show Post Metadata WordPress plugin before 4.9.1 lets an authenticated contributor-level user inject arbitrary JavaScript that runs in the browser session of a higher-privileged editor or administrator. The flaw is a missing output-escape of a post meta key that is echoed into an inline event-handler attribute inside the plugin's admin-facing meta box; the payload only fires when a privileged user opens the attacker's post in wp-admin to review it. Exploitation is therefore second-order and UI-dependent rather than remote-unauthenticated: it requires a contributor account on a site running the vulnerable plugin plus reviewer interaction, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in HappyAddons for Elementor (all versions before 3.50.0) lets an authenticated attacker holding only Contributor-level access or above inject event-handler attributes through the icon value of one of the plugin's button widgets, which the plugin then writes into an HTML attribute without escaping. When a higher-privileged user - an editor, administrator, or any reviewer who opens or previews the crafted page - views that content, the injected JavaScript runs in their session, giving the Contributor a way to bypass the unfiltered_html capability they normally lack. Exploitation requires a valid low-privilege account plus victim interaction (UI:R), there is no public exploit code identified at time of analysis, and the vendor has released HappyAddons for Elementor 3.50.0 as the fix.
Stored cross-site scripting in the Real3D Flipbook WordPress plugin (all versions before 5.4) allows authenticated users with at least the Author role to inject arbitrary JavaScript into several flipbook editor fields, because those fields are neither sanitized on input nor escaped on output. The payload is stored and later fires in the browser of any higher-privileged user - typically an administrator - who opens the affected flipbook for editing, meaning the attacker only needs to plant the content and wait for a privileged victim to interact with it. No public exploit code has been identified at time of analysis and there is no indication of active exploitation (not listed in CISA KEV); the assessed severity is moderate and exposure is limited to sites that grant untrusted users Author-or-above privileges, such as multi-author or membership-driven installations. Patch available per vendor advisory: upgrade to 5.4 or later.
Missing capability checks in the Real3D Flipbook WordPress plugin before 5.4 allow authenticated users with Author-level access or higher to delete other users' flipbook content and overwrite administrator-only global plugin settings, which can be abused to store JavaScript that later executes in the browser of any visitor or administrator who views the affected pages. This is a genuine but conditional broken-access-control flaw (CWE-862) that requires an authenticated foothold rather than being open to anonymous visitors, and the stored-script payoff additionally depends on a victim subsequently rendering the poisoned global settings. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; the vendor has released a fix in version 5.4.
A local denial-of-service condition affects Ghidra versions before 12.1.4, where the software-suite's OptionsDB.createUnregisteredOption() routine fails to validate the TYPE_COL byte of an imported program database, triggering an ArrayIndexOutOfBoundsException. The exception path skips the lock-release logic in AbstractTransactionManager, leaving domain objects permanently locked so the application stalls and cannot clean up resources or shut down gracefully. Exploitation is not remote: it requires a Ghidra operator to be socially engineered into importing a maliciously crafted program database file (CVSS 4.0 base 6.8, AV:L/UI:P, availability-only impact), and no authentication or special configuration is needed. At time of analysis there is no public exploit code identified and no evidence of active exploitation, so this is best treated as a genuine but low-priority availability bug rather than a critical flaw.
Improper TLS certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 allows an unauthenticated attacker holding a man-in-the-middle position on an adjacent network segment to intercept and tamper with the appliance's TLS-protected traffic and to bypass protection mechanisms. The CVSS vector (AV:A/AC:H/PR:N/UI:N, C:H/I:H/A:N) confirms the attacker needs no credentials and no user interaction, but must be able to spoof or intercept traffic on the same/shared network and present a forged certificate that the affected component accepts, which keeps attack complexity high and makes this a moderate, defense-in-depth-grade issue rather than an internet-reachable emergency. No public exploit code identified at time of analysis and no confirmed active exploitation; a vendor patch is available.
Out-of-bounds write in BusyBox's passwd and group applets allows an authenticated attacker with high privileges (PR:H) to corrupt heap memory via a stale endpoint pointer after field trimming. The vulnerability (CVSS 6.7, CWE-787) is local-only (AV:L), requires no user interaction (UI:N), and is confined to the host (S:U), meaning a would-be attacker must already hold root or equivalent privileges to supply the malformed passwd/group entry. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS score was provided; the primary limiting factor is the PR:H requirement, which makes this a defense-in-depth hardening issue rather than a remotely reachable attack.
Argument injection in Red Hat Ansible Automation Platform 2's automation-controller system-job subsystem allows an authenticated user with superuser privileges to inject arbitrary command-line arguments into the control-plane awx-manage process, gaining control of its argument vector and the first entry of its Python module search path. The root cause is that the system-job template launch endpoint stores a caller-supplied 'days' value without applying the integer validation used elsewhere for that field, and the dispatcher flattens the management-command argument list into a single space-delimited string that the job runner re-splits, so embedded spaces become additional arguments; system jobs run in-process on the control node without the container isolation applied to other job types. Confirmed remote code execution does not follow from the injected arguments alone - it would require an additional import gadget that is not present in the current management commands - so the demonstrated impact is argument injection and search-path control rather than code execution, and no public exploit was identified at time of analysis.
TLS peer impersonation in Red Hat Ansible Automation Platform 2's automation-controller instance install-bundle endpoint lets an authenticated controller System Administrator obtain a mesh-CA-signed X.509 certificate that TLS peers will accept as a different control node. The flaw arises because a caller-chosen instance hostname is copied verbatim into the certificate's Common Name, DNS SAN, and receptor node-id, and the hostname charset validator is case-insensitive while the uniqueness validator is case-sensitive, so a case variant of an existing control node's hostname passes registration and yields a hard-coded ten-year, non-revocable mesh peer credential. Realizing the impact additionally requires an on-path/man-in-the-middle position on the receptor mesh, and the scenario is most meaningful in managed or hosted deployments where a customer holds controller superuser while the platform operator runs the mesh; there is no public exploit identified at time of analysis, and the flaw does not grant direct remote code execution because receptor work submission is gated by a separate signing key absent from the bundle.
CVE-2026-96279 is tracked against software maintained in the Ubuntu archive, based on the only source of intelligence available: a report attributed to the vendor:ubuntu channel that cross-references GitHub advisory GHSA-9rww-v4mm-x4jg. The advisory text itself was not supplied and could not be retrieved, so the vulnerable component, version range, attack vector, and security impact remain undefined; no CVSS score, CVSS vector, or CWE classification was provided. No public exploit code has been identified at time of analysis, and there is no KEV listing or EPSS signal to indicate active exploitation, so the practical risk cannot be meaningfully assessed until the underlying advisory is read. The authenticated/unauthenticated question cannot be answered because no CVSS vector containing PR metrics was provided, and no fix version appears in the available data.
Path traversal in Flatpak's `flatpak build-init` command allows an attacker-controlled SDK container to write arbitrary files outside the developer's working directory when that developer builds against the SDK using both the `--writable-sdk` and `--sdk-extension` flags. The root cause (CWE-22) is that the SDK's declared extension-point `directory` value is resolved through a path helper that does not reject `..` components, so a malicious SDK can steer writes outside the intended build root. The independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is a local, user-interaction-dependent action rather than the remote 9.8 originally submitted; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the attacker must convince the developer to consume a hostile SDK, which severely limits real-world exposure.
Arbitrary file read is possible on CyberPanel 1.9.1 hosts: an authenticated panel user who owns at least one configured domain can call readFileContents on /filemanager/controller with a valid domainName of their own plus an arbitrary absolute or out-of-scope path in the fileName JSON property, and the server returns that file's contents. Because the CyberPanel process typically runs as root, disclosure is bounded only by the execution identity's file permissions, yielding high confidentiality impact (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) while integrity and availability are unaffected. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited (not in CISA KEV).
Missing authorization checks in the Advanced Contact Form 7 DB WordPress plugin through version 2.0.9 allow any authenticated user holding Contributor-level access or higher to read every Contact Form 7 submission stored by the site by having the plugin render its 'acf7db' shortcode, exposing logged names, email addresses and message bodies (CWE-862; assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5). The attacker must already hold a low-privileged account, so multi-author sites and sites with open registration are the most exposed, and the assessed impact is confidentiality-only with no integrity, availability or code-execution effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the underlying Contact Form 7 submission data is what is disclosed rather than credentials or site control.
Information disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated user to read sensitive data, because namespace-wide secrets are exposed through file mounts that are reachable from the DataStage workload. The vulnerability is rated CVSS 8.8 by the vendor, but our independent assessment re-scores it as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - a confidentiality-only issue with a scope change, reflecting that the exposed secrets belong to other tenants/services in the same Kubernetes/OpenShift namespace rather than to the vulnerable component itself; the source vector's claims of high integrity and availability impact are not supported by the CWE-200 description. Exploitation requires a valid authenticated account on the affected 5.4.0.0 build and no user interaction; there is no public exploit identified at time of analysis, and no EPSS or CISA KEV signal was provided. Organizations running this release should treat any credentials present in the affected namespace as potentially compromised.
Arbitrary file disclosure in CyberPanel v1.9.1 via a path traversal flaw in the file manager's compress method exposed at the /filemanager/controller endpoint, which lets an authenticated attacker who owns at least one configured domain package out-of-scope files into a downloadable zip/tar archive. The application checks only that the requester owns the referenced domain and never canonicalizes the attacker-supplied listOfFiles, basePath, or compressedFileName values, so absolute or traversal paths are appended to the archive command and executed as the site's externalApp OS user (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5). Impact is confidentiality-only and bounded by the file permissions of that per-site user, with no write, code execution, or availability effect; no public exploit identified at time of analysis, and this is best handled as a defense-in-depth/hardening priority rather than an emergency patch-now item.
CVE-2026-95297 cannot be scoped from the intelligence supplied: the record contains no description, no CVSS score or vector, no CWE classification, and no CPE data. The only attributable signal is that the entry was reported by the Ubuntu vendor source, indicating the CVE is tracked within Ubuntu's vulnerability management process, but neither the affected package nor the vulnerability class is identified, so the impacted versions, attack surface, and required access level are all unknown. No public exploit identified at time of analysis, and no EPSS, KEV, or proof-of-concept signal is present in the input. Risk cannot be meaningfully assessed from the provided data, and re-enrichment from the Ubuntu CVE tracker and NVD is required before any exposure determination can be made.
Authenticated users of any privilege level on Red Hat Ansible Automation Platform 2 automation-controller deployments can extract other tenants' notification secrets-PagerDuty service keys and Slack, Mattermost, RocketChat, and generic Webhook bearer-token URLs-by abusing the API filter backend as a boolean count-oracle. The attack requires only a low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5), is network-reachable and low in complexity, and yields high confidentiality impact with no integrity or availability effect. Impact is greatest in multi-tenant installations where recovered secrets break organization isolation and permit notification-channel impersonation; exploitation is inherently slow, requiring many iterative requests that may be visible in API logs. No public exploit code has been identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Google Chrome desktop (stable channel) builds predating the September 2026 stable-channel update carry a flaw that the vendor has already fixed, but the available intelligence contains no description, CWE, or CVSS vector, so the precise impact cannot be characterized from the supplied data. The affected component is the Google Chrome stable desktop browser, and exploitation would require the victim to run an unpatched build and, in most realistic scenarios, to load attacker-controlled web content, meaning user interaction is likely a prerequisite. There is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided to quantify exploitation likelihood; the principal mitigating factor is that the fix is already shipping through Chrome's automatic update mechanism, which sharply limits the exposure window for most managed and consumer deployments.
Google Chrome for desktop on the stable channel received a vendor security fix shipped in the September 2026 stable channel update, and the Chrome Releases advisory is the only substantive reference in this record. The defect itself is undocumented here: no description, no CVSS vector or score, no CWE, and no CPE data are available, so the attack vector, complexity, privileges required, and technical impact are unverified; the record is attributed to the Ubuntu vulnerability tracker. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) signal, but risk cannot be quantified from vulnerability-specific data and should be treated as unresolved until the referenced Chrome advisory is read directly.
Secret values that playbook authors explicitly marked with no_log can be recovered from Red Hat Ansible Automation Platform 2 (automation-controller) through the REST filter backend, because the WorkflowJobNode.ancestor_artifacts column is not wrapped in prevent_search() and therefore remains queryable even though it is omitted from the API serializer. An authenticated user - one with only read access to a workflow, or any authenticated user with no roles at all by abusing a regular-expression lookup that bypasses the JSON cross-relation filter guard via the world-readable credential-types endpoint - can use the result count as a boolean/count oracle to extract secrets character by character, potentially across organizations. The issue is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-639); no public exploit code or confirmed active exploitation was identified at time of analysis, and because recovery requires an account plus many incremental requests per character, the practical risk is a bounded confidentiality exposure rather than a top-tier emergency.
SQL injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote authenticated attacker to read sensitive data from the underlying database, with impact confined to confidentiality (CVSS 6.5, C:H/I:N/A:N). The flaw is network-reachable with low attack complexity and no user interaction, but exploitation is gated behind a valid authenticated account (PR:L) on the FTM deployment. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fix; practical risk is tempered by the product's restricted financial-sector deployment footprint, making this a moderate-severity, real-but-not-urgent issue.
Remote code execution on the Apache Doris Frontend (FE) is achievable when a privileged, already-authenticated user supplies a crafted JDBC driver URL that the FE loads without sufficient validation, a case of inclusion of functionality from an untrusted control sphere (CWE-829). The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) shows the flaw is network-reachable but gated behind high privileges, meaning only accounts that can define or modify JDBC catalogs or external resources can reach the vulnerable code path; anonymous or low-privilege actors are out of scope, and no user interaction or default-configuration vector exists for an external unauthenticated attacker. No CVSS score, EPSS value, KEV entry, or proof-of-concept was supplied in the source data, so there is no confirmation of active exploitation and no public exploit identified at time of analysis, leaving quantitative prioritization signals absent.
Risk cannot be meaningfully assessed from the available data - CVE-2026-95275 exists only as a bare record attributed to the Ubuntu vendor source, with no description, no CVSS vector, no CWE classification, and no affected-product identification. Because neither the vulnerable component nor the attack surface is known, it is impossible to state what an attacker could accomplish, which Ubuntu release or package is implicated, or whether exploitation would require authentication, local access, or user interaction. The record carries no CISA KEV listing, no publicly available exploit code, and no EPSS signal, so the only defensible posture is to treat the identifier as unverified and pending enrichment from NVD or the Ubuntu security advisory before any risk statement is issued.
Impact cannot be characterized for CVE-2026-95303 because the record supplies no description, no CVSS score or vector, no CWE mapping, and no CPE or version identifiers - the only usable signal is a reporting attribution to the Ubuntu vendor source. Because neither the affected component nor the attack prerequisites are known, no exploitability determination is possible; no public exploit is identified at time of analysis, and this should not be read as evidence that none exists. Treat this entry as unresolved and retrieve the authoritative Ubuntu Security Notice or the upstream NVD record before making any exposure, prioritization, or remediation decision.
Unauthenticated remote attackers can clear active chat sessions in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift because the component handling chat sessions performs improper authorization, rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Any network-reachable deployment of the FTM chat-session feature is exposed, and exploitation requires no credentials or user interaction - but the impact is deliberately narrow: no data can be read (C:N) and the only effect is disruption of in-progress chat sessions (I:L/A:L), making this a genuinely lower-tier issue despite the MEDIUM score. No public exploit identified at time of analysis, and CISA KEV does not list this CVE.
Google Chrome desktop stable channel builds released before the September 2026 stable-channel update are affected by CVE-2026-95374, a security issue that Google addressed in that release. The entry is data-sparse: no description, no CVSS score, no CVSS vector, and no CWE classification have been published by the vendor or any other source in the provided intelligence, so the precise flaw class, attack surface, and impact cannot be characterized from the available data - exploitation conditions are unconfirmed, and by analogy to typical Chrome desktop stable-channel fixes the issue would most likely be reachable through a user rendering attacker-controlled web content, though this remains an assumption rather than an assessed fact. No public exploit identified at time of analysis; CVE-2026-95374 is not listed in CISA KEV in the provided data, and no proof-of-concept, EPSS value, or active-exploitation reporting accompanies this record. Anyone running a Chrome desktop stable build older than the September 2026 update should treat the release note as the authoritative source and patch promptly.
Google Chrome desktop builds prior to the September 2026 stable-channel release referenced in the Chrome Releases advisory are affected by a vulnerability whose technical details have not been disclosed, so its precise impact cannot be independently characterized. Based on the affected product class, exploitation would most plausibly require a victim to run an unpatched Chrome build and interact with attacker-controlled web content, but this is an inference from the product class rather than a confirmed exploitation precondition. No public exploit code or CISA KEV listing has been identified at time of analysis, and with no CVSS score, vector, CWE, or EPSS probability provided, no independent risk score can be assigned.